<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body style="font-family: tt; font-size: 11pt;" bgcolor="#FFFFFF"
text="#000000"><div style="font-size: 11pt;font-family: tt;"><br><br>Colm
MacCárthaigh wrote:<blockquote
cite="mid:CAAF6GDcAr2_Yx7jOXVHa+bZKxbZEzpwE__=Pv4iw4Ft7DPeiPw@mail.gmail.com"
type="cite"><div dir="ltr"><br><div>Your article mentions RRL and <span
style="color:rgb(51,51,51);font-family:Verdana,Arial,sans-serif;font-size:12px;line-height:15.807999610900879px">asymmetric
threats, but does not mention that RRL opens the implementor up to a
new </span><span
style="color:rgb(51,51,51);font-family:Verdana,Arial,sans-serif;font-size:12px;line-height:15.807999610900879px">asymmetric
threat. With RRL, an attacker can spoof legitimate clients and cause
the RRL implementation to deny them service. <br></span></div></div></blockquote><br>no.<br><br><blockquote
cite="mid:CAAF6GDcAr2_Yx7jOXVHa+bZKxbZEzpwE__=Pv4iw4Ft7DPeiPw@mail.gmail.com"
type="cite"><div dir="ltr">
<div><span
style="color:rgb(51,51,51);font-family:Verdana,Arial,sans-serif;font-size:12px;line-height:15.807999610900879px"><br></span></div><div><span
style="color:rgb(51,51,51);font-family:Verdana,Arial,sans-serif;font-size:12px;line-height:15.807999610900879px">For
example, if the authoritative provider <a moz-do-not-send="true"
href="http://www.example.com">www.example.com</a> were to implement RRL
as you describe, then an attacker could spoof traffic purporting to be
from Google Public DNS, OpenDNS, Comcast ... etc, and cause <a
moz-do-not-send="true" href="http://www.example.com">www.example.com</a>
to be un-resolvable by users of those resolvers. <br></span></div></div></blockquote><br>no.
it just does not work that way.<br><br><blockquote
cite="mid:CAAF6GDcAr2_Yx7jOXVHa+bZKxbZEzpwE__=Pv4iw4Ft7DPeiPw@mail.gmail.com"
type="cite"><div dir="ltr">
<div><span
style="color:rgb(51,51,51);font-family:Verdana,Arial,sans-serif;font-size:12px;line-height:15.807999610900879px"><br></span></div><div><span
style="color:rgb(51,51,51);font-family:Verdana,Arial,sans-serif;font-size:12px;line-height:15.807999610900879px">The
more widely RRL is applied to more protocols and schemes, the more they
are vulnerable to this same simple counter-attack. It seems like
setting the internet up with a brittle component that may ultimately
makes spoofing-based denial of service easier, not harder. This creates
additional risk on the implementor at very little benefit to
themselves, which still seems asymmetric. <br></span></div></div></blockquote><br>dns
rrl is a protocol-specific approach to rate limiting, for dns, based on
responses.<br><br>as i said in the ACM Queue article, every protocol we
want to rate limit is going to need a protocol-specific, protocol-aware
method of rate limiting. we must not create new vulnerabilities as a
side effect of closing old ones.<br><br>vixie<br></div></body></html>