[anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity

Replying against my better judgement, as Andre appears to be Trolling for
all he's worth.
But on the off chance...

On Thu, Jan 5, 2017 at 9:32 PM, ox <andre at ox.co.za> wrote:

> On Tue, 03 Jan 2017 09:42:38 -0800
> "Luis E. Muñoz" <lem at uniregistry.link> wrote:
>
> > On 3 Jan 2017, at 2:30, ox wrote:
> > > When it becomes a "STANDARD" (ACCEPTABLE) and nefarious behavior is
> > > suddenly "the way things work" - then this is of serious concern.
> >
> > You seem to be assigning intent to a tool. A hammer in the hands of
> > an artist can produce a beautiful form of art while the same hammer
> > can be used to hurt someone. It's not the hammer's fault. Besides,
> > RPZ is not a requirement to implement the "walled gardens" you're
> > describing. The same thing can be achieved by other, simpler means.
> >
>
> by the same argument then it would be perfectly fine for society to
> promote the distribution of DDOS tools, zero day hacking tools and,
> well methods to defraud Internet users, define best practise for
> Phishing, etc.
>

Acknowledging that tools exist is not the same as condoning their
malicious, or inappropriate, use.




>
>
> and no, of course you do not need RPZ to create "walled gardens"
> but discussing it "as normal practice" and "the way DNS works" and
> "okay" is what serves to legitimize RPZ as "perfectly fine"
>
> Whereas in truth, it is EVIL.
>

I'm not sure that anyone's saying that it's accepted practice in the sense
that everyone does - or should - do it.
My experience is that private network operators, or service providers, have
used it for specific reasons that suit them.
In the case of a private network, that is entirely the right and choice.
In the case of service providers - the old adage 'walk with your feet'
applies. If you don't like it, select a different provider.
At least in my part of the world, service providers are almost universally
against 'mucking up' what is usually otherwise considered a clean and
unmangled end-to-end service. Those service providers who do create 'walled
gardens', do it for a reason, and the fact they do so is not a secret.





> > If you find the "lying" unacceptable, then this is what should be
> > targeted, not the tools that are being used -- which BTW have
> > positive uses that IMO far outweighs the abuse you're describing.
> > Consider this use case: RPZ can be used to prevent a set of known DNS
> > names from resolving, stopping the spread of computer malware.
> > Moreover, it can also be used to alert operators of infected machines
> > that their computers have been compromised.
> >
>
> Trillions and trillions of domain names can resolve to a single ip number.
>
> Please give me one (as in singular) just ONE example of a domain that
> has trillions of IP numbers?
>
>
Removing the hyperbole, there is one very obvious and well established
reason for a 1:many relationship of IP's to DNS names: Virtual service
hosting.
Given that the DNS serves to allow a human-readable name (or names) to
point to a resource (by IP), the inverse relationship doesn't seem to serve
many purposes (though there is a 1:many scenario, round-robin load
balancing, that comes to mind.  But again, i've removed your hyperbole
which may make these examples irrelevant.



> Water does not flow uphill.
>
> DNS firewalls are stupid.
>

You are expressing an opinion which is of course, your right.  But if you
think that somehow you are going to change the minds of some of the _very_
learned minds who participate in this group, you have another thing coming,
i'm afraid.


>
> > I'm at least hesitant to describe any of those as lies. It's just a
> > protocol exchange -- my machine asked for a name-to-IP map and
> > received a suitable response, even one that actually fitted better
> > with my current situation.
> >
>
> You are wrong.
>
> When your user asks you for Google.com and you lie, this is a lie.
>
> It is not just a lie, it is fraud.
>
> If you then still take that a step further and tell different lies to
> different users (depends who is asking)
>
> And, RPZ stil ltakes that a step further, you deceive and hide your
> lies from your users
>
> AND RPZ makes the management of this easy and defines methods how this
> is done - It is simply a hacking tool that promotes deception, secrets,
> fraud and other criminal activity.
>

This is all OTT and if it's the basis of your anger and frustration, you're
going to do yourself some harm.
It's not fraudulent.  There's no intend to gain a pecuniary advantage. It's
a safety measure[1], one fully disclosed to the user and one that can be
bypassed.
Again you make excessive use of hyperbole here so I won't further justify
your comments with a response.



>
> > Granted, this is not the only use case. I dislike walled gardens,
> > which is why I take measures to avoid them -- yet I won't attack the
> > underlying technology because as I said, has far more positive uses.
> >
>
> There are many things about RPZ which is wrong - so many that it is EVIL!
>
> And I am happy to discuss all the EVIL bits, which starts at the very
> foundation of RPZ
> and goes all the way up to the roof...
>
>
>
>
You've made your feelings about RPZ known, but mailing lists are
interactive and bidirectional. You don't appear willing to at least respect
the right of others in this group to express their disagreements with your
opinion by engaging with them rationally, and instead appear to be trying
to shout everyone down.  I don't think you're doing yourself any favours.

I suggest other contributors to this thread weigh carefully their further
contributions as from where I sit, this isn't going anywhere.
Andre has marginalised himself and revealed a relatively extreme position
that he will not compromise on, despite plenty of well reasoned responses.


Mark.


[1] I'm aware of circumstances where it's not used as a safety measure, and
is instead used (or has been used) for some stupid
click-intercept-advertising-revenue-crap, which I fully do not support.
However Andre is railing against every situation where DNS answers are
changed or filtered... and by and large most of this i'm aware of in recent
years has been in the interests of security, customer / user protection,
and crime fighting / fraud intervention. Quite the opposite of what Andre
seems to assert.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20170105/d936ae49/attachment.html>