Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-24 Thread David Conrad
Max, On May 23, 2022, at 9:12 AM, Max Tulyev wrote: > 11.05.22 15:31, Masataka Ohta пише: >> There are various ways, such as crawling the web, to enumerate >> domain names. > > Come on, web is dying! People are moving to mobile applications! > So more and more domains do not need any web site

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-24 Thread Max Tulyev
11.05.22 15:31, Masataka Ohta пише: As I wrote: But some spam actors deliberately compared zone file editions to single out additions, and then harass the owners of newly registered domains, both by e-mail and phone. If that is a serious concern, stop whois. There are various ways, such as

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-12 Thread John McCormac
On 12/05/2022 11:16, Masataka Ohta wrote: John McCormac wrote: There are various ways, such as crawling the web, to enumerate domain names. That is not an efficient method. Not a problem for large companies or botnet. So, only small legal players suffer from hiding zone information.

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-12 Thread Masataka Ohta
John McCormac wrote: There are various ways, such as crawling the web, to enumerate domain names. That is not an efficient method. Not a problem for large companies or botnet. So, only small legal players suffer from hiding zone information. For example, large companies such as google

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-11 Thread Matt Corallo
On 5/6/22 5:58 PM, Amir Herzberg wrote: Hi NANOGers, Questions: - Do you find zone enumeration a real concern? I have found that some people who are concerned about such things will have LetsEncrypt certs for many of the same hosts they were worried about - which of course makes the DNS

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-11 Thread John McCormac
On 11/05/2022 13:31, Masataka Ohta wrote: As I wrote: But some spam actors deliberately compared zone file editions to single out additions, and then harass the owners of newly registered domains, both by e-mail and phone. If that is a serious concern, stop whois. There are various ways,

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-11 Thread Masataka Ohta
As I wrote: But some spam actors deliberately compared zone file editions to single out additions, and then harass the owners of newly registered domains, both by e-mail and phone. If that is a serious concern, stop whois. There are various ways, such as crawling the web, to enumerate

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-10 Thread Masataka Ohta
Rubens Kuhl wrote: But some spam actors deliberately compared zone file editions to single out additions, and then harass the owners of newly registered domains, both by e-mail and phone. If that is a serious concern, stop whois. A wrench can be a tool or a weapon, depending on how one uses

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-09 Thread John Levine
It appears that Rubens Kuhl said: >> It's perfectly reasonable to claim a database right in the WHOIS data, >> but the offense is scraping WHOIS, not enumerating the DNS zone. ... >The zone file could be seen as an accessory to the database rip-off. >For instance, it would be hard to see such a

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-09 Thread Rubens Kuhl
> It's perfectly reasonable to claim a database right in the WHOIS data, > but the offense is scraping WHOIS, not enumerating the DNS zone. > > I could enumerate the DNS zone twice a day every day and so long as I stayed > away from WHOIS, nobody would notice or care. The zone file could be seen

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-09 Thread John Levine
It appears that Ray Bellis said: > >> Is there any case law where someone has asserted a database right for a DNS >> zone? > >> It seems like a rather stupid thing to do. If someone asserted such a >> right, I would make sure not to infringe it by ensuring no entries >> from that database

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-09 Thread Masataka Ohta
Rubens Kuhl wrote: Is there any case law where someone has asserted a database right for a DNS zone? German law has something to goes somewhat near it, although closer to a mandate rather than a right: https://www.denic.de/en/faqs/faqs-for-domain-holders/#code-154 Similar regulation also

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-08 Thread Rubens Kuhl
> Is there any case law where someone has asserted a database right for a DNS > zone? German law has something to goes somewhat near it, although closer to a mandate rather than a right: https://www.denic.de/en/faqs/faqs-for-domain-holders/#code-154 Rubens

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-08 Thread John McCormac
On 09/05/2022 00:10, Ray Bellis wrote: Is there any case law where someone has asserted a database right for a DNS zone? It seems like a rather stupid thing to do. If someone asserted such a right, I would make sure not to infringe it by ensuring no entries from that database entered my

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-08 Thread Ray Bellis
> Is there any case law where someone has asserted a database right for a DNS > zone? > It seems like a rather stupid thing to do. If someone asserted such a > right, I would make sure not to infringe it by ensuring no entries > from that database entered my DNS caches or other software. It

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-08 Thread John Levine
It appears that Ray Bellis said: >> On March 27, 1991, in a case that transformed the nascent online database >> publishing industry, the Supreme Court ruled unanimously that there is no >copyright protection for purely factual products such as a telephone directory >white pages. > >I wasn’t

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-08 Thread Daniel Suchy via NANOG
On 5/8/22 19:48, Warren Kumari wrote: If zone enumeration was not a real concern, NSEC3 would not exist. Ackchyually, that's only partly true — a significant amount of the driver (some would say hte large majority) behind NSEC3 was that it supports "opt-out". This was important in very

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-08 Thread Warren Kumari
On Fri, May 06, 2022 at 9:18 PM, Mukund Sivaraman wrote: > On Fri, May 06, 2022 at 08:58:51PM -0400, Amir Herzberg wrote: > > Hi NANOGers, > > I have a small question re DNSSEC `proof of non-existence' records: NSEC, > NSEC3 and the (dead?) NSEC5 proposal. > > NSEC3 was motivated as a > method

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-07 Thread Ray Bellis
> On 7 May 2022, at 17:37, Mel Beckman wrote: > >  I don’t think copyright can enter into it, by dint of the fact that > registry data, being purely factual and publicly available, cannot be > copyrighted. > > On March 27, 1991, in a case that transformed the nascent online database >

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-07 Thread Mel Beckman
For some reason NANOG is quoting my original reply in base64 encoding. I did not specify that on my end, so I’m not sure what is going on here. -mel > On May 7, 2022, at 12:08 PM, Mel Beckman wrote: > > --_000_D1647C55C4B34117851B3D01FD4CAC89beckmanorg_ > Content-Type: text/plain;

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-07 Thread Mel Beckman
Actually, that source quotes the Feist decision. The rest of the discussion makes it pretty clear that domain registries are not copyrightable. “Thus, a database of unprotectable works (such as basic facts) is protected only as a compilation. Since the underlying data is not protected, U.S.

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-07 Thread Niels Bakker
* m...@beckman.org (Mel Beckman) [Sat 07 May 2022, 18:38 CEST]: I don’t think copyright can enter into it, by dint of the fact that registry data, being purely factual and publicly available, cannot be copyrighted. I'm not a lawyer nor pretend to be one on the internet but

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-07 Thread Mel Beckman
I don’t think copyright can enter into it, by dint of the fact that registry data, being purely factual and publicly available, cannot be copyrighted. On March 27, 1991, in a case that transformed the nascent online database publishing industry, the Supreme Court ruled unanimously that there

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-07 Thread Ray Bellis
On 07/05/2022 02:18, Mukund Sivaraman wrote: If zone enumeration was not a real concern, NSEC3 would not exist. However, public DNS is a public tree and so we should have limited expectations for hiding names in it. A significant motivation was to help defend database copyright in the

Re: Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

2022-05-06 Thread Mukund Sivaraman
On Fri, May 06, 2022 at 08:58:51PM -0400, Amir Herzberg wrote: > Hi NANOGers, > > I have a small question re DNSSEC `proof of non-existence' records: NSEC, > NSEC3 and the (dead?) NSEC5 proposal. > > NSEC3 was motivated as a > method to prevent Zone enumeration, then Berenstein showed its