Subject: Re: I think we're looping (fwd)

From: Dean Anderson <[email-masked]>
Date: Sat, 22 Mar 2003 14:18:29 -0500 (EST)

I don't think anyone is going to come up with an adequate explanation of
why we _must_ keep reverse.  I think we have most clearly demonstrated
that there isn't any valid use of reverse beyond the untrusted convenience
function.

I further agree that some people wholeheartedly believe that one can use
reverse for "full reverse-forward-reverse" checks, even though the harm of
this has been demonstrated to reasonable people.  Those people are not
likely to concede that this is harmful.

There seems to be no point in further debate for the purpose of convincing
people of these harms. This debate was not without purpose, however. The
insistence about the utility of "full reverse-forward-reverse" checks is
clearly proof of the asserted harms to keeping reverse DNS.  So, I think
we should still move to deprecate Reverse for IPV4, and remove it entirely
from IPV6.

		--Dean

On Sat, 22 Mar 2003, Brad Knowles wrote:

> At 2:35 PM -0800 2003/03/21, Rob Austein wrote:
>
> >  I think we're looping.  You've both expressed your opinions, and it
> >  doesn't look to me as if either of you is likely to convince the
> >  other.  Perhaps it is time to agree to disagree and move on?
>
> 	I am willing to agree to disagree, if Dean will do the same.
>
>

#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.

---

From: Brad Knowles <[email-masked]>
Date: Sat, 22 Mar 2003 21:59:18 +0100

>  that there isn't any valid use of reverse beyond the untrusted convenience

	The WG chair asked us (politely) if we could agree to disagree. 
I was willing to do this, if you were.

	Moreover, you have taken a private e-mail, and published a public 
response to it.  You had already demonstrated that you were a boorish 
and rude person, but I didn't know that you would be this low.

	If you can't comply with simple requests from WG chairs and 
follow basic netiquette, then I must conclude that you are no longer 
welcome on the DNSOP mailing list.

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)
#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.

---

From: Masataka Ohta <[email-masked]>
Date: Sun, 23 Mar 2003 07:19:13 +0859 ()

Dean;

> people of these harms.

There is a forward movement in IPv6 WG that site local
addresses are about to be deprecated.

The next step is removal of link local addresses and
autoconfiguration stuff.

> this has been demonstrated to reasonable people.

You are effectively arguing that forward DNS look up is
harmful.

							Masataka Ohta

---

From: Dean Anderson <[email-masked]>
Date: Sun, 23 Mar 2003 14:41:55 -0500 (EST)

> The next step is removal of link local addresses and

Does this eliminate the need for reverse lookups?

> You are effectively arguing that forward DNS look up is

I am not arguing that at all. I think you have misunderstood.  The harm of
"full reverse-foward-reverse" check is that its proponents make an
assumption that if this check "matches", then there is some authenticity
to the response.  As we know, there are no valid authenticators involved.
Both responses could easily be faked.  If one utilizes this so-called
authentication method, security is compromised. Under no cirumstances can
DNS be used as an authenticator.

		--Dean