MERGE! Orlando 2018

Abstract: Dr. Paul Vixie will discuss using a DNS approach called RPZ as a means to reduce accessibility of potentially problematic systems outside your network, which can work in harmony with other firewall systems to improve the security, resilience, and stability of Internet users.

The Internet spans borders, demographics, cultures, attitudes and opinions.  It is diverse, massive, and constantly growing.  Much has been argued about accountability of Internet users - freedom fighters, entrepreneurs, free speech or innovators from their own and friends' perspectives are sometimes considered national security risks, nuisances, lawbreakers or intellectual property thieves from another perspective. The trend for Internet governance has been away from accountability -- anybody can get a domain name or IP address, often need not reveal their identity when doing so, and in many cases can keep those resources - even if their activities generate a lot of complaints or problems.

For a network operator, the friction between the perspectives creates grief that often requires reactive attention with no available time or patience for take down using the ineffective remedies available outside the organization.  For fast relief, administrative blocks can quickly address problems so that the painfully optimized administrator can go about their business.  These administrators share what they blacklist, and this trend leads inexorably toward controlled balkanization, where operators of like mind can make common cause in detecting, cataloging, and shunning Internet identifiers that cause grief to operators. There are decades of proof that "blacklist" initiatives like RBL and RHSBL that such common cause initiatives are effective in protecting e-mail against abuse.

Now it's time to consider RPZ, which extends this approach beyond just email to all Internet services, by working at the DNS level, because DNS is used by everything and it skips past the need to impliment in individual client or server applications.