Subject: Re: [DNSOP] NTA... the new NAT?

From: Shane Kerr <[email-masked]>
Date: Tue, 1 May 2012 17:38:16 +0200

Jim,

(Sorry for the late reply, I've been busy.)

On Wednesday, 2012-04-18 19:52:14 +0100,
Jim Reid <[email-masked]> wrote:
> On 18 Apr 2012, at 19:28, David Conrad wrote:
> 
> > If you don't like the policy of your validator operator, change to
> > a validator operator whose policy you agree with (or, better yet,
> > run your own validator -- it is the only way to be sure).  If you
> > are not permitted to do this, you have other issues.
> 
> +1
> 
> Though you've not explained how someone would be able to find out
> what was the flavour-of-the-month policy of the validator operator
> they were using that day. Assuming the current network's validation
> policy was broken (for some definition of broken) would of course be
> a wise approach. That probably means everyone runs their own
> validator to avoid sucky hotel nets and the like. Which just moves
> where NTAs get (mis)configured.

Well, there is perhaps an idea here. If we make NTA something that can
be queried, then you would have this ability. Full transparency seems
good, although in practice I'm not sure anyone would actually use the
facility if it was available.

--
Shane

---

From: Chris Thompson <[email-masked]>
Date: 01 May 2012 17:34:11 +0100

On May 1 2012, Shane Kerr wrote:
[...]
>facility if it was available.

What would be needed would be a method of finding out about *all*
DNSSEC trust anchors being used, both positive and negative.

And what about DLV? (sorry, Jim)

-- 
Chris Thompson               University of Cambridge Computing Service,
Email: [email-masked]    New Museums Site, Cambridge CB2 3QH,
Phone: +44 1223 334715       United Kingdom.

---

From: paul vixie <[email-masked]>
Date: Tue, 01 May 2012 17:06:11 +0000

> DNSSEC trust anchors being used, both positive and negative.

+1.

> And what about DLV? (sorry, Jim)

dlv is probably wrong for this, for two reasons.

first, it only engages when normal validation fails. i think there are
nta use cases where validation succeeds.

second, dlv is only implementable in a recursive server. we need to take
seriously stub validation and dnssec-enabled apps (like dane).

-- 
"But I'm not done complaining." --Dagon, 2012