Subject: [v6ops] v6-aaaa-whitelisting-implications -- Recommended Practice?

From: "Livingood, Jason" <[email-masked]>
Date: Tue, 25 Jan 2011 21:19:01 +0000

(This is the final specific request for feedback on this draft.)

re http://www.ietf.org/id/draft-ietf-v6ops-v6-aaaa-whitelisting-implications-01.tx<http://www.ietf.org/id/draft-ietf-v6ops-v6-aaaa-whitelisting-implications-01.txt>

One question raised at the last IETF meeting was whether this draft should make some statement at the end of the I-D saying whether or not this is a recommended practice. Alternatively, this can be done as a separate document. However, if the WG believes it useful to make a statement on this practice, I think it simpler and more expedient to add it to this document.

If the WG agrees, then I propose to add a section saying something along the lines of:

Section Name: Is DNS Whitelisting a Recommended Practice?
or
Section Name: Is DNS Whitelisting a Best Practice?

Section Content: Opinions in the Internet community concerning whether or not DNS whitelisting is a recommended practice are understandably quite varied. However, there is clear consensus that DNS whitelisting is at best a useful temporary measure which a domain may choose to pursue as they prepare for the transition to IPv6. In particular, major domains such as those operated by Google view DNS whitelisting as one of the few practical and low risk approaches enabling them to prepare for the transition to IPv6. Thus, DNS whitelisting is not a recommended practice over the long-term. In addition, DNS whitelisting should be avoided wherever possible in the short-term and its use is discouraged. Nevertheless, major domains may find DNS whitelisting a beneficial temporary tactic in their transition to IPv6. Such temporary use during the transition to IPv6 is broadly accepted within the community, so long as it does not become a long-term practice over a period of a year or more past the point when IANA's IPv4 address pool is depleted.

-- JL

---

From: "George, Wes E [NTK]" <[email-masked]>
Date: Wed, 26 Jan 2011 15:55:01 +0000

I’ll give this a better review shortly, but wanted to respond to this one
specifically. 
I think that overall your proposed recommendation text is a good idea.
However, personally I’d remove the reference to Google. As much as I
appreciate the info that Lorenzo and Erik and company have provided and the
work that they’ve done, let’s keep this company agnostic – that’s more
appropriate for an IETF draft, and less likely to skew opinions in one
direction or the other.

You might also want to at least casually mention world IPv6 day as a way to
determine if whitelisting is actually necessary even in the short term.
Since this draft will have likely gone to WGLC before that happens, at least
a passing reference to it would allow you to perhaps nudge the reader into
looking for the information that will become available once everyone
analyzes the results of enabling unfettered IPv6 access to their content for
the day.

Thanks, 
Wes George

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Livingood, Jason
Sent: Tuesday, January 25, 2011 4:19 PM
To: [email-masked]
Subject: [v6ops] v6-aaaa-whitelisting-implications -- Recommended Practice?

re http://www.ietf.org/id/draft-ietf-v6ops-v6-aaaa-whitelisting-implications
-01.tx

One question raised at the last IETF meeting was whether this draft should
make some statement at the end of the I-D saying whether or not this is a
recommended practice. Alternatively, this can be done as a separate
document. However, if the WG believes it useful to make a statement on this
practice, I think it simpler and more expedient to add it to this document.

If the WG agrees, then I propose to add a section saying something along the
lines of:

Section Content: Opinions in the Internet community concerning whether or
not DNS whitelisting is a recommended practice are understandably quite
varied. However, there is clear consensus that DNS whitelisting is at best a
useful temporary measure which a domain may choose to pursue as they prepare
for the transition to IPv6. In particular, major domains such as those
operated by Google view DNS whitelisting as one of the few practical and low
risk approaches enabling them to prepare for the transition to IPv6. Thus,
DNS whitelisting is not a recommended practice over the long-term. In
addition, DNS whitelisting should be avoided wherever possible in the
short-term and its use is discouraged. Nevertheless, major domains may find
DNS whitelisting a beneficial temporary tactic in their transition to IPv6.
Such temporary use during the transition to IPv6 is broadly accepted within
the community, so long as it does not become a long-term practice over a
period of a year or more past the point when IANA's IPv4 address pool is
depleted.

-- JL

---

From: Erik Kline <[email-masked]>
Date: Thu, 27 Jan 2011 02:00:38 +0900

You might also want to explain where the SWAG about "one year from
IANA runout" comes from.  It appears a little arbitrary.  Remember:
there's 15 years of failed transition to overcome.  It will take as
long as it takes.

