Subject: Re: Confirming the Nominet position

From: Paul Vixie <[email-masked]>
Date: Thu, 27 May 2004 16:39:04 +0000

> > If an operator's reasons for not deploying DNSSECbis are policy ones,
> > how can this be a technical problem?
> 
> How does it sit with you if a technical change forces an operator into 
> changing their policy? Are you saying that by default the policy must have 
> been wrong in the first place?

"wrong" is such a strong word.  "not the way dns was intended to work" and
"placing new requirements on dns, without standardization" are more to the
point.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jim Reid <[email-masked]>
Date: Thu, 27 May 2004 17:53:40 +0100

>>>>> "Jay" == Jay Daley <[email-masked]> writes:

    Jay> How does it sit with you if a technical change forces an
    Jay> operator into changing their policy?

It depends on the technical change and the policy. If we're talking
specifically about a policy which sets out to prevent or thwart zone
enumeration, yes, I do think that policy needs to be reviewed.

Lots of other technical changes to the DNS -- IDN, IPv6, ENUM, etc --
are likely to mean policy changes for operators. In some cases, these
changes will mean policies have to be created. The deployment of
DNSSEC will be no different in that respect. As the saying goes, you
can't make an omelette without breaking eggs. If anything DNSSEC is
going to demand new and/or changed operator policies because of stuff
like key handling and so on.

    Jay> Are you saying that by default the policy must have been
    Jay> wrong in the first place? 

Not necessarily. The policy may well have been right for its time.
But when circumstances change, policies might have to change too.
Even if those policies were right. Or wrong as the case may be.

This thread is getting somewhat off-topic for namedroppers.

---

From: Paul Vixie <[email-masked]>
Date: Thu, 27 May 2004 21:21:59 +0000

> >    That aside, I suspect that -IF- one were to waive some of the 
> >    fundamental design principles of the DNS and DNSSEC, it would be
> >    possible to design a technical solution to your particular policy
> >    drivers. 
> 
> This is the crux of it.  With DNS no fundamental principles are waived. We 
> enforce our policy by controlling AXFR.  With DNSSECbis that is no longer 
> possible.

i disagree.  when i put the first AXFR-blocking code into BIND 4 in ~1988,
i considered it a protocol violation and i made my apologies to the gods.

it appears that those gods have a long memory, and a grand scale of vengeance.