On Mon, Jan 16, 2023 at 20:45, Jasper Hugo wrote:

You could instead come up with some other mechanism, for example have the browser remember previous answers for a given DNS name and balk if it changes from Internet-routable to RFC1918, but really that would still be messing with DNS at the edge, and no doubt would have other unintended consequences.

Well, there are already unintended consequences from the particular messing with the DNS at the edge that we are talking about, including the migration of users to centralised DNS services away from local ones, in fact: even people who like the idea of DNS as a control plane should dislike this.

Of course, the real problem is the vulnerable devices, but taking the approach that all of those just need to be fixed is accepting a lot of harm in the meantime.

They still need to be fixed, though. What measures like this do is relieve the need for fixes and make them stay broken for longer.

These are one-shot band-aids that don't solve problems; they just obscure them. I realise I've long past the point of becoming a grumpy old man, but that doesn't make this kind of thing a good idea :-) Joe