Re: [dns-privacy] I-D Action: draft-ietf-dprive-start-tls-for-dns-00.txt

2015-05-13 Thread John Heidemann
On Wed, 13 May 2015 12:36:17 +0200, Simon Josefsson wrote: >Daniel Kahn Gillmor writes: > >> On Tue 2015-05-12 14:40:12 -0400, Simon Josefsson wrote: >>> What I'm basically wondering, and advocating, is if perhaps one method >>> would be sufficient. This would reduce complexity on the protocol a

Re: [dns-privacy] How many mechanisms in draft-ietf-dprive-start-tls-for-dns?

2015-05-13 Thread Phillip Hallam-Baker
On Wed, May 13, 2015 at 12:32 PM, Doug Royer wrote: > > Firewall issue: > > We can't live in fear that only a handful of ports are forever usable > because of busted firewalls or busted firewall administrators. > > I think the decision should be based on what's best for DNS. > > I hope that older

Re: [dns-privacy] How many mechanisms in draft-ietf-dprive-start-tls-for-dns?

2015-05-13 Thread Doug Royer
Firewall issue: We can't live in fear that only a handful of ports are forever usable because of busted firewalls or busted firewall administrators. I think the decision should be based on what's best for DNS. I hope that older DNS servers do no crash when getting a new type of packet informatio

[dns-privacy] How many mechanisms in draft-ietf-dprive-start-tls-for-dns?

2015-05-13 Thread Paul Hoffman
On May 13, 2015, at 3:52 AM, Simon Josefsson wrote: > Paul Hoffman writes: > >>> Having two parallel mechanisms for a latency-sensitive protocol leads to >>> the necessity of doing a "happy eyeballs" approach in implementation to >>> decrease latency. >> >> That's only true of the specification

Re: [dns-privacy] I-D Action: draft-ietf-dprive-start-tls-for-dns-00.txt

2015-05-13 Thread Paul Hoffman
On May 13, 2015, at 2:28 AM, Tony Finch wrote: > My understanding is that the smtps port was allocated, then in a fit of > panic the IETF decided that allocating N*M ports (N protocols, M security > layers) would be a disaster and cause horrible security layer negotiation > problems, so smtps was

Re: [dns-privacy] I-D Action: draft-ietf-dprive-start-tls-for-dns-00.txt

2015-05-13 Thread Simon Josefsson
Paul Hoffman writes: >> Having two parallel mechanisms for a latency-sensitive protocol leads to >> the necessity of doing a "happy eyeballs" approach in implementation to >> decrease latency. > > That's only true of the specifications don't say what to do > first. However, draft-ietf-dprive-star

Re: [dns-privacy] I-D Action: draft-ietf-dprive-start-tls-for-dns-00.txt

2015-05-13 Thread Simon Josefsson
Daniel Kahn Gillmor writes: > On Tue 2015-05-12 14:40:12 -0400, Simon Josefsson wrote: >> What I'm basically wondering, and advocating, is if perhaps one method >> would be sufficient. This would reduce complexity on the protocol and >> implementation level. > > I agree that a single mechanism w

Re: [dns-privacy] I-D Action: draft-ietf-dprive-start-tls-for-dns-00.txt

2015-05-13 Thread Tony Finch
Paul Hoffman wrote: > On May 12, 2015, at 11:40 AM, Simon Josefsson wrote: > > > For SMTP, IMAP, POP etc the reason for having both port-based and > > upgrade-based is legacy and historic reasons: back in the days the > > STARTTLS approach wasn't invented, so following HTTP(S) footsteps, new > >