Subject: The problem I see with DNSSEC as a potential end user and administrator.

From: Duane <[email-masked]>
Date: Fri, 08 Aug 2008 15:57:27 +1000

I just spoke to Mark on the phone, I'm sure he'll have some interesting
remarks about that in private, but to sum things up the conclusion I was
trying (poorly) to get across to Mark was this.

The higher the perceived cost, and the lower the perceived benefit will
make people complacent about deploying DNSSEC.

If the PDF link Bert posted is anything to go by there is a long way to
go before it's simple enough for people not to care about doing 1 or 2
things extra to implement DNSSEC.

However while ever the process is so long and drawn out, regardless of
how much worst it was in the past, people won't be bothered with it
until or unless they are personally effected in some respect.

You can't over come complacency by saying the process is simpler now
then it used to be and how easy it is to setup, it doesn't wash with me
or anyone else like me. We all live busy lives and all have better
things to do then care about if the zone is signed or not at present
because of a lack of tangible benefit.

Further more when anything gets more complicated I worry about how much
additional maintenance work it will take putting out fires in the future
when something breaks. Something always breaks so it isn't a matter of
if but when.

To sum things up, I don't care how easy the people promoting DNSSEC is,
it is still much too drawn out and I have better things to do with my
time then doing a bunch on mundane and repetitive things which computers
are so much better at.

Make the setup so easy a cave man could do it, or even better, fully
automate then when there is no perceived additional cost people will
start adopting it.

-- 

Best regards,
 Duane

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: David Ulevitch <[email-masked]>
Date: Thu, 07 Aug 2008 23:24:58 -0700

Duane,

Can we get a last name please? We already have one Duane on this list 
and it's hard to know who you are.  Is that too much to ask?  This is an 
IETF mailing list, after all.

-David

---

From: Duane at e164 dot org <[email-masked]>
Date: Fri, 08 Aug 2008 16:37:22 +1000

> IETF mailing list, after all.

In all the time I've used the internet you are the only person to care
at all.

-- 

Best regards,
 Duane

---

From: Duane at e164 dot org <[email-masked]>
Date: Fri, 08 Aug 2008 19:12:40 +1000

Ondřej Surý wrote:

> I know that it does add more burder of shoulder of any sysadmin, but
> is it really so much - add a cron job and some monitoring script and
> you are done?

at some point you load the beasts of burden up with so much work that
one extra piece of straw is all that is needed or takes to break the
poor animals back.

-- 

Best regards,
 Duane

---

From: "Ondřej Surý" <[email-masked]>
Date: Fri, 8 Aug 2008 11:18:24 +0200

> one extra piece of straw is all that is needed or takes to break the

But now is starts to be only rhethorical discussion.  Have you calculated
how much additional work it would be for you?  Using right tools for it
(like dnssec-tools[1] or ZKT[2])?

Ondrej
1. www.dnssec-tools.org
2. http://www.hznet.de/dns/zkt/
-- 
 Ondřej Surý
 technický ředitel/Chief Technical Officer
 -----------------------------------------
 CZ.NIC, z.s.p.o. -- .cz domain registry
 Americká 23,120 00 Praha 2,Czech Republic
 mailto:[email-masked] http://nic.cz/
 sip:[email-masked] tel:+420.222745110
 mob:+420.739013699 fax:+420.222745112
 -----------------------------------------
������r��zǧu���Ơz�'jg���iz�+z����)�'�~���+a����n�˛���m�jȧ�W��w���^��,j�{[�ܚ��b��m�����"z����l�v�y�覗��

---

From: Duane at e164 dot org <[email-masked]>
Date: Fri, 08 Aug 2008 19:26:02 +1000

> (like dnssec-tools[1] or ZKT[2])?

If I have to go out of my way to learn about this stuff you again have
shown it is neither straight forward nor simple to do.

Until I can type a single command (or no commands) that sets everything
up I really can't be bothered, since there is no perceived benefit in
doing so for me.

