Re: [dane] Behavior in the face of no answer?

John Gilmore <gnu@toad.com> Fri, 11 May 2012 16:46 UTC

Return-Path: <gnu@toad.com>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7D6421F86C2 for <dane@ietfa.amsl.com>; Fri, 11 May 2012 09:46:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 1.081
X-Spam-Level: *
X-Spam-Status: No, score=1.081 tagged_above=-999 required=5 tests=[AWL=-0.505, BAYES_05=-1.11, RCVD_IN_NJABL_RELAY=2.696]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XmGK2bpoHJIA for <dane@ietfa.amsl.com>; Fri, 11 May 2012 09:46:28 -0700 (PDT)
Received: from new.toad.com (new.toad.com [209.237.225.253]) by ietfa.amsl.com (Postfix) with ESMTP id 42B9421F86C1 for <dane@ietf.org>; Fri, 11 May 2012 09:46:27 -0700 (PDT)
Received: from new.toad.com (localhost.localdomain [127.0.0.1]) by new.toad.com (8.12.9/8.12.9) with ESMTP id q4BGkNcF008939; Fri, 11 May 2012 09:46:23 -0700
Message-Id: <201205111646.q4BGkNcF008939@new.toad.com>
To: Paul Wouters <paul@cypherpunks.ca>
In-reply-to: <alpine.LFD.2.02.1205082055270.17396@bofh.nohats.ca>
Date: Fri, 11 May 2012 09:46:23 -0700
From: John Gilmore <gnu@toad.com>
Cc: dane@ietf.org
Subject: Re: [dane] Behavior in the face of no answer?
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 May 2012 16:46:28 -0000

Paul Wouters said:
> But we all know there are many embedded devices with badly written DNS
> proxy software that do things like comparing packets to known byte
> streams without actual understanding of bit values.

I don't personally know this.  If we're going to design a protocol
around such devices, let's at least get some details instead of vague
generalizations that "we all know".

Can you provide some actual names of such devices, preferably with
links to people complaining about their badly written DNS proxies?
What is the practical effect of the limitations in their DNS proxies?
How widely deployed are they, and where?  Are these endpoint devices
or routers?  Has the mfr released updated firmware for them?  Etc.

Are these proxies only in the data stream while the box is trying to
interpose itself into "your first web access" to force you to log in?
Or are the proxies permanently affecting every end user's ability (on
that network) to send and receive arbitrary packets on port 53?

	John