Subject: Re: [DNSOP] Ben Campbell's No Objection on draft-ietf-dnsop-dnssec-roadblock-avoidance-04: (with COMMENT)

From: Wes Hardaker <[email-masked]>
Date: Fri, 05 Aug 2016 14:05:09 -0700

"Ben Campbell" <[email-masked]> writes:

[everything else addressed but I had a question about this last one:]

>>> -8: Seems like there could be  more to say about the potential
>>> consequences about the “fail or proceed without security” decision
>>> in 6
>>> and 6.1.
>>
>> I think the world is very much at a loss as to the best thing to do in
>> that case.  And is likely very case specific.  Military installations
>> tend to be a bit more strict about continuing through to a
>> unacceptable
>> security certificate, eg.  I'm not sure we can enumerate every
>> context,
>> but rather say each local policy will need to do what is appropriate
>> for them.
>>
>
> I think it would be useful to say _that_. (as in "here's a security
> consideration people need to, well, consider")

How's this sound as a concluding sentence:

      <section title="What To Do">
	<t>If Host Validator detects that DNSSEC resolution is not
	possible it SHOULD log the event and/or SHOULD warn user. In
	the case there is no user no reporting can be performed thus
	the device MAY have a policy of action, like continue or
	fail.
  new:  Until middle boxes allow DNSSEC protected information to
	traverse them consistently, software implementations may need
	to offer this choice to let users pick the security level they
	require.</t>
      </section>

It's not an easy thing without introducing more "temporal" text into the document
-- 
Wes Hardaker
Parsons

---

From: "Ben Campbell" <[email-masked]>
Date: Mon, 08 Aug 2016 11:17:09 -0500

> It's not an easy thing without introducing more "temporal" text into 

I have no objection to adding that that, but I was thinking along the 
lines of "Note that continuing without DNSSEC protection in the absence 
of a notification or report could lead to situations where users assume 
a level of security does not exist."

Thanks!

Ben.

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 10 Aug 2016 10:44:38 -0700

"Ben Campbell" <[email-masked]> writes:

> lines of "Note that continuing without DNSSEC protection in the
> absence of a notification or report could lead to situations where
> users assume a level of security does not exist."

That's well worded.  Thanks for providing text, and I'll use it!
-- 
Wes Hardaker
Parsons