<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Paul,</div><p class="airmail_on">On September 6, 2016 at 1:48:05 AM, Paul Vixie (<a href="mailto:paul@redbarn.org">paul@redbarn.org</a>) wrote:</p> <div><blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><div><div></div><div>you're doing far more work blocking ANY than the attacker<span class="Apple-converted-space"> </span><br>would have to do to switch to a different qtype.<span class="Apple-converted-space"> </span></div></div></span></blockquote></div><p>"Far more"? Isn't the expense of this "work" on the part of the defenders already a sunk cost? DNS software implementers have implemented and operators that care have already deployed the code, no?</p><p>If I understand the ecosystem, for the attacker to switch to another qtype, the attacker has to either have the knowledge and access to the attacking code or wait for the attacker's "vendor" to modify the code and deploy the modified code across the constellation of zombies. </p><p>Also, as Jim has pointed out, forcing the attackers to move from ANY means a reduction in the efficiency (however slight) of their attacks, forcing them to expend more work for the same effect.</p><p>Seems to me the edge on this round is in the defender's camp.</p><div><div><blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><div><div>in the unending game<span class="Apple-converted-space"> </span><br>play of cybercat and cybermouse, that means you lose the current round.<span class="Apple-converted-space"> </span></div></div></span></blockquote></div><p>The joy of arms races is that there are always more rounds.</p><div><blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><div><div>blocking ANY is just silly.<span class="Apple-converted-space"> </span><br></div></div></span></blockquote></div></div><div id="bloop_sign_1473179534276107008" class="bloop_sign"></div><div id="bloop_sign_1473179534276107008" class="bloop_sign"><br></div><div id="bloop_sign_1473179534276107008" class="bloop_sign">Meh. It's a primitive tool: sort of like a rock one might use to beat back a rabid ferret. You don't expect it to cure rabies, but it can get the immediate job done in a pinch.</div><div id="bloop_sign_1473179534276107008" class="bloop_sign"><br></div><div id="bloop_sign_1473179534276107008" class="bloop_sign">Regards,</div><div id="bloop_sign_1473179534276107008" class="bloop_sign">-drc</div><div id="bloop_sign_1473179534276107008" class="bloop_sign"><br></div></body></html>