Re: [dnsext] Re: I-D ACTION:draft-vandergaast-edns-client-ip-00.txt

[Nicholas Weaver <[e-mail]>]

On Jan 28, 2010, at 11:45 AM, Paul Vixie wrote:
>> 
>> Actually, that IS the fix:  Use the ISP's recursive resolver.
>> 
>> This is necessary if you want to use something OTHER than the ISP's
>> recursive resolver to work well on today's Internet.
> 
> i love how somebody else (CDN providers) violate all existing assumptions
> (by creating requestor-specific DNS replies) which then makes the Internet
> work "less well" for lots of people... who are then constrained from doing
> what were previously reasonable things (like using distant recursive servers).

Why?  IMO, its a great strategy, simply because it not only works WELL for most users (it only fails those who want third party DNS resolvers), 

> 
>> Do you want third-party DNS providers to not suck for youtube, akamai,
>> Google, and a good fraction of the net people use every day?  If so, you
>> need this.
> 
> if youtube and akamai and google want to suck, let them suck.  they weren't
> the first movers and they won't be the last and redrawing the protocol to
> support their flawed technical model is not in the global system's interest.

Too late.  They are established.  Your protocol has been rewritten for this.

> this incoherency should be dealt with more harshly, perhaps by minimizing
> TTL to 5 minutes, and sharing a single DNS cache across global providers.
> 
> any CDN who relies on what i call "stupid DNS tricks" to deliver their
> advantage should upgrade to something at the WWW layer, and leave DNS alone.

Except THIS assumes that the only load-balancing one wants to do is at the WWW layer, and its possible.  EG, you have this stupid same-origin stuff all over the place on the web that prevents a lot of WWW layer tricks from working.


> especially with DNSSEC coming.

DNSSEC makes no difference to this.  You know the addresses you are going to return in advance.