-- 

Best regards,
 Duane

---

From: "Ondřej Surý" <[email-masked]>
Date: Fri, 8 Aug 2008 11:32:27 +0200

> up I really can't be bothered, since there is no perceived benefit in

So when you installed your DNS server infrastructure, was it just
some "magic" command which caused all your domain names to be server
by that servers?  Or did you have to make changes to config files,
generate TSIG keys, configure primary, configure slaves, add zones
to config file...

I see kind of analogy here.  Available tools are bit rough at this time,
but it's magnituted better that it was half a year ago.

Ondrej.

---

From: Duane at e164 dot org <[email-masked]>
Date: Fri, 08 Aug 2008 19:38:20 +1000

> generate TSIG keys, configure primary, configure slaves, add zones

apt-get scripts either prompt for more information or pre-config nearly
everything out of the box.

> but it's magnituted better that it was half a year ago.

What was, is meaningless to those that don't know or care, what is, is
all that matters if you are trying to sell DNSSEC to the unwashed masses
that aren't drinking the koolaid.

-- 

Best regards,
 Duane

---

From: "Ondřej Surý" <[email-masked]>
Date: Fri, 8 Aug 2008 11:52:08 +0200

MjAwOC84LzggRHVhbmUgYXQgZTE2NCBkb3Qgb3JnIDxkdWFuZUBlMTY0Lm9yZz46Cj4gT25kxZllaiBTdXLDvSB3cm90ZToKPgo+PiBTbyB3aGVuIHlvdSBpbnN0YWxsZWQgeW91ciBETlMgc2VydmVyIGluZnJhc3RydWN0dXJlLCB3YXMgaXQganVzdAo+PiBzb21lICJtYWdpYyIgY29tbWFuZCB3aGljaCBjYXVzZWQgYWxsIHlvdXIgZG9tYWluIG5hbWVzIHRvIGJlIHNlcnZlcgo+PiBieSB0aGF0IHNlcnZlcnM/ICBPciBkaWQgeW91IGhhdmUgdG8gbWFrZSBjaGFuZ2VzIHRvIGNvbmZpZyBmaWxlcywKPj4gZ2VuZXJhdGUgVFNJRyBrZXlzLCBjb25maWd1cmUgcHJpbWFyeSwgY29uZmlndXJlIHNsYXZlcywgYWRkIHpvbmVzCj4+IHRvIGNvbmZpZyBmaWxlLi4uCj4KPiBhcHQtZ2V0IHNjcmlwdHMgZWl0aGVyIHByb21wdCBmb3IgbW9yZSBpbmZvcm1hdGlvbiBvciBwcmUtY29uZmlnIG5lYXJseQo+IGV2ZXJ5dGhpbmcgb3V0IG9mIHRoZSBib3guCgpObywgaXQgZG9lc24ndC4gIEl0IGp1c3QgYWRkIHNvbWUgcHJlY29uZmlndXJhdGlvbiBmb3IgckROUywgYnV0IGl0IGRvZXNuJ3QKc2V0dXAgeW91ciB6b25lcy4gIFlvdSBoYXZlIHRvIGFkZCB0aGVtIG1hbnVhbGx5LiAgU2FtZSB3aXRoIFRTSUcsIHNsYXZlcywKZXRjLgoKPj4gSSBzZWUga2luZCBvZiBhbmFsb2d5IGhlcmUuICBBdmFpbGFibGUgdG9vbHMgYXJlIGJpdCByb3VnaCBhdCB0aGlzIHRpbWUsCj4+IGJ1dCBpdCdzIG1hZ25pdHV0ZWQgYmV0dGVyIHRoYXQgaXQgd2FzIGhhbGYgYSB5ZWFyIGFnby4KPgo+IFdoYXQgd2FzLCBpcyBtZWFuaW5nbGVzcyB0byB0aG9zZSB0aGF0IGRvbid0IGtub3cgb3IgY2FyZSwgd2hhdCBpcywgaXMKPiBhbGwgdGhhdCBtYXR0ZXJzIGlmIHlvdSBhcmUgdHJ5aW5nIHRvIHNlbGwgRE5TU0VDIHRvIHRoZSB1bndhc2hlZCBtYXNzZXMKPiB0aGF0IGFyZW4ndCBkcmlua2luZyB0aGUga29vbGFpZC4KCldlbGwsIHdlIGRvbid0IG5lZWQgdG8gc2VsbCBpdCB0byBtYXNzZXMuICBXZSBqdXN0IG5lZWQgdG8gZWR1Y2F0ZWQgcmVnaXN0cmFycywKSVNQcyBhbmQgYmlnIHpvbmUgaG9zdGVycywgd2hlcmUgcGVvcGxlIHdpdGggKGF0IGxlYXN0IHNvbWUpIGNsdWUgd29ya3MuCkFuZCB0aGF0J3Mgc29tZXRoaW5nIHdoYXQgd2UgYXJlIHdvcmtpbmcgb24uCgpPbmRyZWoKLS0gCiBPbmTFmWVqIFN1csO9CiB0ZWNobmlja8O9IMWZZWRpdGVsL0NoaWVmIFRlY2huaWNhbCBPZmZpY2VyCiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQogQ1ouTklDLCB6LnMucC5vLiAtLSAuY3ogZG9tYWluIHJlZ2lzdHJ5CiBBbWVyaWNrw6EgMjMsMTIwIDAwIFByYWhhIDIsQ3plY2ggUmVwdWJsaWMKIG1haWx0bzpvbmRyZWouc3VyeUBuaWMuY3ogaHR0cDovL25pYy5jei8KIHNpcDpvbmRyZWouc3VyeUBuaWMuY3ogdGVsOis0MjAuMjIyNzQ1MTEwCiBtb2I6KzQyMC43MzkwMTM2OTkgZmF4Ois0MjAuMjIyNzQ1MTEyCiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQo=--to unsubscribe send a message to [email-masked] withthe word 'unsubscribe' in a single line as the message text body.archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Duane at e164 dot org <[email-masked]>
Date: Fri, 08 Aug 2008 19:55:01 +1000

