Subject: [DNSOP] Call for Adoption draft-livingood-dnsop-negative-trust-anchors

From: Tim Wicinski <[email-masked]>
Date: Wed, 26 Nov 2014 10:58:52 -0500

This starts a Call for Adoption for 
draft-livingood-dnsop-negative-trust-anchors. There was much discussion 
at the last meeting about adopting this draft and working on it.

The draft is available here:
	https://datatracker.ietf.org/doc/draft-livingood-dnsop-negative-trust-anchors/

Please review this draft to see if you think it is suitable for adoption 
by DNSOP,  and comments to the list, clearly stating your view.

Please also indicate if you are willing to contribute text, review, etc.

This call for adoption ends Wednesday, December 10th, 2014

Thanks,
tim wicinski
DNSOP co-chair

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 26 Nov 2014 08:16:07 -0800

<no hat>

I support this draft becoming a WG work item, and will review drafts as they proceed. I expect there to be a lot of wordsmithing done on it after that happens, but I believe that this WG can come to rough consensus on the topic and implementation.

--Paul Hoffman

---

From: Ted Lemon <[email-masked]>
Date: Wed, 26 Nov 2014 11:22:24 -0500

On Nov 26, 2014, at 10:58 AM, Tim Wicinski <[email-masked]> wrote:
> Please review this draft to see if you think it is suitable for adoption by DNSOP,  and comments to the list, clearly stating your view.

I think the draft is worth adopting, and the practice is worth documenting.   I have seriously considered the arguments that have been raised, and I think this technique as proposed strikes the right balance for operators.   As a bit of a tinfoil hat wearer, I would never trust some random third party's (e.g., my ISP's) assertions about the security of a zone anyway, so I think this addresses the needs of its intended audience while inconveniencing me not at all.

---

From: "Rose, Scott" <[email-masked]>
Date: Wed, 26 Nov 2014 16:59:11 +0000

I support the adoption and will review/post comments.  I think this draft will be a necessity as DNSSEC validation gets wider deployment.

Scott

On Nov 26, 2014, at 10:58 AM, Tim Wicinski <[email-masked]> wrote:

> 
> This starts a Call for Adoption for draft-livingood-dnsop-negative-trust-anchors. There was much discussion at the last meeting about adopting this draft and working on it.
> 
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

===================================
Scott Rose
NIST
[email-masked]
+1 301-975-8439
Google Voice: +1 571-249-3671
http://www.dnsops.gov/
https://www.had-pilot.com/
===================================

---

From: 神明達哉 <[email-masked]>
Date: Wed, 26 Nov 2014 09:32:14 -0800

At Wed, 26 Nov 2014 10:58:52 -0500,

> by DNSOP,  and comments to the list, clearly stating your view.

I support the adoption of this draft as a dnsop wg item.  I've already
sent some comments on the 01 individual version, in case they were not
noticed:
http://www.ietf.org/mail-archive/web/dnsop/current/msg12614.html
I'm willing to review subsequent revisions, too.

--
JINMEI, Tatuya

---

From: Evan Hunt <[email-masked]>
Date: Wed, 26 Nov 2014 17:52:12 +0000

> at the last meeting about adopting this draft and working on it.

Support adoption, will review and contribute text if needed.
(N.B., I have implemented this mechanism.)

-- 
Evan Hunt -- [email-masked]
Internet Systems Consortium, Inc.

---

From: Daniel Migault <[email-masked]>
Date: Wed, 26 Nov 2014 20:47:55 +0100

I support the adoption of the document. It is one of the identified
requirement in the DNSSEC Validator Requirements draft.

BR,
Daniel

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58

---

From: Olafur Gudmundsson <[email-masked]>
Date: Thu, 27 Nov 2014 11:17:55 -0500

> This call for adoption ends Wednesday, December 10th, 2014

This is a unique document that addresses operational realities and tries hard to do something that protocol purists 
do not like in a sane manner, if we do not document how to do this some real bad ideas will spread. 
The idea is the “permissive validator” i.e. validator that will set AD bit on every answer that validates
but ignores validation errors. 
I strongly support this document will review again

	Olafur

---

From: David Conrad <[email-masked]>
Date: Thu, 27 Nov 2014 08:23:09 -0800

Strongly support. Willing to contribute/review/etc.

Regards,
-drc