Subject: Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

From: [email-masked] (Ted Lindgreen)
Date: Tue, 24 Jul 2001 13:07:17 -0700

[Quoting Edward Lewis, on Jul 24, 20:33, in "Re: I-D ACTION:draft ..."]

> Although I have been arguing for verify-on-send/reply, ...

I totally agree with this, like probably almost everyone else on
this list, certainly for the common case of all reasonably sized
zones, which is > 99% of all zones. A special solution (an option
to disable it) seems more logical to cope with the special case.

I can understand that for a handfull of superlarge zones like .com,
BIND can run into a performance problem, but I don't understand
why this must lead to not implement signature checking of local
data at all into nameserver software meant for general use.

Or should we conclude from this that BIND-9, in contrast to all
previous BIND implementations, is geared towards the special
case of superlarge zones, and this special case only?

Also, another proposal from Nominum (Roy Arends) to separate the
functions from authorative servers and caching forwarders, which
does not fit in many (most?) situations, like nameservers on company,
university, etc. networks, seems to support the above conclusion.

However, I can not believe that such is what ISC wants, and what
the various organisations that donate to ISC for BIND development
expect. Or am I missing something?

Confused,
-- ted

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: "David R. Conrad" <[email-masked]>
Date: Wed, 25 Jul 2001 06:26:48 -0700

Hmmm.

I thought this list was not supposed to delve into particular implementations.

Discussions about what ISC's plans are (or intents were) with BIND are 
probably more appropriate on bind{,9}-{users,[email-masked] or with ISC's 
board directly.  While I am not able to speak for ISC in any way,  I 
suspect ISC will do whatever people who fund it want it to do.  I also 
suspect that ISC would be willing to consider donations of code for 
functionality that people wish to have implemented including something like 
verify-on-send/reply or whatever (particularly if it is configurable to 
"off" by the administrator who actually wants his/her nameserver to do 
something other than verify data).

Rgds,
-drc