Subject: Re: [DNSOP] call for adoption: draft-vandergaast-dnsop-edns-client-subnet

From: "Mark Delany" <[email-masked]>
Date: 12 Feb 2015 06:51:19 +0000

On 24Dec14, Mark Delany allegedly wrote:
> > The draft is available here: http://datatracker.ietf.org/doc/draft-vandergaast-dnsop-edns-client-subnet/
> 
> a) 6.2 - Intent of SCOPE NETMASK
> 
>   "In both cases, the value of the SCOPE NETMASK in the reply has strong
>   implications with regard to how the reply will be cached"
> 
> I wonder whether SCOPE NETMASK should have a bigger impact beyond how
> the reply is cached?

Tap tap tap. Is this thing turned on?

I think 3-4 people made some well-considered feedback on this draft,
but there has been zero discussion or author feedback for some six
weeks now.

Does that mean there is insufficient interest in progressing this draft?

I ask because in my dayjob we've been recently approached by some
large eyeball providers who are now willing to invest in upgrading
their resolver infrastructure to support client-subnet now that they
see the benefits.

It'd be a pity if this died on the vine just as others are starting to
come around to the idea.

Mark.

---

From: George Michaelson <[email-masked]>
Date: Thu, 12 Feb 2015 16:54:56 +1000

we've got two agencies who do DNS, and probably have > 20% worldwide
eyeball share in DNS (I don't know, thats a guesstimate) now doing
edns0_client_subnet albiet with whitelist, so its a permit-list, but its
functionally 'there'

we've got running code in bind. and no doubt other product.

wouldn't it be passing strange for the premier body which determines DNS
standards to decide to drop this one when we have massive widescale
adoption, a clear use-case, and running code?

Its probably already more widely deployed than IPv6...

-G

On Thu, Feb 12, 2015 at 4:51 PM, Mark Delany <[email-masked]> wrote:

> > > The draft is available here:
> http://datatracker.ietf.org/doc/draft-vandergaast-dnsop-edns-client-subnet/
> >
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>
>

---

From: "Mark Delany" <[email-masked]>
Date: 12 Feb 2015 07:31:27 +0000

> edns0_client_subnet albiet with whitelist, so its a permit-list, but its

Whitelists are my biggest bugbear actually. All my other comments are
nice-to-haves. I hear that Google now adaptively whitelist which is a
nice strategy but I'd really like to see the whitelist approach
deprecated as much as possible. (And yes, I understand MarkA's stats
that show some small percentage of auth queries will break).

I've been in other conversations lately where it was all about how do
we get "pick some larger resolver" to whitelist us? We all know that
doesn't scale. So interest appears to be growing.

> Its probably already more widely deployed than IPv6...

On the auth side I think you're right. It's the client side that's the
missing link. But this is a classic alignment-of-interest problem. The
relatively small number of auths who care implement, but there is
little incentive on the resolver side.

Mark.

---

From: "Livingood, Jason" <[email-masked]>
Date: Fri, 13 Feb 2015 01:01:46 +0000

On 2/12/15, 2:51 PM, "Mark Delany" <[email-masked]> wrote:

>I think 3-4 people made some well-considered feedback on this draft, but
>there has been zero discussion or author feedback for some six weeks now.
>

I don¹t think so. I, for one, support adoption and hope the WG does so and
moves on. This one is important and can actually positively improve the
experience of end users of the Internet, which is a really good thing and
something DNSOP should do more often. :-)

>their resolver infrastructure to support client-subnet now that they see
>the benefits.

Awesome! :-)

Jason

---

From: "Livingood, Jason" <[email-masked]>
Date: Fri, 13 Feb 2015 01:05:45 +0000

On 2/12/15, 2:54 PM, "George Michaelson" <[email-masked]<mailto:[email-masked]>> wrote:

we've got two agencies who do DNS, and probably have > 20% worldwide eyeball share in DNS (I don't know, thats a guesstimate) now doing edns0_client_subnet albiet with whitelist, so its a permit-list, but its functionally 'there'

Should be also in Nominet’s resolver. I suspect many others will soon support it as well. Smells like an emerging standard to me. ;-)

wouldn't it be passing strange for the premier body which determines DNS standards to decide to drop this one when we have massive widescale adoption, a clear use-case, and running code?

