> On Thu, Apr 03, 2008 at 12:19:27PM +0200, Antoin Verschuren wrote:
> 
> > http://seclists.org/bugtraq/2008/Jan/0270.html
> > that states that localhost entries in zones should be discouraged.
> 
> if I follow this correctly, the risk is for "localhost.example.org" to enable
> anyone on the same host as the victim to "steal" cookies destined for
> "*.example.org".  This reminds me of what Yngve has been pointing us at repea
> tedly
> and that is the cookie mechanism makes brave assumptions about the DNS.
> 
> > I know that localhost entries were encouraged in RFC 1537 but that one
> > is obsolted by RFC 1912 which doesn't say anything anymore about
> > localhost entries, so no encouragement nor disencouragement.
> 
> RFC 1912 is quiet about localhost entries in random forward zones, but
> different from RFC 1537 it recommends setting up a "localhost" TLD on ones
> local recursive name server.  So, if memory serves, there were two schools
> of thought: one saying that forward and reverse should be immediately
> consistent and the other trying to rely upon the search path for
> resolution of the "localhost" token.  Other alternatives include
> mapping this name by other means than the DNS, likely /etc/hosts on
> members of the Unix family.
> 
> > I think that if localhost entries in zones should be discouraged, it
> > should come from the consensus of this WG.
> 
> Independent of this, the "localhost" issue might need some attention because
> it is related to other work on our plate, namely mixed v4/v6 search path
> issues as well as topics discussed recently: the "localhost" TLD is special
> in the sense that it is actually reserved by RFC 2606 but neither delegated
> nor mapped to anything in real life.  Back then there was some discussion
> about recommending an A RR for this name in the public DNS.  At that time,
> not all root servers responded NXDOMAIN, either.
> 
> -Peter
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop

        Additionally "localhost" is the only hold over from single
        label hostnames.  Everything else got qualified, initially
        by .ARPA then by other suffixes.

        Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [EMAIL PROTECTED]
_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop

Reply via email to