Subject: RE: NSEC+ and NO

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 16 Jul 2004 12:37:17 -0700

Since this is only going to be verifiable via applications that
know the semantics it cannot be beyond our abilities to fix this.
A prefixing scheme should be fine.

Each time we go to fix this record there is a huge amount of
pushback trying to minimize the extent of the fix and then
someone finds that the fix is insufficient for their real world
requirements and then we have another 18 month delay while
something else is built and so on. And in the process the
spec gets ever more complex because it is no longer sufficient
to solve the problem, the solution has to avoid treading on
the previous attempts now found to be insufficient.

I think it is entirely possible to build something here that
meets all the stated requirements and have done with the issue
for good. Can't we try that route for once and build something 
that might appear to some slightly more complex than required
or allowing deployments to be slightly less secure than some
think is the perfect solution?

There are a bunch of proposals in the offing to use the DNS
as a protocol policy distribution mechanism. MARID and the
proposed MASS being only the first of that type. These are going
to create a requirement for DNS security that could be the
killer app.

I have interests in the policy publication mechanism, I don't
care how DNS security happens, only that it does happen and it
has sufficient buy in and support from the operators and be
available in circa 4Q2005 which is when I expect the bad guys
to find it worthwhile to perform DNS content attacks. If DNSSEC
meets these criteria I'll be happy to use it but not otherwise.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Ben Laurie
> Sent: Friday, July 16, 2004 11:54 AM
> To: Jim Reid
> Cc: Ólafur Guðmundsson; [email-masked]
> Subject: Re: NSEC+ and NO
> 
> 
> Jim Reid wrote:
> 
> >>>>>>"Ben" == Ben Laurie <[email-masked]> writes:
> > 
> > 
> >     Ben> I make it 4d99aa84d5d72b1b57e56a5b186a0c64.co.uk. (or
> >     Ben> 873bcdba87401b485022b8dcd4190e3e.co.uk. if the more correct
> >     Ben> "amazon.co.uk." is the string).
> > 
> >     >> Now, what if I have already registered that name and 
> even gone
> >     >> as far as trademarking it.  what happens ?
> > 
> >     Ben> Nothing - that name only appears in NSEC2 records 
> - it would
> >     Ben> not be a trademark infringement for it to do so.
> > 
> > Suppose I've just incorporated 873bcdba87401b485022b8dcd4190e3e
> > Limited and registered that name as a trademark. Oh, and I want to
> > register my company's name in co.uk. See you in court. :-)
> 
> Sure, but I'm pretty damn sure you'd lose. If you really want 
> to waste a 
> lawyer's time on this red herring, I'm sure I can get an opinion.
> 
> Cheers,
> 
> Ben.
> 
> -- 
> http://www.apache-ssl.org/ben.html       http://www.thebunker.net/
> 
> "There is no limit to what a man can do or how far he can go if he
> doesn't mind who gets the credit." - Robert Woodruff
> 
> --
> to unsubscribe send a message to 
> [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Mon, 19 Jul 2004 09:57:08 +0200

Hi Jim(*)

If trademark issues form a requirement than please contact Ben and Rip.

(see: http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg01237.html)

-- Olaf

(*) just because Jim brought this up, the message is off course intended for
a broader audience: Bring your implicit and explicit requirements and non-requirements
to Ben and Rip. 

---------------------------------| Olaf M. Kolkman
---------------------------------| RIPE NCC