Subject: Re: On dynamic NSEC

From: Edward Lewis <[email-masked]>
Date: Thu, 11 Nov 2004 09:16:42 -0500

At 8:10 -0500 11/11/04, Alex Bligh wrote:
>Agree; DNSSEC-bis prohibits epsilon based dynamic signing, and we shouldn't
>be fiddling with DNSSEC-bis now (not sure we even can).

I'd put it this way - we shouldn't be fiddling with the DOCUMENTS 
that are in production.

But don't let DOCUMENTS get in the way of RUNNING CODE.  Proposed 
Standard status recognizes that there may need to be adjustments to 
the text to describe reality.

I said in another group "it's never too late to comment on the 
protocol, but it's too late to comment on the document" in the 
context of a document that we had handed to the IESG.

Simon is right about the passage.  Alex is half right that fiddling 
with DNSSECbis - we ought not fiddle with docs so implementers and 
operators can get to work.  But never let the bureaucracy of what's 
been written get in the way of real technical progress.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-571-434-5468
NeuStar

I would have been at the meeting, but I was busy raking the leaves from
the (now) empty non-terminals in my yard.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ólafur Gudmundsson/DNSEXT co-chair <[email-masked]>
Date: Thu, 11 Nov 2004 09:47:03 -0500

At 09:16 11/11/2004, Edward Lewis wrote:
>I'd put it this way - we shouldn't be fiddling with the DOCUMENTS that are 
>in production.
>
>But don't let DOCUMENTS get in the way of RUNNING CODE.  Proposed Standard 
>status recognizes that there may need to be adjustments to the text to 
>describe reality.
>
>I said in another group "it's never too late to comment on the protocol, 
>but it's too late to comment on the document" in the context of a document 
>that we had handed to the IESG.
>
>Simon is right about the passage.  Alex is half right that fiddling with 
>DNSSECbis - we ought not fiddle with docs so implementers and operators 
>can get to work.  But never let the bureaucracy of what's been written get 
>in the way of real technical progress.

To amplify what Ed said, at this point we do not know the FULL extent
of the changes needed to the DNSSECbis documents, when we know that we
will issue an update to DNSSECbis documents.
We also do not know at this time for sure that anyone will deploy
the +/-epsilon changes, there might be engineering reasons not to do that
in which case the updating the protocol is a mute point.

Please start the discussion on what +/- epsilon will be like, once the
WG understands and has consensus on the modified protocol, the appropriate 
changes to protocol described in DNSSECbis will be made.

         Olafur

         Olafur

---

From: Alex Bligh <[email-masked]>
Date: Thu, 11 Nov 2004 15:11:20 +0000

--On 11 November 2004 09:47 -0500 "Ólafur Gudmundsson/DNSEXT co-chair" 
<[email-masked]> wrote:

> will issue an update to DNSSECbis documents. [***]

Sorry to be an aspiring documentation-lawyer, but I presume what you
mean is that
(a) we should be developing a draft documentation which,
    if things run to completition will form a stand-alone set of documents
    which can be read as as update for the existing DNSSECbis protocol
    (i.e. that the two instances of the word "documentats" above should
    be "protocol"); and not
(b) that we are going to be doing work now which will result is us asking
    the IESG to change the DNSSECbis documents themselves prior to further
    advance down the standards track.

I would be worried if you did in fact mean (b) as I thought the entire
purpose of sending DNSSECbis off to the IESG although quite a few people
think it is far from perfect was so that further development would NOT
disrupt code development deployment.

Alex

---

From: Alex Bligh <[email-masked]>
Date: Thu, 11 Nov 2004 19:03:35 +0000

--On 11 November 2004 13:55 -0500 "Ólafur Gudmundsson/DNSEXT co-chair" 
<[email-masked]> wrote:

> DNSSECbis documents are set in stone.
>
> The WG can issue NEW documents that clearly, coherently and safely
> specify changes in DNSSECbis protocol.

Thanks :-) (& I agree).

Alex