Indeed!

Ha! I think that wins the award for best quote of the day. ;-)

- Jason

---

From: "jewforice ." <[email-masked]>
Date: Fri, 13 Feb 2015 11:14:43 +0800

I support adoption of this document because we're using this spec on our
authority name servers and planning to use it on our recursive resolvers.

On Tue, Oct 28, 2014 at 11:50 PM, Suzanne Woolf <[email-masked]>
wrote:

> Dear DNSOP WG,
>
> This draft documents the specification, use, and cautions regarding the
> "client-subnet" EDNS option. Please consider adoption of this draft as a WG
> work item.
>
> As some of you will remember, this is a successor to a draft that was
> considered in DNSEXT some time ago and eventually expired without formal
> action. Since then, the option codepoint has been granted under the
> appropriate registry policy (expert review) and the option is in
> significant operational use.
>
> The topic has come up more than once on the WG mailing list, with some
> vigorous discussion, so a couple of the original authors and a couple of
> new people have revived the draft in the interests of documenting the
> option, including specific behavior and cautions in its use.
>
> Please review to see if you think this document is suitable for adoption
> by DNSOP and comment to the list.
>
> Please state your view, your reasons, and (if you're in favor of adoption)
> whether you are willing to contribute text, review, etc.
>
> This call for adoption ends Tuesday 11-Nov.-2014, end of the day wherever
> you happen to be. This is the same day as our WG meeting at IETF 91.
>
>
> Thanks,
> Suzanne Woolf
> DNSOP co-chair

---

From: Peter DeVries <[email-masked]>
Date: Fri, 13 Feb 2015 07:59:17 -0500

My dayjob supports this as well and has been running resolvers with similar
functionality implemented for a while now.   We are looking to switch to
edns-clent-subnet once it is standardized and have been approached by
parties willing to invest in development.

Peter

---

From: "Livingood, Jason" <[email-masked]>
Date: Sat, 14 Feb 2015 01:58:06 +0000

On 2/13/15, 9:05 AM, "Livingood, Jason" <[email-masked]<mailto:[email-masked]>> wrote:
we've got running code in bind. and no doubt other product.

Should be also in Nominet’s resolver.

BTW, I meant NomiNUM not NomiNET. Darned Nomi* names. ;-)

JL

---

From: Suzanne Woolf <[email-masked]>
Date: Sun, 15 Feb 2015 07:49:45 -0500

The WG adopted this document some time ago (the announcement to the list is dated Nov. 14, 2014). 

It now needs reviewers to review and authors to revise. 

If you agreed to review it earlier, or even if you didn't but you're interested, please do.

Authors, any feedback on the reviews/comments so far? 

thanks,
Suzanne

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 15 Feb 2015 12:26:04 -0800

<secretary hat on>

> The WG adopted this document some time ago (the announcement to the list is dated Nov. 14, 2014). 

Yep, and the authors turned in an WG-named draft: https://tools.ietf.org/html/draft-ietf-dnsop-edns-client-subnet-00
> If you agreed to review it earlier, or even if you didn't but you're interested, please do.

FWIW, according to <https://svn.tools.ietf.org/svn/wg/dnsop/doclist.html>, four people (including me) agreed to review. It probably needs more.

--Paul Hoffman

---

From: "Mark Delany" <[email-masked]>
Date: 15 Feb 2015 21:02:07 +0000

> FWIW, according to <https://svn.tools.ietf.org/svn/wg/dnsop/doclist.html>, four people (including me) agreed to review. It probably needs more.

And I might add that at least some of us (even though not named in
that list) did post review comments after the call and we've yet to
hear from the authors on some of the issues raised. That was my point
in prodding a day or so ago.

Mark.

---

From: Warren Kumari <[email-masked]>
Date: Mon, 23 Feb 2015 12:54:51 -0500

> in prodding a day or so ago.

Apologies - the authors had all forgotten which one us was holding the
pen, and were all wondering why others were not responding /
incorporating comments.
I've just gone hunting under my desk and have found an old, leaky biro
that looks like it still has sufficient ink.

I'll now go back and try incorporate all the comments, etc. Expect to
see a flurry of updates.
This document lives in GitHub, I'm hoping to incorporate comments and
then commit often, so folk can follow along at home...

W

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf