Subject: Re: Proposal to fix NSEC

From: Alex Bligh <[email-masked]>
Date: Fri, 21 May 2004 13:26:56 +0100

Paul Vixie wrote:
> i agree with ted.  dns is a publication mechanism, and if you don't want
> something published you probably shouldn't be putting it into dns at all.
> and, if your only way to keep whois safe is to hide its index, then you
> have probably got other troubles.  parts of the "index" are exposed every
> day in server logs or in-addr.arpa/ip6.arpa walks.

With respect Paul, I think you are handwaving. The wish to have data
published in response to a specific query is not necessarily commensurate
with the wish to have it published under any circumstances whatsoever.
Many people write emails, and thus publish their email addresses. This
does not necessarily mean they want them compiled into lists of email
addresses, associated with other data, and sold as a database.

Current DNS protocol and servers allow a granularity of policy decision on
what gets published, when, and to whom. The currently proposals for DNSSEC
would remove the ability of DNSSEC users to take advantage of that
granularity (i.e. they reduce current functionality that is in use, and
wanted, at least by a significant subset of users)

Whether or not making use of a function that prevents publication of entire
zone files is desirable is a policy question, and not a protocol question.
However, given that the current DNSSEC proposals remove functionality that
is in use (prevention of publication of entire zone files), it's worth a
few of lines describing why removal of that functionality is important.

The problem has been described as simply a legal problem. Whilst indeed
there are EU law considerations, I am aware that the IETF's approach to
legal problems in the past has often been "fix the law"; and indeed, often
rightly so.

However, the problem goes beyond that. In this instance, in my opinion, the
law is merely a symptom of what people want. RFC1591 talks about the local
internet community. In the UK, and the rest of the EU, people are perhaps
more sensitive to privacy issues than they seem to be in the US. Hence, if
you sign up for a phone here, you have the (legal) right to have your
number listed in directory enquiries, but not to have your name included in
a database of names and phone numbers sold to others by the phone company,
and indeed the phone company has an obligation not to distribute the data
for purposes other than those for which it collected it. That legal right
is based on widely held beliefs about privacy. I picked the phone book
example because it's the closest I could find to DNS. And there is a
strongly held local internet community (in an RFC1591 sense) views that
such privacy should continue to apply. See for instance item 8 at:
  http://tinyurl.com/2l59u

I'm posting this rest of this message in a personal capacity, but as a
director of Nominet since it started, and a member of its policy advisory
board, I'll submit the following: the issue of zonefile protection has been
a very significant issue for stakeholders, and an issue on which we
(Nominet) have spent a considerable amount of time and money. And the
reason we've done this is not for narrow commercial advantage, but because
over the past years we've come to realize it's an important matter to the
local community. That's why we are concerned about protocol changes which
remove our ability to do protect zonefiles. My understanding is that
several other ccTLDs have the same concerns for similar reason.

Alex

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Badami <[email-masked]>
Date: Fri, 21 May 2004 14:15:20 +0100

>>>>> "Alex" == Alex Bligh <[email-masked]> writes:

    Alex> See for instance item 8 at: http://tinyurl.com/2l59u

And although Alex doesn't state this explicitly, the PAB minutes
available at the URL above seem to indicate that it is Nominet's
stated policy that zone file protection takes precedence over DNSSEC
deployment.

Which means for me (as an end user) that I won't be getting a secure
delegation of my .org.uk domain in the foreseeable future...

	   -roy

---

From: Alex Bligh <[email-masked]>
Date: Fri, 21 May 2004 14:44:17 +0100

> stated policy that zone file protection takes precedence over DNSSEC

We are constrained by what is legal, and guided by what our stakeholders
want. Enumerable zonefiles seem to have problems on both grounds.
My assessment is that there is (perhaps wrongly) rather more stakeholder
interest in privacy aspects than DNSsec (to which the normal answer
is "what?").

> delegation of my .org.uk domain in the foreseeable future...

This would depend in part on whether or not the problem is fixable or
workroundable via NSEC2 or some other way. Nominet would love to deploy it,
indeed it's been a strategic objective for over a year:
 http://tinyurl.com/2mk8f

Alex

---

From: Jim Reid <[email-masked]>
Date: Fri, 21 May 2004 15:11:37 +0100

>>>>> "Alex" == Alex Bligh <[email-masked]> writes:

This discussion is getting off-topic for this list which is supposed
to be about DNS protocol issues.

