Subject: [Asrg] 6. Proposals - DNS Based - Security of DNS (was RE: [Asrg] DNSSEC not deployable)

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 04 Jul 2003 11:08:35 -0400

We need to determine for the future consideration of all DNS based proposal 
the state of DNSSEC and its planned deployment. Since you are in 
disagreement and this is obviously not the correct forum for such 
discussion, especially when resorting to name calling, why don't we request 
a comment on this matter from the IESG, IAB or ICANN?

Yakov

At 07:47 AM 7/4/2003 -0700, Hallam-Baker, Phillip wrote:

>The allegation that I am a liar is actionable. I demand that you withdraw
>this allegation immediately and appologise.
>
> > -----Original Message-----
> > From: Eric Brunner-Williams in Portland Maine
> > [mailto:[email-masked]]
> > Sent: Friday, July 04, 2003 10:42 AM
> > To: Hallam-Baker, Phillip
> > Cc: 'Yakov Shafranovich'; Steven F Siirila; [email-masked];
> > [email-masked]
> > Subject: Re: [Asrg] DNSSEC not deployable
> >
> >
> > Crap. Lies and Crap.
> >

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Walter Dnes <[email-masked]>
Date: Mon, 7 Jul 2003 02:14:18 -0400

On Fri, Jul 04, 2003 at 11:08:35AM -0400, Yakov Shafranovich wrote

> We need to determine for the future consideration of all DNS based
> proposal the state of DNSSEC and its planned deployment.

  I strongly disagree with your conclusion.  If DNS gets compromised
that badly, the entire internet will collapse in a pile of rubble...

  - how is an MTA going to figure out the IP address from an MX record
    if DNS is kaput ?

  - how will people surf to www.bad.example.com if their OS can't get a
    reliable IP address ?

  - ftp, IRC, chat, messaging, etc.  *EVERYTHING* goes down the tubes.

  - How many megabytes of hosts file can your OS take before it begins
    crawling each time you try a web lookup ?

  If we assume that there will be an internet tomorrow, requiring our
solutions for email problems, we must also assume that DNS will be
operational tomorrow.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 07 Jul 2003 02:21:32 -0400

>solutions for email problems, we must also assume that DNS will be

Thank you Walter. Point taken - numerous others have also pointed out that 
status of DNS-SEC is irrelevant for us for other reasons. I have learned 
the error of my ways :)

Yakov