Ondřej Surý wrote:

> Well, we don't need to sell it to masses.  We just need to educated registrars,
> ISPs and big zone hosters, where people with (at least some) clue works.
> And that's something what we are working on.

I wish you well on your endeavour, I've said my piece but so far no one
has convinced me over DNSSEC to date.

Also you are assuming I don't have anything to do with administering a
large number of zones, but that's ok :)

-- 

Best regards,
 Duane

---

From: Olaf Kolkman <[email-masked]>
Date: Fri, 8 Aug 2008 12:17:48 +0200

[This thread has gone off-topic, so has this reply]

On Aug 8, 2008, at 11:52 AM, Ondřej Surý wrote:

> No, it doesn't.  It just add some preconfiguration for rDNS, but it  
> doesn't
> setup your zones.  You have to add them manually.  Same with TSIG,  
> slaves,
> etc.
>

Ondřej Surý, Duane Groth,

You are both right.

We need the clueful folk to deploy and provide basic infrastructure,  
we need the clueful folk to build the tools, the devices and auto- 
scripts, and then we need the masses to make deployment a success. We  
are still at the beginning of the deployment curve.

But mind you. If you want to do DNSSEC in a no-brain fashion there are  
proprietary solutions already (just like there are proprietary  
solutions for plain-old DNSSEC management).

The design of management software is to a great extend off-topic for  
this list, unless we need protocols to make them interoperate.

We have RFC5011 to manage part of that (open-source implementation  
forthcoming) and numerous folk are working on key-maintenance tools.  
See for instance: http://www.dnssec-tools/, http:// 
www.opendnssec.org/, http://www.xtcn.com/ lamb/pkcs11HSMtools.tar.gz,  
and http://www.ripe.net/disi/dnssec_maint_tool/ are some initiatives I  
am aware of. ISC has announced work on tools for the next version of  
bind.

I would agree with claims that most of them are far from state-of the  
art, but the activity in this area is rapidly increasing.

Duane , you seem to be the kind of guy that knows both what end-users  
really need, and have the clue to spec and implement that ;-)

--Olaf

PS. I will keep an open eye on alternative protocol or operational  
practices that will help to bridge the gap between now and the time  
that DNSSEC has seen sufficient deployment to make it useful, but I  
will try to refrain from entering in future off-topic debates on this  
issue on this list.

