Subject: Re: (ngtrans) The reverse lookup issue

From: Dean Anderson <[email-masked]>
Date: Mon, 8 Jul 2002 17:03:57 -0400 (EDT)

On Mon, 8 Jul 2002, David Terrell wrote:

> On Mon, Jul 08, 2002 at 01:15:54AM -0400, Dean Anderson wrote:
> > But the problem is your [wrong] _assumption_ that when forward and reverse
> > match, you have "identified someone responsible".
> 
> Given a reverse dns of foo-10-27-123-99.example.net and a forward that
> matches, I can reasonably assume that I can email 
> {root,postmaster,[email-masked] and probably reach someone who can
> take care of a problem I am having with a machine; and I am more likely
> to get a response from the tech contact under whois example.net than
> I am from the contact in whois -a 10.27.123.99.

You can _ASSUME_ anything. That doesn't make the assumption true.  I know
I have far better luck contacting whois contacts than I do domain
contacts, especially domains associated with some kind of abuse or
cracking.  A whois record usually represents a real business. Even when
the email address and phone number doesn't work, the business can still be
found. A domain name registration record represents $10. Sometimes less.  
DNSSEC (when it is used), will get you to someone who paid $10 and didn't
leave any addresses or phone numbers. (one could say DNSSec [if it works,
and is used] is a lot of trouble for securing something worth $10).

> Whois data is far more frequently out of date; a single whois request
> causes a much higher load on the whois server than a single reverse
> DNS request; and most importantly there is no way for a clued person
> to enforce that whois is somewhat correct when a connection is made.
> 
> > anything of the sort. Garbage in just matches garbage out. If you have the
> > IP address, you will be able to find out (eg from DHCP logs) who was
> > assigned that IP address at a certain time, and you'll be able to find the
> > DHCP server owner starting from whois records. If you have only the
> > reverse DNS, you have nothing.  Even if the reverse matches the forward,
> > you still have nothing.
> 
> DHCP?  Are you assuming these are internal netblocks that I own?

In IPv6, it is expected that there will be more DHCP use. Who owns the
address today will be different from who owns it in 2 weeks.  That
information (to whom it was assigned and when) will be logged in a DHCP
log.

> Just because DNS is sometimes wrong doesn't mean that it's useless.
> Forward DNS is sometimes wrong, should we eradicate that too?  If
> we push people off to whois, the load on whois servers will go up
> exponentially and we'll end up needing to bring it back anyway.

You should not be using it for authentication.  Forward and reverse DNS is
useless for authentication. Its use should be eradicated from
authentication.  So, "yes".

Whois servers can be scaled up. And you can get local copies.  Most people
don't need to make these lookups frequently, so your assertion that whois
load will increase exponentially is false. And frankly, I think that whois
lookups should be far easier to process than DNS lookups, so even if it
did increase by a lot, it should be more than compensated by the reduced
reverse lookup load, and corresponding traffic.

		--Dean

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: David Terrell <[email-masked]>
Date: Mon, 8 Jul 2002 16:06:09 -0700

> and is used] is a lot of trouble for securing something worth $10).

There is no information on the internet guaranteed to be true, and that
is correct regardless of encryption, information source, or anything else.

However, reverse DNS is a lightweight method to identify a name for a 
host that cannot be easily replicated using another method.  If a 
central TCP server identifying addresses would have scaled, DNS would
never have been created.  Reverse DNS has value.  Your statement that you
do not find it to be valuable are interesting, but not sufficient to 
convince me that the value I have derived from said service where 
chimerical.

> information (to whom it was assigned and when) will be logged in a DHCP

Much work has gone into making DHCP completely unnecessary for IPv6
deployment, though of course DHCPv6 does exist.

Regardless, you only buttress my position.  Reverse DNS today, when you
connect to my machine, is far more likely to have useful information that
may point me to you than whois will in a month when that netblock has 
been reassigned by your upstream.  whois is not loggable in-band.  DNS
is.

> authentication.  So, "yes".

r* should die; agreed.  So what?  SSH's RSARhosts authentication
method uses reverse DNS securely.

You assume that authentication is the only purpose of this data.
You're wrong.  It has informational value to me, there are ways 
in which reverse DNS records can be cryptographically verified 
using another service that is secure.

> reverse lookup load, and corresponding traffic.

A scalable protocol for a global name and address resolution already
exists, why are you trying to duplicate it, badly, with a TCP
service?

-- 
David Terrell          | Step 1: "configure one system using your GUI"
[email-masked]           | Step 2: "now configure 1000 more"
Nebcorp Prime Minister |   - Casper H.S. Dik
http://wwn.nebcorp.com |

---

From: Danny Mayer <[email-masked]>
Date: Tue, 09 Jul 2002 20:14:29 -0400

At 05:03 PM 7/8/02, Dean Anderson wrote:
>  A domain name registration record represents $10. Sometimes less.

You are not really securing the domain as much as you are making the
user secure in that he has received a valid answer to a lookup for that
domain. The difference may seem subtle, but the domain does nothing
with the data, it's the client that uses it.

Danny