<div dir="ltr"><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Mar 6, 2017 at 9:13 AM, Thomas Steen Rasmussen <span dir="ltr"><<a href="mailto:thomas@gibfest.dk" target="_blank">thomas@gibfest.dk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><span class="">
On 03/06/2017 01:59 PM, Phillip Hallam-Baker wrote:<br>
<blockquote type="cite">
<div dir="ltr">
<div style="font-size:small"><br>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mon, Mar 6, 2017 at 3:33 AM, Marat
Khalili <span dir="ltr"><<a href="mailto:mkh@rqc.ru" target="_blank">mkh@rqc.ru</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<p><span> </span></p>
<blockquote type="cite">
<div style="font-size:small">There are two issues,
both of which I brought up at the start of DPRIV:</div>
<div style="font-size:small"><br>
</div>
<div style="font-size:small">1) Must be supported by
browsers.</div>
<div style="font-size:small">2) Protocol MUST be
entirely state free</div>
<div style="font-size:small"><br>
</div>
<div style="font-size:small">If you want a protocol to
be deployed, you need to solicit input from the
people who you need for deployment and take notice
of it. DNS over anything TCP is not going to measure
up.</div>
</blockquote>
DNS-over-TLS in public resolvers would be very useful
for small-scale DNS repeaters in corporations and ISPs.
They usually connect to few public resolvers and can
easily keep these connections alive. Persistent TCP
connections place much lighter burden on firewalls than
UDP requests, so there might be overall performance gain
on both sides.<br>
<p>QUIK, SCTP and similar future technologies can be
even better, but are obviously not ready for
deployment here and now. TLS is.</p>
</div>
</blockquote>
<div>
<div style="font-size:small">No.
TLS is not ready for deployment because the protocol
model for TLS (and for that matter DTLS) is not
compatible with running a large public resolver.</div>
<div style="font-size:small"><br>
</div>
</div>
</div>
</div>
</div>
</blockquote></span>
Hello,<br>
<br>
If providers running large resolvers today are unwilling to use the
extra resources that dns-over-tls will require then maybe they
should stop running large resolvers.</div></blockquote><div><br></div><div><div class="gmail_default" style="font-size:small">Or maybe:</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">PEOPLE WHO WANT TO PROPOSE SECURITY STANDARDS FOR US TO USE SHOULD LISTEN TO US FIRST.</div><br></div><div><div class="gmail_default" style="font-size:small">Just a suggestion you know..</div></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="#FFFFFF" text="#000000"> This is no different from the
people who used to complain loudly that HTTPS will never work large
scale. </div></blockquote><div><br></div><div><div class="gmail_default" style="font-size:small">Actually no it is not. I never argued that HTTPS would not scale. I did point out that certain aspects of PKIX would not scale, CRLs for example. But nobody I know of ever argued TLS does not scale.</div><div class="gmail_default" style="font-size:small"><br></div></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="#FFFFFF" text="#000000">Of course it will, we might have to throw some more hardware
at it though, but more likely said hardware will have been naturally
replaced with newer hardware before we reach high adoption of
dns-over-tls. Adoption will not happen overnight.<br></div></blockquote><div><br></div><div><div class="gmail_default" style="font-size:small">No, it is not just a question of different hardware. It is a completely different model because a DNS over UDP resolver is entirely stateless and a DNS over TCP resolver is not.</div><br></div><div><div class="gmail_default" style="font-size:small">The group was told repeatedly that this was a show stopper and they ignored us. And now their work is being ignored. DPRIV was not a waste of time, it was much worse than that.</div><br></div><div><br></div></div></div></div>