[dns-operations] K-root in CN leaking outside of CN

[Manu Bretelle]

On Sat, Nov 6, 2021 at 9:35 AM Phillip Hallam-Baker <phill at hallambaker.com>
wrote:

> On Sat, Nov 6, 2021 at 12:22 AM Manu Bretelle <chantr4 at gmail.com> wrote:
>
>> Hi all,
>>
>> Based on https://root-servers.org/, there are a few root servers
>> operated from Mainland China.
>>
>> How do we ensure that those are not advertised outside of China so DNS
>> answers are not poisoned by the GFW?
>>
>
> You can't.
>
> All you can do is to authenticate the data and reject invalid responses.
>

Thanks Philip,

I do understand, but there is still a long way to go before this happens
globally based on https://stats.labs.apnic.net/dnssec/ it is roughly 30% of
resolvers validating.


>
> I am getting heartily sick of all this fearmongering about China. One of
> the chief fearmongers who was largely responsible for coining the phrase
> 'yellow peril' was Kaiser Wilhelm II who after telling Europe how China was
> going to invade Europe for decades went and invaded Europe himself starting
> WWI.
>

It is not my intent to discuss this on this forum.


>
> If the DNS protocol were sane the root zone would be published as a
> notarized, chained append only log. Every DNS resolver would obtain a list
> of updates to that log either directly or indirectly. There would be no
> root server to poison or DDoS.
>
> But the DNS protocol is not sane and is not going to be changed. Not least
> because the organizations that run root servers are rather pleased about
> the prestige it brings to them.
>

There is probably a lot that can be done, that could have been done
better.... but as you certainly know, the DNS ecosystem being that widely
distributed by totally independent systems is extremely slow to migrate.
And while addressing the problem in the long run is definitely something
valuable, I wonder how we could prevent the problem in its current state.

Manu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20211106/72588acb/attachment.html>