3 ms·
Wondering what prompted the blog post. The recent publication of RFC 9539? It would be interesting to hear how often the google dns servers see attempts to poi
by mjl- 3y ago
Wondering what prompted the blog post. The recent publication of RFC 9539?
It would be interesting to hear how often the google dns servers see attempts to poison their cache. The mitigations probably prevent folks from even trying, but he numbers would be interesting.
The OARC 40 presentation PDF mentions cookies deployment is low for large operators but open source software has compliant implementations. Are large operators writing their own dns servers, but badly? I would think there wouldn't be many custom implementations, and that you would be able to detect which software nameservers are running, each with known capabilities. But from the way the numbers are presented it seems they only look at behaviour without considering software (versions).
- mike_d 3y ago> Are large operators writing their own dns servers, but badly? Yes. It is trivial to build a DNS server, and near impossible to write a correct DNS server. Eventually your organization gets large enough that someone thinks it is a good idea without understanding the implications. > you would be able to detect which software nameservers are running, each with known capabilities There are pseudo-standards for asking an authoritative server what software it is running, but everyone turns that off because somehow it makes you "more secure." What you end up having to do is probe auth servers by replaying user queries on the side, measuring if the responses you get are correct, and then keeping a database somewhere of which servers support which flags.