From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.1 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: from second.openwall.net (second.openwall.net [193.110.157.125]) by inbox.vuxu.org (Postfix) with SMTP id 796022044E for ; Fri, 22 Mar 2024 01:38:07 +0100 (CET) Received: (qmail 7964 invoked by uid 550); 22 Mar 2024 00:33:31 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 7906 invoked from network); 22 Mar 2024 00:33:31 -0000 Date: Thu, 21 Mar 2024 20:38:14 -0400 From: Rich Felker To: musl@lists.openwall.com Message-ID: <20240322003813.GQ4163@brightrain.aerifal.cx> References: <20240308203143.GQ4163@brightrain.aerifal.cx> <20240308225445.GR4163@brightrain.aerifal.cx> <20240321120727.GI15722@brightrain.aerifal.cx> <20240321193552.GO4163@brightrain.aerifal.cx> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [musl] mDNS in musl On Fri, Mar 22, 2024 at 01:29:43AM +0100, Tomas Volf wrote: > On 2024-03-22 10:10:29 +1000, David Schinazi wrote: > > > PS: which are the stakeholders contacted while the relevant standards > > > brought in such hazardous default? > > > > > > These RFCs went through the IETF Standards Track process, so the entire > > IETF community was consulted when this was finalized around 2011-2012. > > > > I'd like to understand why you think this is hazardous though. mDNS only > > applies to host names under .local - those names are not covered by DNSSEC, > > and therefore any queries for them are always sent completely insecure. > > Sending those queries over the wire to the configured DNS resolver has very > > similar security properties to sending them over the wire as multicast. > > Please ignore my comment from the peanut gallery if it is totally off, but is it > not a difference between being able to do MitM (for regular non-DNSSEC DNS) and > just being on the same network (multicast)? So the former only router/gateway > can do, the latter anyone able to respond to the multicast? Assuming my > understanding is correct, that does not seem "very similar security properties". On lots of networks, root on any device attached to the local network segment can hijack/mitm unauthenticated traffic (mac spoofing, arp shenanigans, etc.), but indeed with intelligent switches that restrict what addresses can be used by what physical ports, or with various bridged interface configurations, etc. it's possible to have a setup where untrusted devices attached to the network can't do that. So, whether there's a difference depends on how hardened your network layer is. Rich