Re: [dnsext] Re: I-D ACTION:draft-vandergaast-edns-client-ip-00.txt

[Carlo Contavalli <[e-mail]>]

On Mon, Feb 1, 2010 at 2:25 PM, Ondřej Surý <[e-mail]> wrote:
> On 28.1.2010 20:02, Nicholas Weaver wrote:
>>> it's not worth a global upgrade to DNS in its current form.
>>
>> It can be done WITHOUT a global upgrade: you can do it with JUST
>> upgrades to the recursive resolvers and authorities desiring such
>> behavior, see my note on fallbacks from the resolver point of view.
>
> No you can't.  Since all end users would loose privacy from day zero, since
> this proposal is opt-out, not opt-in.  Therefore you need to do a global
> upgrade.

Define "from day zero"? recursive resolvers do not have to implement
edns-client-ip, and they do not have to turn it on. They CAN, if they
want, and the hope is that they eventually WILL when it brings
advantages to their users. And it'll take time for each one of them to
eventually decide they want to enable the option.

It is opt-in from the recursive-resolver point of view. It is opt-out
from the end client point of view. But again, we are defining a
*protocol*, a means for two computers to exchange data with each
other, not a policy.

> opt-in (same as in the browser).  I would just hate if my resolver starts to
> send my IP address to authoritative DNS without asking me.
Eg, what's preventing recursive resolvers from forwarding your IP
address now? the lack of protocol support? or a contract/privacy
statement with their users? if IETF does not allow a protocol to do
so, will they NOT forward your IP address? and again, we're not even
talking about the full IP address, and in most cases you just connect
to the server right after doing the lookup.

It's similar to when you use a proxy: will it include a
X-Forwarded-For header? or not? how do you know it is? how do you know
it won't include the header in the future? how do you know they are
not forwarding your data by some other means? is this ground to say
that X-Forwarded-For should not exist? is this a problem at the
protocol layer?

Carlo