Subject: [DNSOP] review of qname-minimisation-01 draft

From: "Rose, Scott W." <[email-masked]>
Date: Fri, 6 Mar 2015 16:12:38 -0500

I think the draft is good enough to be advanced.  Since it is on the Experimental track, there isn't too much risk.  It only affects the resolver that chooses to do it, not any other entity and doesn't change the DNS protocol.

Basic copy-edit comments:
1. Section 1. Introduction and background
	s/etc/etc.  (Depends on style guide used I guess)

2. Section 3 
	I would prefer the sentence on legal issues dropped.  It may decrease the usefulness of the logging, but maybe not the obligation to do it).

3. Section 3, paragraph 5
	"Other strange and illegal practices..."  Perhaps illegal is too strong of a word - replace with "unsafe"?  If it is illegal somewhere, keep the language as is.

	There also used to be a very poorly implemented load balancer that would always return A RR's for whatever qtype that was asked.  So a query for "example.com NS" would always return "www.example.com A".  A couple of .gov sites used them, but replaced them when deploying DNSSEC.  Not sure if they are still being used elsewhere.  Like the other broken load balancers, they are only found on leaf nodes so not a major stumbling block.

Security Considerations:
	While it does reduce the the amount of data seen by wire sniffers, it depends on where the wire sniffers are - if one is on the ISP somewhere in front of the recursive resolver, it could construct the entire query by recording all the minimized queries.  Maybe rewrite as "Minimising the amount of data sent also, in part, addresses the case of a wire sniffer on transit networks as well as the case of privacy violation by the servers."

also:  s/improvment/improvement

Scott

===================================
Scott Rose
NIST
[email-masked]
+1 301-975-8439
Google Voice: +1 571-249-3671
http://www.dnsops.gov/
https://www.had-pilot.com/
===================================

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 9 Mar 2015 15:38:56 +0100

On Fri, Mar 06, 2015 at 04:12:38PM -0500,
 Rose, Scott W. <[email-masked]> wrote 

> 	s/etc/etc.  (Depends on style guide used I guess)

Yes. Deferred to when the RFC Editor will look at it.

> 2. Section 3 
> 	I would prefer the sentence on legal issues dropped.  It may
> 	decrease the usefulness of the logging, but maybe not the
> 	obligation to do it).

Sentence completely rewritten (I still believe it is useful to note
that, when discussing the pros and the cons, people remember that
there are not only technical arguments.) New version:

<t>DNS administrators are reminded that the data on DNS requests
that they store may have legal consequences, depending on your
jurisdiction (check with your local lawyer).</t>

> 	"Other strange and illegal practices..."  Perhaps illegal is
> 	too strong of a word - replace with "unsafe"?

Replaced with non-conformant. I remember there was a discussion (in
this WG), about the proper word to describe anti-RFC behaviour (not
"illegal" since RFCs are not law). I'll search for it.

https://github.com/bortzmeyer/my-IETF-work/commit/6a3305d3c889a1deb3917fba1c5a213bd8ce951f