Subject: RE: Last Call: 'Linklocal Multicast Name Resolution (LLMNR)' to Proposed Standard

From: Dave Singer <[email-masked]>
Date: Wed, 31 Aug 2005 15:06:12 -0700

I'm a by-stander on this discussion, maybe off-base or out of it -- 
but something other than the undesirable traffic struck me.

Isn't it also true that I might *deliberately break* all sorts of 
things by introducing 'blocking' names into DNS responses, so that an 
LLMNR request is never issued.  So an ISP could 'grab' traffic that 
the users thought was local, by replying to a DNS request in a proxy 
(or converting a negative reply into an answer).

Also, ISPs might be tempted to start turning around DNS requests in 
their proxies for names that they *think* should be answered by 
LLMNR, returning resolution failure, so as not to send too much 
traffic outbound.  This pre-empts the real DNS from ever actually 
replying.

The whole idea that 'real DNS' can arbitrarily pre-empt local name 
resolution seems, well, wrong, and needs serious study for security 
implications for the services using those names, no?

-- 
David Singer
Apple Computer/QuickTime

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Keith Moore <[email-masked]>
Date: Wed, 31 Aug 2005 23:34:15 -0400

> implications for the services using those names, no?

The whole idea that local names should look like DNS names and be 
queried through the same APIs and user interfaces seems, well, wrong (or 
dubious at best), and needs serious study for the implications of 
applications using those APIs and the impact of such names on DNS, no?

IMO, local names and a lookup service for local names would be extremely 
useful, but neither the names nor the query interface should look much 
like DNS - the names should look different because otherwise there's too 
much potential for confusion with DNS names, and the query service 
should look different because local name lookup service probably can't 
make the same kinds of consistency or stability assurances that DNS does.