Re: [dnsext] draft-mohan-dns-query-xml-00.txt

[[e-mail]]

On Wed, Oct 05, 2011 at 07:25:39AM -0700, David Conrad wrote:
> On Oct 4, 2011, at 3:54 PM, Brian Dickson wrote:
> > This proposal is a very lightweight and elegant (IMHO) counter-counter-measure.
> 
> Not really. It is a hack that, if implemented, will ensure there is no pressure to actually fix broken infrastructures.  Realistically:
> 
> - states-sponsored censorship will continue to occur: states have a tendency to insist on that sort of thing, with guns if necessary;
> - folks intentionally blocking working DNS to force the use of their name servers will figure out a way to continue blocking DNS: I have sufficient faith in the tenacity of such folks that all this will do is result in a cat-and-mouse game (e.g., it won't be that hard to figure out which HTTP{,S} server IP addresses to blacklist);
> - middlebox vendors and lazy DNS operators won't need to fix their DNS implementations because there is now a HTTP{,S} bypass for the folks that whine about such things; and
> - we now have to saddle DNSSEC server implementations (auth and recursive) with yet more complexity.  Permanently.

	complexity is a serious problem for maintaining a secure and auditable system.
	there is no clear, crisp engineering reason to persue this tactic... it is, as
	stated, a counter-counter measure... looks like an arms race to me, not useful
	engineering.

> This feels like the wrong way to solve this problem.

	amen.  (sorry - too religious -  +1)

/bill

> 
> Regards,
> -drc
> 
> _______________________________________________
> dnsext mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsext
_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext