Re: [dnsext] Empty AA=0 AD=1 answers to AAAA queries: your thoughts pls

[bert hubert <[e-mail]>]

On Sun, Dec 21, 2014 at 01:25:06AM +1100, Mark Andrews wrote:
> > I have a question if I am right in concluding something is a protocol
> > violation, and if we should reward it by papering it over or (finally)
> > concluding that enough is enough.
> 
> I've been thinking for a long time that enough is enough.  Named tried
> to reject all non referral "aa=0" from supposedly authoritative servers
> a while back and we had to reverse the change.  While pandora.tv has
> fixed the aa=0 issue they still return malformed answers.

What about if (say) ISC, NLNetlabs, Nominum, PowerDNS and Google DNS say
"enough is enough"?  

Because right now, the dynamics we all know are "yeah but you must fix it
since it works on X" (where X isn't you).

If we had a nice manifesto to point to, we could make this stick.

I estimate that >25% of the PowerDNS recursor now consists of "stuff we have
to do because the internet sucks". 

The horrible thing is that every workaround we add increases the chance we
break legitimate things, or open ourselves up to attacks that make good use
of our willingness to bend things to make them work.

> Personally I would like to take a stand.  Whether we can convince others
> is another matter.

Benno, Wilmer, Ted, Kumar, what do you think? We could coordinate off-list
perhaps?

	Bert