<div dir="ltr"><div class="gmail_default" style="font-size:small">Umm sorry. I hadn't seen the DNSSEC bit.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">The idea of validating punnycode in the resolver was just such a bad idea, I really couldn't quite believe you would be doing it. But having spent part of the day cataloging all the times someone had called me an idiot (23) a liar (12) a paid Clinton stooge (13) a US disinformation agent (34) for stating that the DNC attack was performed by Russia, as confirmed by Trump Jr's email messages released today, I was probably in a frame of mind where the stupid was the most likely explanation.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">I apologize.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_extra"><div class="gmail_default" style="font-size:small">Incidentally, yes I am looking at how many of the 'people' making the attacks are still posting and the answer is, about a quarter seem to have vanished off the face of the earth, another quarter have switched to a new, apparently unrelated singular obsession.</div><br></div><div class="gmail_extra"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jul 11, 2017 at 2:16 PM, Warren Kumari <span dir="ltr"><<a href="mailto:warren@kumari.net" target="_blank">warren@kumari.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><div><div><div class="gmail_quote"><div dir="auto">On Tue, Jul 11, 2017 at 1:11 PM Phillip Hallam-Baker <<a href="mailto:phill@hallambaker.com" target="_blank">phill@hallambaker.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="font-size:small">On Tue, Jul 11, 2017 at 9:54 AM, Warren Kumari <span><<a href="mailto:warren@kumari.net" target="_blank">warren@kumari.net</a>></span> wrote:<br></div></div><div><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Because the DNSSEC for that domain is broken....<br>
<a href="http://dnsviz.net/d/xn--e5h.com/dnssec/" rel="noreferrer" target="_blank">http://dnsviz.net/d/xn--e5h.<wbr>com/dnssec/</a><br>
<br>
The other resolvers that you tried presumably do not validate....<br>
<br>
Working as intended, will not fix :-),</blockquote><div><br></div></div></div></div><div><div class="gmail_extra"><div class="gmail_quote"><div style="font-size:small">It might be as you intend but you are violating the protocol and your resolver is causing systems to break.</div><div style="font-size:small"></div></div></div></div></blockquote><div dir="auto"><br></div><div dir="auto"><br></div></div></div></div></span><div><div><div class="gmail_quote"><div dir="auto">Please re-read the original. You appear to be working from an incorrect assumption. This is not a syntax check; there is a DS at the parent, but no matching signature in the zone.</div><div dir="auto"><br></div><div dir="auto">The domain fails DNSSEC validation, nothing to do with the label itself -- if this had been <a href="http://example.com" target="_blank">example.com</a> the exact same thing would have happened...</div></div></div></div><div><div class="gmail_quote"><span class=""><div dir="auto"><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="gmail_extra"><div class="gmail_quote"><div style="font-size:small"><br></div><div style="font-size:small">Intermediary servers performing unwanted validation have long been the bane of the Internet. They break the end to end protocol and in a bad way. I will probably be raising this in the plenary in Prague because I think there are good and bad uses of intelligence in the middle and you have a bad one. And I think that it illustrates a much more general problem that we need to get to grips with.</div><div style="font-size:small"><br></div><div style="font-size:small"><br></div><div style="font-size:small">Back in the distant past, a lot of people realized that you could put 'intelligence' in the mail server. Why put code to wrap lines of text in every app when you could put it in the mail server. So we ended up with a crappy unreliable mail system because some folk took a shortcut.</div><div style="font-size:small"><br></div><div style="font-size:small">A lot of the problems with transitioning the DNS to new uses in the past has come from built in assumptions such as requests only being for a limited number of queries. </div><div style="font-size:small"><br></div><div style="font-size:small">This check is unnecessary. <a href="http://xn--e5h.com" target="_blank">xn--e5h.com</a> is a perfectly legal DNS address according to the protocol.</div></div></div></div></blockquote><div dir="auto"><br></div></span><div dir="auto">Nod.</div><span class=""><div dir="auto"><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="gmail_extra"><div class="gmail_quote"><div style="font-size:small"></div></div></div></div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="gmail_extra"><div class="gmail_quote"><div style="font-size:small">It might be illegitimate as far as the application layer goes but that is not part of the protocol. So one part of the problem here is that we have a layering violation. We have a transport layer intermediary attempting to enforce application layer concerns.</div></div></div></div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="gmail_extra"><div class="gmail_quote"><div style="font-size:small"><br></div><div style="font-size:small">History tells us that your validation hack will not be properly maintained and that over time we will find it is still blocking sites after the rules have been changed. You have created a source of confusion and entropy. Stop it.