6 ms·

This is pretty interesting, and I've never heard of it before today. However - I am a little worried that this seems to allow anyone that enables this option t

This is pretty interesting, and I've never heard of it before today. However - I am a little worried that this seems to allow anyone that enables this option to track all users that make DNS lookups. And it doesn't say if there's a way to disable the behavior, short of switching to a DNS server that doesn't do this.

brlewis 15y ago
Usually the company that now gets the first 3 octets of your IP4 address is the same company that will get your full IP address anyway when you hit their web page.
- jcr 15y ago
  Your statement is true, but unfortunately, you're not thinking it through completely, so you don't see the worrying implications. Most modern web browsers these days do "DNS Prefetch" which is a fancy way to say domain names found within web pages are resolved to IP address before they are actually needed. This means the new GIS (Global Internet Speedup) garbage will send the first three octets of your IP address to every evil spamming/tracking site that has a link on the page you're viewing regardless if you followed the link due to the browser doing a DNS prefetch. If you run your own DNS server, then the browser DNS prefetch is already allowing you to be tracked, and by full IP address rather than just the first three octets. On the other hand, most people do not run their own DNS server, so GIS is a reduction of privacy.
  - someone13 15y ago
    The DNS prefetching was exactly what I was thinking of. With GIS, if my site shows up in Google (or elsewhere), I can now track exactly how many people see my site, and from where, without them ever clicking on a link.
    - michaelcampbell 15y ago
      I'm a network neophyte, so go slow, but can you explain how? Is it this? "Basically, when your browser makes a DNS request, the DNS server will now forward the first three octets (123.45.67) of your IP address to the target web service." So say you search for something on google; google returns its search results page, your browser gets the page, looks at all the links, asks DNS for the IP's to all those links' addresses, and DNS auto-sends YOUR (truncated) IP to all those addresses' servers? I guess I'm unclear on why it would do that. If the truncated IP coming to a CDN isn't coming with an actual request, how do they know that at some time later your actual request is from your truncated IP? (I also don't understand why a CDN would use some sort of DNS address as a geolocation strategy, but I guess that's another discussion.)
      - jcr 15y ago
        > So say you search for something on google; google returns its search results page, your browser gets the page, looks at all the links, asks DNS for the IP's to all those links' addresses, and DNS auto-sends YOUR (truncated) IP to all those addresses' servers? Yes. > I guess I'm unclear on why it would do that. The DNS prefetching done by the browser exists to save your time. Instead of waiting to do a DNS lookup until you click on a link in the current page, the browser does DNS lookups on all links in the page as soon as the page is loaded. By the time you're done deciding which link to follow, the browser is already done with the initial step required to follow any link on the page. > If the truncated IP coming to a CDN isn't coming with an actual request, how do they know that at some time later your actual request is from your truncated IP? (I also don't understand why a CDN would use some sort of DNS address as a geolocation strategy, but I guess that's another discussion.) You seem to have misread the description. A CDN is a group of multiple servers and all of them could, in theory, respond to your request for a specific web page. The servers in the group are spread out all over the globe, but all of them share the same domain name. When you look up the IP address of the shared domain name, this new GIS draft sends your truncated IP address to the DNS server of the CDN so it can choose the server in the group that is "closest" to you. I hope that makes more sense.
        michaelcampbell 15y ago
    - jcr 15y ago
