Re: DNS was Re: Internet Vulnerabilities

[Randy Bush <randy () psg com>]

> Now that we've seen enough years of experience from Genuity.orig,
> UltraDNS, Nominum, AS112, and {F,K}.root-servers.net, we're seriously
> talking about using anycast for the root server system.

without dnssec, how do we differentiate this from a routing attack
on the roots?

the as112 anycast thingie is fine, as who cares if someone attacks
reverse servers for bogus requsts.  attacking bogosity is good. :-)

the decade of sprint, uunet, ... running anycast caching is within
an isp is risky, but they are responsible for their own security and
fate.

beyond that, security and anycast don't mix well without the data
being authenticated, e.g. dnssec.

randy