Subject: [dnsext] Re: A use case

From: Eric Brunner-Williams via VSAT from somewhere <[email-masked]>
Date: Mon, 22 Mar 2010 07:16:05 -0500

I appreciate that this is "at a distance".

I'm concerned at the absence, other than TTLs, of any temporal mechanism
which might be useful to create convergence, over time, between any two
subgraphs.

Restated, it seems to me that the "sameness" design needs to have some
temporal qualifier.

I'm also concerned by the absence of delegation in a draft. I do know
the rational for the draft, and administrative convience should not
permanently constrain delegation.

Cheers,
Eric

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 22 Mar 2010 13:25:15 -0400

> Restated, it seems to me that the "sameness" design needs to have some

Well, a temporal qualifier other than the timers already in the DNS,
you're saying.

If the goal is to say "A clone B", then by definition the longest
anything can be "out of sync" is the longest time it takes for every
authority server to have "current" copies of every relevant zone, plus
the TTL, right?  How tight do you want coherence to be?

(This is, by the way, a central question we need to address.  Some
seem to have the idea that we'll guarantee coherence among caches for
all the "variants".  I know of no way so far proposed to make that
work.)

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Eric Brunner-Williams <[email-masked]>
Date: Mon, 22 Mar 2010 21:24:17 +0100

> Well, a temporal qualifier other than the timers already in the DNS,

Well, no one's yet come up with a nice algebraic cover of all the
timers (caches on Mars excepted) which are relevant to some provable
property of sameness between A and B.

It would be nice if we could say time_to(A clone B) and come up with
an answer, possibly less than BIGINT.

Thanks for the clarification!

Eric

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 22 Mar 2010 18:23:45 -0400

> an answer, possibly less than BIGINT.

That seems to me like a matter of sitting down and working out all the
effects, in exactly the way that we're only just now working out
exactly what all the timers in DNSSEC operation are.  See Olafur's
ICANN presentation and the morris-timings I-D over in DNSOP.

No?

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.