Re: [DNSOP] Definitions of foo-centric

Edward Lewis <edward.lewis@icann.org> Wed, 25 February 2015 15:38 UTC

From: Edward Lewis <edward.lewis@icann.org>
To: "dnsop@ietf.org" <dnsop@ietf.org>
Thread-Topic: [DNSOP] Definitions of foo-centric
Thread-Index: AQHQUNlPtglP9kT6PEG6UKGl1dxh3Z0Bm3CAgAABcwCAAE9GAP//xqqA
Date: Wed, 25 Feb 2015 15:38:39 +0000
Message-ID: <D1135363.9428%edward.lewis@icann.org>
References: <20150225085816.GB24102@nic.fr> <21E596E7-E156-446F-9B80-2AD9B7F24A0A@nominet.org.uk> <20150225092003.GA30956@nic.fr> <20150225.150348.396032001.he@uninett.no>
In-Reply-To: <20150225.150348.396032001.he@uninett.no>
Accept-Language: en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/14.4.8.150116
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha1"; boundary="B_3507705515_13567508"
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/dnsop/6JHfMEJhg4Q9oJD2f26tCvMpVuI>
Subject: Re: [DNSOP] Definitions of foo-centric
Precedence: list

On 2/25/15, 9:03, "Havard Eidnes" <he@uninett.no> wrote:

>Hmm.
>
>Firstly, isn't this "child-centric resolver" / "parent-centric
>resolver" simply an euphemism papering over the more distinct
>"correctly" and "wrongly" implemented resolver?

That’s my thought exactly.  (But that doesn’t mean the terms needn’t be
given definitions.)

>A correctly
>implemented resolver implements the DNS authority model, and to do
>that requires that the resolver replaces non-authoritative cached data
>with more authoritative data whenever it is obtained.

To put a sharper point on this, this is documented as “trustworthiness” in
“Clarifications to the DNS Specification” [RFC 2181] inside section 5.4.1
on “Ranking Data."

I’ve seen a case of a resolver that favored the parent NS set over a child
NS set (and glue), which led to a cache poisoning event.  A delegation
that was transferred forgot to remove the glue records in the TLD, an
apparently disgruntled employee aware of this left the company, registered
a new domain that made use of the glue record.  (I’m omitting details to
make this quick.)  The net result is that the caches following this model
quickly favored the stale glue over the fresh authoritative answer,
victimizing the registrant.

Nevertheless, giving the practice a name will make it easier to explain to
someone why it’s a bad idea.

>  The perhaps
>most prominent example of non-authoritative data is the copy of the NS
>RRset from the child zone which exists in the parent zone.

And/or the glue.

>>Phantom domain: ...
>
>Again, I'd simply call a resolver allowing this situation to persist
>to be "wrong/buggy".

In operations, you have to deal with the bad a lot - in fact, by the very
nature of the bad being bad, you deal more with the bad than the good.
(The good is hidden under automation.)  Giving names to the bad is very
helpful for that reason.  (Root cause voice call recordings, staff
turnover, these are places where common terminology is helpful regardless
whether the term describes something good or something bad.)

Attachment: smime.p7s

[DNSOP] Definitions of foo-centric Paul Hoffman
Re: [DNSOP] Definitions of foo-centric Mark Andrews
Re: [DNSOP] Definitions of foo-centric Edward Lewis
Re: [DNSOP] Definitions of foo-centric Edward Lewis
Re: [DNSOP] Definitions of foo-centric Mark Andrews
Re: [DNSOP] Definitions of foo-centric Stephane Bortzmeyer
Re: [DNSOP] Definitions of foo-centric Stephane Bortzmeyer
Re: [DNSOP] Definitions of foo-centric Ray Bellis
Re: [DNSOP] {Sender Address Possibly Forged} Re: … Ray Bellis
Re: [DNSOP] Definitions of foo-centric Stephane Bortzmeyer
Re: [DNSOP] Definitions of foo-centric Tony Finch
Re: [DNSOP] {Sender Address Possibly Forged} Re: … Edward Lewis
Re: [DNSOP] Definitions of foo-centric Olafur Gudmundsson
Re: [DNSOP] Definitions of foo-centric Havard Eidnes
Re: [DNSOP] Definitions of foo-centric Edward Lewis
Re: [DNSOP] Definitions of foo-centric Stephane Bortzmeyer
Re: [DNSOP] Definitions of foo-centric Havard Eidnes
Re: [DNSOP] Definitions of foo-centric Mark Andrews
Re: [DNSOP] Definitions of foo-centric Mark Andrews
Re: [DNSOP] Definitions of foo-centric Havard Eidnes
Re: [DNSOP] Definitions of foo-centric Ray Bellis

Re: [DNSOP] Definitions of foo-centric

Attachment: smime.p7s