Thread by @csoandy

The first time I crossed paths with @dakami, let’s just say I wasn’t pleased. But it’s a little bit of a long story, and we did share a laugh at the end of it, so bear with me. #InMemoryOfDakami

The story starts in 2007, maybe. One of my biggest worries at Akamai was hardening our DNS infrastructure. If you take out a CDN’s top level DNS, that’s … pretty much it. 2/ #InMemoryOfDakami

You’re limited in how many top level name servers you can use for a given domain (by convention, 8 IPs, although really, 13). That’s gives you a weak spot that an attacker can go after, and I really wanted to solve it. 3/ #InMemoryOfDakami

We already had interesting ways to detect which resolvers were used to send HTTP traffic to edge servers, and, together with some brilliant architects in Mapping, we stumbled on a solution for protecting top level name servers . 4/ #InMemoryOfDakami

Imagine if every resolver on the planet, instead of using the same 8 top level name servers, used a unique set of 8? Especially if those 8 were close to them? It would be hard to take out the whole CDN, and if 8 went down, we’d know the targeting resolver. 5/ #InMemoryOfDakami

The TLDs didn’t give us a way to glue our name servers differently based on resolver, but we stumbled on a clever hack in DNS responses we could use.

The Additional section. #InMemoryOfDakami

DNS allowed you to send extra information in answers, as long as you stayed in your domain. We used two stage DNS - a first query to our top level NS, which sent you to low level NS, with a short TTL, and handled a second query to get you to a web server. 6?/ #InMemoryOfDakami

We could use the additional section to give you a new answer for where to find our top level name servers.

It would be unique to you, and, continually refreshed so a resolver would never go back to the TLDs!
We were so excited. #InMemoryOfDakami

Of course, by this time, we’re just starting to build the system, and plan the safety checks, when a new bug gets announced in DNS.

A bug about using the additional section to send unasked for information.
@dakami had also figured out how to exploit it.
#InMemoryOfDakami

Everyone raced to patch The Kaminsky Bug.
And we were left with a lot of wasted design effort. Let’s just say I uttered som choice words in @dakami’s direction.
9/ #InMemoryOfDakami

I ran into him a few years later, and told him the story. I told him I wished we’d gotten our system out, and how annoyed I was.

He told me it was a clever design, and bought me a drink. FIN/ #InMemoryOfDakami