Subject: Re: [dane] DNSSEC Optionality (was: New Version Notification for draft-ietf-dane-use-cases-03.txt)

From: =JeffH <[email-masked]>
Date: Fri, 17 Jun 2011 14:36:53 -0700

> I think for the browser case, the majority of TLS, no one will ever use
 > non-DNSSEC secured DANE records, whether we allow these to go into the
 > user-case document or not. It's just not worth the potential risks.
 >
 > I really hope the use-cases can make a simple a clear statement to
 > application developers to not use DANE without DNSSEC protection. Writing
 > up convoluted marginalised use cases where it could theoretically be
 > useful would cause more damage by badly written implementations that
 > got it wrong.

Although I sympathize with this position, this use-case exercise, as I 
understand it, is to inform the protocol design work, and isn't intended to be 
a deployment guide.

IMV, a use-cases-for-protocol-design doc generally isn't the place to be using 
the RFC2119 MUST, SHOULD, MAY language.

We can place such imperatives in the protocol doc proper. We can also do a 
deployment guidelines doc if we gin up enough gumption and all.

Perhaps we ought to put "This is NOT A deployment guide" right up in the front 
of the introductoin of -dane-use-cases.

=JeffH