5 ms·

> providers don't have an easy way to correlate addresses Yes, they do. It's called DNSSEC.

• tptacek 5mo ago
  Leaving aside that you applied the word "easy" to DNSSEC, how do you mean? How does DNSSEC solve the problem being discussed?
  • azernik 5mo ago
    It was a somewhat flippant (given that GitHub doesn't implement DNSSEC either) dig at the idea of using hand-entered/hand-updated IP addresses for access control, rather than having the access control system look addresses up in the system designed to securely attest owner/ip mappings.
    • tptacek 5mo ago
      (Almost nobody signs zones.) How is that any easier than just having an https:// URL from which you pull an (arbitrarily-formatted) list of IP addresses to block? Is the idea that you'd otherwise be able to do real-time DNS lookups on incoming IP addresses?
      • azernik 5mo ago
        Yes - delay SYNs until an authenticated reverse lookup confirmed the IP was owned by a trusted domain. With caching to reduce common-case latency, which would otherwise be intolerable.
        • tptacek 5mo ago
          Does this system exist somewhere?
          • azernik 5mo ago
            Absolutely not