Re: [dnsext] afasterinternet.com trial and draft-vandergaast-edns-client-subnet-00

On Tue, Sep 06, 2011 at 11:02:15AM -0700, Nicholas Weaver wrote:
> 
> The only information leakage is SUBNET (NOT IP address), TO the authority for the domain.  
> 
> Which would ONLY be an information leakage at all if either:
> 
> a)  The authority is NOT responsible for operating the final server the client eventually contacts 
> b)  The client does NOT use the DNS record to contact a server belonging to the authority
> c)  The client uses a broken tunnel, contacting the final server from a different IP from that used by DNS.

	c) - at one time was very common, most computers had multiple NICs, each with its own IP.
	     in the last decade, it became common for a single NIC with one usable IP, HOWEVER
	     these days, the NIC in my laptop has NINE IPs associated with it (thanks IPv6)...

	     So the channel my machine uses to talk to the DNS likely has little to no relationship
	     with the channel used to talk with other nodes. This is particularly true in walled
	     gardens with DNS lattice... The DNS server has no idea/concept of the topology betwen
	     my node and the target node - This proposal is trying to allow DNS service to 
	     fabricate a synthetic view of a presumed map of Internet topology and then project 
	     that fabrication on its clients.  

	     IMHO, that pretty much exceeds the remit of the DNS. :)

/bill

> 
> 
> 
> And this is ONLY necessary for out-of-path resolvers (eg, Google Public DNS, OpenDNS), where in almost all cases the user has already explicitly opted in!  
> 
> No other resolver really benefits from supporting this anyway, as most of the big nation-spanning ISPs have already gone with a distributed DNS infrastructure, so the IP address of the query to the authority is already giving the authority of the domain information roughly equivalent to what EDNS-client-subnet provides.
> 
> _______________________________________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsext