Subject: Re: [dnsext] Case for EDNS0-client-subnet...

From: John Kristoff <[email-masked]>
Date: Mon, 1 Nov 2010 15:41:16 -0500

On Mon, 1 Nov 2010 09:57:33 +1100
Nicholas Weaver <[email-masked]> wrote:

> IMO, it really shows the value that EDNS0-client-subnet would have if
> deployed: OpenDNS and Google DNS provide significantly less local
> replies in many many cases.

Of course it also shows the value of a well designed local caching
infrastructures by the ISPs.  :-)  That might suggest the DNS resolver
providers should be trying to deploy their boxes within ISP networks
as well, much like Akamai has done with their gear.  I know some have
been trying to do this of course.

John

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 02 Nov 2010 06:03:55 +0900

> been trying to do this of course.

Wise ISPs will soon learn to override 208.67.222.222, 208.67.220.220,
8.8.4.4 and 8.8.8.8 by their own DNS servers and the problems caused
by OpenDNS and google will go away.

						Masataka Ohta

---

From: Colm MacCárthaigh <[email-masked]>
Date: Mon, 1 Nov 2010 19:55:59 -0700

2010/11/1 Masataka Ohta <[email-masked]>

> by OpenDNS and google will go away.

Care to commit to a date and some numbers for that prediction?

-- 
Colm

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 2 Nov 2010 14:31:02 +0100

On Tue, Nov 02, 2010 at 06:03:55AM +0900,
 Masataka Ohta <[email-masked]> wrote 
 a message of 17 lines which said:

> Wise ISPs will soon learn to override 208.67.222.222,
> 208.67.220.220, 8.8.4.4 and 8.8.8.8 by their own DNS servers

ISPs which are evil enough to provide lying DNS resolvers will
certainly have no scruple doing so. 

On the other hand, such action (announcing someone else's prefixes)
may be considered illegal in some jurisdictions. And they certainly
would be a direct attack against net neutrality.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 2 Nov 2010 15:39:15 -0400

And when that day comes people will start deploying clients that prevent
ISPs from that type of man in the middle attack.

-- 
Website: http://hallambaker.com/

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 03 Nov 2010 06:09:07 +0900

> ISPs from that type of man in the middle attack.

FYI, as long as OpenDNS is autocorrecting typos of domain names
and putting advertisements for uncorrectable domain names, which
is very basic business model of OpenDNS, there is no room for
DNSSEC.

A problem is that most, if not all hopefully, ISPs are unwise.
But, less wise ISPs may still intercept all the DNS traffic.

						Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 03 Nov 2010 15:19:39 +0900

> On the other hand, such action (announcing someone else's prefixes)

Announcing someone else's prefixes??? I never say such action.

BTW, some countries, including Japan, are trying to restrict
freedom of speech by blocking sites which are declared to be
child porn sites, regardless of whether they actually are or
not with vague definition of "child porn" different country
by country, through DNS replying non-existent domain.

It means that such reply of non-existent domain can not be
authenticated by DNSSEC.

In addition, in the future in some countries, it may be considered
illegal for ISPs not to override DNS queries.

> certainly have no scruple doing so.

Welcome to the real world where so many people have no scruples.

						Masataka Ohta

---

From: Wilmer van der Gaast <[email-masked]>
Date: Wed, 3 Nov 2010 17:12:37 +0000

Everyone,

Since we're talking about this option now, here's a short update on
edns-client-subnet. We don't have a new draft ready yet, but have been
working on running code. Using a temporary option code we want to find
out if the option gets us the benefits we expect (overall lower
latency and page load times for many users), and quantify the
drawbacks (more DNS latency, lower cache hit rate, larger cache on the
resolver and higher traffic level).

Google Public DNS is using the option internally for some time now for
all queries to ns[1-4].google.com, without issues. Anyone who's
interested in trying out the option at this point (both authoritative
servers and resolvers), please contact us.

We hope to have edns-client-(ip|subnet)-02 together with some numbers
on its effectiveness ready before EoY.

Regards,

-- 
Wilmer van der Gaast, Traffic SRE/Google Public DNS team.
Google Ireland.