Subject: RE: wildcards, dnssec, and opt-in

From: Jakob Schlyter <[email-masked]>
Date: Wed, 18 Sep 2002 10:32:26 +0200 (CEST)

On Tue, 17 Sep 2002, Hallam-Baker, Phillip wrote:

> They care if the impact of DNSSEC on .com is such that we do not deploy.

people will deploy dnssec either to increase the security of the dns or to
make money. I would guess verisign falls into the second category.

	jakob

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: David Conrad <[email-masked]>
Date: Wed, 18 Sep 2002 09:45:02 -0700

On 9/17/02 6:01 PM, "Hallam-Baker, Phillip" <[email-masked]> wrote:
> The time issue is far less important than the data volume issue.  No
> extension that causes an immediate and sudden increase in the
> data volumes will be deployed.

Just to be clear, this isn't really true.

The problem is that DNSSEC without opt-in implies a significant and
immediate increase in data volume _without any mechanism by which costs to
account for that increase can be recovered_.

When you are talking about instantaneously multiplying a 2-3GB memory image
by 8-10, I can see how people can get nervous, particularly on a 32 bit
architecture.

Of course, one might question whether keeping all that data in memory is a
good idea in the first place, but changing architecture also costs money.

Rgds,
-drc