Re: [dns-privacy] [DNSOP] FW: New Version Notification for draft-pan-dnsop-edns-isp-location-00

[Lanlan Pan <[e-mail]>]

Hi,

Thanks for Petr and Brian.

Brian Hartvigsen <[e-mail]>于2017年3月21日周二 上午3:34写道：


>> For user privacy concern, we can revise  ECS(114.240.0.0/24
>> <http://114.240.0.0/24>) => EIL (CHINA, BEIJING, UNICOM)，give a
>> tradeoff between privacy and precise.
>
> Nice, this sounds like appropriate tradeoff to me.
>
>
> Side-effect of this is that it removes need to maintain copies of
> various Geo-IP databases all over the place, which is an improvement to
> operational practice.

I disagree.  Unless you get the clients to implement EIL, then you’ve
simply just pushed the need for geo-ip mapping from CDN to DNS provider.
Of course one would assume that an ISP already has this mapping, but 3rd
party DNS would not.  So either they have to build the mappings,  maintain
a copy of some Geo-IP database, or hope that all the clients have it
implemented.  With 3rd party DNS carrying double digit percentages of
traffic (iirc ~15% total from 2015 OARC presentation), that’s not something
to just brush away.


*AUTH*
ECS needs AUTH to do geo-ip mapping to decide most satisfied response.
There is Geo-IP database on the AUTH which is supporting ECS.  (ECS example
figures: Which CDNs support edns-client-subnet? )
<https://www.cdnplanet.com/blog/which-cdns-support-edns-client-subnet/>
<https://www.cdnplanet.com/blog/which-cdns-support-edns-client-subnet/>
Therefore, if AUTH support ECS, the AUTH can support EIL too.

*RECUR*
<https://www.cdnplanet.com/blog/which-cdns-support-edns-client-subnet/>
Return to the origin smart-dns-resolution problem, there are two critical
factors that affect the response accuracy of authoritative server: (details
wrote in my *Paper
<https://drive.google.com/open?id=0B5gNT4RRJ0xPaG9nZ045VXRrZzg>*)
1) Is the resolver's IP address close to the client's IP address?
2) Is the IP geolocation database used by the authoritative server with
high quality?

Public recursive resolvers offer free DNS resolution services for global
users. But these servers are NOT CLOSE TO many users because the public
recursive service providers COULDN'T deploy servers in every country and
every ISP's network.
That is why public recursive service provider starved of ECS, which carried
client subnet to AUTH for geo-ip mapping.
Therefore, public recursive resolvers INCREASE the seperated distance of
client's IP and resolver's IP. Because on traditional ISP recurisve
resolver side, ISP are nearby the client's IP.

That is why I say the most recommend is P-Model, deploy EIL on public
recursive resolver, to partly lighten the burden of AUTH (as Petr pointed),
decrease the user privacy risk at PUB RECUR -> AUTH path.
EIL deploy on I-Model (ISP recursive resolver)  and L-Model (Local
forwarding resolver) is in long-term, the most realistic nowadays is the
P-Model (Public recursive resolver).

By the way，if 3rd party public recursive DNS are carrying double digit
percentages of traffic, there is a high probability that they have strong
technologies and rich resources to do geo-ip mapping for their client
queries.



— Brian

-- 
致礼  Best Regards

潘蓝兰  Pan Lanlan