Hello Yu Fu, I was not at the workshop. Warren already mentioned some issues. I second what he is saying in a stronger terms:
+ What you are proposing has no value for optimizing content delivery on the Internet. Physical location and the topology of content delivery do not match. Also, Anycast is used. It is NOT expensive. The reason why so many CDN operator use DNS based tools for content delivery is granularity of action. An edge compute system (i.e. what many CDNs are) can do all sorts of checks via DNS approach vs an Anycast approach. Also, the ECS security assessment if off. ECS from the resolver to the aDNS is sending a subnet configured by the operator of the rDNS. Once the connection to the client to the CDN is made, the CDN operator has the full details of the client. The term “leak client subnet to AUTH” is misleading from a “privacy risk.” Once the connection is made to my CDN, I know the IP specifics. + What you are proposing has great value for Law Enforcement and State Security. It would cut out the Operator as the middle man and eliminate the need for a court order to release details on suspects. This also is a tool for criminals. I can easily see bad guys who are dropping ransomware use this as a tool to say “pay up or I’ll SWAT your house” or move from E-mail exertion threats to phone based threats. Barry > On Mar 17, 2017, at 6:57 PM, Lanlan Pan <abby...@gmail.com> wrote: > > Hi all, > > In NDSS 2017 DNS Privacy Workshop, I presented a EIL option as an alternative > privacy improvement for ECS. > > The paper and slide are attached. Test code in github : > https://github.com/abbypan/dns_test_eil > > Any comments or suggestions will be appreciated. > > Regards. > > Yu Fu <f...@cnnic.cn>于2017年3月16日周四 上午10:37写道： > Hi all, > > We have submitted a new draft as draft-pan-dnsop-edns-isp-location-00. > This document is an improved solution for ECS(RFC7871), describes an EDNS ISP > Location (EIL) extension to address the privacy problem of ECS, find the > right balance between privacy improvement and user experience optimization. > EIL is defined to convey ISP location information that is relevant to the DNS > message. It will provide sufficient information for the Authoritative Server > to decide the response without guessing geolocation of the IP address. > > Your comments are appreciated. > > Thanks > Lanlan & Yu > > >-----Original Message----- > >From: internet-dra...@ietf.org [mailto:internet-dra...@ietf.org] > >Sent: Monday, March 13, 2017 6:07 PM > >To: Pan Lanlan; Lanlan Pan; Yu Fu > >Subject: New Version Notification for > >draft-pan-dnsop-edns-isp-location-00.txt > > > > > >A new version of I-D, draft-pan-dnsop-edns-isp-location-00.txt > >has been successfully submitted by Yu Fu and posted to the IETF repository. > > > >Name: draft-pan-dnsop-edns-isp-location > >Revision: 00 > >Title: ISP Location in DNS Queries > >Document date: 2017-03-13 > >Group: Individual Submission > >Pages: 14 > >URL: > >https://www.ietf.org/internet-drafts/draft-pan-dnsop-edns-isp-location-00.txt > >Status: > >https://datatracker.ietf.org/doc/draft-pan-dnsop-edns-isp-location/ > >Htmlized: > >https://tools.ietf.org/html/draft-pan-dnsop-edns-isp-location-00 > > > > > >Abstract: > > This document describes an Extension Mechanisms for DNS (EDNS0) > > option that is in active use to carry information about the network > > that originated a DNS query and the network for which the subsequent > > response can be cached. > > > > It is inspired by EDNS Client Subnet (ECS) with some privacy > > considerations, goals to reduce the "guess geolocation of client's > > IP" work on Authoritative Nameservers. > > > > > > The IETF Secretariat > > > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop > -- > 致礼 Best Regards > > 潘蓝兰 Pan Lanlan > <Slide_EIL_Dealing_with_the_Privacy_Problem_of_ECS_PanLanlan.pdf><Paper_EIL_Dealing_with_the_Privacy_Problem_of_ECS.pdf>_______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop _______________________________________________ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop
