Re: 9 reasons for dynamic authorization records

Hadmut Danisch wrote:

>On Fri, Feb 13, 2004 at 04:37:44PM +0100, Patrik Fältström wrote:
>  
>
>>(a) What is the problem with updating the zonefile every second? I 
>>don't see any problems at all with it. If you said 100 times a second, 
>>sure, then we can talk about potential issues, but once?
>>    
>>
>
>
>Is that something we would really like to support? It would
>at least break normal DNS servers used as secondaries.
>
>
>Of course, you could write special DNS servers, which do that.
>
>But that's a contradiction in terms. Read your own argument:
>
>You're objecting my proposal about dynamicly generating authorization 
>records with a proposal to update the zone table every second
>(and consequently leave the SOA expiry and TTL short). 
>
>What is that if not a dynamic authorization record? Should
>this be an argument against dynamic authorization records?
>
>
>But If you agree that authorization records are to be updated
>dynamically or within short time intervals, why do you want to 
>modify or reinvent DNS and replace DNS servers if there is 
>the better solution with HTTP servers and CGI scripts which
>doesn't need any protocol or implementation to be raped 
>and which is already there, widely implemented, ready to 
>be used and mastered by many sysops?
>
>
>
>
>
>  
>
>>(b) You seem to think, or I have missed something, that the end user is 
>>sending things directly from wherever they are on the network?
>>    
>>
>
>At least I know many users who do so and I received many complaints
>about RMX from users who felt handicapped because the first version
>of RMX did not explicetely support this. That's why I included a
>section about DynDNS records. However, they are still not sufficient, 
>and several complainers expressed to be not willing to reveal 
>their mail infrastructure  (including some three letter organizations).
>
>This is not only about the end user.
>
>
>
>
>  
>
>>As Alan said, there are two correct solutions for this: A VPN
>>connection to the "home network" or use of SMTP AUTH with an
>>outgoing relay-MTA which is at a fixed point in the world (in the
>>"home network").
>>    
>>
>
>That's what I proposed in the RMX drafts (e.g. I prefer to 
>exchange mail with my "home network" through uucp over ssl, which
>works perfectly well), but there are so many people who do not want to
>do this. Some of them claimed to be violated in their freedom of
>speech. But others have better reasons. And some have three letters.
>
>
>
>
>
>
>  
>
>>You seems to definitely have a very very special network design which 
>>you use for this and other arguments of yours, and it seems people 
>>don't agree with that design.
>>    
>>
>
>Huh? 
>
>As I said, my network design doesn't play a role here, since I 
>do not even use SMTP to exchange E-Mail with my "home relay", which has 
>a static address. So my "special network" definitely does not 
>affect my proposal in any way.
>
>
>But I believie it's somehow malicious to insinuate that I would 
>do this just because of my personal "special network". That's pure 
>nonsense. Many other people in IETF working groups have experience 
>with their own private network only, but not me. 
>
>I'm working as a professional security consultant for many years now
>and have seen and advised dozens of companies and their networks, and
>have seen the problems they have with their remote users, spread all 
>over Europe and some world wide, including the USA. I have advised
>companies with highest security requirements and written an expertise
>for the german government which was partly reprinted where the 
>government publishes it's laws.
>
>And I published RMX in December 2002, a long time before the other 
>drafts flying around here had been written. I followed thousands of
>mails from the first months of the ASRG mailing list, and received 
>several hundreds of comments outside the list. Thus I have discussed 
>using RMX with a lot of people, and have heared their opinion.
>
>That's what I base my experience on.
>
>So your statement is pure nonsense. This is not about 
>"my very very special network design which I use for this and other 
>arguments".
>
>You would do much better to use objective arguments instead
>of attacking people personally and trying to ridicule their
>proposals. 
>
>Try to be less biased.
>
>
>
>regards
>Hadmut
>
>
>  
>
I am having troubles with the discussion - maybe it's me, maybe it's the 
discussion.  I would appreciate it if somebody would please take a 
moment to clarify the issue.

It seems to me that there are two parts to question here.  I think the 
first part is "What do we want to do"? and the second part is "How do we 
want to do it".   I think the answer to the first part is "We want to 
build some sort of sender authorization mechanism that is robust, 
effective, easy-to-use, supports mobile users, is legal in all 
jurisdictions, and free of any intellectual property entanglements".  
Please correct me if I am wrong.

For the second part, there seems to be three camps: "Modify DNS to 
support this", "Implement it using a web server", and "Build something 
completely new".

Although I despise Microsoft with a passion, I don't see how the leak of 
the source code or the ASN.1 changes the urgency of the problem.  The 
SPAMmers are able to SPAM effectively without resorting to breaking and 
entering.  This is an urgent problem.  And yet, as somebody pointed out, 
we really have only one chance to get this thing right, so let us move 
cautiously, with rigorous testing.


Have I captured the gist of the discussion or am I missing something?

Sorry to be a pest, and thank you for taking the time to help me.



Jeff