"We currently believe the best way to create a stable environment for TLDs is to enact a central authority. We know this will cause much argument within the community, but we have made the decision that we believe will be best for the continued development of this project."
That is the answer to the question I was going to ask, namely "what does decentralized DNS even mean?" People throw around the word "decentralized" as a presumed solution to centralized control, but at the end of the day someone has to decide who wins if two different people both claim that microsoft.com points to their server.
Also, "visit mybiz.yo after adding altdns.com as a DNS authority" doesn't exactly have the same ring to it as "visit mybiz.com". It also doesn't fit on the side of a truck, nor is it something that you will ever convince 99.9% of the population to do just to visit a website.
I envisage a system where a few dozen independent organisations around the World run the root. They all have the same data. If any of them modify their local copy of the data or try to poison the distributed data, their trusted status is revoked. Child DNS resolvers should be able to detect new trusted organisations and remove untrusted organisations quickly.
This could all be handled through public key encryption and automatic voting. DNSSEC or similar should be complete and enforced for all zones and lookups.
You would need to compromise over half of the trusted organisations running the root in order to break this system.
I envisage a system where a few dozen independent organisations around the World run the root. They all have the same data. If any of them modify their local copy of the data or try to poison the distributed data, their trusted status is revoked.
So what happens if someone attacks/compromises more than half of these trusted nodes at once with bad data? Is the bad data then the good data
If there are 35 trusted organisations and governments around the World colluded to take over the network by taking over 18 of these organisations and getting them to "untrust" the other 17, then this would splinter the network, and people around the World would need to manually repoint their resolvers at the other group of 17.
This system relies on the fact that it is difficult to take down lots of independent organisations that are spread around the World at the same time easily.
But if something like that did happen, the organisations would be able to roll back the data as long as more than half of them agreed.
If public key cryptography were used, then you could make it so that only change requests signed with the domain owners private key are accepted and distributed too.
Currently the best non-centralized solution proposed on the mailing list is to flood domain subscriptions and cache them at each node, so whoever claims a domain first will own it. This is pretty vulnerable to a variety of attacks but it does give a rough idea how a p2p dns system would work.
I suspect that if this goes anywhere it will end up much like tor, being used as a censorship circumvention tool rather being installed everywhere by the general public.
That is the answer to the question I was going to ask, namely "what does decentralized DNS even mean?" People throw around the word "decentralized" as a presumed solution to centralized control, but at the end of the day someone has to decide who wins if two different people both claim that microsoft.com points to their server.
Also, "visit mybiz.yo after adding altdns.com as a DNS authority" doesn't exactly have the same ring to it as "visit mybiz.com". It also doesn't fit on the side of a truck, nor is it something that you will ever convince 99.9% of the population to do just to visit a website.