Subject: Re: [dane] Why shut down the DANE group?

From: Geoff Huston <[email-masked]>
Date: Wed, 2 Mar 2016 07:37:02 +1100

> On 14 Feb 2016, at 5:40 AM, Dave Crocker <[email-masked]> wrote:
> 
> 
> On 2/13/2016 2:42 AM, Patrik Fältström wrote:
>> On 13 Feb 2016, at 5:35, Viktor Dukhovni wrote:
>> 
>>> Yes, I understand that DNSSEC is at present and may indefinitely remain too high a bar.
>> 
>> It is too high a bar just because this is repeated over and over again. Not because it really is.
> 
> 
> Please explain.  The continuing lack of widespread adoption is only due to what?  The fact that people keep saying it's too hard?  It would be easy if only they would realize it?
> 
> When a market is glacially slow to adopt something, it does not help much to blame the market.
> 

two graphs:

http://bit.ly/1QJxNo0

http://bit.ly/1LHZRa3

These two graphs tell me that by the reasoning you are providing about DNSSEC (“glacially slow” adoption) IPv6 is a complete and total waste of our collective time.

Today we see some 1 in 6 users using DNS resolvers that will perform DNSSEC validation in signed responses. 1 in 6. Thats some half a billion users will validate DNSSEC signed responses - AND WILL NOT GO TO A BADLY SIGNED NAME.

By comparison, how’s V6? 1 in 20 users will use IPv6. 

I find it impossible to reconcile the mood of doom and depression surrounding DNSSEC I read from this post and others in a similar vein, while at the same time observing the sunny, and by this metric completely insane, optimism of the IPv6 proponents. 

Sometimes the lies we tell ourselves just get in the way. This is one such case. 

regards,

   Geoff

---

From: "Patrik Fältström" <[email-masked]>
Date: Tue, 01 Mar 2016 21:54:34 +0100

> Sometimes the lies we tell ourselves just get in the way. This is one such case.

Yup!

My view for DNSSEC:

Will be deployed in the same speed as new DNS software will include DNSSEC by default and it will be turned on by default. Further, as the validation is done by the ISP, the end user is not involved.

My view for IPv6:

Each person/organization that is responsible for IP addressing will completely ignore IPv6 (i.e. have it as priority number 7 in a list where only the first three can be dealt with) until the day when suddenly there for that person/organization is zero IPv4 addresses to use.

I.e. we have for both IPv6 and DNSSEC passed the point where "normal" advertisements help.

Now the best help we get is by just adding time.

Sure, we can still inform about both of the above, specifically the 2nd, but will it help?

   Patrik

---

From: Warren Kumari <[email-masked]>
Date: Tue, 01 Mar 2016 21:26:08 +0000

On Tue, Mar 1, 2016 at 3:54 PM Patrik Fältström <[email-masked]> wrote:

> Will be deployed in the same speed as new DNS software will include DNSSEC
> by default and it will be turned on by default. Further, as the validation
> is done by the ISP, the end user is not involved.
>

Yup, but it is critical that we do not screw up the KSK roll -- otherwise
the response is likely to disable validation and "once bitten, twice shy"

 W

>
> My view for IPv6:
>
> Each person/organization that is responsible for IP addressing will
> completely ignore IPv6 (i.e. have it as priority number 7 in a list where
> only the first three can be dealt with) until the day when suddenly there
> for that person/organization is zero IPv4 addresses to use.
>
>
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
>

---

From: "John Levine" <[email-masked]>
Date: 2 Mar 2016 00:24:21 -0000

>My view for DNSSEC:
>
>Will be deployed in the same speed as new DNS software will include DNSSEC by default and it will be turned on by default.
>Further, as the validation is done by the ISP, the end user is not involved.

I see it as a lot like IPv6 -- the fans claim it's great, just do it,
while in the real world the tools are somewhere between half-hearted
and unsuable and the benefits vague.

