<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=us-ascii" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Michael Tokarev wrote:
<blockquote cite="mid487652E1.2030003@msgid.tls.msk.ru" type="cite">
<pre wrap="">Victor Duchovni wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On Thu, Jul 10, 2008 at 09:28:40AM -0700, Jeff Chan wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi Michael,
In light of the recent DNS cache poisoning exploits identified,
may I request DNSSEC for rbldnsd? Obviously this could add very
significant overhead but it could help prevent alteration of DNS
responses in a remote cache.
</pre>
</blockquote>
<pre wrap="">The SpamHaus PBL contains ~420 million logical RRsets. Each would have
to be individually signed. All the individual IPs in the zone (instead
of rather large efficiently stored CIDR blocks) would need a separate
record in the RBL zone file. Rsync feeds of PBL would become essentially
impossible.
</pre>
</blockquote>
<pre wrap=""><!---->
Or let rbldnsd to sign replies on the fly, giving it the necessary key(s).
It's a trade-off between being unrealistic and providing some protection.
After all, signing key security isn't more important than the data it
protects.
But I still don't think it's necessary to implement. All this current
fuzz about DNS insecurities, with "DNSSEC" written over everything...
There are far more important points to attack than a DNSBL. And even
if a DNSBL is being attacked, it's usually some sort of DDoS attack
against DNSBL itself.
/mjt
</pre>
</blockquote>
I think Michael is right. What is the gain from attacking DNSBL data?
<br>
<br>
How does the attacker make money? He makes money by steering web
traffic to compromised servers to push bot software to your desktop or
to push popups or ads to your desktop.<br>
<br>
He does not make money attacking DNSBL data.<br>
<br>
This whole thing is being driven by money and I don't see the
attraction in attacking DNSBL data. If he clears listed IP's, the
content filters after the DNSBL check will catch most of it. If he
blocks your mail, it's a DoS attack that will go away when the data
clears in cache. And the attacher is left with what?<br>
<br>
Lyle<br>
<br>
</body>
</html>