Subject: Re: Reality check (was Re: Wildcard NS and DNSSEC)

From: Masataka Ohta <[email-masked]>
Date: Mon, 10 Nov 2003 14:02:53 +0900

Hi, I'm posting to both DNSEXT and DNSOP.

As I post to DNSEXT ML,

> I do love simple approaches.
> 
> However, in this case, the complexity is not in wildcard but
> in DNSSEC.
> 
> So, the proper question is
> 
>     do we need DNSSEC?
> 
> and the reality is that we don't.
> 
> Just discard DNSSEC and move along.

I think secure DNS, with its complexity, is hard to deploy and does
not worth the deployment effot.

Given that securty problem on small ID space is solvable (as was
discussed recently with subject "preventing cache contamination"),
do we still have to try secure DNS deployed (in vain)?

							Masataka Ohta

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: bert hubert <[email-masked]>
Date: Mon, 10 Nov 2003 08:25:29 +0100

> not worth the deployment effot.

Some days ago I wrote http://ds9a.nl/secure-dns.html which may be relevant.

	Bert.

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO
#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 11 Nov 2003 02:39:38 +0900

Bert;

> Some days ago I wrote http://ds9a.nl/secure-dns.html which may be relevant.

I mostly agree (of course).

But, note that it was intended to provide confidentiality by
sharing an IPSEC session key with public keys of a host obtained
from secure DNS, though it is not practical with reasons you
mentioned.

						Masataka Ohta