Subject: Re: [DNSOP] Possible slower response with minimization

From: Masataka Ohta <[email-masked]>
Date: Thu, 06 Nov 2014 20:00:35 +0900

Paul Vixie wrote:

>>> Right, NXDOMAIN returned by some broken implementation to empty
>>> non-terminals MUST NOT be interpreted that the terminals does not
>>> exist.
> 
> i disagree with this. broken implementations who emit NXDOMAIN for
> empty non-terminals cannot be used as an excuse not to develop and
> deploy correct protocol and software enhancements.

My suggestion is just for robust minimization without sacrificing
the correctness as NXDOMAIN for full domain name is interpreted
as is.

> the internet has
> hundreds of years to run yet, and these broken implementations are
> (a) shrinking not growing, and (b) subject to rapid replacement when
> they start to encounter problems with correct enhancements to their
> habitat.

How widely is EDNS deployed?

IIRC, about 20 years ago, you said 2KB DNS message of DNSSEC
was not a problem because EDNS takes care of it.

						Masataka Ohta

---

From: Nicholas Weaver <[email-masked]>
Date: Thu, 6 Nov 2014 07:55:18 -0800

> they start to encounter problems with correct enhancements to their

Hh. Hahahah.  HAHAHA. MUHAAHHAHAHAHAHAHAHA.

Sorry, where was I.

Oh yeah.  There is far too much bad undergrowth on the Internet, of old code and old systems that "it still works" and is never upgraded.  For example, we see plenty of instances of dnsmasq which are so old that the version date is before the developer started keeping a changelog.

Short of setting deliberate viral brush fires designed to brick old devices, we're stuck with them and need to plan around them.

--
Nicholas Weaver                  it is a tale, told by an idiot,
[email-masked]                full of sound and fury,
510-666-2903                                 .signifying nothing
PGP: http://www1.icsi.berkeley.edu/~nweaver/data/nweaver_pub.asc

---

From: Paul Vixie <[email-masked]>
Date: Thu, 06 Nov 2014 08:37:02 -0800

> Nicholas Weaver <mailto:[email-masked]>
> Thursday, November 06, 2014 7:55 AM
>
>
> ...
>
> Short of setting deliberate viral brush fires designed to brick old
> devices, we're stuck with them and need to plan around them.

BIND once had a 100% market share, and did a number of things wrong,
which Win/NT's DNS implementation had to work around. rather than
documenting the current behaviour and telling others to plan around it,
we fixed BIND.

similarly, many DNS servers are behind low-grade IP firewalls who pass
udp/53 but not frags, thus keeping EDNS from working. so, every EDNS
implementation has complicated fallback, and DNSSEC won't work on many
data paths. nevertheless we call those firewalls "wrong" and keep trying
to get DNSSEC (and therefore EDNS) working.

so, there are cases where you have to plan for an extremely long tail,
and other cases where you plan for a rapid transition.

implementations who think NXDOMAIN is valid for empty-nonterminal nodes
are known-broken, and they are on our short list to fix, and we're going
to ignore them and let their operators feel the pain.

-- 
Paul Vixie

---

From: Mark Andrews <[email-masked]>
Date: Fri, 07 Nov 2014 10:23:29 +1100

> How widely is EDNS deployed?

http://users.isc.org/~marka/ts.html

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]