S. Bortzmeyer ✅ utilise mastodon.gougere.fr. Vous pouvez læ suivre et interagir si vous possédez un compte quelque part dans le "fediverse". Si ce n’est pas le cas, vous pouvez en créer un ici.
S. Bortzmeyer ✅ @bortzmeyer

There are three categories of broken resolvers, regarding ATR: "can't receive fragments", "can't retry with TCP" and those who have both curses. What are the sizes of these categories?

S. Bortzmeyer ✅ @bortzmeyer

Apparently, takes place in a very dangerous city: twitter.com/ripemeeting/status

S. Bortzmeyer ✅ @bortzmeyer

Working Group, second session, at DNS privacy, DNS over TLS, etc.

S. Bortzmeyer ✅ @bortzmeyer

Colin Petrie about the deployment of the DNS-over-TLS resolver at the meeting

Uses Knot Resolver with 10 lines of a plugin to improve DNS64. (Because BIND still has no QNAME minimisation and no TLS ; Unbound has almost everything but no address-specific DNS64)

S. Bortzmeyer ✅ @bortzmeyer

Anand Buddhev on the RIPE-NCC services. New K-root instances in Lyon (second one in France), Duchanbe, Panama...

S. Bortzmeyer ✅ @bortzmeyer

zone transfers of RIPE-NCC services are now exclusively on (just one IPv4 fallback remaining, for Afrinic).

S. Bortzmeyer ✅ @bortzmeyer

config (zones under ip6.arpa and in-addr.arpa) is checked with zonemaster.ripe.net/ Soon to be integrated under RIPEstat.

S. Bortzmeyer ✅ @bortzmeyer

Victoria Risk on stage about a survey done by ISC.

S. Bortzmeyer ✅ @bortzmeyer

"Business benefits and costs of for operators". The US approach to privacy online... Very oriented questions such as "do you think [ ] is another example of over-engineering?"

S. Bortzmeyer ✅ @bortzmeyer

Around 100 answers, and results are displayed with four digits...

S. Bortzmeyer ✅ @bortzmeyer

. @zorun on stage "Large-scale over - or " Practical or not?

Ping @quota_atypique

S. Bortzmeyer ✅ @bortzmeyer

"What is every home router would have a persistent TCP connection with the ISP resolver?" Is it realistic? Could we switch off UDP?

S. Bortzmeyer ✅ @bortzmeyer

Meausrement: queries generated with a custom C progrem + running on Grid5000

At the beginning, the resolver can answer all queries then sustain a fixed rate, even when the queries number increases.

S. Bortzmeyer ✅ @bortzmeyer

UDP still 4x better for high query handling, except when there are few TCP clients.

S. Bortzmeyer ✅ @bortzmeyer

Best test :-) 6.5 M TCP simultaneous connections to the resolver (Linux and Unbound still work).

S. Bortzmeyer ✅ @bortzmeyer

Executive summary: DNS over TCP works, and scales. Just buy some hardware.

S. Bortzmeyer ✅ @bortzmeyer

"Default value was 10, I've set it to 7 millions."

S. Bortzmeyer ✅ @bortzmeyer

Another over TCP+TLS benchmark, by Sara Dickinson.

S. Bortzmeyer ✅ @bortzmeyer

Willem Toroop "Who Needs Reasons, When You've Got Heroes?"

Do we need when we have ? (Executive summary: yes, for instance for redirections - SRV or MX, where TLS does not provide end-to-end security. And of course the biggest flaw of TLS is the CAs, something that DNSSEC+DANE solves.)

· Web · 0 · 0
mastodon.gougere.fr propulsé par Mastodon