Re: [DNSOP] Introducing draft-vavrusa-dnsop-aaaa-for-free

[Andrew Sullivan <[e-mail]>]

On Sat, Mar 26, 2016 at 03:59:39PM -0400, Ólafur Guðmundsson wrote:
> There are 3 possible outcomes when a DNS querier gets an aswer like this
> #1 It accepts everything from authority section
> #2 It tosses the non queried RRset
> #3 it Rejects the answer and tries again

#4 it panics and you don't know that.

There's no way to know whether #4 cases are out there, and nothing in
any data you collect would tell the difference between 1 and 4.  I
think the chances are pretty low because of the experience with DNSSEC
deployment, but at least there we were relying on the DO bit.  What
you're proposing is to change the protocol for people who don't even
set DO.  Surely that's risky?

> For #2 that means convincing the software vendors to adopt more relaxed
> approach

No, it means making a protocol change to a well-established,
long-deployed standard and _then_ getting people to adopt it, and
doing so without any signals about the deployment.

Please don't think I'm saying no: my employer feels this pain just as
much as yours does, and I also am anxious to support ideas that move
the state of the art ahead.  But I cannot believe we are seriously
talking about deploying stuff that changes a 30 year old
connectionless protocol without any signal in the protocol that the
change is ok for the involved players in each exchange.  If that's
really the sort of thing we're going to do, then we might as well just
start uploading protocol definitions to github and tell people to try
to track them.

Best regards,

A

-- 
Andrew Sullivan
[e-mail]