</div></div></div></div></blockquote><div dir="auto"><br></div></span></div></div><div><div><div class="gmail_quote"><div dir="auto">Stop what? DNSSEC validation? </div><div dir="auto">Again - nothing to do with the string itself, this was a regular DNSSEC failure.</div></div></div></div><span class=""><div><div><div class="gmail_quote"><div dir="auto"><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="gmail_extra"><div class="gmail_quote"><div style="font-size:small"></div><div style="font-size:small"><br></div><div style="font-size:small"><br></div><div style="font-size:small">So what sort of intervention would be appropriate, what if the domain was Microsoft with a Cyrillic s or the like?</div><div style="font-size:small"></div></div></div></div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="gmail_extra"><div class="gmail_quote"><div style="font-size:small"><br></div><div style="font-size:small">Here we do have the start of a concern but we also have a slippery slope. What kind of slope? Should we try to go down slowly or on skis?</div><div style="font-size:small"><br></div><div style="font-size:small"><br></div><div style="font-size:small">A DNS resolver is potentially a control point that can be used to provide a huge degree of protection to the systems using it to resolve. Consider the forms in which most blacklists of bad sites are provided today - bad IP addresses, bad DNS addresses. I can block access to 90% of the badness on the Internet in one cut just by blackholing requests that would lead there.</div><div style="font-size:small"><br></div><div style="font-size:small">But Google really must not go there because the primary brand for 8.8.8.8 is anti-censorship.</div><div style="font-size:small"></div></div></div></div></blockquote><div dir="auto"><br></div></div></div></div></span><div><div><div class="gmail_quote"><div dir="auto">Yup. Exactly.</div></div></div></div><span class=""><div><div><div class="gmail_quote"><div dir="auto"><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="gmail_extra"><div class="gmail_quote"><div style="font-size:small"><br></div><div style="font-size:small">A while back, I proposed a one stop shop for resolution of services. I still think that is the right idea.</div><div style="font-size:small"><br></div><div style="font-size:small">If you are going to start putting any sort of intelligence into the network core, you have to get full consent from the use for all the purposes. And consent means choice.</div><div style="font-size:small"><br></div><div style="font-size:small"><br></div><div style="font-size:small">My vision for omnibroker was always that there would be <a href="http://free.omnibroker.comodo.com" target="_blank">free.omnibroker.comodo.com</a> and <a href="http://premium.omnibroker.comodo.com" target="_blank">premium.omnibroker.comodo.com</a>. I was not going to be censoring anyone if they weren't asking for just that.</div><div style="font-size:small"><br></div><div style="font-size:small">The principle of using the resolution service as a policy enforcement point is good. But if we are going to mess up consumer's experience it should be to protect them from criminals. Not to enforce pointless syntax rules.</div><div style="font-size:small"><br></div><div style="font-size:small"> </div></div></div></div></blockquote></div></div></div></span><div><div><div class="gmail_quote"><div dir="auto">Nor to accuse people of performing checks which they aren't - the domain fails regular DNSSEC validation:</div><div dir="auto"><br></div><div dir="auto"><ul style="margin:0px;padding:0px;list-style:none;color:rgb(34,34,34);font-family:'Lucida Grande','Lucida Sans',Arial,sans-serif;font-size:13.333333015441895px"><li style="margin:0px;padding:0px">No valid RRSIGs made by a key corresponding to a DS RR were found covering the DNSKEY RRset, resulting in no secure entry point (SEP) into the zone. (208.109.255.48, 216.69.185.48, 2607:f208:206::30, 2607:f208:302::30, UDP_0_EDNS0_32768_4096, UDP_0_EDNS0_32768_512)</li><li style="margin:0px;padding:0px">The DS RRset for the zone included algorithm 7 (RSASHA1NSEC3SHA1), but no DS RR matched a DNSKEY with algorithm 7 that signs the zone's DNSKEY RRset. (208.109.255.48, 216.69.185.48, 2607:f208:206::30, 2607:f208:302::30, UDP_0_EDNS0_32768_4096, UDP_0_EDNS0_32768_512)</li></ul><span class="HOEnZb"><font color="#888888"><div dir="auto"><font color="#222222" face="Lucida Grande, Lucida Sans, Arial, sans-serif" size="2"><span><br></span></font></div><div dir="auto"><font color="#222222" face="Lucida Grande, Lucida Sans, Arial, sans-serif" size="2"><span>W</span></font></div></font></span></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="gmail_extra"><div class="gmail_quote"><div style="font-size:small"></div></div></div></div>
</blockquote></div></div></div><div class="HOEnZb"><div class="h5"><div dir="ltr">-- <br></div><div class="m_-1772101109579608410gmail_signature" data-smartmail="gmail_signature">I don't think the execution is relevant when it was obviously a bad idea in the first place.<br>This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants.<br> ---maf</div>
</div></div></blockquote></div><br></div></div>