Subject: [DNSOP] Data format for DNS looking glasses

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 21 Jan 2013 12:02:20 +0100

I already mentioned this service here, but it is now officially in
production:

http://www.bortzmeyer.org/dns-lg.html

What is of special interest for this WG is that the XML output format
relies on two (expired) Internet-Drafts. The JSON format, on the other
hand, is completely non-standard. An interesting work item?

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 21 Jan 2013 07:37:42 -0800

> hand, is completely non-standard. An interesting work item?

I would work on this. Having lots of looking glasses with a standard output format would be useful to the Internet.

--Paul Hoffman

---

From: "Livingood, Jason" <[email-masked]>
Date: Mon, 21 Jan 2013 19:43:00 +0000

Seems a really interesting idea.

Jason

On 1/21/13 10:37 AM, "Paul Hoffman" <[email-masked]> wrote:

>I would work on this. Having lots of looking glasses with a standard
>output format would be useful to the Internet.
>
>--Paul Hoffman
>_______________________________________________
>DNSOP mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/dnsop

---

From: Andreas Papst <[email-masked]>
Date: Tue, 22 Jan 2013 09:37:37 +0100

I'm not sure if it is a good idea to deploy open recursive
resolvers around the world again after having pushed so many people
to close theirs. At least we should consider some reasonable
precautions.
A 2nd demur: what is the difference to RIPE Atlas?
Ok it is not for free at the moment but maybe we can urge RIPE to
offer a public service without charge.

Andreas Papst

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 22 Jan 2013 07:38:11 -0800

> to close theirs. At least we should consider some reasonable

An attacker has a huge overhead to using this service versus just sending the queries directly. What would be the advantage of the attacker to do so?

> offer a public service without charge.

The RIPE Atlas is focused on the RIPE service area, and is not focused on DNS.

--Paul Hoffman

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 22 Jan 2013 17:08:59 +0100

On Tue, Jan 22, 2013 at 09:37:37AM +0100,
 Andreas Papst <[email-masked]> wrote 
 a message of 36 lines which said:

> I'm not sure if it is a good idea to deploy open recursive resolvers

They are not open recursive DNS servers. Read the article 
<http://www.bortzmeyer.org/dns-lg.html>

> around the world again after having pushed so many people to close
> theirs.

??? RFC 5358 was about DNS, not HTTP. It was about attacks using a
spoofed IP address, something which is easy with UDP and very hard
with TCP. I really do not see the problem.

> At least we should consider some reasonable precautions.

There is rate-limiting, as explicitely mentioned in the article.

> A 2nd demur: what is the difference to RIPE Atlas?

1) Atlas is not publically open.

2) Atlas cannot be queried with a simple REST URL (there is no API
yet)

3) Atlas does not parse the DNS responses for you, you get back a blob
of wire-format DNS and you have to parse it.

---

From: "Wessels, Duane" <[email-masked]>
Date: Tue, 22 Jan 2013 11:23:58 -0800

> I would work on this. Having lots of looking glasses with a standard output format would be useful to the Internet.

I like this idea as well and am willing to work on it.

DW