On Fri, 2013-12-27 at 10:04 +0000, Dobbins, Roland wrote: > On Dec 27, 2013, at 4:50 PM, Gert Doering <[email protected]> wrote: > > I'd terminate my contract if my ISP would take away the ability to > > query "foreign" DNS servers (usually done to troubleshoot things), > > to run traceroutes, to ping stuff, etc. > > Neither you nor I are typical broadband access customers;
Most people on this list might not be typical access customers -- they might be running their own resolver to get proper DNSSEC -- but that still doesn't make it okay for an ISP to do things most of their customers wouldn't notice or things where these customers wouldn't know the cause (i.e. the ISP) of some possibly noticable consequences. Combine this benevolent filtering with an ISP supplied caching resolver that "helps" you by giving "relevant" results if you made a "spelling error". Think Phorm et cetera. It's a slippery slope. > the overwhelming majority of broadband access customers have no need > to use DNS servers beyond the recursive DNS servers provided by their > ISPs and/or Google DNS or OpenDNS, and in fact are exposed to danger > in the form of various malware which changes the recursive DNS > settings on their computers by unfettered DNS access. Unrestricted > recursive DNS access is in fact inimical to the overwhelming majority > of users. Though I'm not unsympathetic to your arguments, one could actually use the same reason to block port 80/tcp; much malware comes in this way. > Exceptions should always be granted for 'advanced' users who want to > utilize DNS servers outside their broadband operator's own network, > and these cases can be accommodated in a scalable manner via > automation; I'm afraid many service providers would not see the benefit of implementing this to cater to what is probably < 1% of their customer base. And the bean counters might want to charge extra for this "service", like many providers do with static IP addresses or reverse DNS records. I'm with Gert here; we don't need to further inhibit the concept of end-to-end and any kind of filtering needs to be considered very closely. Inbound filtering of DNS responses should at most be a _temporary_ measure to combat a specific DoS attempt. Just my two cents of course. :-) -- Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
