Re: [DNSOP] PTR usage cases for networking Re: Using PTRs for security validation is stupid

2014-11-12 Thread Paul Ebersman
ogud> The usage case that got brought up at the mike ``PTR records are ogud> used by logging systems''  got me thinking ``when does a logging ogud> system need this information''  and the answer is I think ``when a ogud> human is looking at the log'' in all other cases if the system is ogud> runni

Re: [DNSOP] PTR usage cases for networking Re: Using PTRs for security validation is stupid

2014-11-12 Thread Doug Barton
On 11/12/14 9:48 AM, Olafur Gudmundsson wrote: The usage case that got brought up at the mike “PTR records are used by logging systems” got me thinking “when does a logging system need this information” and the answer is I think “when a human is looking at the log” in all other cases if the syste

Re: [DNSOP] PTR usage cases for networking Re: Using PTRs for security validation is stupid

2014-11-12 Thread Richard Clayton
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 In message <76f43494-b863-4e1e-ad5d-29e34b650...@ogud.com>, Olafur Gudmundsson writes >Thus I would say the usage case is “a log processing tool MAY do PTR lookups” >the real information about addresses can be extracted from other sources as >well

Re: [DNSOP] PTR usage cases for networking Re: Using PTRs for security validation is stupid

2014-11-12 Thread Andrew Sullivan
On Wed, Nov 12, 2014 at 07:48:19AM -1000, Olafur Gudmundsson wrote: > Thus I would say the usage case is “a log processing tool MAY do PTR lookups” There's no reason to suppose that the name a source has at the time you look at the log is the one that it had when it performed the action. I think

[DNSOP] PTR usage cases for networking Re: Using PTRs for security validation is stupid

2014-11-12 Thread Olafur Gudmundsson
On Nov 11, 2014, at 5:48 PM, Lee Howard wrote: > Many SSH servers (by default) reject connections from IP addresses without > PTRs. > This is stupid. > > I heard applause during the WG meeting in response to these statements; > sounded like consensus to me. I said I would check that consensus o