<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 03/06/2017 04:31 PM, Phillip Hallam-Baker wrote:<br>
<blockquote
cite="mid:CAMm+LwjW+FPsB4ozLpYKkBX_zawKpgup2Z3jtZKgMM4iakbtpA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">On Mon, Mar 6, 2017 at 9:13 AM, Thomas
Steen Rasmussen <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:thomas@gibfest.dk" target="_blank">thomas@gibfest.dk</a>></span>
wrote:<br>
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">Hello,<br>
<br>
If providers running large resolvers today are unwilling
to use the extra resources that dns-over-tls will
require then maybe they should stop running large
resolvers.</div>
</blockquote>
<div><br>
</div>
<div>
<div class="gmail_default" style="font-size:small">Or
maybe:</div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">PEOPLE
WHO WANT TO PROPOSE SECURITY STANDARDS FOR US TO USE
SHOULD LISTEN TO US FIRST.</div>
<br>
</div>
<div>
<div class="gmail_default" style="font-size:small">Just a
suggestion you know..</div>
</div>
<div><br>
</div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"> This is no
different from the people who used to complain loudly
that HTTPS will never work large scale. </div>
</blockquote>
<div><br>
</div>
<div>
<div class="gmail_default" style="font-size:small">Actually
no it is not. I never argued that HTTPS would not scale.
I did point out that certain aspects of PKIX would not
scale, CRLs for example. But nobody I know of ever
argued TLS does not scale.</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Maybe you personally didn't, but the biggest concern about https has
always been the performance hit, right up until maybe 5 years ago.
This is the whole reason sites like <a class="moz-txt-link-freetext" href="https://istlsfastyet.com/">https://istlsfastyet.com/</a>
existed. And as it turns out it was not an issue at all by the time
we got around actually implementing it wide scale.<br>
<br>
Our hardware evolves faster than our workload. See also NSEC5 - it
was considered downright impossible to to "live" signing/proof of
non-existance to prevent zone walking, but lo and behold, what do
you think we will all be doing in a few years?<br>
<br>
DNS-over-TLS will not happen widescale from one day to the next. You
will have plenty of time to adapt your setup to the new worloads.<br>
<br>
<blockquote
cite="mid:CAMm+LwjW+FPsB4ozLpYKkBX_zawKpgup2Z3jtZKgMM4iakbtpA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div> </div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">Of course it will,
we might have to throw some more hardware at it though,
but more likely said hardware will have been naturally
replaced with newer hardware before we reach high
adoption of dns-over-tls. Adoption will not happen
overnight.<br>
</div>
</blockquote>
<div><br>
</div>
<div>
<div class="gmail_default" style="font-size:small">No, it
is not just a question of different hardware. It is a
completely different model because a DNS over UDP
resolver is entirely stateless and a DNS over TCP
resolver is not.</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Just because it has been stateless historically does not mean it has
to be stateless for all eternity. Stuff changes, deal with it. <br>
<br>
Whatsapp could do well over 2 million simultaneous TCP connections
five years ago on a single FreeBSD server, yet you want to throw in
the towel on this before we even give it a shot? smh<br>
<br>
<blockquote
cite="mid:CAMm+LwjW+FPsB4ozLpYKkBX_zawKpgup2Z3jtZKgMM4iakbtpA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div><br>
</div>
<div>
<div class="gmail_default" style="font-size:small">The
group was told repeatedly that this was a show stopper
and they ignored us. And now their work is being
ignored. DPRIV was not a waste of time, it was much
worse than that.</div>
<br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Well that tends to happen when you yell your point at people. I am
tempted to ignore you myself, so there's that. :)<br>
<br>
<br>
/Thomas<br>
<br>
<br>
</body>
</html>