---

From: Stefan Schmidt <[email-masked]>
Date: Fri, 8 Aug 2008 12:21:32 +0200

> And that's something what we are working on.

If you don't deploy it to a hundred percent it simply won't be 'the solution'
to the spoofing and man-in-the-middle problem as some people here like to
think. Saturation is important to the success of a protocol, think of blueray
vs. hd-dvd so you need not only to address the forbes500 but also
www.mylittlewebsitethatsellsstuff.cctld, that kind of thing is often run by
small companys that lack the clue you want people to have.

	Stefan
-- 
There is hopeful symbolism in the fact that flags don't wave in a vacuum.
- Arthur C. Clark

---

From: Ralf Weber <[email-masked]>
Date: Fri, 8 Aug 2008 12:31:41 +0200

Moin!

> ISPs and big zone hosters, where people with (at least some) clue  
Well even these guys (I think my company is in one of the above  
mentioned business ;-) want tools that don't put to much operational  
burden on them. So a switch or checkbox that says DNSSEC enabled for  
that zone, and does all the rest in background (KSK, ZSK generation,  
zone signing and resigning, ZSK rollover, KSK rollover) is something  
that we  and I guess others want. Ok for KSK it would be good if it  
offer to access it via an external storage that you only attach to the  
box at certain times to not have always on the box and at risk being  
compromised. And we do want it in an integrated manner and not as a  
bunch of different toolsets that you can stick together.

So far I know of no solution that does offer that, but if anyone knows  
tell me.

> And that's something what we are working on.
You can try, but I guess you will have problems when the operational  
overhead is bigger than the potential benefit.

So long
-Ralf
---
Ralf Weber
Platform Infrastructure Manager
Colt Telecom GmbH
Herriotstrasse 4
60528 Frankfurt
Germany
DDI: +49 (0)69 56606 2780 Internal OneDial: 8 491 2780
Fax: +49 (0)69 56606 6280
Email: [email-masked]
http://www.colt.net/

Data | Voice | Managed Services

*****************************************
COLT Telecom GmbH, Herriotstraße 4, 60528 Frankfurt/Main, Deutschland *
Tel +49 (0)69 56606 0 * Fax +49 (0)69 56606 2222 *
Geschäftsführer: Albertus Marinus Oosterom (Vors.), Rita Thies *
Amtsgericht Frankfurt/Main HRB 53898 * USt.-IdNr. DE 220 772 475

---

From: Duane at e164 dot org <[email-masked]>
Date: Fri, 08 Aug 2008 20:48:32 +1000

> vs. hd-dvd so you need not only to address the forbes500 but also

Actually funny you should mention blueray, an article about it today how
it may have won the format wars but no one really cares about it because
DVDs are good enough.

Many think DNS is more or less good enough and well you get the idea.

-- 

Best regards,
 Duane

---

From: "Ondřej Surý" <[email-masked]>
Date: Fri, 8 Aug 2008 14:01:20 +0200

> small companys that lack the clue you want people to have.

That's the reason why to talk to registrars, webhosters and zone hosters (which
is almost the same people here).  That way you hit not only top companies
but also lots and lots of small folks.

Ondrej

---

From: [email-masked]
Date: Fri, 8 Aug 2008 22:48:03 +0000

"Duane" - David is not the only one... he's just more vocal.
 you invite confusion ...  

 based on public records, I will presume this is you until or unless
 othewise proven by credible parties.

Duane Groth
P.O. Box 75
Banksia
NSW 2216 AU

--bill

---

From: Duane at e164 dot org <[email-masked]>
Date: Sat, 09 Aug 2008 10:11:42 +1000

>  "Duane" - David is not the only one... he's just more vocal.

Basing identity on names is pointless, especially with how easily mail
headers can be spoofed, well not even spoofed, but 'set'.

Although should there be an uproar about you not setting your full name?

>  othewise proven by credible parties.

You can presume what ever you wish, does it change who I am by what name
I choose to be known as?

I wonder how the guy went who allegedly changed his name legally to Sony
Playstation...

http://www.wattpad.com/72957-List-of-unusual-personal-names-

-- 

Best regards,
 Duane