4 ms·

> and not really because you run a recursive resolver. "No", because the system depends on running a recursive resolver locally to separate queries onto differ

by pdkl95 8y ago

> and not really because you run a recursive resolver. "No", because the system depends on running a recursive resolver locally to separate queries onto different nameservers.

Dylan16807 8y ago
It depends on doing so to work better. But a similar not-quite-as-good system could do without that feature. It's not integral.
- pdkl95 8y ago
  What is this system that prevents pattern-of-life analysis while still sending all DNS queries to one nameserver? I'm still sending frequent short-TTL (normal caching) DNS lookups for most hosts that would betray my pattern-of-life in aggregate. The vast majority of the security is from sending those requests to the domain-specific nameservers instead of aggregating it all through a single upstream nameserver. Aggressive caching of NS records for TLDs doesn't do anything to prevent a single upstream nameserver from leaning your pattern of life from the frequent DNS lookups for A records that are not cached longer than normal.
  - Dylan16807 8y ago
    > What is this system that prevents pattern-of-life analysis while still sending all DNS queries to one nameserver? Setting $CACHE_TTL to "months" on everything, and doing nothing else. > I'm still sending frequent short-TTL (normal caching) DNS lookups for most hosts that would betray my pattern-of-life in aggregate. Your system does that. This theoretical mildly-inferior system would not have frequent DNS lookups for any record type.
    - pdkl95 8y ago
      > Setting $CACHE_TTL to "months" on everything, and doing nothing else. That will break a lot. DNS isn't static; IPs regularly change as servers move, CDNs are introduced/changed. Long-term caching only works on NS records because changing DNS delegations is relatively rare. NS record caching does cause problems, but they are infrequent. Caching the addresses of the actual servers will break some things within days, and most of the internet the next time each server is updated/moved/etc.

by pdkl95 8y ago

> and not really because you run a recursive resolver. "No", because the system depends on running a recursive resolver locally to separate queries onto different nameservers.

Dylan16807 8y ago

It depends on doing so to work better. But a similar not-quite-as-good system could do without that feature. It's not integral.

pdkl95 8y ago
What is this system that prevents pattern-of-life analysis while still sending all DNS queries to one nameserver? I'm still sending frequent short-TTL (normal caching) DNS lookups for most hosts that would betray my pattern-of-life in aggregate. The vast majority of the security is from sending those requests to the domain-specific nameservers instead of aggregating it all through a single upstream nameserver. Aggressive caching of NS records for TLDs doesn't do anything to prevent a single upstream nameserver from leaning your pattern of life from the frequent DNS lookups for A records that are not cached longer than normal.
- Dylan16807 8y ago
  > What is this system that prevents pattern-of-life analysis while still sending all DNS queries to one nameserver? Setting $CACHE_TTL to "months" on everything, and doing nothing else. > I'm still sending frequent short-TTL (normal caching) DNS lookups for most hosts that would betray my pattern-of-life in aggregate. Your system does that. This theoretical mildly-inferior system would not have frequent DNS lookups for any record type.
  - pdkl95 8y ago
    > Setting $CACHE_TTL to "months" on everything, and doing nothing else. That will break a lot. DNS isn't static; IPs regularly change as servers move, CDNs are introduced/changed. Long-term caching only works on NS records because changing DNS delegations is relatively rare. NS record caching does cause problems, but they are infrequent. Caching the addresses of the actual servers will break some things within days, and most of the internet the next time each server is updated/moved/etc.