[dns-operations] RIPE-52 preso on DNS issues, author comments on Slashdot.

[Florian Weimer]

* Roland Dobbins:

> http://www.ripe.net/ripe/meetings/ripe-52/presentations/uploads/ 
> Wednesday/sirer-perils_of_transitive_trust_in_the_domain_name_system.pps

I'm very sceptical about arguments based on operator negligence and
software quality.  There case against DNS seems to be mostly based on
this (DNS's lack of integrity checks alone isn't very compelling in
itself because our experience clearly shows the protocol is good
enough---which is somewhat surprising).  This reminds me to tone down
the section on operator carelessness in an upcoming research
report. 8-)

I don't think it's possible to roll out a DNS replacement at this
stage.  Just ask your lawyers about trademark issues in a global,
universal naming scheme.  Apart from that, I can't see how technology
at the replication level could have prevented some of the recent
actual domain hijacks (EBAY.DE and PANIX.COM come to my mind).

The integrity issues have already been solved by DNSSEC anyway (I
suppose, I didn't look too closely at the specification).  DNS is
already very good at availability.  Confidentiality has traditionally
been regarded a a non-goal (especially confidentiality of queries),
but it's a concern for some applications[1].  As far as I can see,
distributed hash tables make it even less obvious who gets to see
which requests; in other words, they are even worse.

[1] The answer to this one seems to be that if you really need to keep
    queries secret, you must not abuse DNS for your application, but
    build your own distributed database.