Re: [DNSOP] DNSOP Call for Adoption draft-vixie-dns-rpz

2016-12-28 Thread Scott Schmit
On Tue, Dec 20, 2016 at 04:35:48PM +, Ray Bellis wrote:
> On 20/12/2016 16:33, Paul Hoffman wrote:
> > Counter-question: of what value is documenting this current practice?
> > Anyone who is already using it can find the documentation for it from
> > their software vendor. There is nothing here that really affects the
> > rest of the DNS other than "there will be lies".
> 
> The document primarily covers BIND's behaviour.
> 
> It would be good if other implementations were completely compatible
> with that

Why?  How does this help the "good guys" (define that as you wish)?

I'm seeing how it really helps governments cheaply create and enforce
the creation of national internets -- especially with the walled garden
features.  Are those the good guys to you, or are there other benefits?

I'm also seeing how, if hijacked, the walled garden feature makes it
trivial to distribute malware to large numbers of users.

> and this also forms the baseline for potential future
> enhancements which could be under IETF change control.

If this is being submitted to the WG, this document will already be
under IETF & WG change control.  If that's not the intent, then the
document should not be adopted.

-- 
Scott Schmit

___
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop


Re: [DNSOP] DNSOP Call for Adoption draft-vixie-dns-rpz

2016-12-28 Thread John Levine
>I'm seeing how it really helps governments cheaply create and enforce
>the creation of national internets -- especially with the walled garden
>features.  Are those the good guys to you, or are there other benefits?

Please see the previous gazillion messages from people who are using
RPZ in production to keep malware away from their users.

Also see the previous gazillion messages noting that governments do
all sorts of DNS censorship now and don't need RPZ.

Could you explain in more detail why you don't believe operators will
continue to use RPZ to protect their users, and why you think hostile
actors will do things with RPZ that they couldn't do now?

R's,
John

___
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop