Re: [DNSOP] SIG(0) useful (and used?)

[Warren Kumari <[e-mail]>]

On Thu, Jun 21, 2018 at 4:52 AM Joe Abley <[e-mail]> wrote:

> On Jun 20, 2018, at 21:05, Shumon Huque <[e-mail]> wrote:
>
>
> On Wed, Jun 20, 2018 at 7:30 PM Joe Abley <[e-mail]> wrote:
>
>> On Jun 20, 2018, at 19:07, Warren Kumari <[e-mail]> wrote:
>>
>> ​... what I'd alway wanted[0] was to be able to setup my own recursive
>> name server somewhere on the Internet, and then only allow myself (and a
>> few of my closest friends) to be able to query it.
>>
>> For this particular use-case, why is SIG(0) better than TSIG?
>>
>
> Either might be fine in these small user scenarios.
>
>
> Yes, I know, hence the question. Warren usually has his reasons :-)
>

​Yes, but these are often related to "because it amused me or seemed like a
good idea at the time", and so it is always worth checking :-)

I was wanting to be able to provide this on the order of 50 - 100 devices.
This includes all my devices, including laptops, phones, tablets, travel
routers, kindle, and all of my wife's devices (similar set), and my aunty
Sue's devices. Ideally this would also be usable for something like a small
enterprise (without having a full VPN). Managing TSIG keys for all those
seems tricky.

I don't actually think that TSIG would do what I want either -- technically
it could, but I think that what is missing is the ability to easily
configure keying information in /etc/resolv.conf (or other stub config).
Ideally I'd like to add something to resolve.conf (or similar) saying:
nameserver 192.0.2.53 key 0xbadc0ffee

I think that 95% of the issue is on the stub side.

Paul's https://github.com/BII-Lab/DNSoverHTTP and Stubby both come fairly
close to solving this. The more I think about it, DPRIVE and DoH are
driving towards what I want.


> The follow-on question was why he needs this functionality in the stub
> resolver rather than running a local copy of BIND9 (bound to localhost,
> configured appropriately) and pointing his stub resolver at that.
>

A couple of reasons:
1: I'd like to be able to take advantage of a shared cache
2: I'd like to be able to use this for my {mac,  androids,  iPhone / iPads,
linux laptops}, my wife's {mac, iPhone / iPads, linux laptops}, travel
router, kindle, etc.
Apart from the fact that I cannot run BIND / Unbound on many of these
devices, keeping this many full nameservers watered and fed would be
annoying.


​W​



>
>
> Joe
>


-- 
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf