Subject: Re: I-D ACTION:draft-ietf-dnsext-restrict-key-for-dnssec-03.txt

From: Ted Lemon <[email-masked]>
Date: Tue, 9 Jul 2002 11:28:26 -0500

> With current reality (delegations only in COM) it must not. So, "fugue.com"
> has an A RR and you have delegated "sshd.fugue.com" for fugue's "special
> strings harmony department". Now your key's name would fall into their
> namespace.

Okay, I can see where this would be a problem in the case you describe.   
Everybody here who types "ssh mydomain.com" to lob in, please raise your 
hand?

I guess this would be a problem for people who set up "fugue.com" as their 
web server address instead of "www.fugue.com", though.   I never understood 
why that was such a great idea, but whatever.   So fine, the key has to go 
at _sshd.fugue.com.   Again, why's that a problem?

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 09 Jul 2002 18:40:10 +0200

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

Peter Koch <[email-masked]> writes:

>> No, seriously, if fugue.com doesn't have an A record (and thus, a related 
>> appkey) then it has a CNAME that points you to the True Name of the host, 
>

So what?  If you delegate away a critical zone, it is your loss.

Naturally the name "sshd." could be chosen differently so that people
normally don't have to revoke delegations to take advantage of this,
thus "_sshd.".

You can see from another angle too.  Consider that you trust the
Special Strings Harmony Department to handle keys better than
yourself, then you can delegate this responsibility to them.

> Did you say "2782"? OK, make it _sshd.fugue.com. But then we have this "_"
> debate again.

Please summarize the technical arguments from the debate so we don't
have to go through it again.  Did someone dislike the "_" character?

None of this applies if NAPTR is used, of course.

---

From: Randy Bush <[email-masked]>
Date: Tue, 09 Jul 2002 23:36:09 -0700

this discussion is about how to put app keys in the dns.  but there
is a different list for that.  using namedroppers is disenfranchisng
those who think the topic will be discussed there.  

randy