dropsafe

@pmoriarty asks “What’s so scary about RPZ?” in reference to a couple of tweets of mine regarding DNS reputation blacklisting.

So I’ll try to phrase a response. It’ll take more than 140 characters.

First up, I want to be clear about the terms of the question – this is not a technical crit of RPZ, it’s certainly not a crit of Vixie for whom I have enormous respect – although we’ve not met since Ranum and my getting dreadfully drunk at some Monterey USENIX bash in the mid 90s and my listening to MJR and Vixie hammering out some obscure point of trust, leaving me with an impression of Paul being a paragon of earnestness.

The question is: what are my fears, regarding RPZ. So I shall be brief, but in round terms my concerns are these:

Infinite Space Whackamole

DNS is a potentially infinite space, certainly potentially (actually?) larger than IPv4. If I took the contrary position of “what if we went to a whitelist-only system?” – I believe the proposition would be declared unworkable due to its complexity and communication-inhibiting nature; from this we can establish that any significant amount of declaring who is “good” and who is “bad” makes for an unworkable solution irrespective of who does it, an issue which equally affects blacklisting.

Empirical Sensation

Twice, now, I’ve had to deal with some idiot security company blacklisting my security-themed blog as a “hacking” website, and preventing several of my friends reaching it/me, so that they have to resort to Twitter and Facebook to let me know there’s a problem. The cleanup/appeals procedure is atrocious, and would be worse if my key resource (my domain) was blacklisted. I have no reason to believe DNS blacklisting will be better administrated.

The Law of Unintended Consequences

Witness 1) Wikipedia and 2) the sort of stuff that happens because of the IWF which I am sure some day some politician will try to use to their benefit; it would be better if such a structure did not exist

WTF? – a subclass of the previous

Vixie writes: “Most new domain names are malicious“; as Wikipedia would say that’s a matter of “[citation needed]” but also I wonder what’s being got-at here; yes I have suffered any number of redirects through u43vbs1egs.com to www.viagrascammers.com, but banning them just means they’ll all just move to GMail or Picasa.

So – whitelists? blacklists? What’s my choice?

I choose neither, I express a preference for “everybody learning to live in a world where spam, fraud and other forms of shit, exist”; and if they don’t like that then it’s their tough luck.

But these are my fears. You asked.

• lg handful chopped dates
• lg handful chopped dried apricots
• spoon sticky honey
• small splash water

warm-through the above mixture (low heat) in a small saucepan until goopy and thoroughly mixed, and some of the water has evaporated off

de-core 2+ cooking apples and score them equatorially with a knife tip

stuff the hollow apple cores with the mixture above

place apples in a smallish ceramic dish, add a splash of water in the base to provide steam/humidity.

cook at 200C until apple starts to leak from the scored equatorial line

This is great, until you get to the signature…

What do they call him in private – “Head of Cognitive Bicycle Therapy?”

OK – here’s a cool experiment – go to the NYT homepage and do a search on WikiLeaks and you’ll get the following search results and headline:

Sweden Rescinds Warrant for WikiLeaks Founder Julian Assange …
Julian Assange was sought by Swedish prosecutors for questioning on rape allegations, but the prosecutors then said the accusations were …

Note the headline. Now, click through to the link:

Sweden Adds to Drama Over Founder of WikiLeaks
By JOHN F. BURNS and ERIC SCHMITT
Published: August 21, 2010

LONDON — Julian Assange, the founder of the WikiLeaks Web site who is embroiled in a fight with the Pentagon over the disclosure of secret military documents, was caught up in a new drama on Saturday when Swedish prosecutors sought him for questioning on allegations of rape and molestation — and then announced the rape allegation was unfounded.

WTF is “Adds To Drama?” Surely the big news is the quashing of the allegation, it’s not “additional drama” it’s complete negation of the old story, and a bigger one atop it viz: who issued the warrant, why, and under what circumstances?