4 ms·
How would it block creation? Is AWS supposed to keep a full record of CNAME entries for the Internet and keep it up to date? Since CNAME records can point to
by chaboud 5y ago
How would it block creation? Is AWS supposed to keep a full record of CNAME entries for the Internet and keep it up to date?
Since CNAME records can point to other domains, I’m not sure how AWS is supposed to police this and allow cross-referencing from other parties. Blocking based on any CNAME presence could turn into a bucket-squatting exploit pretty quickly.
A CNAME record is an “I’m pointing my domain at some other place” record. Redirect to something out of your control, S3 or otherwise, and you’re handing over control of the returned content. That doesn’t so much strike me as a mistake but more as the way that CNAME records were designed to work.
- detaro 5y agoyes, as mhio already pointed out the first variant doesn't actually work. The second does though, and is what's commonly done. > That doesn’t so much strike me as a mistake but more as the way that CNAME records were designed to work. "I hold something into a saw, and it gets cut. That doesn’t so much strike me as a mistake but more as the way that saws are supposed to work. Why are all these fingerless people saying our saws should have safety features?!" We know such things happen to all kinds of people all the time. It has been part of actual security problems. We know how to fix it, because many service providers do require validation. Why not consider the validation?
- chaboud 5y agoYou’ve tried the snark twice, but it’s not aiding your point. What is the actual mechanism you think should be implemented, and how does that support cross-party referencing while avoiding other modes of vulnerability (e.g. denial of service)?