Subject: Re: Proposal to fix NSEC

From: Ben Laurie <[email-masked]>
Date: Thu, 20 May 2004 23:30:39 +0100

Paul Vixie wrote:
>>I was just trying to counter what I perceived to be a possible sense
>>of "there's no possible reason why this issue should botther you" in
>>some of the comments in this thread.
> 
> 
> there's no possible reason why this issue should bother you.
> 
> if someone wants to enumerate the secondlevel names in a tld, they will
> do it using well understood data mining techniques including watching
> log files from busy mail and web and proxy servers, surfing the PTR's,
> spidering the web itself, or buying the ISC Domain Survey four times a
> year, or perhaps all of the above.
> 
> a tld operator's lack of desire for such enumeration cannot prevent it.
> and dnssec's lack of compatibility with the well known BINDist hack of
> turning off AXFR access or limiting it to well known addresses or TSIGs,
> does not mean that dnssec has something wrong with it.

It is my understanding that what NSEC2 tries to achieve is to make 
enumeration no easier than it is with plain DNS. Clearly there is no 
point in doing more than this.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ben Laurie <[email-masked]>
Date: Fri, 21 May 2004 10:27:25 +0100

> point in doing more than this.

Actually, I'll take that back, there may be a point in doing more, but 
there's certainly an argument that suggests that its reasonable to 
expect not to be in a worse position by virtue of switching from DNS to 
DNSSEC.

Cheers,

Ben.