Re: djbdns/dnscache poisoning weakness

Dean Anderson wrote:

> Actually, it turns out that Dan Kaminsky wrote a fast TCP scanner that 
> bypassed the unix TCP stack.  TCP can scale. Just not with the file 
> descriptor abstraction.

I don't think a distributed DATABASE of the scale of the DNS system
can operate using TCP, independent of any implementation optimization.
Even if the computation overhead of the protocol elements were reduced
by a decimal order of magnitude, latency as a percentage of bandwidth
continues to grow.  This doesn't favor a connection oriented protocol
with a 3-way handshake.  RFC 1644-style T/TCP might be interesting,
but has largely been abandoned for its own set of security problems.

I think DJB's proposed solution is the only workable approach.