Subject: Re: Joint DNSEXT & NGTRANS agenda

From: "D. J. Bernstein" <[email-masked]>
Date: Thu, 02 Aug 2001 07:44:45 -0700

Robert Elz writes:
> before it has even had a reasonable chance to be tested

We're saying ``deployment will be a disaster, and here's why.'' You're
saying ``let's deploy it and see what happens.'' That's unacceptable.
A6 and DNAME need to be killed _before_ people start relying on them.

---Dan

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 02 Aug 2001 07:47:51 -0700

Robert Elz wrote:

> A couple of years ago we made the choice.   That was A6.  =20
> It has taken since then until about now (or even a bit=20
> beyond now) to get to the point where A6 can be deployed=20
>(when the implementations exist, etc).

> This isn't a case where we have 2 competing proposals on=20
> a more or less equal footing, and want to choose one, its=20
> a case where we have an IETF consensus doc, and are now=20
> considering deprecating it, before it has even had a=20
> reasonable chance to be tested, and without doing any actual=20
> testing (that has been reported anyway) to suggest that=20
> it won't work.

I have no doubt we could figure out how to make A6 work, and with a few =
guidelines written up even keep it from being noticeably different. My =
concern is that the basic premise for its need is explicitly =
contradictory to economic realities. As much as people claim they need =
to renumber their customers to compress the routing table, how many will =
really tell the people paying them that to continue being a customer =
they have to go through some level of routine pain? Even if it is only a =
few records a couple of times a year, the customers will quickly bail =
and find a provider that can deal with the entropy. This is just another =
case of the point of pain not matching with the gain, so it simply won't =
happen.

Tony

---

From: Robert Elz <[email-masked]>
Date: Thu, 02 Aug 2001 07:43:04 -0700

Date:        Thu, 02 Aug 2001 20:03:36 +0900
    From:        [email-masked]
    Message-ID:  <[email-masked]>

  | 	One last comment - you and I are not agreeing on the urgency of this.

Perhaps not, though I don't think we're that far apart on that.

  | 	If we don't pick AAAA or A6 right now, we cannot deploy IPv6 NS
  | 	records and/or IPv6 MX records, we cannot convince gTLDs/ccTLDs to
  | 	accept IPv6 NS record registrations.  The deadline for picking them up
  | 	is at the London IETF.  We wanted the choice like a couple of years ago.

A couple of years ago we made the choice.   That was A6.   It has taken
since then until about now (or even a bit beyond now) to get to the point
where A6 can be deployed (when the implementations exist, etc).

This isn't a case where we have 2 competing proposals on a more
or less equal footing, and want to choose one, its a case where we
have an IETF consensus doc, and are now considering deprecating it,
before it has even had a reasonable chance to be tested, and without
doing any actual testing (that has been reported anyway) to suggest
that it won't work.

  | 	We operate commercial IPv6 backbone and selling services to customers
  | 	since the summer of 1999.  And we don't have an official choice of
  | 	IPv6 DNS records?

We do, that is A6.   What we don't have is those actually deployed yet.

  | 	We did the analysis and test operations, and the result is in my draft.

Maybe the draft is just lacking the necessary information, but I see
nothing in it that is more than speculation, and fear of the unknown.

  | 	The open questions in my drafts are intended to be answered, or get
  | 	the consensus among people.  This is not intended to be left
  | 	ununsewered (What suggested you like that?  Did I tell you so?
  | 	how can can you assert like that without checking with me?).

That's from the conclusion of the draft.   It makes no sense to want
answers to questions that are only relevant if A6 is to be used, if the
answer is to deprecate A6.   You say that A6 should be deprecated.  In
that case, it can't possibly be interesting to find the answers to
questions that are only relevant if A6 is to be used...

kre

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 02 Aug 2001 07:47:51 -0700

Tony

---

From: Michael Richardson <[email-masked]>
Date: Thu, 02 Aug 2001 09:59:41 -0700

My main fear about A6 is documentation: it seems too complicated, and the failure
cases for it seem very hard to explain to muggles.

  Muggles have enough time maintaining IPv4 DNS records without DNSSEC.

  I am not certain if DJB is correct about the technical argument about
signatures. I do not have a problem resigning my zones every day. I think
that I have enough CPU. Maybe this won't be true for ccTLDs, etc.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy");  [

---

From: Michael Richardson <[email-masked]>
Date: Thu, 02 Aug 2001 09:59:41 -0700

---

From: Dancer Vesperman <[email-masked]>
Date: Fri, 03 Aug 2001 16:14:22 -0700

> A6 and DNAME need to be killed _before_ people start relying on them.

You know, I seem to recall that I said the same about HTTP, way back when...

I get the impression that it's too late to deploy something that isn't 
already ready.

I agree with itojun (It's true that I spend a lot of time doing this): 
There is no time. A broken thing is probably better than no thing.

IT people tend to laugh at IPv6 as vaporware these days. Personally, I 
don't much _CARE_ if it's possible for a DNS administrator to get things 
Horribly Wrong(tm) with A6 records. They _already_ get things Horribly 
Wrong(tm) with A records, NS records, MX records, SOA records and CNAME 
records....screwing up their domains with yet another record type would 
merely be continuing a grand tradition.

Dan: You have a point. Maybe a good one. Personally, I don't think it's 
quite good enough given the apparent time-frames. Fait accompli and all 
that.

D