Subject: [Dots] draft-ietf-dots-data-channel - ietf-dots-access-control-list extensions

From: "Jon Shallow" <[email-masked]>
Date: Fri, 4 Aug 2017 14:59:12 +0100

Does it make sense to add to the extensions of ietf-dots-access-control-list
the ability to black list or possibly white list, Country Codes and AS
numbers?

Regards

Jon

---

From: Artyom Gavrichenkov <[email-masked]>
Date: Fri, 4 Aug 2017 20:02:31 +0300

Hi Jon,

Personally, I don't think this is a good idea. Here are my reasons.

Neither a country code nor an AS number (be the latter a current BGP Origin
attribute value, as seen by a mitigator, or simply an entry in a RIR DB)
are present in the network and transport layer header data. Both are often
meant to be taken from some foreign key-value stores of disputable quality.

LIRs often, to say the least, tend to underestimate the importance of
updating their data in their respective RIR databases (see, I'm trying to
put it gently). In turn, those databases are now often considered as
unreliable sources of information sometimes even when it comes to routing
data. With geographic data (which is not used for routing purposes and thus
never gets verified), everything is much, much worse.

There are organisations (MaxMind, IPIP and others) which maintain their
own, proprietary geo databases, in proprietary formats, which are still far
from ideal, but suitable enough for purposes of, say, measuring statistics.
Yet, most of those databases are not good enough for the means of
preventing access because of a high rate of both false positives and false
negatives. Here's a recent case: https://github.com/
docker/for-linux/issues/57#issuecomment-314476406

So as there's no "official" geoblocking method, a proposed extension should
explicitly specify which exactly database should be used. Now it seems to
be better for the user of a DOTS client to implement an access to such
databases (be it MaxMind, RIPE DB, Spamhaus or whatever key-value store a
user chooses) theirselves, while a DOTS server would only see the final
resolution on an IP address or network.

| Artyom Gavrichenkov
| gpg: 2deb 97b1 0a3c 151d b67f 1ee5 00e7 94bc 4d08 9191
| mailto: [email-masked]
| fb: ximaera
| telegram: xima_era
| skype: xima_era
| tel. no: +7 916 515 49 58

4 авг. 2017 г. 4:59 PM пользователь "Jon Shallow" <[email-masked]>
написал:

> Does it make sense to add to the extensions of
> ietf-dots-access-control-list the ability to black list or possibly white
> list, Country Codes and AS numbers?
>
>
>
> Regards
>
>
>
> Jon
>
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots
>
>