      You are correct in a general sense but it seems you're stretching the truth a little bit. Since you only get three octets from GIS, it is impossible to know "exactly" how many people visit your site. As for the "from where," you could get a rough idea of location through GeoIP on three octets, but the result would be generalized. The generalized data would still be useful, but it would be lacking in resolution and reliability compared to GeoIP on the full four octet IP address. The approaching exhaustion of IPv4 in the coming years, and how, in practice, it is handled could make a real mess of GIS. If your ISP starts handing out IPv4 addresses in the private address space to customers and does transparent PNAT, then GIS breaks badly for all customers of said ISP. In the case of large ISPs, GIS could actually make things slower. The part I have no clue about is how GIS works with IPv6? I haven't read the IETF draft, so I'll just shut up and hope someone more knowledgeable chimes in here.
      - jcrites 15y ago
        > The generalized data would still be useful, but it would be lacking in resolution and reliability compared to GeoIP on the full four octet IP address. How is that? ARIN doesn't delegate IP address space to users or ISPs in smaller segments than 1024K IP addresses. So it seems that 3 octets is enough to map to a physical location. How does the additional octet give you additional geolocational abilities?
        jcr 15y ago
        Good question. The answer is in understanding the details. The RIR's (Regional Internet Registry - ARIN, RIPE, APNIC, ...) do allocate large blocks as you state, but those large blocks are divided into subnets. When you realize the subnets have routers and routers often provide their GPS coordinates, you can see how Geolocation can become more accurate with more address bits. That's just one of the ways. Another way would be the subnet assignments often being public and location of the company/organization with said assignment having a known location. Still another approach is the looking up locations based on AS/ASN. And yet another is GPS reporting (think mobile android/ios). There are probably other ways that I don't know. The important part to realize is how all of the various methods are both employed and combined to build out geolocation databases. Geolocation by IP is far from perfect, but often it can be surprisingly accurate.
    - jpablo 15y ago
      The directions that browsers are going is to prefetch the entire page ahead of time anyway, so this is a moot point.
      - mike-cardwell 15y ago
        Firefox users: RequestPolicy users can disable Link prefetching and DNS prefetching from the Advanced tab in the RequestPolicy preferences. Everyone else can search for "prefetch" in about:config and do it from there. Also, Prefetching is disabled by default if the page containing the link is opened over HTTPS.
  - brlewis 15y ago
    That's a good point. I still think that evil spamming/tracking sites will only be able to get aggregate data, not track or spam individuals.
lhnn 15y ago
I was concerned about privacy, too, but heck, your IP is already logged by the primary site and logged by the CDN. This is just adding some logic to the routing.
davidu 15y ago
We've thought about letting people turn it on or off, but have held off for now. We're only sending the edns-option to authoritative DNS providers who also handle the HTTP request, and thus would have seen the entire src_ip anyways.
- jcr 15y ago
  David, I hope you'll forgive me for asking questions before I'm done reading the draft, but I'm curious about one thing. Are there any known effects on client-side caching? I can't think of any, but the rise in high latency links on the last hop (particularly mobile, but to a lesser degree WiMax, satellite, ...) is one of the places where client-side caching (including dns caching) can make a big difference. If you've ever seen the painfully common DNS issues on Verizon Wireless, you'd know why I'm asking. ;)
- stock_toaster 15y ago
  > We're only sending the edns-option to authoritative nameservers who also handle the HTTP request Authoritative nameservers handling http requests? Mine certainly don't. Or did you mean to say that you only send edns-option to the server that is authoritative for the domain being requested?
  - davidu 15y ago
    clarified language.
- someone13 15y ago
  Thank you for your clarification :)

