Skip to main content
2 of 3
added CERT link for open resolvers, not everyone knows what they are
Andrew B
  • 33.5k
  • 15
  • 31

Do we want to humor "how do I intentionally provide an insecure service" questions?

tl;dr

I'm a DNS admin who has seen numerous DNS attack strategies evolve over the past few years, and I'm uncomfortable with encouraging Q&A's that try to split hairs on how an (intentionally) insecure configuration can be run "more securely" in a constantly evolving threat landscape. I do not consider the questions or the answers responsible in this context. I'm just one person though. How does the community want to approach this?

Long version

Today I saw the following question: How to prevent an openly recursive DNS server from being abused for DNS amplification

This is the latest rehash of the "I am determined to be an open resolver and don't care what anyone has to say about it" Q&A that we see a few times per year. While the intentions are good, the Q&A basically boils down to how to minimize a company's negative contributions to the internet while still knowingly being a bad netizen.

How do we want to deal with questions like this? We have existing precedent for helping people who are forced to maintain insecure legacy environments, but I'm personally much less comfortable with questions that are deliberately embracing bad behavior. These questions feel bad to me for the same reason why product recommendation question are bad; they don't scale well with time, particularly when DDoS mitigation is involved.

Andrew B
  • 33.5k
  • 15
  • 31