<html><head></head><body>The announcement is rubbish. I've argued this extensively with the discoverers and now that they've gone public so will I. Vixie<br><br><div class="gmail_quote">Geert Jan de Groot <GeertJan.deGroot@xs4all.nl> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail"><br />Please have a look at:<br /><a href="https://www.ncsc.nl/dienstverlening/response-op-dreigingen-en-incidenten/beveiligingsadviezen/NCSC-2013-0597+1.00+Rate+limiting+van+DNS+responses+veroorzaakt+kwetsbaarheid.htm">https://www.ncsc.nl/dienstverlening/response-op-dreigingen-en-incidenten/beveiligingsadviezen/NCSC-2013-0597+1.00+Rate+limiting+van+DNS+responses+veroorzaakt+kwetsbaarheid.htm</a><br /><br />(which is in Dutch and which breaks google translate; cut/paste <br />the text itself does work however).<br /><br />Note that this refers to a CERT message from a French CERT (again,<br />use 'translate if required).<br /><br />I think these CERT warnings are poorly informed, incorrect, <br />and lack a fundamental understanding of how RRL works. <br /><br />The mitigation proposed, instead of using RRL, is problematic:<br />"Managers of resolver DNS servers (!) could use monitoring to<br />detect unusual high amounts of DNS requests to detect an attack".<br
/>Right.<br /><br />Unfortunately, CERT messages are sometimes seen as gospel<br />even when they are incorrect.<br /><br />I'm not sure about what to do against spread of this misinformation.<br /><br />Geert Jan<br /><br /><hr /><br />ratelimits mailing list<br />ratelimits@lists.redbarn.org<br /><a href="http://lists.redbarn.org/mailman/listinfo/ratelimits">http://lists.redbarn.org/mailman/listinfo/ratelimits</a><br /></pre></blockquote></div><br>
-- <br>
Sent from my Android phone with K-9 Mail. Please excuse my brevity.</body></html>