Re: [dnsext] Re: I-D ACTION:draft-vandergaast-edns-client-ip-00.txt

[Ondřej Surý <[e-mail]>]

I am replying to several mails at once, since some of them address my 
concerns after reading whole draft.

On 28.1.2010 00:56, Wilmer van der Gaast wrote:
> Hello everyone,
>
> I spoke to Olafur about this idea in Hiroshima last year. I'm afraid
> the deadline for Anaheim already passed, but we hope we can discuss it
> on-line in the meantime and decide if it should become a WG item in
> Maastricht later this year.
>
> To summarize the I-D: It specifies an EDNS0 option that carries IP
> address information (by default only the first 24 bits to preserve
> privacy) of the user that triggered a DNS resolution. This should
> allow authoritative nameservers that give geo-targeted responses to be
> more accurate, even in cases where the resolver and its users aren't
> close to each other. To preserve the ability to cache such responses
> efficiently, the option in the response can indicate which exact
> subnet it should be cached for.
>
> Comments are more than welcome.

#1: There should be a way how to ask recursive resolver if he has set 
edns-client-ip on query or not, so end client knows if authoritative 
server knows his IP or not. (let's call it stalk flag)


On 28.1.2010 20:02, Nicholas Weaver wrote:
 >> it's not worth a global upgrade to DNS in its current form.
 >
 > It can be done WITHOUT a global upgrade: you can do it with JUST
 > upgrades to the recursive resolvers and authorities desiring such
 > behavior, see my note on fallbacks from the resolver point of view.

No you can't.  Since all end users would loose privacy from day zero, 
since this proposal is opt-out, not opt-in.  Therefore you need to do a 
global upgrade.

On 29.1.2010 12:32, Stephane Bortzmeyer wrote:
 > 2) A more ambitious one (may be too ambitious), to have an EDNS option
 > code "Client info", with sub-codes and various fields (and a registry
 > at IANA to register these fields) to carry absolutely everything from
 > the desktop client to the authoritative name server. IP address
 > information would then be just a special case.

I like this proposal, you can then set country to CZ, or language to 
"cs" as opt-in (same as in the browser).  I would just hate if my 
resolver starts to send my IP address to authoritative DNS without 
asking me.

Ondrej
-- 
  Ondřej Surý
  vedoucí výzkumu/R&D manager
  -------------------------------------------
  CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
  Americka 23, 120 00 Praha 2, Czech Republic
  mailto:[e-mail]    http://nic.cz/
  tel:[phone]       fax:[phone]
  -------------------------------------------