Subject: Re: DNSSEXT Yokohama Minutes

From: Paul Vixie <[email-masked]>
Date: Wed, 04 Sep 2002 19:51:24 +0000

> Once you convince the world that following is not needed in any zone.
> 
> *       MX      10 <mail1>
>         MX      20 <mail2>
> 
> Then killing wildcards is becomes a possibility.

"convincing the world" == "boiling the ocean."  let's just convince the
world that if they want wildcards then they have already discarded all
hope of security, so they don't need dnssec for zones using wildcards.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: bert hubert <[email-masked]>
Date: Wed, 4 Sep 2002 22:35:49 +0200

> hope of security, so they don't need dnssec for zones using wildcards.

the case for dnssec is thin enough as it is and right now can't withstand
even the slightest restriction of functionality.

Regards,

bert hubert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO

---

From: Ólafur Guðmundsson<[email-masked]>
Date: Thu, 05 Sep 2002 00:19:17 -0400

>hope of security, so they don't need dnssec for zones using wildcards.

Paul, I hope one day to kill wild cards but there is no way that can
be done without educating the current users/abusers of wild cards how to
accomplish the same thing without wild cards.

You (as an author on a book about real popular mail delivery program)
are in much better position than most of us to explain why wildcards
are not needed for Mail delivery.

If that argument can be made, then largest current usage of wildcards
can be explained away, then we can take on the next group and so on.
Before we know it there will be no reason to use wild cards at that point
we can take on the standards action of removing wild card support in DNS.

We must not offend potential users of DNSSEC by taking away something they
depend on every day.

         Olafur

---

From: Paul Vixie <[email-masked]>
Date: Thu, 05 Sep 2002 05:49:09 +0000

> accomplish the same thing without wild cards.

that's fine, though.  there are three classes of wildcard user, and none
of them is affected in any way by my proposal to preclude wildcard names
from being present in signed zones.

1. for folks who use * because they don't want to enumerate a lot of names,
they can just start enumerating those names.  it's possible that they would
then ask for opt-in depending on how many names we'd be talking about, but
they have a workaround over and above "just don't sign that zone, then."

2. for folks who use * because they cannot enumerate because the names are
not knowable in advance, dnssec would not make their zone more secure and
they should not miss it since it wouldn't do them any good anyway.

3. for folks who use * because it was in some template zone and they never
actually depend on it since their genericfrom mail addresses all end in
@DOM rather than @HOST.DOM, they can just remove the nfg *.

most uses of wildcard are of the third (completely gratuitious and unused)
kind.  i think we have overcomplicated an already fragile dnssec design and 
considerably lengthened its specification/development/deployment cycle for
the protection of wildcarding that does not matter.  the DS problem is just
the last straw for secure wildcards.  let's legislate them out of existence.

> are not needed for Mail delivery.

i see your mail here as From: [email-masked].  no wildcards are needed to
reply to it.  it's only if your mail was From: [email-masked] or
From: [email-masked] *AND* you did not want to install MX's for
both engill and mail.dc that a "* MX" would be necessary.  

> can be explained away, then we can take on the next group and so on.

go for it.

> we can take on the standards action of removing wild card support in DNS.

no.  we must not invalidate existing zones.  we can however make a sieve for
them such that only zones without wildcards can utilize the DNSSEC featureset.

> We must not offend potential users of DNSSEC by taking away something they

show me.