Re: Fedora 34 Change proposal: Remove and deprecate nscd in favour of sssd and systemd-resolved (Self-Contained Change)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On So, 15.11.20 10:18, Marius Schwarz (fedoradev@xxxxxxxxxxxx) wrote:

> Am 11.11.20 um 16:58 schrieb Lennart Poettering:
> > So if you configure 4 DNS servers then each will still get roughly
> > 1/4th of your requests? That's still quite a lot of info.
> the more you use, and i did, the better it protects against tracking by the
> dns cache owners.
>
> How about putting this as a feature request in resolved?

Please file an RFE issue on github:

https://github.com/systemd/systemd/issues/new?template=Feature_request.md

Implementing this does not come without drawbacks though: right now
resolved tries hard to use the same server if at all possible, since
we want to use newer DNS features if possible, but many DNS servers
(wifi routers, yuck) tend to support them quite badly. This means
resolved has an elaborate scheme to learn about the feature set of the
DNS servers it contacts. And that can be slow, in particular on
servers where we step-by-step have to downgrade to the most minimal of
DNS protocols. This learning phase is run only when first contacting
some server (and after some grace period). If we'd switch servers all
the time, for every single lookup, then we'd start from zero every
time, not knowing what the server supports, and thus having to learn
about it over and over again. This would hence make all,
*every*single* transaction pretty slow. And that sucks.

It might be something to add as opt-in, and come with the warning that
you better list DNS servers that aren't crap if you want to use that,
so that we never have to downgrade protocol level, and thus the
learning phase is short.

(There have been suggestions to probe ahead-of-time, i.e. already
before we have to dispatch the first lookup request to it, i.e. at the
time the DNS server address is configured. However that is a privacy
issue, too, since it means systems would suddenly start contacting DNS
servers, even without anyone needing it.)

> It should of course use encrypted protocols first.

It supports DoT since a longer time. Is currently opt-in on Fedora
though, but we should change that.

DoT becomes efficient when we can reuse the established TCP/TLS connection
for multiple lookups. But if we'd switch servers all the time, then of
course there's no reuse of TCP/TLS connections possible.

or in other words: adding this conflicts with other (and I think more
important) goals here. Thus if we add this, only as option i
figure. It's not suitable as sensible default.

Lennart

--
Lennart Poettering, Berlin
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux