[dns-operations] DNS Flush Protocol

[George Michaelson]

OK. thats a good motivation. Nicely stated.

Models based on in-band proof(s) of possession might then in some
sense, be better. While I hate meta-protocol usage, since we don't
have a c&c channel that zone owners share with resolver owners, it
might be a tool in the locker.

How do you feel about state in the resolver to rendesvous on? Because
if we can do DNS 'query knocking' with held state, we can signal both
intentionality, and proof of possession. Obvious DoS risk of making a
resolver hold state but its probably no worse than the Amp Attack
risks.

Or if we have held-open session, then sequences of queries can be more
meaningful. I connect, I prove something doesn't exist with zero TTL,
I perform state change in the zone and re-query which shows you I
effected change for a prior query..

-G




On 27 March 2015 at 15:08, Paul Vixie <paul at redbarn.org> wrote:
>
>
> George Michaelson wrote:
>> I would agree that assumptions are a road to perdition.
>>
>> But the model of concentration of eyeballs through resolvers is not
>> new. So, whilst I agree in *principle* I think it bears thinking
>> about: do you actually really expect a disruptive (sea)change  here?
>
> yes. or i wouldn't have worked on RPZ. the DNS resolution path is a huge
> component of internet autonomy, and it is under powerful attack by both
> corporations and governments around the world, for censorship,
> surveillance, and commerce purposes. to regain control of their own
> internet experience and to protect their privacy against upstream
> wiretapping, many enterprises of all sizes and many "power users" are
> going to move back to a private resolver model. we should do nothing in
> this WG that makes that movement less attractive, such as creating a DNS
> cache purge model that requires registration, subscription, or a
> clearinghouse.
>
> --
> Paul Vixie