RIPE Labs

IMO it's easy to have an opinion on either side of the fence - based on what you've done (or not done). Cloudflare, for example, committed to RPKI very publicly in 2018 [0]. This article, by ThousandEyes, does a nice job of visualizing the problem [1], published in July of 2019. As I read the parent article to this thread it strikes me as a bit defensive - which smells of a lie of omission (not exactly the whole truth, but conveniently cherry picked). They do very little in the article to state two missing arguments: 1) their timeline to implement RPKI (they only state: "At this stage we are looking in to this. We want to be sure we take the right approach, some of which will involved asking our transit providers what they are doing about it.") and 2) the rationale for not being further along of protecting customers with regard to the topic of RPKI.

They also grab Coronovirus as a rationale for doing nothing right now:

"Since this has now happened a few times, we felt it worth giving some more information that may be useful to customers and others who've seen these tweets (either directed at us, or at other ISPs), explaining a bit about what BGP is and how RPKI can extend it, and also our feelings about Cloudflare attempting to build support in this manner, especially now, during the Corona Virus situation."

If you look at this NANOG thread [2] nobody is complaining about ATT announcing they have implemented RPKI. So is there a negative downside? No. Has CloudFlare…

The fact that it can be trivially blocked by anyone on the network path does not make it "much better".

Of course anyone on the "network path" can block almost any protocol; DoT isn’t unique in that regard.

The concern is many large businesses block port 853 but that's because prior to the development of DoT, there was no reason for IT departments to configure firewalls to enable it. Most organizations only have a handful of ports available, including 443, which is what HTTPS uses and therefore DoH works as a result.

I've been running DNS over TLS using the Unbound [1] resolver for my home LAN on a spare laptop for a few weeks now and it’s been great.

Given the privacy trade-offs between privacy and security, many IT departments would opt to make port 853 available for DoT rather than increasing the ability for their users to be tracked.

As I mentioned elsewhere in this thread, the article Centralised DoH is bad for Privacy, in 2019 and beyond [2] clearly describes the issues with DoH:

DNS over HTTPS opens up DNS to all the tracking possibilities present in HTTPS and TLS. As it stands, DNS over UDP almost always gets some free privacy by mixing all devices on a network together – an outside snooper sees a stream of queries coming from a household, a coffeeshop or even an entire office building, with no way to tie a query to any specific device or user. Such mixing of queries provides an imperfect but useful modicum of privacy.

DNS over HTTPS however neatly separates…

> VPN providers shouldn't be allowed to claim that VPNs protect you from malware or that they do a better job at protecting data in transit than vanilla SSL.

That's... not exactly true, given what definition of "protecting" you follow. VPNs definitely can protect against some forms of attacks that plain old HTTPS can't:

- malicious QoS/routing policies at the ISP (or a public WiFi operator) that, say, down-prioritise or throttle stuff like YouTube, or route it through backed-up links (German Telekom was infamous for bad peering towards high traffic sites including Youtube [1] or where they all but extorted money from "double paid traffic" from server owners [2])

- ISPs hijacking DNS for a myriad of reasons (NXDOMAIN ad-hijacks, government-ordered censorship, thinking they can offer "improved" DNS service by simply answering all requests going out on UDP53 with their own servers [3], ...)

- ISPs and WiFi operators listening on DNS requests or doing traffic analysis to sell to advertisers [4]

- other devices on the network attacking your machine (e.g. in a coworking space) - proper VPN software like Cisco will "cut off" all communication with the outside with the exception of the remote VPN endpoint IP and DHCP.

The part about malware is more sketchy, but in case the VPN operator uses something like PiHole and other shared lists of malware domains and IPs to blacklist common-known vectors and C&C sites, it is a valid statement.

[1]…

I admit vague ignorance here. The article links to two test sites, https://www.dns-oarc.net/oarc/services/replysizetest and http://labs.ripe.net/content/testing-your-resolver-dns-reply-size-issues

The dig test on the first site times out. The second site has a downloadable java test which I didn't use. Instead I adapted the first site's dig test to the second site:

$ dig +short test.rs.ripe.net txt
rst.x477.rs.ripe.net.
rst.x481.x477.rs.ripe.net.
rst.x486.x481.x477.rs.ripe.net.
"68.87.85.100 DNS reply size limit is at least 486 bytes"
"68.87.85.100 lacks EDNS, defaults to 512"
"68.87.85.100 summary bs=512,rs=486,edns=0,do=0"

68.87.85.100 is comcast, my ISP.

The first test site, dns-oarc.net, shows expected results (which I don't have here), and for the above error it says I should "investigate further."

I'm running ubuntu 10.04 LTS (uptime about 10 hours :) on a laptop behind my WRT54GL and did nothing specific to configure the network.

$ cat /etc/resolv.conf
# Generated by NetworkManager
domain hsd1.co.comcast.net
search hsd1.co.comcast.net
nameserver 68.87.85.102
nameserver 68.87.69.150

The basic question is, should I be looking at my router's configuration (WRT54GL) or should I be asking comcast what's up?

And what should I be reading to understand this issue. I'm afraid of traveling down a rabbit hole following semi-random RFCs.

> My company has just turned off all ip6 connectivity for its corporate laptops because it’s considered a security risk.

If your corporate laptops are running Windows, then you're going against the officially supported configuration of the vendor (Microsoft):

> Internet Protocol version 6 (IPv6) is a mandatory part of Windows Vista and Windows Server 2008 and newer versions.

> We don't recommend that you disable IPv6 or IPv6 components or unbind IPv6 from interfaces. If you do, some Windows components might not function.

* https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows

> Cg nat does everything that’s needed […]

Except for making it convenient for end-user to, say, play P2P video games, or host Mindcraft servers, etc.

> […] and 6 alone sadly still doesn’t work reliably.

It's so unreliable that half of all Internet traffic uses it. It's so unreliable that Microsoft has been going IPv6-only in their corporate networks (a decade ago):

* https://labs.ripe.net/author/mirjam/ipv6-only-at-microsoft/

It's so unreliable that Google is now 99% IPv6-only/mostly on their corporate networks:

* https://www.youtube.com/watch?v=UTRsi6mbAWM

I seem to remember a paper a few years ago that (IIRC) tested this by setting a very low TTL (like 60), changing the value, and seeing how long they continued to receive requests at the old value... and most updated within the TTL, but there were some that took up to (I want to say) an hour. I'm probably getting bits of this wrong though..

I did find this paper:
https://labs.ripe.net/Members/giovane_moura/dns-ttl-violations-in-the-wild-with-ripe-atlas-2

The violations in that paper that are important are those that have increased the TTL. Reducing the TTL increases costs for the DNS provider, but isn't important here. The slowest update was about 2 hours (with the TTL set to 333).

Of those that violated the TTL, we don't know what portion of those would function correctly with a different TTL (increasing the TTL indicates they're already not following spec). So I wouldn't assume that increasing the TTL would get them to abide by your requested TTL. They're following their own rules, and those could by anything.

Considering how common low TTLs are... you're worrying about a DNS server that's already potentially causing errors for major well known websites.