Subject: [DNSOP] Small review of draft-ietf-dnsop-edns-client-subnet-00

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 1 Apr 2015 16:34:29 +0200

[I am not a big fan of the idea, because I see it as useful mostly for
big public resolvers and I am not a big fan of big public resolvers.]

Section 1:

1) "The motivation for a user to configure such a Centralized Resolver
varies but is usually because of some enhanced experience, such as
greater cache security or applying policies regarding where users may
connect." OK, but the draft should also mentions the cons of
centralized resolvers such as the privacy risks and the security risks
in the first kilometer (which is many kilometers long).

Section 6.3:

2) "implementing full caching support as described in this
section is STRONGLY RECOMMENDED." STRONGLY is not in RFC 2119 and
therefore should not be in uppercase.

Section 10.1:

3) "Users who wish their full IP address to be hidden can include an
edns-client-subnet option specifying the wildcard address 0.0.0.0/0"
This make the entire mechanism opt-out rather than opt-in. Not ideal
for privacy. It should at least be explained why.

Section 12:

4) "1.   A stub resolver SR with IP address 192.0.2.37 tries to resolve
        www.example.com, by forwarding the query to the Recursive
        Resolver R from IP address IP, asking for recursion." R should
be RNS, as used later.

---

From: Edward Lewis <[email-masked]>
Date: Wed, 1 Apr 2015 14:53:41 +0000

>in the first kilometer (which is many kilometers long).

The draft isn't justifying the existence or use of centralized resolvers,
just establishing they exist.  Digressing into such a discussion would be
a distraction.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 1 Apr 2015 16:59:40 +0200

On Wed, Apr 01, 2015 at 02:53:41PM +0000,
 Edward Lewis <[email-masked]> wrote 
 a message of 127 lines which said:

> The draft isn't justifying the existence or use of centralized
> resolvers, just establishing they exist.  Digressing into such a
> discussion would be a distraction.

I disagree. The draft is not neutral, it lists the pros of the
centralized resolvers but not the cons.

For me, it is not ready to be published.

---

From: "Mark Delany" <[email-masked]>
Date: 1 Apr 2015 15:13:06 +0000

> big public resolvers and I am not a big fan of big public resolvers.]

It's also useful for big "private" resolvers too. Such as those run by
ISPs, mobile phone networks, large corporations and research networks
that have a national or global footprint and multiple ingress points
into their network.

If you're a Comcast or a Verizon or an AARNet serving potentially vast
numbers of customers over a large footprint, how different is that
from a public resolver in the context of this draft?

Mark.

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 1 Apr 2015 08:42:55 -0700

> in the first kilometer (which is many kilometers long).

Disagree. Many Centralized Resolvers are run by large, geographically and topologically diverse ISPs. This draft should not be used to praise or criticize the fact that some of these ISPs are using a small number of IP addresses for their whole topology.

--Paul Hoffman