On 15-Feb-2009, at 12:29 PM, Paul Wouters wrote:
I.e. anyone can see anything in my cache except my private dataYou want them to not "use" the cache, but allow them to "debug" the cache.
Yes, exactly. Well, at least the current cache contents. I've long ago given up on the desire to allow full testing of a DNS caching resolver so that the tester can see how it recursively resolves answers to new queries. My experience now shows that is the current cache contents that are the most important to debugging and testing from remote sites.
To me, "debug" is a higher priviledge then "using".
While that is certainly true for some meanings of "debug", in this case the person doing the debugging may very well "own" the data that is in the remote DNS cache, or they may be answering support queries for people who are at remote sites, etc., etc., etc.
In fact I end up having to debug other people's cache data on an almost daily basis. In recent year I almost always have to gain access to a system on a network their caching nameserver(s) trust in order to do such debugging, and that's not always easy, but it is almost always possible in one way or another. Cache almost never manage to protect their copy of my data from my view anyway -- they just make it very annoying to get at.
Even more hypocritical are those large access providers who might think they are gaining some security advantage by preventing the half of the world they don't provide access to from querying the caching nameservers used by the half of the world they do provide access to. 99.999% of the time the most worrying attacks will come from the networks they "trust" even if they don't provide access to half the world. Sure it might help that they have contractual relationships with the customers who own machines that might attack them, but in practice they almost never exercise the management level controls they could use in order to kick offending customers off their networks (Cogeco being one recent example I know of to the contrary).
While I definitely do worry about attacks that can abuse caching nameservers, I have a very strong desire to keep the public data in them publicly available.
--
Greg A. Woods; Planix, Inc.
<[email protected]>
PGP.sig
Description: This is a digitally signed message part
_______________________________________________ Unbound-users mailing list [email protected] http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users
