Re: [Bitcoin-development] Policy for DNS seeds

[Peter Todd <pete@petertodd.org>]

[-- Attachment #1: Type: text/plain, Size: 3203 bytes --]

On Mon, Jul 21, 2014 at 03:43:42PM +0200, Wladimir wrote:
> We've established a few basic rules for the DNS seeds as used in the
> Bitcoin Core software. See below.
> 
> If you run one of the DNS seeds please reply to this and let us know
> whether you agree to these terms. if you think some requirements are
> unreasonable let us know too. If we haven't heard from you by
> 2014-08-04 we will remove your DNS seed from the list of defaults.
> 
> Expectations for DNSSeed operators
> ====================================
> 
> Bitcoin Core attempts to minimize the level of trust in DNS seeds,
> but DNS seeds still pose a small amount of risk for the network.
> Other implementations of Bitcoin software may also use the same
> seeds and may be more exposed. In light of this exposure this
> document establishes some basic expectations for the expectations
> for the operation of dnsseeds.

Might be worthwhile to also write an "Expectations for DNSSeed users"
outlining what security properties the seeds actually have, and what
kind of attacks are possible. Many users would be better served with
seeds that offer authenticated and encrypted connections to the seeds
for instance. (esp. if they're using authed/encrypted connections to
nodes, e.g. Tor hidden services)


> 1. The DNSseed results must consist exclusively of fairly selected and
> functioning Bitcoin nodes from the public network to the best of the
> operators understanding and capability.

Along the lines of my above point, for Bitcoin Core users of the
DNSSeeds what constitutes a "functioning" Bitcoin node is much more
broad than what other users might need.


> 2. For the avoidance of doubt, the results may be randomized but must not
> single-out any group of hosts to receive different results unless due to an
> urgent technical necessity and disclosed.

Note that singling out a group of hosts to receive different results
with DNS is especially difficult as you'll be usually singling out
different ISP's rather than hosts themselves. That said if we ever start
operating HTTPS or similar seeds this expectation will become even more
relevant for them.


> If these expectations cannot be satisfied the operator should
> discontinue providing services and contact the active Bitcoin
> Core development team as well as posting on bitcoin-development.
> 
> Behavior outside of these expectations may be reasonable in some
> situations but should be discussed in public in advance.

I'll let others refine the exact wording. but I broadly agree with these
rules.

For the testnet DNS seeds - IE my one - my thoughts are the rules should
be identical. Most of the above is related to privacy rather than
security, which apply equally well on testnet. While there have been
suggestions to use the testnet seeds for testing vulnerabilities, the
public discussion clause should suffice to allow those exceptions. I
also suspect that vulnerabilities are likely to be dismissed by a large
part of the community if demonstrated with DNSSeed operator
co-operation.

-- 
'peter'[:-1]@petertodd.org
00000000000000003dcfcd420fbf9e5b6bdab43ac772960351475dec125382ef

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 650 bytes --]