All IP Addresses Are Equal? "dot-zero" Addresses Are Less Equal
• 4 min read
In theory, all IP addresses are the same, and you can allocate them at random without a problem. 192.168.1.2 is certainly not better or worse than 192.168.1.15, right? But, in practice, certain IP addresses are regarded as "special" by some implementations and do not yield the same user experience.…
"This was a precursor to DNS." whois, a precursor of the DNS??? "IDN TLD's (Internationalised Domain Names in Unicode) were defined much later on in RFC5890 in 2010." No, seven years before (RFC 3490) "Some TLDs even need a registrar to send an email to the TLD management organisation to create register a new domain. A human then has to manually edit the zone" There is nothing wrong with that, if that suits their constituency. The whole point of decentralisation (a strong feature of the DNS) is the ability to have different policies. "the amount of servers" It is an useful information, yes, but less important than the "strength" of the servers. bortzmeyer.fr has eight name servers but cannot be compared to .de (six servers) "It [ICANN] sadly can't enforce it on the legacy ones" See my point above about the freedom brought by decentralisation.
"the NixOS infrastructure relies heavily on GitHub" Why? NixOS needs to contact Github daily like ChromeOS needs to talk to Google? And if it is just to update packages, aren't they alternative sources?
“These are all good points. I especially like the idea of search suggestions. Another useful refinement would be to default search results newest first and oldest last. At the moment, documents and pages are mixed together and not ordered by date. This can make searching for the one document you want a real slog.”
As an example, searching "IP address" returns the RIPE NCC Activity Plan 2012 :-)
Many people visiting RIPE Web site have a RIPE Access account. Are there plans to use their search history to provide context, which helps a lot in Web search? (And also raises a lot of touchy privacy issues. IMHO, "anonymous" users, those not logged in RIPE Access must be excluded of this feature. But the privacy issue also holds for logged-in users.)
I'm not sure about the consequences. Does it mean that Afrinic could lose its accreditation?
I like the IP address 2610:a1:1072::1:42 since the name is an IDN. But, alas, no DNSSEC.
"They may also receive more spam and phishing e-mails, since modern e-mail security protocols rely on DNSSEC as well." I would like to see email servers use SPF, DKIM and DMARC records only if they have been validated with DNSSEC but I strongly doubt it is the case today.
Developping something new (no installed base) and mission-critical in C, today, is a bit strange. Why not using a safer language?
Nice and useful article. For OpenDNSSEC, the important parameter is named Jitter and is enabled by default. Check that you have something like "<Policy name="default">...<Signatures>... <Jitter>PT12H</Jitter>" It would be nice to document here how it is done for other signing programs.
Great survey, thanks for this work. Indeed, the variations in EDE are funny. For bogus.bortzmeyer.fr, Unbound (and 1.1.1.1) say "9 (DNSKEY Missing)", 9.9.9.9 say "10 (RRSIGs Missing)" and Knot-Resolver say "12 (NSEC Missing)"
Showing 56 comment(s)