Subject: Re: WGLC for DNSSECbis docs

From: Masataka Ohta <[email-masked]>
Date: Wed, 02 Jun 2004 15:48:36 +0900

Paul Vixie wrote:

>>It's lossless and simple.

> It's not lossless.  If a zone changes during an AXFR, then either the AXFR
> is TCP-RST'd (BIND4, BIND8, most nonBINDs) or it continues but using the old
> zone contents (BIND9), but if a zone changes during an NSEC traversal, there
> will almost certainly be some data loss due to the rewritten NSEC chain.

If you are saying AXFR not with BIND9 is lossless, if you frequently
check SOA during the traverse, you can simulate TCP-RST. Throw away
data after the last unmodified serial.

							Masataka Ohta

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked] (Geoffrey Sisson)
Date: Wed, 2 Jun 2004 08:51:10 +0100 (BST)

> will almost certainly be some data loss due to the rewritten NSEC chain.

True, "lossless" is technically inaccurate.  "Practically lossless"
(from the standpoint of a data miner, for whom other techniques may be
at best somewhere on the order of 80% or 90% lossy) is more accurate.

> > The only way I see to mitigate this is to make the same information
> > available via less expensive facilities, e.g. unrestricted FTP/HTTP
> > access.  This may be an option for some operators of nameservers with
> > large zones but, unfortunately, it's not an option for us.
> 
> Your position is quite well understood.  For the record, did anyone from
> Nominet comment during the January WGLC on the design goals of DNSSEC-BIS?

No, and for this I can only say "mea culpa".  While we've been aware of
the potential of NXT/NSEC abuse, it was only in the course of a recent
painful legal action (involving WHOIS abuse, and still ongoing) that we
fully connected the dots.

> For my part, it's not frustration but rather sadness.  DNSSEC-BIS will be
> deployed, and some parts of the DNS tree won't benefit from it, and that's
> how it has to be, but I don't have to like it and in fact I don't like it.

I'm concerned that even the parts of the DNS tree who do deploy may
face operational issues unless they give away the data in their zone
files with no questions asked.  Even a minor procedural obstacle, such
as requiring a subscription to a service or formal request via a web
form, may result in an abuser preferring the simplicity/anonymity of
NSEC RR elaboration instead.

I also may have under-represented the case of DNS end-users, for whom
simple privacy is the principal concern.  Even using split DNS, they
may have information they'd prefer not to broadcast.

Regards

Geoff