Re: OFFTOPIC: DNSSEC groupthink versus improving DNS

[Duane <[e-mail]>]

Brian Dickson wrote:

> Ballpark figure - 6.5 B people, 10 transactions per day average, gives ~
> 1M/s worldwide.
> If the rates were comparable, each resolver would process ~ 1
> query/second. Off by several orders of magnitude.

So you are stating there is more CC authorisations per second for CC's
than DNS, and if that system works so well (most of the time) why can't
DNS follow that approach too?

> Sorry, the details on the attack methods and vectors means you would
> throw away good answers more often
> than you would throw away bad answers (from the cache), but an empty
> cache for a given domain is an extra vector.

Very few ISPs cache websites any more even though there is tangible
benefits in doing so still, but due to a variety of reasons many stopped
doing caching because it was more hassle then it was worth, at present
for me and others DNSSEC is more hassle then it's worth.

In short web pages could be cached rather than 'throw' away good answers
but they don't, why should caching DNS be given any more consideration
in this respect?

-- 

Best regards,
 Duane

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>