Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google Proposes DNS Extension

Posted by CmdrTaco on from the you-know-my-name dept.

ElusiveJoe writes "Google, along with a group of DNS and content providers, hopes to alter the DNS protocol. Currently, a DNS request can be sent to a recursive DNS server, which would send out requests to other DNS servers from its own IP address, thus acting somewhat similar to a proxy server. The proposed modification would allow authoritative nameservers to expose your IP address (instead of an address of your ISP's DNS server, for example) in order to 'load balance traffic and send users to a nearby server.' Or it would allow any interested party to look at your DNS requests. Or it would send a user from Iran or Libya to a 'domain name doesn't exist' server."

3 of 271 comments (clear)

  1. Not as evil as suggested by Saishuuheiki · · Score: 5, Informative

    If you read the entire post by google, you'll notice they are suggesting only the first 3 octects of the IP address are transmitted. Now while this could theoretically be used to censor regions of users, it could not be used to expose you (since it isn't the complete IP address)

  2. Re:Wow, Slashdot editors hate Google by Nimey · · Score: 5, Informative

    These days?

    --
    Hail Eris, full of mischief...

    E pluribus sanguinem
  3. Re:Do no evil, eh? by dito · · Score: 5, Informative

    On your point about the Iran point...I think there is still the issue of intermediate servers sending "domain doesn't exist" messages to Libyan requests before the packet even reaches the intended destination.

    What intermediate servers? The only parties involved here are you, the website and a 3rd-party resolver that you have chosen to use.

    If you don't trust your 3rd-party resolver then you're screwed with or without this extension because this resolver can see your full IP address and can lie to you about DNS (e.g. sending you to an ad site instead of saying "no such domain" or whatever).

    If you don't trust the website then why are you trying to connect to it? The website will get your full IP address as soon as you connect and can then do whatever it likes with that.

    Assuming you are actually planning on connecting to the website and not just doing DNS requests for the sake of it, nobody gets any information that they weren't going to get anyway and nobody has any opportunity to block you that they weren't going to have anyway.