[72699] in North American Network Operators' Group
Re: VeriSign's rapid DNS updates in .com/.net
daemon@ATHENA.MIT.EDU (Richard Cox)
Fri Jul 23 05:29:48 2004
From: Richard Cox <richard@mandarin.com>
To: nanog@nanog.org
Reply-To: nanog@mandarin.com
In-Reply-To: <16640.27017.495045.676419@roam.psg.com>
Date: Fri, 23 Jul 2004 09:29:10 +0000 (GMT)
Errors-To: owner-nanog-outgoing@merit.edu
On Thu, 22 Jul 2004 15:27:37 -1000 Randy Bush <randy@psg.com> wrote:
| all they need to do is register foo.bar with delegation to their
| dns servers, and change a third level domain name at will.
Er, no. They have of course tried that already!
By registering foo.bar with delegation to THEIR dns servers gives full
identification of THEIR dns servers, and the host or upstream of those
servers can (and often does) start invoking their acceptable use policy.
If not, then all the considerations that Paul V. recently cited about
neighbours who allow bad things on their network, start to kick in.
The scenario I have outlined - now well established, and the mechanism
understood - allows the malfeasants to operate on the 'net with zero
traceability of their identity or location, based on everything they do
being able to be done through zombied Windows PCs or open(ed) proxies.
--
Richard Cox