Subject: Re: [v6ops] Last Call: <draft-ietf-v6ops-v6-aaaa-whitelisting-implications-08.txt> (Considerations for Transitioning Content to IPv6) to Informational RFC

From: "Livingood, Jason" <[email-masked]>
Date: Wed, 15 Feb 2012 15:52:16 +0000

To be more specific, at least section 5.5 ("it is unclear how implementers will judge when the network conditions will have changed sufficiently to justify turning off DNS Resolver Whitelisting and/or what the process and timing will be for discontinuing this practice") is now incorrect. It *is* clear, and it's what those implementers are doing as part of World IPv6 Launch.

Does that make more sense?

As the author, if it helps I plan to make the following change to Section 5.5 following the conclusion of IETF Last Call. I ran this by a few folks already and it seems broadly acceptable (have not heard from Lorenzo yet though).

Jason

CURRENT 5.5:
5.5.  Turning Off DNS Resolver Whitelisting

Domains that choose to implement DNS Resolver Whitelisting generally consider it to be a temporary measure. It is unclear how implementers will judge when the network conditions will have changed sufficiently to justify turning off DNS Resolver Whitelisting and/or what the process and timing will be for discontinuing this practice, though the extent of IPv6 deployment to end users in networks, the state of IPv6-related impairment, and the maturity of IPv6 operations are all clearly factors. However, implementers may wish to take into consideration that, as a practical matter, it will be impossible to get to a point where there are no longer any IPv6-related impairments; some reasonably small number of hosts will inevitably be left behind as end users elect not to upgrade them or as some hosts are incapable of being upgraded.

PROPOSED 5.5 (NEW TEXT IN ALL CAPS):
5.5.  Turning Off DNS Resolver Whitelisting

Domains that choose to implement DNS Resolver Whitelisting generally consider it to be a temporary measure. It is unclear how implementers will judge when the network conditions will have changed sufficiently to justify turning off DNS Resolver Whitelisting and/or what the process and timing will be for discontinuing this practice, though the extent of IPv6 deployment to end users in networks, the state of IPv6-related impairment, and the maturity of IPv6 operations are all clearly factors. However, SOME IMPLEMENTERS HAVE ANNOUNCED THAT THEY PLAN TO PERMANENTLY TURN OFF WHITELISTING BEGINNING ON WORLD IPV6 DAY IN JUNE 2012 [REFERENCE]. IN ANY CASE, implementers may wish to take into consideration that, as a practical matter, it will be impossible to get to a point where there are no longer any IPv6-related impairments; some reasonably small number of hosts will inevitably be left behind as end users elect not to upgrade them or as some hosts are incapable of being upgraded.

<eom>

---

From: Lorenzo Colitti <[email-masked]>
Date: Tue, 21 Feb 2012 16:54:32 +0900

On Thu, Feb 16, 2012 at 00:52, Livingood, Jason <
[email-masked]> wrote:

>      To be more specific, at least section 5.5 ("it is unclear
> how implementers will judge when the network conditions will have
> changed sufficiently to justify turning off DNS Resolver Whitelisting
> and/or what the process and timing will be for discontinuing this
> practice") is now incorrect. It *is* clear, and it's what those
> implementers are doing as part of World IPv6 Launch.
>
>  As the author, if it helps I plan to make the following change to
> Section 5.5 following the conclusion of IETF Last Call. I ran this by a few
> folks already and it seems broadly acceptable (have not heard from Lorenzo
> yet though).
>
>     Jason
>
>  *CURRENT 5.5: *
> Domains that choose to implement DNS Resolver Whitelisting generally
> consider it to be a temporary measure. It is unclear how implementers will
> judge when the network conditions will have changed sufficiently to justify
> turning off DNS Resolver Whitelisting and/or what the process and timing
> will be for discontinuing this practice, though the extent of IPv6
> deployment to end users in networks, the state of IPv6-related impairment,
> and the maturity of IPv6 operations are all clearly factors. However,
> implementers may wish to take into consideration that, as a practical
> matter, it will be impossible to get to a point where there are no longer
> any IPv6-related impairments; some reasonably small number of hosts will
> inevitably be left behind as end users elect not to upgrade them or as some
> hosts are incapable of being upgraded.
>  *PROPOSED 5.5 (NEW TEXT IN ALL CAPS):*
> Domains that choose to implement DNS Resolver Whitelisting generally
> consider it to be a temporary measure. It is unclear how implementers will
> judge when the network conditions will have changed sufficiently to justify
> turning off DNS Resolver Whitelisting and/or what the process and timing
> will be for discontinuing this practice, though the extent of IPv6
> deployment to end users in networks, the state of IPv6-related impairment,
> and the maturity of IPv6 operations are all clearly factors. However, *SOME
> IMPLEMENTERS HAVE ANNOUNCED THAT THEY PLAN TO PERMANENTLY TURN OFF
> WHITELISTING BEGINNING ON WORLD IPV6 DAY IN JUNE 2012 [REFERENCE]. IN ANY
> CASE*, implementers may wish to take into consideration that, as a
> practical matter, it will be impossible to get to a point where there are
> no longer any IPv6-related impairments; some reasonably small number of
> hosts will inevitably be left behind as end users elect not to upgrade them
> or as some hosts are incapable of being upgraded.
> <eom>
>

I think the suggested change does not go far enough. The
"high-service-level domains" that prompted this draft to be written, and
all the implementers I'm currently aware of, are decommissioning the
practice.

So the paragraph that states, "It is unclear how implementers will judge
when the network conditions will have changed sufficiently to justify
turning off DNS Resolver Whitelisting and/or what the process and timing
will be for discontinuing this practice" is still incorrect. Can you just
remove the paragraph and start the section with "Many implementers have
announced that they plan to permanently turn off whitelisting beginning
on..." ?

---

From: "Livingood, Jason" <[email-masked]>
Date: Tue, 21 Feb 2012 19:38:05 +0000

On 2/21/12 2:54 AM, "Lorenzo Colitti" <[email-masked]<mailto:[email-masked]>> wrote:
I think the suggested change does not go far enough. The "high-service-level domains" that prompted this draft to be written, and all the implementers I'm currently aware of, are decommissioning the practice.

So the paragraph that states, "It is unclear how implementers will judge when the network conditions will have changed sufficiently to justify turning off DNS Resolver Whitelisting and/or what the process and timing will be for discontinuing this practice" is still incorrect. Can you just remove the paragraph and start the section with "Many implementers have announced that they plan to permanently turn off whitelisting beginning on..." ?

I've changed it around to the following:

Domains that choose to implement DNS Resolver Whitelisting generally consider it to be a temporary measure. Many implementers have announced that they plan to permanently turn off DNS Resolver Whitelisting beginning on the date of the World IPv6 Launch, on June 6, 2012 <xref target='World IPv6 Launch'/>. For any implementers that do not turn off DNS Resolver Whitelisting at that time, it may be unclear how each and every one will judge when the network conditions to have changed sufficiently to justify turning off DNS Resolver Whitelisting. That being said, it is clear that the extent of IPv6 deployment to end users in networks, the state of IPv6-related impairment, and the maturity of IPv6 operations are all important factors. Any such implementers may wish to take into consideration that, as a practical matter, it will be impossible to get to a point where there are no longer any IPv6-related impairments; some reasonably small number of hosts will inevitably be left behind as end users elect not to upgrade them or as some hosts are incapable of being upgraded.

Thanks for your input,
Jason