Subject: Dynamic DNS - The dark side III

From: [email-masked] (Dan Kolis)
Date: Fri, 1 Mar 2002 16:01:37 -0500

Tony Hain <[email-masked]> said:
>Mobility is not the only reason to use DDNS. Consider the case of Dan's
>residential gateway. If it provided a consumer-friendly automated DDNS
>server for a sub-domain delegated to the residence, what are the hard
>issues? First would be security, but that is reasonably addressed by
>making the dynamic registrations only possible by devices on the lan
>side, and by a simple web-based cert mechanism between that device and
>the ISP DNS infrastructure. This aligns the DDNS trust boundary with the
>basic service boundary. Second would be getting past the brain-dead
>perspective that consumer connections to the Internet should not be
>hosting services. The entire set of peer-to-peer applications is based
>on the fundamental assumption that a service endpoint can exist anywhere
>and be found through simple resolution of a name. What are the reasons
>to do it? First the consumer would have simple consistent access to name
>resolution for all devices on the home network. Second, they would be
>able to expose services (peer-to-peer games, appliance diagnostics) that
>fit directly into the naming framework they are already accustomed to
>for other Internet services. Third, it scales much more realistically as
>the infrastructure side only has to support updates based on the
>attachment frequency of the consumer network, not every device as they
>power up, or move between subnets. This would also allow for very short
>TTLs where they make sense without requiring them to be everywhere.

Dan says:
Well, this makes me feel better and there is certainly a lot of good
thinking in the above. I wonder, though since I know almost nothing about
IPNG whether maybe its handled there better.

It seems to me for troubleshooting, its awefully handy to think of the DNS
as more or less static. If the connection that used to be somebody's WWW
pointing to there childrens playground is instead the sex-with-goats hotline
for 20 minutes, its harder to troubleshoot if everything is dynamic.

I'm arguing both sides clearly becuase it a subtle tradeoff. The scalability
thing is a good point.

In my implementation, every house it going to have a WWW server, some with
fixed Ip's some just pointed to by a corperate resource, some an
intentionally obscure port and (maybe dynamic) DHCP assigned IP, etc.

I think TOny is perceiving the DNS process as just another service, not a
framework per se.

But with the name resolution Internet board, etc, it has a quasi-legal
status already.

I guess among other things I don't quite get is why if an ISP buys an IP for
$0.35 they rerent if for ten times that, per month.

I'm rambling. Its a fun topic though.

Regs to all
Dan

---

From: "Tony Hain" <[email-masked]>
Date: Fri, 1 Mar 2002 13:51:07 -0800

> IPNG whether maybe its handled there better.

DNS is orthogonal to IPv6, but absolutely required to avoid having to
type addresses that look like::  1234:5678:9abc:def0:1234:5678:9abc:def0
It does seem a bit strange that you are working on a new residential
gateway, but haven't looked at IPv6... ;)

> for 20 minutes, its harder to troubleshoot if everything is dynamic.

Granted, and one of the advantages of IPv6 is that the ISP *could*
choose to statically allocate a prefix to a customer. The mindset for
doing that today is hard to get across, since everyone is in strong
conservation mode, but it has been shown there are enough /48's in the
current PA prefix space to allocate half-a-dozen to everyone that is
expected to be alive 70 years from now, so statically allocating one to
a household in the short term should not be as big a deal as some are
making it out to be.

> intentionally obscure port and (maybe dynamic) DHCP assigned IP, etc.

Just make sure you put IPv6 support in it, and don't preclude the
concept of a game-console behind it registering for peer-to-peer gaming.

> I think TOny is perceiving the DNS process as just another

DNS is a service, just like forwarding packets is a service. There are
technical components that have to be right for the service to work, but
there is no reason those components have to be as complex as they are
today.

> $0.35 they rerent if for ten times that, per month.

Simply because they can, due to the scarceness of the resource.
Fortunately with IPv6, there is no address scarcity.