On 27 January 2011 00:55, George, Wes E [NTK]
<[email-masked]> wrote:
> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops
>
>

---

From: Victor Kuarsingh <[email-masked]>
Date: Wed, 26 Jan 2011 13:02:56 -0500

Jason,

I would agree with Wes on this, perhaps we can we can remove Google as a
reference and make it generic.  I do however like the the overall text and
direction of the new section.

Regards,

Victor K

On 26/01/11 10:55 AM, "George, Wes E [NTK]" <[email-masked]>
wrote:

>I?ll give this a better review shortly, but wanted to respond to this one
>specifically. 
>However, personally I?d remove the reference to Google. As much as I
>work that they?ve done, let?s keep this company agnostic ? that?s more
>re 
>http://www.ietf.org/id/draft-ietf-v6ops-v6-aaaa-whitelisting-implications
>-01.tx
>

---

From: Martin Millnert <[email-masked]>
Date: Wed, 26 Jan 2011 13:33:06 -0500

> direction of the new section.

I agree with the above.  The Comcast vs Google scent of it right now
makes it look, to me at least, a little like a blog post from
comcast.com that found its way onto www.ietf.org.  I believe the text
will work better in generic form.

Something doesn't feel right with this sentence:
   'As a result, it is worth considering that IPv4-related impairment
    could exceed that of IPv6-related impairment and that such
    IPv4-related impairment may have simply been accepted as "background
    noise" on the Internet for a variety of reasons.'

I think it's the "could" there.  It comes across (to me) as apparent
guesswork, which would do well with more [citations] and references, and
pointers/suggestions to further work/research, to find out if this is
the case or not. IMHO.  
  Because essentially, this relates to the core motivation behind doing
a AAAA whitelist in the first place (introducing AAAA records leading to
fewer total users being able to successfully reach a service than not
doing it), and would do well with basically an answer to whether or not
this is the case.

Regards,
Martin

---

From: "Livingood, Jason" <[email-masked]>
Date: Thu, 27 Jan 2011 01:18:45 +0000

However, personally I?d remove the reference to Google. As much as I appreciate the info that Lorenzo and Erik and company have provided and the work that they?ve done, let?s keep this company agnostic ? that?s more appropriate for an IETF draft, and less likely to skew opinions in one direction or the other.

That is a fair point. I was actually trying to react to feedback from Erik himself on 10/1/2010 to the list where I perceived he wanted to have the numerous vague "some parties" made more specific. I want to also be clear that I went to pains in my previous drafts and in my presentations to not cite specific company names, as this is an industry issue and not a company issue. I will carefully go back through my –01 version and change these references back. I will also change this addition as well.  (See below)

Good suggestion. Here is the new text:

            Opinions in the Internet community concerning whether or not DNS whitelisting is a recommended practice are understandably quite varied. However, there is clear consensus that DNS whitelisting is at best a useful temporary measure which a domain may choose to pursue as they prepare for the transition to IPv6. In particular, major domains view DNS whitelisting as one of the few practical and low risk approaches enabling them to prepare for the transition to IPv6. Thus, DNS whitelisting is not a recommended practice over the long-term. In addition, DNS whitelisting should be avoided wherever possible in the short-term and its use is discouraged. Nevertheless, major domains may find DNS whitelisting a beneficial temporary tactic in their transition to IPv6. Such temporary use during the transition to IPv6 is broadly accepted within the community, so long as it does not become a long-term practice.

            Finally, World IPv6 Day, which is sponsored by the Internet Society [ADD REFERENCE] and is scheduled to occur on June 8, 2011, will be an opportunity for domains to add AAAA resource records to the DNS without using DNS whitelisting. As a result, this is likely an excellent opportunity for domains to evaluate the utility or necessity of DNS whitelisting, even in the short-term.

//

---

From: "Livingood, Jason" <[email-masked]>
Date: Thu, 27 Jan 2011 01:18:40 +0000

>there's 15 years of failed transition to overcome.  It will take as

It was completely arbitrary. I was trying to anticipate a question about
how long this should be the case (if I did not use a timeframe), and so
put in a near-term date in order to provoke discussion, which seems to
have been a successful tactic. ;-)

Anyway, how about the following, with no timeframe specified?

"Such temporary use during the transition to IPv6 is broadly accepted
within the community, so long as it does not become a long-term practice
[STRIKE] over a period of a year or more past the point when IANA's IPv4
address pool is depleted[/STRIKE]."