As a concrete datapoint, I have about 250 signed zones on my DNS
server.  Half are usable with a DS record in the parent, all zones
that I have registered for myself or as a registrar reseller.  I've
been able to install the ones I have because Tucows has a proprietary
but documented reseller API that lets me do it automatically, not one
at a time.  I did one elsewhere (sp.am) by hand, just to see if it was
possible.

The other half are not usable with DNSSEC because there is no way for
me to install the DS -- I'm running the DNS for domains other people
have registered at other registrars, so those registrars won't talk to
me.  In theory I could walk my users through their various registrars'
DNSSEC hoops; in reality life is too short.

You might hope that after more than a decade we'd have gotten around
to addressing basic configuration problems, but no.

R's,
John

---

From: "Patrik Fältström" <[email-masked]>
Date: Wed, 02 Mar 2016 06:46:38 +0100

On 2 Mar 2016, at 1:24, John Levine wrote:

> me.

...and the people you talk with have not added you as a tech contact?

> In theory I could walk my users through their various registrars'

Of course.

But the registrars issue I, speaking as a registrar, will not be sorted out before registries _also_ start to move to a harmonized management of DNSSEC. Registrars make for example in Sweden about $1/domain name while the registry charge $10/domain.

   paf

---

From: "John R Levine" <[email-masked]>
Date: 2 Mar 2016 10:20:14 -0500

> ...and the people you talk with have not added you as a tech contact?

It doesn't matter -- I don't have the password to log into their registrar 
account.

> But the registrars issue I, speaking as a registrar, will not be sorted out before registries _also_ start to move to a harmonized management of DNSSEC. Registrars make for example in Sweden about…

This isn't just an issue for registrants and registrars; it's a problem 
wherever the operator of one zone delegates a subzone to someone else with 
whom they don't have a side channel to exchange the signing key.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.

---

From: "Patrik Fältström" <[email-masked]>
Date: Wed, 02 Mar 2016 16:26:54 +0100

On 2 Mar 2016, at 16:20, John R Levine wrote:

> It doesn't matter -- I don't have the password to log into their registrar account.

Ok, my point was that a tech contact should have their own log in. It has in the Frobbit system ;-)

> This isn't just an issue for registrants and registrars; it's a problem wherever the operator of one zone delegates a subzone to someone else with whom they don't have a side channel to exchange the signing key.

100% agree.

But just to close this, I did not want to restart a discussion between the ones that are more optimistic and less optimistic about DNSSEC or IPv6. I just wanted to say that I personally for DNSSEC think we will not get forward movement faster than software get the features by default so that one have to turn off things to not use it. For that to happen, yes, many many things are still to be resolved. For example side channel for the DS (which we have a suggestion on how to implement, by publication of the key material in the zone itself).

Glacier speed indeed...

    paf

---

From: "John R Levine" <[email-masked]>
Date: 2 Mar 2016 10:34:54 -0500

> Ok, my point was that a tech contact should have their own log in. It has in the Frobbit system ;-)

They don't in any of the gTLD registrars I've used.  As far as I can tell, 
the only actual use of the tech contact is so ISC employees can flame you 
if your DNS records are mildly inconsistent.

>  I just wanted to say that I personally for DNSSEC think we will 
> not get forward movement faster than software get the features by 
> default so that one have to turn off things to not use it. For that to 
> happen, yes, many many things are still to be resolved. For example side 
> channel for the DS (which we have a suggestion on how to implement, by 
> publication of the key material in the zone itself).

These issues are certainly soluble, but it's pretty telling that this 
obvious problem has been been facing us for ten years and we're just 
getting around to it now.

FYI, people at Google have told me that they have no plans to turn on 
DNSSEC for their zones any time soon because too much stuff breaks.  Since 
it's Google, I expect they have precise but non-public numbers for what 
too much means.  I don't know enough details to guess whether normal 
upgrade cycles with newer software will fix the breakage.

Regards,