    Alex> With respect Paul, I think you are handwaving. The wish to
    Alex> have data published in response to a specific query is not
    Alex> necessarily commensurate with the wish to have it published
    Alex> under any circumstances whatsoever.  Many people write
    Alex> emails, and thus publish their email addresses. This does
    Alex> not necessarily mean they want them compiled into lists of
    Alex> email addresses, associated with other data, and sold as a
    Alex> database.

With all respect, I think this is hand waving too. Anyone with half a
clue will realise that by publishing their email address, they have no
control over what others may do with that data. Even when there are
supposedly the safeguards of data protection and anti-spam legislation.
For instance, by responding to this mail I accept the risk that
someone may harvest my address and send me spam even though I don't
want them to do that. Going back to DNS, I doubt very much if anyone
registering a domain name in a TLD cares or even realises that the
whole TLD zone file might be available. Or not as the case may be.
They just want their domain name visible through the DNS protocol.

    Alex> However, the problem goes beyond that. In this instance, in
    Alex> my opinion, the law is merely a symptom of what people want.

A discussion about "what people want" is well off-topic for this list.

    Alex> That's why we are concerned about protocol
    Alex> changes which remove our ability to do protect zonefiles.

It's still not clear to me what those concerns actually are and why
traversing the zone file is such a worry. Maybe I'm just being more
stupid than usual. As Paul has pointed out, there are plenty of ways
of enumerating a TLD zone today, with or without some flavour of
DNSSEC, irrespective of whether zone transfers are possible. If the
concern is NSEC records makes whois disclosure easier, then fix whois:
that's where the personal data lives after all. That data isn't in the
DNS. If it's about copyright, the copyright holder's rights should
still apply. Just like record companies sell copyrighted material on
(copy-protected) CDs but are able to pursue anyone who illegally
duplicates that material.

In some respects, zone traversal might actually alleviate the concerns
of these TLDs. Suppose you put a delegation into the zone that doesn't
have a genuine whois entry or a registrar or end user. The delegated
zone has no web server or MX records so nothing other than the domain
name itself is ever published. And that's found by walking the NSEC
list. If this name pops up in your query logs, voila! The honey trap
has found someone who's up to no good and you can set your lawyers on
them.

---

From: Alex Bligh <[email-masked]>
Date: Fri, 21 May 2004 16:22:06 +0100

Jim,

--On 21 May 2004 15:11 +0100 Jim Reid <[email-masked]> wrote:

(with apologies for reodering)

> to be about DNS protocol issues.
...
> A discussion about "what people want" is well off-topic for this list.

The protocol issue at stake is the removal of a piece of functionality
(granularity in zonefile protection). I think you agree that much. Whether
or not removal of functionality is acceptable depends on the value of that
functionality. AIUI Your view (and Paul's) is that it is valueless, and
thus removing it doesn't matter. I find it hard to see how you can on the
one hand assert this, and on the other describe as off-topic those
attempting to explain to you the value they have. Functionality does not
exist in an abstract space. What people want from their protocols (what is
useful vs. useless functionality) surely drives what gets included and what
doesn't.

> want them to do that.

Yep. But I am guessing you wouldn't want psg.com as list operator
to be complicit in it.

> Going back to DNS, I doubt very much if anyone
> whole TLD zone file might be available.

That isn't what they tell us.

> DNSSEC, irrespective of whether zone transfers are possible.

Paul has asserted out that a third party can make a partial, non-shapshot,
list of TLD zonefile contents over months. I don't dispute that. If
I spent three months on it, I bet I could work out a way to steal
a substantial proportion of your possessions. That doesn't make it
either right, or legal, or desirable, for your landlord to decide that
there is thus little point in putting a lock on your door. Despite
the fact that "bad things happen", the zonefile operator does not need
to be complicit in it or make it easier.

> If the
> that's where the personal data lives after all.

> If it's about copyright, the copyright holder's rights should
> still apply.

IANAL but the difference AIUI is that under the proposed protocol, one
would be publishing the compilation (in which separate copyright exists)
oneself.

However, I don't want to reduce this to a legal argument as for me, at
least, that's only one portion of the argument. The fact is (see
references) stateholders in certain ccTLDs do not wish the zonefile to be
published by the ccTLD operator.

> honey trap

Easy enough without DNSSEC.

Alex