Re: [dnsext] draft-mohan-dns-query-xml-00.txt

[David Conrad <[e-mail]>]

On Oct 4, 2011, at 3:54 PM, Brian Dickson wrote:
> This proposal is a very lightweight and elegant (IMHO) counter-counter-measure.

Not really. It is a hack that, if implemented, will ensure there is no pressure to actually fix broken infrastructures.  Realistically:

- states-sponsored censorship will continue to occur: states have a tendency to insist on that sort of thing, with guns if necessary;
- folks intentionally blocking working DNS to force the use of their name servers will figure out a way to continue blocking DNS: I have sufficient faith in the tenacity of such folks that all this will do is result in a cat-and-mouse game (e.g., it won't be that hard to figure out which HTTP{,S} server IP addresses to blacklist);
- middlebox vendors and lazy DNS operators won't need to fix their DNS implementations because there is now a HTTP{,S} bypass for the folks that whine about such things; and
- we now have to saddle DNSSEC server implementations (auth and recursive) with yet more complexity.  Permanently.

This feels like the wrong way to solve this problem.

Regards,
-drc

_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext