Slashdot Mirror
Kaminsky Bug Options Include "Do Nothing," Says IETF
netbuzz writes "Meeting in Minneapolis this week, the Internet engineering community is debating whether to aggressively fashion and apply fixes for the so-called Kaminsky bug in the DNS discovered this summer, or to simply let its threat stand as motivation for all to move with greater speed toward DNSSEC, which is considered the best long-term security solution. Problem with the latter approach is that DNSSEC has been in the works for a decade already, no one is confident it will be universally embraced, and the Kaminsky flaw is causing real problems today.
and I am reading the wrong site. The aliens can return the real slashdot now. Surely IETF would never choose to "Do Nothing" :-)
I'm trying to figure out exactly what they're deciding. Yes, I understand it's a discussion about "upgrade to DNSSEC" vs. "implement the hacks". But these guys don't control the internet, and my understanding is they only make "recommendations", which nobody is obliged to follow.
So exactly what exactly are these guys debating about "doing"? Is it really just "recommend DNSSEC" or "recommend the hack"?
AccountKiller
It's a space station. You don't need a vacuum cleaner. Just open a window.
1984 was not supposed to be an instruction manual.
If it's eight, then it's probably that missing space station spider!
I'll stand here shaking in the corner emitting arachnophobic screams...
I'm sorry, I can't hear you scream...
Help! Help! I'm being repressed!
As often, Ars Technica has had this for a while.
http://arstechnica.com/news.ars/post/20080726-new-dns-exploit-now-in-the-wild-and-having-a-blast.html
I quote:
"This would be less of an issue if the widely released patch from two weeks ago had been fully deployed"
And:
Moving to the more DNSSEC system would have solved this problem, and that idea was apparently floated, but it was dismissed on account of the tremendous overhead required by this protocol. The patch that currently exists is not a foolproof solution, but it minimizes the chances that the attack will succeed. "The exploit is now tens of thousands of times harder, but still possible," Kaminsky stated during his Black Hat webcast. "one in several hundred million to one in a couple billion."
Yawn.
Now, when, and I mean EVER, has a security hole meant that people switch to a new platform? Or when has a severe security hole EVER caused people to even consider moving?
Windows has its leaks. But people keep using it. Why? Because they don't care, don't know or because "hey, what are the odds that it happens to me?". SMTP and POP have flaws, spam is running rampart because of it, and we switch to securer ways of mailing that can verify the sender... not! IPv4 has security problems and we're not even seriously considering switching to something more secure.
People will NOT switch to something else just because of a security problem. Because the people who could enforce it simply don't care. ISPs? ISPs don't even care about trojans running rampart in their network. Most don't even bother trying to block Sasser from spreading. The governments? Spare me that, currently I'd rather expect them to use the flaw themselves for better surveillance of their subjects.
Fix that damn bug! Nobody will move to a better platform just because of a "mere" security problem.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
*whoosh*...
You really should have your humor circuits checked you know ?
YHBT
MP3 Search Engine
Stupid sensationalism.
You can right now use draft-vixie-dnsex-dns0x20 to protect against the kaminsky bug. This option is already available in the unbound nameserver.
Talking about totally talking out of context. Fools!
If IETF does something to mitigate, the unbelievers scream "see we dont need dnssec"
If IETF does not do something, the unbelievers scream "you're blackmailing us into dnssec"
Stop whining and put your foot where your mouth is.
I was in the meeting. As I recall, one gentleman, I'll repeat that, one gentleman from the audience of a few hundred got up and expressed the opinion that we should do nothing so as to spur DNSSEC deployment.
There was rather more consensus for the view that we should avoid making quick hacks that might obstruct DNSSEC deployment since DNSSEC is currently the only approach on the table that we're reasonably sure ends the problem.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
It's a space station. You don't need a vacuum cleaner. Just open a window.
No way! That would make a vacuum dirtier!
Socialism: a lie told by totalitarians and believed by fools.
I don't know much about this sort of thing, but I bet it's relatively cheap to book in cold-weather cities in the winter.
As a side benefit, it annoys Californians. Win all around.
Minneapolis has a "Skyway." Basically, many of he buildings downtown are connected via heated walkways between the second floors. These second floors form literally miles and miles of indoor pedestrian mall. The Hilton where the conference is held is connected to it.
So basically you can go everywhere without having to ever go outdoors. And we have a gig-e Internet link for the duration of the conference. Its computer geek heaven.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Eh, the whole downtown is covered in habitrails, so you can walk from building to building in short sleeves, because you don't ever have to go outside. It's kind of like living on a really big space station, only with gravity.
It was kind of cold in my hotel room, though.
Trust me, there's very little need for Trojans at a typical IETF meeting.
Even an amateur cryptographer would tell you that the more you know about the message, the easier it is to break it.
And a professional cryptographer would tell you to use a signature scheme that is provably secure (under standard cryptographic assumptions) against known plaintext signature forgery, and use a key big enough to satisfy you. Heck, you do all the crypto off-line, so you can pick a big one.
Confidentiality protections reduce the amount of knowledge, and thus protect against attacks that are yet unknown.
Prove the security of your signature scheme in the Universal Composability model and it's secure against all attacks, known and unknown.
I don't think you know what you're talking about.
Oh the iro... No, actually, you _do_ know what you're talking about: amateur cryptography.
DNSCurve protects against denial of service attacks [link]
So to back up your claim, you post a link to someone making the same claim. Now I'm convinced...
It requires far less compute-power than DNSSEC.
Yes, but it requires it on-line. It also requires caching keys for your clients unless you want to double your in- and outbound packet load.
Read the page about DNSCurve. It says "DNSCurve and DNSSEC have complementary security goals. If both were widely deployed then each one would provide some security that the other does not provide."
They're, taken at the word, not meant to replace each other.