Subject: [Enum] Fwd: [Sipping] I-D ACTION:draft-ietf-sipping-e164-03.t xt

From: "Stastny Richard" <[email-masked]>
Date: Tue, 8 Jul 2003 20:43:05 +0200

Jaap wrote:

	>No, that is different. You can delegate to a nameserver which
	>maintains that part of the name space for that particular PBX.
	>There is no need to populate the toplevel with all the nitty gritty
	>details of that PBX.
	
	  Ok, and what are you doing there? Of course there is no need to do this at Tier 1
	(I assume thats what you call toplevel), but you then have to do it at Tier 2 (or 3).
	Richard    

§ºišŠX§‚X¬µéîš'~Šà†Ûi³ÿðÃ
bz×è®æj)fjåŠËb�ú?z{¦

---

From: Jaap Akkerhuis <[email-masked]>
Date: Wed, 09 Jul 2003 12:18:52 +0200

>There is no need to populate the toplevel with all the nitty gritty

	  Ok, and what are you doing there? Of course there is no
	  need to do this at Tier 1 (I assume thats what you call
	  toplevel), but you then have to do it at Tier 2 (or 3).

You have to do that in whatever level the name space is delegated
to. I know of a campus place that has a phone number block like +12
34 567XXXX. On the campus are seperate entities, each running a
part of the name/nummer space for themselves (each have their own
PBX). The XXXX namespace is devided by a central body in smaller
portions and each maintain a PBX for their parts of the name space.
So one can imagen that the whole block (7.6.5.4.3.2.1.e164.arpa)
is delegated to the central body and that one can populate the rest
of the block or even delegate again to the separate entities such
as 1.7.6.5.4.3.2.1.e164.arpa to group A, 2.7.6.5.4.3.2.1.e164.arpa
to group B etc.

(BTW I avoid terms as Tiers # here. Sometimes in some contexts they
have specific meanings. What I want to point out here is that the
DNS system is hierachical. Delegations may appear at every level
(label) and that might be useful to do so in certain occasions).

	jaap

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Marian Durkovic <[email-masked]>
Date: Wed, 9 Jul 2003 14:20:51 +0200

> as 1.7.6.5.4.3.2.1.e164.arpa to group A, 2.7.6.5.4.3.2.1.e164.arpa

Yes, but this works only if the institutions are well experienced, and
each of the smaller entities operates 2 DNS servers. With companies totally
unrelated to IT it's obvious that they outsource things like DNS to 
some service providers, which might get overwhelmed with the growing number
of records if all possible numbers need to exist in DNS. Yes, they can
run DNS with millions of records but it's certainly slower, takes time
to start up and is more sensitive to DOS attacks compared to the one 
with hudreds of one-to-many records - which are sufficient in many cases.

	M.

---

From: Jim Reid <[email-masked]>
Date: Wed, 09 Jul 2003 08:46:30 -0700

>>>>> "Marian" == Marian Durkovic <[email-masked]> writes:

    Marian> Yes, but this works only if the institutions are well
    Marian> experienced, and each of the smaller entities operates 2
    Marian> DNS servers. With companies totally unrelated to IT it's
    Marian> obvious that they outsource things like DNS to some
    Marian> service providers, which might get overwhelmed with the
    Marian> growing number of records if all possible numbers need to
    Marian> exist in DNS.

I fail to see how this is remotely relevant to the discussion about
wildcard RRs. If a service provider can't do their job properly, find
another one!

    Marian> Yes, they can run DNS with millions of
    Marian> records but it's certainly slower, takes time to start up
    Marian> and is more sensitive to DOS attacks compared to the one
    Marian> with hudreds of one-to-many records - which are sufficient
    Marian> in many cases.

Eh? If a DNS server is too slow at loading zones, pick another one! I
know of at least 5 DNS implementations that offer near-instant zone
loading (or equivalent). I don't see how DoS attacks are relevant
either: this is orthogonal to the issue of zone load times. BTW, BIND9
is multi-threaded so it can load zones and answer queries at the same
time, unlike BIND8. Not that anyone should be using BIND8 for ENUM
related stuff anyway. And have you considered the potential for DoS
attacks that get introduced by having wildcards?

---

From: Jaap Akkerhuis <[email-masked]>
Date: Wed, 09 Jul 2003 14:54:56 +0200

Note I said: Delegations may appear at every level
(label) and that might be useful to do so in certain occasions.

    Yes, but this works only if the institutions are well experienced,
    and each of the smaller entities operates 2 DNS servers. With
    companies totally unrelated to IT it's obvious that they outsource
    things like DNS to some service providers, which might get
    overwhelmed with the growing number of records if all possible
    numbers need to exist in DNS.

So you you want concentrate on solutions for people without a clue
who outsource to other clueless people?

    Yes, they can run DNS with millions of records but it's certainly
    slower, takes time to start up and is more sensitive to DOS
    attacks compared to the one with hundreds of one-to-many records

There are commonly available nameservers out there that do start
quickly with millions of records, but apart from that, what has the
amount of records to do with DOS attacks?

    one one-to-many records - which are sufficient in many cases.
    
Jim, Patrick and I were making the point that it is not a DNS
problem, there are quite some ways to solve the provisioning problems.
That wild cards are not the sole answer since they come with new
problems so people should look to other solutions first.

It is like the proverb: ``if your only tool is a hammer, the world
looks like a nail''.