Alternatively, I could say "...over a reasonable timeframe."

Thoughts?

Regards
Jason

---

From: "Livingood, Jason" <[email-masked]>
Date: Thu, 27 Jan 2011 01:18:48 +0000

Done. Thanks, Victor. (And see suggested text in my last email to Wes and the list.)

Jason

On 1/26/11 1:02 PM, "Victor Kuarsingh" <[email-masked]<mailto:[email-masked]>> wrote:

Jason,

Regards,

Victor K

---

From: "Livingood, Jason" <[email-masked]>
Date: Thu, 27 Jan 2011 01:18:50 +0000

Martin – Please see inline below.

Thank you,
- Jason

On 1/26/11 1:33 PM, "Martin Millnert" <[email-masked]<mailto:[email-masked]>> wrote:

Please see my note to Wes. This was in no way, shape, or form my intention. In fact, I was actually trying to be responsive to some old feedback from Erik himself, and perhaps did so a bit too enthusiastically or inelegantly. So it will be made more generic (see my post a moment ago to the list with the new text). I also want to make 110% clear that I am very complimentary of the work that Google has done on IPv6 and agree that, for them, whitelisting was a logical short-term tactic. My interest with this I-D is to focus on the long-term of course. :-)

Fair point. It is speculative on my part (and as discussed with other ISPs / operators). Given that, is it best discussed elsewhere in the document as speculative or removed or something else in your view? Open to suggestions on how to resolve this.

Thanks
Jason

Regards,
Martin

---

From: Martin Millnert <[email-masked]>
Date: Wed, 26 Jan 2011 21:46:42 -0500

Jason,

On Thu, 2011-01-27 at 01:18 +0000, Livingood, Jason wrote:
> Fair point. It is speculative on my part (and as discussed with other
> ISPs / operators). Given that, is it best discussed elsewhere in the
> document as speculative or removed or something else in your view?
> Open to suggestions on how to resolve this. 
> 

I don't think I'm the best person on the plane to answer that. :)

My 2 cents are, I guess, that the measurements methods deployed, and
more specifically the analysis performed, by participants of the World
IPv6 day should be able to answer this for us "once and for all^Wmost"

So to the participants of World IPv6 day, it would obviously be
extremely valuable for the community if you could:
  1)  Be as open as possible about how you measure the brokenness, state
and explain your assumptions and (if possible), verify/refute as many of
them as possible  (I too am interested in the answer to the question on
how many % of Internet users have broken v4 :) )
  2) Publish the brokenness seen.
  2) Save logs or similar in ways that data can be compared using the
same methods (it wouldn't hurt with a ~simplified w3c-log-parser fed
with logs in an appropriate manner, released to the community), so that
there is an at least pseudo-standardized way for the industry to measure
this, as it conceivably vary between geographical areas/markets, etc.
(comparability / "reproducibility" is quite central to scientific work,
right?)

I believe the industry share an interest in getting the transition off
its wheels, so I hope something along the lines of what I suggest above
can be done. It would be awesome, simply, IMO.

Now with that suggestion out there, I think it is a valid and fair
question to raise in the document, but it should perhaps be explicitly
clear that it is speculative to minimize the % of careless readers who
mistake it for fact?  (Make no mistake: I like and want IPv6 deployed!)
  Not sure if a specific section on ipv6-% brokeness measurement methods
is appropriate, as you say it might be better discussed elsewhere (and
instead referenced).  [While by no means claiming to be any kind of
all-knower on the subject, ] I think the goog-v6-quadrett's paper,
"Evaluating IPv6 adoption in the Internet"
( http://www.google.com/research/pubs/pub36240.html ) is a good
reference to begin with.

HTH,
Cheers,
Martin

---

From: Martin Millnert <[email-masked]>
Date: Wed, 26 Jan 2011 21:52:38 -0500

*chuckle*

On Wed, 2011-01-26 at 21:46 -0500, Martin Millnert wrote:
> getting the transition off its wheels [...]

[...] up in the air, through the building storm of v4-clouds, into the
clear blue v6 skies above... ;)

Cheers,
Martin

---

From: "Livingood, Jason" <[email-masked]>
Date: Mon, 31 Jan 2011 19:13:47 +0000

Thanks for the feedback, and for the reference suggested at the end. I'll
add that to the -02 update, as well ensure that any speculation is
explicitly described as such.

BTW, based on your email, sounds like good input for an "Objectives for
World IPv6 Day" document!

Regards
Jason