Subject: Re: wildcards, dnssec, and opt-in

From: Edward Lewis <[email-masked]>
Date: Wed, 18 Sep 2002 12:48:53 -0400

At 9:38AM -0700 9/18/02, David Conrad wrote:
>want DNSSEC.  What I take Phill's comments to mean is that Verisign is not
>willing to take the risk.

I don't mean to pick on my esteemed colleague quoted above, but let's 
drop picking on business models and the motivation behind deploying 
DNSSEC.  Let's instead get out hands on code that will let us look at 
our own personal "corner cases" to see just how (bad/painless/good) 
opt-in is.  I would think this is an action item from the proponents 
of the change.

Besides my FUD over wildcards and DNSSEC (and FUD it is as I can't 
test it), I have FUD over how an application might interpret the 
results of an opt-in impacted response.  I'm not saying "it ain't 
gonna work," I'm saying "I can't tell right now."

To the proponents of opt-in, don't take my (or others') skepticism as 
an unwillingness to adopt it.  Naturally, any change to a system that 
is in operation will be looked at suspiciously until it becomes clear 
the change is beneficial.  Scientists and engineers are naturally 
skeptical - new theories are only immediately adopted by trade rags 
and supermarket tabloids.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Thu, 19 Sep 2002 18:21:46 +0200 (CEST)

On Wed, 18 Sep 2002, David Conrad wrote:

> Roy,
>
> On 9/18/02 8:39 AM, "Roy Arends" <[email-masked]> wrote:
> > On Wed, 18 Sep 2002, Jakob Schlyter wrote:
> >> On Wed, 18 Sep 2002, Roy Arends wrote:
> >>>> people will deploy dnssec either to increase the security of the dns or to
> >>>> make money. I would guess verisign falls into the second category.
> >>> Nonsense.
> >>>
> >>> People will deploy dnssec to increase the security of the DNS and (or) not
> >>> to loose money (because of lack of security). These are effectively the
> >>> same.
> >>
> >> yes, that may be true for end-zone administrators - I was talking about
> >> the registry.
> >
> > fud, stop it :-)
>
> This is not FUD.
>
> Whether any registry deploys DNSSEC is a business decision of that registry.
> The registry, by and large, is not affected by the integrity issues DNSSEC
> protects against.  If the registry's customers really want (that is, be
> willing to pay for) DNSSEC, it will get deployed, regardless of the
> implications that deployment might have on the registry's infrastructure.

You just proved my point. Not deploying DNSSEC means loosing money. No
commercial entity will be healthy just living by the promise of loosing
money. But that might not be the only motivation.

> Unfortunately, to date, there has not been significant demand for DNSSEC
> from customers.  As such, any registry that considers deploying it must be
> willing to assume some risk, believing that in the future customers will

Take Phill's comment for what they are, I was merely responding to the 2
extreme motivations to "deploy dnssec" that were presented by Jakob, as
if no other motivations where possible. That, and the fact that his
conclusions where based without motivation, and on a technical list like
this, lead me to conclude it was FUD. It still is.

roy