brlewis 15y ago

Usually the company that now gets the first 3 octets of your IP4 address is the same company that will get your full IP address anyway when you hit their web page.

jcr 15y ago
Your statement is true, but unfortunately, you're not thinking it through completely, so you don't see the worrying implications. Most modern web browsers these days do "DNS Prefetch" which is a fancy way to say domain names found within web pages are resolved to IP address before they are actually needed. This means the new GIS (Global Internet Speedup) garbage will send the first three octets of your IP address to every evil spamming/tracking site that has a link on the page you're viewing regardless if you followed the link due to the browser doing a DNS prefetch. If you run your own DNS server, then the browser DNS prefetch is already allowing you to be tracked, and by full IP address rather than just the first three octets. On the other hand, most people do not run their own DNS server, so GIS is a reduction of privacy.
- someone13 15y ago
  The DNS prefetching was exactly what I was thinking of. With GIS, if my site shows up in Google (or elsewhere), I can now track exactly how many people see my site, and from where, without them ever clicking on a link.
  - michaelcampbell 15y ago
    I'm a network neophyte, so go slow, but can you explain how? Is it this? "Basically, when your browser makes a DNS request, the DNS server will now forward the first three octets (123.45.67) of your IP address to the target web service." So say you search for something on google; google returns its search results page, your browser gets the page, looks at all the links, asks DNS for the IP's to all those links' addresses, and DNS auto-sends YOUR (truncated) IP to all those addresses' servers? I guess I'm unclear on why it would do that. If the truncated IP coming to a CDN isn't coming with an actual request, how do they know that at some time later your actual request is from your truncated IP? (I also don't understand why a CDN would use some sort of DNS address as a geolocation strategy, but I guess that's another discussion.)
    - jcr 15y ago
      > So say you search for something on google; google returns its search results page, your browser gets the page, looks at all the links, asks DNS for the IP's to all those links' addresses, and DNS auto-sends YOUR (truncated) IP to all those addresses' servers? Yes. > I guess I'm unclear on why it would do that. The DNS prefetching done by the browser exists to save your time. Instead of waiting to do a DNS lookup until you click on a link in the current page, the browser does DNS lookups on all links in the page as soon as the page is loaded. By the time you're done deciding which link to follow, the browser is already done with the initial step required to follow any link on the page. > If the truncated IP coming to a CDN isn't coming with an actual request, how do they know that at some time later your actual request is from your truncated IP? (I also don't understand why a CDN would use some sort of DNS address as a geolocation strategy, but I guess that's another discussion.) You seem to have misread the description. A CDN is a group of multiple servers and all of them could, in theory, respond to your request for a specific web page. The servers in the group are spread out all over the globe, but all of them share the same domain name. When you look up the IP address of the shared domain name, this new GIS draft sends your truncated IP address to the DNS server of the CDN so it can choose the server in the group that is "closest" to you. I hope that makes more sense.
      - michaelcampbell 15y ago
  - jcr 15y ago
    You are correct in a general sense but it seems you're stretching the truth a little bit. Since you only get three octets from GIS, it is impossible to know "exactly" how many people visit your site. As for the "from where," you could get a rough idea of location through GeoIP on three octets, but the result would be generalized. The generalized data would still be useful, but it would be lacking in resolution and reliability compared to GeoIP on the full four octet IP address. The approaching exhaustion of IPv4 in the coming years, and how, in practice, it is handled could make a real mess of GIS. If your ISP starts handing out IPv4 addresses in the private address space to customers and does transparent PNAT, then GIS breaks badly for all customers of said ISP. In the case of large ISPs, GIS could actually make things slower. The part I have no clue about is how GIS works with IPv6? I haven't read the IETF draft, so I'll just shut up and hope someone more knowledgeable chimes in here.
    - jcrites 15y ago
      > The generalized data would still be useful, but it would be lacking in resolution and reliability compared to GeoIP on the full four octet IP address. How is that? ARIN doesn't delegate IP address space to users or ISPs in smaller segments than 1024K IP addresses. So it seems that 3 octets is enough to map to a physical location. How does the additional octet give you additional geolocational abilities?
      - jcr 15y ago
        Good question. The answer is in understanding the details. The RIR's (Regional Internet Registry - ARIN, RIPE, APNIC, ...) do allocate large blocks as you state, but those large blocks are divided into subnets. When you realize the subnets have routers and routers often provide their GPS coordinates, you can see how Geolocation can become more accurate with more address bits. That's just one of the ways. Another way would be the subnet assignments often being public and location of the company/organization with said assignment having a known location. Still another approach is the looking up locations based on AS/ASN. And yet another is GPS reporting (think mobile android/ios). There are probably other ways that I don't know. The important part to realize is how all of the various methods are both employed and combined to build out geolocation databases. Geolocation by IP is far from perfect, but often it can be surprisingly accurate.
  - jpablo 15y ago
    The directions that browsers are going is to prefetch the entire page ahead of time anyway, so this is a moot point.
    - mike-cardwell 15y ago
      Firefox users: RequestPolicy users can disable Link prefetching and DNS prefetching from the Advanced tab in the RequestPolicy preferences. Everyone else can search for "prefetch" in about:config and do it from there. Also, Prefetching is disabled by default if the page containing the link is opened over HTTPS.
- brlewis 15y ago
  That's a good point. I still think that evil spamming/tracking sites will only be able to get aggregate data, not track or spam individuals.

lhnn 15y ago

I was concerned about privacy, too, but heck, your IP is already logged by the primary site and logged by the CDN. This is just adding some logic to the routing.

davidu 15y ago

We've thought about letting people turn it on or off, but have held off for now. We're only sending the edns-option to authoritative DNS providers who also handle the HTTP request, and thus would have seen the entire src_ip anyways.

jcr 15y ago
David, I hope you'll forgive me for asking questions before I'm done reading the draft, but I'm curious about one thing. Are there any known effects on client-side caching? I can't think of any, but the rise in high latency links on the last hop (particularly mobile, but to a lesser degree WiMax, satellite, ...) is one of the places where client-side caching (including dns caching) can make a big difference. If you've ever seen the painfully common DNS issues on Verizon Wireless, you'd know why I'm asking. ;)
stock_toaster 15y ago
> We're only sending the edns-option to authoritative nameservers who also handle the HTTP request Authoritative nameservers handling http requests? Mine certainly don't. Or did you mean to say that you only send edns-option to the server that is authoritative for the domain being requested?
- davidu 15y ago
  clarified language.
someone13 15y ago
Thank you for your clarification :)