4 ms·

I've always used it to explore the internet for fun as a person without any profit motive. Cloudflare's argument's are all based around ANY making it slightly

I've always used it to explore the internet for fun as a person without any profit motive. Cloudflare's argument's are all based around ANY making it slightly harder for them to make a profit. A small chance of DNS amplification attacks in DNS is what Cloudflare thinks about because it's their business. But there's no reason to believe this is more important than individual users wishing to see what servers are behind a domain. Combined with GDPR killing off whois the internet is a much more boring, less transparent place.

j0057 8y ago
Limiting ANY queries to just TCP would have been a reasonable middle ground, but now Cloudflare has a cleaner codebase and does not have to do any difficult thinking around what to do with synthetic rrsets in response to ANY queries. Good for Cloudflare!
- majke 8y ago
  > Limiting ANY queries to just TCP would have been a reasonable middle This was proposed solution, the problem is that in case of attack, against a valid Authoritative service, launched via open resolvers, the open resolvers would just download Gigabits of ANY traffic with TCP. Read about this here: https://fanf.livejournal.com/140566.html https://fanf.livejournal.com/140566.html
- CKN23-ARIN 8y ago
  They could have done this locally, just for their authoritative servers, without trying to force their ideas about ANY on the rest of the Internet.
majke 8y ago
(A) This days Cloudflare can sustain all the DNS amplifications without even blinking. This work doesn't help us in any way on the DoS front. This work helps smaller players that don't have spare network capacity. If anything, making amplification attacks harder _reduces_ our benefits. (B) You are free to run ANY as you like on your domain. For domains you own, this RFC doesn't change anything. (C) Would you advocate for responding to AXFR / zone transfers? There generally is consensus that allowing enumeration is not desired.
howard941 8y ago
I hear you. I think whois was neutered for anti-abuse purposes by the pay-for fake front proxy "privacy" vendors. Perhaps like you I use any in conjunction with dig, and muscle memory alone is going to keep the query alive in spite of 8482.
derefr 8y ago
Would you give an equivalent argument that Microsoft pushes automatic security updates because Windows vulnerabilities make it "slightly harder for them to make a profit"; that "a small chance of becoming part of a botnet" is what Microsoft thinks about because it's their business; but that there's no reason to believe this is more important than individual users wishing to experiment with A-Life?
orf 8y ago
Sorry, but less DNS amplification attacks is more important than you having fun on the internet.
- JakeTheAndroid 8y ago
  And relatively counter to Cloudflare's interest. The more people get DoSed the more reason they have to use Cloudflare.
brlewis 8y ago
> individual users wishing to see what servers are behind a domain Since most servers are web servers these days, you can get pretty close to this goal from certificate transparency logs.
dcbadacd 8y ago
> But there's no reason to believe this is more important than individual users wishing to see what servers are behind a domain. None of your business, really. > Combined with GDPR killing off whois the internet is a much more boring, less transparent place. Thank lord for that, there's literally no benefit from it, with WHOIS evil still did evil and normal users got their privacy violated, without WHOIS evil can still do evil and normal users' privacy is protected.

j0057 8y ago

Limiting ANY queries to just TCP would have been a reasonable middle ground, but now Cloudflare has a cleaner codebase and does not have to do any difficult thinking around what to do with synthetic rrsets in response to ANY queries. Good for Cloudflare!

majke 8y ago
> Limiting ANY queries to just TCP would have been a reasonable middle This was proposed solution, the problem is that in case of attack, against a valid Authoritative service, launched via open resolvers, the open resolvers would just download Gigabits of ANY traffic with TCP. Read about this here: https://fanf.livejournal.com/140566.html https://fanf.livejournal.com/140566.html
CKN23-ARIN 8y ago
They could have done this locally, just for their authoritative servers, without trying to force their ideas about ANY on the rest of the Internet.

majke 8y ago

(A) This days Cloudflare can sustain all the DNS amplifications without even blinking. This work doesn't help us in any way on the DoS front. This work helps smaller players that don't have spare network capacity. If anything, making amplification attacks harder _reduces_ our benefits. (B) You are free to run ANY as you like on your domain. For domains you own, this RFC doesn't change anything. (C) Would you advocate for responding to AXFR / zone transfers? There generally is consensus that allowing enumeration is not desired.

howard941 8y ago

I hear you. I think whois was neutered for anti-abuse purposes by the pay-for fake front proxy "privacy" vendors. Perhaps like you I use any in conjunction with dig, and muscle memory alone is going to keep the query alive in spite of 8482.

derefr 8y ago

Would you give an equivalent argument that Microsoft pushes automatic security updates because Windows vulnerabilities make it "slightly harder for them to make a profit"; that "a small chance of becoming part of a botnet" is what Microsoft thinks about because it's their business; but that there's no reason to believe this is more important than individual users wishing to experiment with A-Life?

orf 8y ago

Sorry, but less DNS amplification attacks is more important than you having fun on the internet.

JakeTheAndroid 8y ago
And relatively counter to Cloudflare's interest. The more people get DoSed the more reason they have to use Cloudflare.

brlewis 8y ago

> individual users wishing to see what servers are behind a domain Since most servers are web servers these days, you can get pretty close to this goal from certificate transparency logs.

dcbadacd 8y ago

> But there's no reason to believe this is more important than individual users wishing to see what servers are behind a domain. None of your business, really. > Combined with GDPR killing off whois the internet is a much more boring, less transparent place. Thank lord for that, there's literally no benefit from it, with WHOIS evil still did evil and normal users got their privacy violated, without WHOIS evil can still do evil and normal users' privacy is protected.