Subject: Re: What are the opt-in issues

From: David Conrad <[email-masked]>
Date: Sat, 08 Jun 2002 14:01:19 -0700

Derek,

On 6/7/02 9:41 PM, "Derek Atkins" <[email-masked]> wrote:
> First, note that the DNS Directorate does not have any real power,
> AFAICT (I've only recently been invited to join).

Randy Bush has used "pushback from the DNS directorate" as justification for
postponing a decision on opt-in.  This would appear to imply some power
delegated to a closed group that keeps no public record.  However, I do not
believe this is the appropriate venue for such discussions.  The poised list
is a better venue.  Unfortunately, it appears the poised list is not
currently accepting new subscriptions.

> Specifically on opt-in, there are a number of attacks that full DNSSec
> protects against but opt-in re-opens.  In particular there are a few
> types of cache poisoning attacks that fall into this category.

It would seem to me that _publicly_ documenting these attacks would go a
long way towards reducing this controversy.

Rgds,
-drc

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Randy Bush <[email-masked]>
Date: Sat, 08 Jun 2002 15:32:35 -0700

> Randy Bush has used "pushback from the DNS directorate" as
> justification for postponing a decision on opt-in.

close.  as explanation, not justification.  and it was the ads
who the directorate advises who received the pushback, exactly
how a directorate is supposed to function.

so we have done our best to get more expert technical input [0]
by asking roy to talk with us a few times.  and now roy and rob
are working on writing up the technical issues.

> The poised list is a better venue.  Unfortunately, it appears
> the poised list is not currently accepting new subscriptions.

heck, yesterday my post there bounced.  but i have heard rumor
that the list is in a maint/move cycle this weekend.

> It would seem to me that _publicly_ documenting these attacks
> would go a long way towards reducing this controversy.

i think rob and roy are working on writing up the technical
issues.

but a worrysome one is that folk are still discovering corner
cases and having to explore technical issues while we are in
what many hoped would be a spec freeze and ship cycle [1].  when
will the tech issues stop arising?

randy

---

[0] - if we want political input, this forum seems to specialize
      in it sufficiently to cause a large flurry of unsubscribes
      in the last day or so.

[1] - i know this is not the forum for technical issues :-), but
      here's a timy one that came up last week.  how does opt-in
      affect ad-is-secure?  it seems to further weaken what
      receiving ad==true tells a stub resolver.

---

From: Derek Atkins <[email-masked]>
Date: 08 Jun 2002 23:10:28 -0400

David Conrad <[email-masked]> writes:

> delegated to a closed group that keeps no public record.  

I don't think it is any more power than, theoretically, Jeff Schiller
and Steve Bellovin asking a small set of people for their private
opinion on "FooProtocol" and then blocking progress due to those
private discussions.  The directorate exists at the pleasure of the AD
and exists to advise the ADs.  The ADs can do whatever they wish using
the information and advice of the directorate.

Keep in mind that working group chairs and ADs have a lot of leeway
here, and private discussions have as much place as discussions on
public lists and WG meetings.  An AD can base their decisions on
whatever information they have, however they get it.  The appeal
process exists to make sure that such decisions are made reasonably.

Complaining about private meetings at the IETF is just plain
ludicrous.  How much work gets accomplished during lunches and dinners
during the IETF?  Should all that be "outlawed" because it's not an
open process?  Or are you only complaining because this is blocking a
protocol that you are interested in?  You can't have it both ways.

> long way towards reducing this controversy.

Well, these attacks were only brought to my attention in Minneapolis.
I believe that Roy and Rob are writing up a document and personally I
am waiting to see what it says.  I believe that Rob knows about this
attack, and I'm fairly sure that Roy does as well.

> -drc

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available