Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-22 Thread Kalman Feher
On 22/09/10 4:14 AM, Doug Barton do...@dougbarton.us wrote: On 9/21/2010 7:46 AM, Kalman Feher wrote: It may well be analogous to that (though I disagree), but the quote does not substantiate why knowing public information is bad. In the example above, you've simply saved your switchboard

Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-22 Thread Niobos
On 2010-09-21 16:46, Kalman Feher wrote: If you don't want someone to know it, don't make it public (at the very least). I agree totally! You'll have to accept that no matter what steps you take, your public information will be available to those who wish to find it. I agree. But I'd argue

Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-22 Thread Niobos
On 2010-09-21 16:56, Phil Mayers wrote: On 21/09/10 14:43, Niobos wrote: On 2010-09-21 15:32, Kalman Feher wrote: On 21/09/10 8:43 AM, Niobosnio...@dest-unreach.be wrote: I personally find protection against zone enumeration to be a false sense of security. If it's public people will find

Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-22 Thread Matus UHLAR - fantomas
I'll reply with a quote from the BIND DNS book: It’s the difference between letting random folks call your company’s switchboard and ask for John Q. Cubicle’s phone number [versus] sending them a copy of your corporate phone directory. That is a poor analogy. imho it's perfect. On

Re: NSEC3 salt lifetime (and some other DNSSEC params): sane value?

2010-09-22 Thread Kalman Feher
On 22/09/10 11:29 AM, Matus UHLAR - fantomas uh...@fantomas.sk wrote: I'll reply with a quote from the BIND DNS book: It¹s the difference between letting random folks call your company¹s switchboard and ask for John Q. Cubicle¹s phone number [versus] sending them a copy of your