It seems to me that the advice to look into the toolbox for something
other then a hammer doesn't seem to be accepted by you.

	jaap

---

From: Marian Durkovic <[email-masked]>
Date: Thu, 10 Jul 2003 10:28:52 +0200

> who outsource to other clueless people?

Well, ENUM is not a standard important to experts-only like BGP, but its
intended audience is in principle anyone using the telephone. Experts
in e.g. medicine and law have no need to understand DNS so outsourcing is a
natural solution.

> other then a hammer doesn't seem to be accepted by you.

No, the problem here is we're looking at the same thing from a different
perspective. I've never said DNS wildcards will solve all the world's
problems. What I'm saying is that there's a serious scalability issue
rising from the fact, that today, most of DNS zones contain just a few
records - for web server(s), mail server(s) etc. With the aproach of
enumerating all possible combinations, the ENUM zone for a PBX
customer will be 3 orders of magnitute (!) bigger than the zone for his
domain. If these are to be hosted by service providers, their DNS has to be
prepared for 3 orders of magnitude more records.

That's why I'm suggesting to start looking for other solutions. But you and
Jim seem to be denying that any problem actually exists and consider this to
be only a provisioning issue. Well, if all service providers anywhere in the
world are running .COM sized DNS server, there's certainly no problem. But
that's not true and, by the way, tomorrow some other group might propose
another important application based on DNS... So my point is - it's better
to think twice how we use the resources and if wildcards are no good let's
try to find some other solution for one-to-many translation.

	With kind regards,

		M.

---

From: Patrik Fältström <[email-masked]>
Date: Thu, 10 Jul 2003 11:09:00 +0200

On torsdag, jul 10, 2003, at 10:28 Europe/Stockholm, Marian Durkovic 
wrote:

> If these are to be hosted by service providers, their DNS has to be

If, as you claim, the number of records in a zone is too large for a 
DNS server you have, this can be solved in a very simple way. The way 
ENUM is defined, delegations can be made at any digit in the E.164 
number. This means you can split your block of E.164 numbers onto any 
number of DNS servers. Each one of them only holding some k*10 records 
(where k is small). They because of this don't have to change DNS 
software, but instead buy more computers and make sure their 
provisioning system can handle the distributed scenario. That way you 
also distribute the load regarding potential increase in the number of 
lookups being made.

> So my point is - it's better

What we are trying to say is that you should try to solve the real 
problem you have, and if no other solution exists, you can use 
wildcards in DNS.

You seem to say (that is what I read at least, even though that is not 
your intention): "Wildcards in DNS are ok as a default answer until 
proven otherwise" which Jim, Jaap, myself and others object to.

This together with us not understanding what real problem you have part 
from a provisioning issue.

    paf

---

From: Jim Reid <[email-masked]>
Date: Thu, 10 Jul 2003 03:07:03 -0700

>>>>> "Marian" == Marian Durkovic <[email-masked]> writes:

    Marian> Well, ENUM is not a standard important to experts-only
    Marian> like BGP, but its intended audience is in principle anyone
    Marian> using the telephone. Experts in e.g. medicine and law have
    Marian> no need to understand DNS so outsourcing is a natural
    Marian> solution.

Well it's one solution. There are others. Like better tools. The idea
that people manage their DNS data and name servers with text editors
has to die if DNS is going to pervade households and small offices. The
idea of someone like my mother running vi on a zone file simply isn't
going to work.

    >> It seems to me that the advice to look into the toolbox for
    >> something other then a hammer doesn't seem to be accepted by
    >> you.

    Marian> No, the problem here is we're looking at the same thing
    Marian> from a different perspective. I've never said DNS
    Marian> wildcards will solve all the world's problems. What I'm
    Marian> saying is that there's a serious scalability issue rising
    Marian> from the fact, that today, most of DNS zones contain just
    Marian> a few records - for web server(s), mail server(s) etc.

With all respect, you have not been saying that until now.

    Marian> That's why I'm suggesting to start looking for other
    Marian> solutions. But you and Jim seem to be denying that any
    Marian> problem actually exists and consider this to be only a
    Marian> provisioning issue.

I can't speak for Patrik, though I think he agrees with me. Yes, there
is a problem. But it's a provisioning problem: how to manage the data
that will be fed to the name servers. As far as the task of serving
that data goes, there is no practical problem in the DNS. That's a
matter of scaling and we know how inherently scalable the DNS is. The
proof is all around us.

    Marian> anywhere in the world are running .COM sized DNS server,
    Marian> there's certainly no problem. But that's not true and, by
    Marian> the way, tomorrow some other group might propose another
    Marian> important application based on DNS... 

They're already out there. DNSSEC is one. RFID tags are another. That
technology will have a *much bigger* impact on the DNS than ENUM.

    Marian> So my point is - it's better to think twice how we use the
    Marian> resources and if wildcards are no good let's try to find
    Marian> some other solution for one-to-many translation.

I'm glad we're in agreement at last.

---

From: Randy Bush <[email-masked]>
Date: Thu, 10 Jul 2003 12:15:34 +0200

> intended audience is in principle anyone using the telephone.

bgp is not a standard important to experts-only, but its intended audience
is in principle anyone using the internet.

in case the above is too subtle, do not confuse the importance of an
*underlying* technology with the end users' need to understand it.

q: do telephone users understand how a 5ess works?
a: actually, no one does

randy