Subject: RE: OPT-IN at delegation points only (Re: DS and Opt-in - a propo sal)

From: [email-masked] (Ted Lindgreen)
Date: Thu, 17 Jan 2002 21:17:17 +0100

[Quoting "Hallam-Baker, Phillip", on Jan 17, 18:29, in "RE: OPT-IN at delega ..."]
...
> > -----Original Message-----
> > From: Randy Bush [mailto:[email-masked]]
> > Sent: Wednesday, January 16, 2002 6:05 PM
> > To: Hallam-Baker, Phillip
> > Cc: [email-masked]
> > Subject: RE: OPT-IN at delegation points only (Re: DS and Opt-in - a
> > propo sal)
> > 
> > > So making it impossible for the operator of 85% of the DNS
> > > domain names to deploy DNSSEC will speed up the roll out?
> > 
> > please stop trying to throw corporate weight.  it will only justify
> > pissing contests.
> > 
> > randy
...
> 	If Ted's original claim was on point then the rebuttal will 
> surely be.

I thought that Randy's suggestion to throwing the same arguments
at each other over and over again was very good, and I refrained
from replying. However, it seems Phillip demands my answer, even
though all arguments have been repeated many, many, too many,
times :-(

OK, but this is really my last post on this subject:

1. Yes, Phillip's statement is incorrect: no-one disputes that using
   non-Opt-In may lead to more startup cost, but also no-one supports
   Phillip's claim that non-Opt-In makes it IMPOSSIBLE to deploy
   DNSSEC at large TLDs.

2. I am not concerned, that TLDs, both the non-profit TLDs and
   for-profit TLDs will jump on DNSSEC as soon as:
   1. The standard has been finalised.
   2. Serious domainholder demand is expected.
   Likely, VeriSign will be a frontrunner, Opt-In or non-Opt-In.

3. However, I am really concerned, that users (read: the domainholder's
   clients) may not embrace DNSSEC soon enough that it leads to great
   domainholder demand. That will lead to only some scattered secured
   zones and perhaps even only a few RRs. This, in turn will lead to
   even less users interest, and the process will stop there.

The reason that I am concerned about the users interest is based on:

1. Most of discussion on this list is from a DNS-manager or domainholder
   perspective. I have hardly read anything from the resolver perspective.
   I looks like users and their tool, the resolver, are a little ignored.
2. At least two software packages to serve domainholders are available, and
   people are actively improving it.
   But little is available on the resolver side. BIND-8 has a sig/key
   checker/chaser ("host -s"), but it's broken. BIND-9 lacks even such
   a basic tool (NLnet Labs has produced an addition to both "host" and
   "dig" to implement a checker/chaser in BIND-9. This was offered
   to Nominum, but not included (yet?)). It looks that there is really
   little interest in doing anything with the costly KEYs and SIGs...

I think, that looking at DNSSEC from the resolver perspective needs
much more attention, and soon, otherwise DNSSEC will likely remain
limited to scattered parts of the DNS tree.

Back to Opt-In: from the resolver perspective, Opt-In does not
seem helpfull to give users a warm, secured feeling, because it
further obscures what's secured and what's not.

-- ted

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Brian Wellington <[email-masked]>
Date: Thu, 17 Jan 2002 18:05:37 -0800 (PST)

>    little interest in doing anything with the costly KEYs and SIGs...

For the record, my objection to this at the time was the fact that what
was provided was not a "basic tool", but an extension to an already
overcomplicated program, that would have had strange interactions with
existing features of the overcomplicated program.  If someone were to
submit a basic tool that just verified a chain of signatures, I see no
reason why it wouldn't be included in future releases of BIND 9.

Brian