Re: [DNSOP] another way to minimize ANY responses

2015-03-28 Thread Jan Včelák
On 26.3.2015 07:26, Paul Vixie wrote: Evan Hunt wrote: On Wed, Mar 25, 2015 at 05:24:32PM -0700, Paul Vixie wrote: ... that would be an overspecification. the spec should simply say any RRset, where the choice of which RRset is implementation-dependent. some might go for oldest; some

Re: [DNSOP] another way to minimize ANY responses

2015-03-26 Thread Paul Vixie
Ted Lemon wrote: On Mar 26, 2015, at 1:26 AM, Paul Vixie p...@redbarn.org wrote: you make an excellent point. so, the spec might ask for repeatability, but not specify how that's to be achieved. it's still an information leak since the preferred type may have timed out of the cache, in

Re: [DNSOP] another way to minimize ANY responses

2015-03-26 Thread Ted Lemon
On Mar 26, 2015, at 4:28 PM, Paul Vixie p...@redbarn.org wrote: what we should say in the spec is determinative, and non-information-leaking, and let implementers scratch their heads about how to do that. we should not try to invent it here, or specify it in an ietf document. I don't see

Re: [DNSOP] another way to minimize ANY responses

2015-03-26 Thread Evan Hunt
On Thu, Mar 26, 2015 at 06:33:18PM -0500, Ted Lemon wrote: what we should say in the spec is determinative, and non-information-leaking, and let implementers scratch their heads about how to do that. we should not try to invent it here, or specify it in an ietf document. I don't see how

[DNSOP] another way to minimize ANY responses

2015-03-25 Thread Evan Hunt
Last night the dumb-idea fairy visited me as I was falling asleep, and suggested that another way to reduce the impact of ANY queries would be to pick *one* rrset and return just that. (Probably the numerically smallest rrtype present at the node, plus RRSIGs if any.) This avoids poisoning caches