Subject: RE: [Asrg] 2. Improving Blacklists and Reputation Services

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 11 Feb 2004 06:41:51 -0800

> A new RR with its own format or a TXT record with its own 
> format. I am 
> not talking about a free form format, rather something like LMAP.

The info I get from the DNS engineers is that new RRs take a very long time
to propagate. DNS servers are not required to support them or forward them
under the standard.

We almost certainly do not need a TXT record per entry. If we do there
starts to be a scaling issue on the back end. If you have 60 million domains
to track you need to keep a handle on the per-domain data. 3 bytes per
domain is 120 Mb. 32 bytes per domain is 1.2Gb and so on...

And that memory footprint will affect caches as well.

What I suggest is that we use an A record for _per_domain_ info and a TXT
record to describe the format of the record - see my accreditation draft.

> What I am basically trying to figure out is whether taking the entire 
> mix of DNSBLs outthere with all of their various response codes, 
> formats, etc. and standardazing it would help.

Trying to get people to change what they are doing today in a major way is
going to fail. They will all wait for someone else to move. Much better to
work out how to work within the system. A single TXT record giving
descriptive information solves that problem.

With the metadata approach you can also tell the user that there is
additional info that is NOT in A records. For example a link to a digital
certificate, and yes a TXT record if it is really necessary and useful.

> For major ISPs, bulk transfer of data might be better. To avoid DDOS, 
> P2P might be better. There are other cases.

DDoS is a solved problem for the core DNS. That is why Vixie used it in the
first place.

Bulk transfer is a useful supplement, but remember that we have been through
this whole thing in the PKI space for 15 years and the trend has been away
from CRLs to OCSP/XKMS. In other words the opposite to what you suggest.

I would expect that there would be alternative arragements for the major
ISPs. But remember that they get their .com data that way so they can do it
for their spam data.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Viktor S. Grishchenko" <[email-masked]>
Date: Wed, 11 Feb 2004 21:37:47 +0500

> DDoS is a solved problem for the core DNS. That is why Vixie used it in the

Yes, solved, because it is under DDoS all the time:
http://www.npaci.edu/online/v7.3/caida.root.html
New functionality will introduce new issues (by the way, it is already a 
straightforward reason to reject new functionality). And million zombie army 
is not something unreal today.
DNS root is too far from its clients to somehow affect their behavior, 
implement some policy or establish some 'contract'. At the same time it has 
to run at any cost. This abyss between abilities and responsibilities may be 
source of many problems.
So, your 'solved' better be understood as 'solved for now, until nothing has 
changed'.
E.g. LMAP deployment may introduce additional pressures: functional, 
bug-related and malicious.

Excuse me for being pessimistic and being off-topic, but DNS wasn't engineered 
to express reputation and trust. There is a high risk to be involved in 
programming 3D shooter for exactly the Turing machine. H. Danisch states we 
already do. (I currently don't think so.)

-- 

	Viktor S. Grishchenko

---

From: George Schlossnagle <[email-masked]>
Date: Wed, 11 Feb 2004 11:46:31 -0500

> already do. (I currently don't think so.)

I don't completely get the analogy, but DNS was designed as an 
informational system, having the authoritative record-holder for a 
domain express policy information in a TXT record for that domain seems 
well in-line with the original design.

George

---

From: Daniel Feenberg <[email-masked]>
Date: Wed, 11 Feb 2004 16:21:20 -0500 (EST)

Some years ago I saw a long essay posted on the web with a title something
like "DNS makes a bad distributed database for things other than domain
names". It was written in the style of an RFC, but it doesn't look like it
was ever made part of the series. 

I don't remember if the arguments made in the paper were good, or merely
repeated obvious points about the possible propagation of stale entries,
data format limitations, etc. Does anyone remember that paper?

I would add that the use of DNS for distributing RBL information has a
remarkable breadth of support covering all major open source and
proprietary MTAs, and could better be held up as a model for imitation,
rather than carping about minor shortcomings.