Subject: [DNSOP] my comments on draft-ietf-dnsop-terminology-bis

From: Paul Vixie <[email-masked]>
Date: Fri, 14 Apr 2017 12:07:06 -0700

in the current dns terminology rfc, it editorializes and is inaccurate
by understatement and overstatement concerning the "passive dns" term. i
suggest the following edits, should you decide to retain this text
rather than copy from the COF i-d or from florian's original work:

   Passive DNS:  A mechanism to collect large amounts of DNS data by
      storing DNS responses from servers.  Some of these systems also
      collect the DNS queries associated with the responses; this can
      raise privacy issues.  Passive DNS databases can be used to answer
      historical questions about DNS zones such as which records were
      available for them at what times in the past.  Passive DNS
      databases allow searching of the stored records on keys other than
      just the name, such as "find all names which have A records of a
      particular value".

s/large amounts of//
s/responses/transactions/
s/servers/name servers/
s/; this can raise privacy issues/; done correctly, this raises no
privacy issues/
s/records/answers/
s/available for them/witnessed/
s/the name/the name and type/

-- 
P Vixie

---

From: "Paul Hoffman" <[email-masked]>
Date: Fri, 14 Apr 2017 12:15:25 -0700

Started as a new issue at 
https://github.com/DNSOP/draft-ietf-dnsop-terminology-bis/issues/21

--Paul Hoffman

---

From: Warren Kumari <[email-masked]>
Date: Fri, 14 Apr 2017 15:39:42 -0400

> https://github.com/DNSOP/draft-ietf-dnsop-terminology-bis/issues/21

<no hats>
I don't think that I agree with "this raises no privacy issues" --
some folk seem to think that they can store "private" information in
the DNS, and if queried for, this may / will expose it. Someone (I
think it was Facebook or LinkedIn) creates (or used to create) a
per-user DNS name for load-balancing purposes -- scraping passive DNS
would allow someone to find many profiles, which could be viewed as a
privacy issue.

I'd much prefer "done correctly, this raises minimal privacy issues"
or "done incorrectly this can raise privacy issues" (or just skip
everything after the semi-colon and say nothing).

I believe that passive DNS is incredibly useful for security stuff, I
just think that saying that it raises no privacy issues could get
sticky.

Oh, I added the above to the issue.
W

>
> --Paul Hoffman
>
>
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: P Vix <[email-masked]>
Date: Fri, 14 Apr 2017 19:54:44 +0000

I accept Warren's alternative wording. Any of them.
-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.