At 10:05 AM -0700 2003/10/01, Justin Mason wrote:
"Pull" methods should try to consider if this would still be workable. If
it would, it's not a big deal for spammers to all start using that
technique.
([1]: I'm not entirely sure how this is done off the top of my head right
now. ;)
DNS Cache pollution/poisoning. Jon Postel did it accidentally in
the mid 90's, and Eugene Kashpureff did it again in 1997, and many,
many servers remain vulnerable. At last survey, over 50% of the
ccTLD servers were vulnerable to cache pollution/poisoning, which
would imply that a much, much higher percentage of "regular"
nameserves are likewise vulnerable.
See <http://www.shub-internet.org/brad/papers/dnscomparison/>.
I'm sure Men & Mice has some numbers, too.
--
Brad Knowles, <brad(_dot_)knowles(_at_)skynet(_dot_)be>
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-Benjamin Franklin, Historical Review of Pennsylvania.
GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg