Re: [dns-privacy] How many mechanisms in draft-ietf-dprive-start-tls-for-dns?

2015-05-18 Thread Simon Josefsson
Christian Huitema huit...@huitema.net writes: On any other topic I would agree. Breaking DNS should be one of the things to worry about. Maybe we should make the distinction between stub resolver and iterative resolver part of the architecture. This would be very much the same split as

Re: [dns-privacy] How many mechanisms in draft-ietf-dprive-start-tls-for-dns?

2015-05-18 Thread Simon Josefsson
Paul Hoffman paul.hoff...@vpnc.org writes: That approach is what dual-stack IPv4+IPv6 applications did before people realized defining fails is non-trivial and came up with the happy eyeballs approach to let the quickest path win, and not bother waiting for the fail to be determined. And if

Re: [dns-privacy] How many mechanisms in draft-ietf-dprive-start-tls-for-dns?

2015-05-17 Thread Christian Huitema
On any other topic I would agree. Breaking DNS should be one of the things to worry about. Maybe we should make the distinction between stub resolver and iterative resolver part of the architecture. This would be very much the same split as between an mail client and an e-mail server. Email

Re: [dns-privacy] How many mechanisms in draft-ietf-dprive-start-tls-for-dns?

2015-05-17 Thread Doug Royer
On 05/14/2015 09:25 PM, Mark Andrews wrote: We, like I suspect every other DNS vendor, expect garbage to appear on the port / socket having had 1/4 of a century of attempts to break into machines over DNS behind us. We really should stop worrying about DNS servers falling over when something

Re: [dns-privacy] How many mechanisms in draft-ietf-dprive-start-tls-for-dns?

2015-05-14 Thread Mark Andrews
In message CADC+-gTgbRQ=vjm8kf23_d+jdvyhi6ndgrxohbdbaj6vfh1...@mail.gmail.com, Doug Royer writes: Firewall issue: We can't live in fear that only a handful of ports are forever usable because of busted firewalls or busted firewall administrators. I think the decision should be based on

[dns-privacy] How many mechanisms in draft-ietf-dprive-start-tls-for-dns?

2015-05-13 Thread Paul Hoffman
On May 13, 2015, at 3:52 AM, Simon Josefsson si...@josefsson.org wrote: Paul Hoffman paul.hoff...@vpnc.org writes: Having two parallel mechanisms for a latency-sensitive protocol leads to the necessity of doing a happy eyeballs approach in implementation to decrease latency. That's only

Re: [dns-privacy] How many mechanisms in draft-ietf-dprive-start-tls-for-dns?

2015-05-13 Thread Phillip Hallam-Baker
On Wed, May 13, 2015 at 12:32 PM, Doug Royer douglasro...@gmail.com wrote: Firewall issue: We can't live in fear that only a handful of ports are forever usable because of busted firewalls or busted firewall administrators. I think the decision should be based on what's best for DNS. I