Date: Fri, 06 Dec 2013 18:18:58 -0800 From: Michael Sinatra <michael@rancid.berkeley.edu> To: Mark Felder <feld@FreeBSD.org>, Mark Andrews <marka@isc.org> Cc: freebsd-stable@freebsd.org Subject: Re: BIND chroot environment in 10-RELEASE...gone? Message-ID: <52A28592.1000200@rancid.berkeley.edu> In-Reply-To: <1386370916.5659.56527093.3A6A1DF1@webmail.messagingengine.com> References: <529D9CC5.8060709@rancid.berkeley.edu> <20131204095855.GY29825@droso.dk> <alpine.BSF.2.00.1312041212000.2022@badger.tharned.org> <E915D8A5-1CD0-465B-BAD1-59C45C9415F4@gid.co.uk> <20131205193815.05de3829de9e33197fe210ac@getmail.no> <20131206143944.4873391d@suse3> <20131206220016.BADCAB556F4@rock.dv.isc.org> <1386367748.17212.56515229.7C50AFEB@webmail.messagingengine.com> <20131206223300.89253B55861@rock.dv.isc.org> <1386370916.5659.56527093.3A6A1DF1@webmail.messagingengine.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 12/06/13 15:01, Mark Felder wrote: > On Fri, Dec 6, 2013, at 16:33, Mark Andrews wrote: >> >> In message >> <1386367748.17212.56515229.7C50AFEB@webmail.messagingengine.com>, Ma >> rk Felder writes: >>> On Fri, Dec 6, 2013, at 16:00, Mark Andrews wrote: >>>> >>>> But they should all be running a resursive validating resolver on >>>> every box. >>>> >>> >>> Are you *really* suggesting that I should run a recursive validating >>> server on every single server I admin? >> >> I'm suggesting that it should be run on *every* machine in the >> world, until all the applications that use data from the DNS have >> been upgraded to validate the data they get from the DNS, need to >> be be running a validating resolver. >> >> MiTM attacks happen all the time in the DNS. >> >> For mobile devices I would say "Don't leave home without one" to >> use a well know slogan. >> > > In a world where every zone is signed (DNSSEC) I might agree, but what's > preventing your traffic from being a victim of a MITM attack when 99% of > the internet doesn't have DNSSEC deployed? Having a local resolver > doesn't improve your security in a statistically significant way. Actually, you have it backwards. Think of it this way: Not every website uses https, but it is VERY useful and important that 100% of the browsers out there support https. That way, the client/server interactions that need https can get https. If I want clients to access my site over https, I simply have to put a cert on my website and configure it to force the clients to do the right thing. What we need is 100% adoption of validation, regardless of the percentage of zones actually signed. That way, if I choose to sign my zone, I know that everyone will actually be validating it. Until we have validating stub resolvers (and Casper seems like a promising way to do that), having validating daemons does provide that blanket client support that we need. michael
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?52A28592.1000200>