Subject: Re: OPT-IN at delegation points only (Re: DS and Opt-in - a proposal)

From: [email-masked] (Ted Lindgreen)
Date: Wed, 16 Jan 2002 10:36:51 +0100

[Quoting Paul Vixie, on Jan 16,  1:00, in "Re: OPT-IN at delega ..."]

> why not?  because it's up to zone owners to decide how to serve their zones.

I am all for freedom of choice, but the problem with this is that
while it seems perfectly valid from the zoneholders point of view,
it's not from the resolvers point of view.

Please note, that DNSSEC is not:
  to protect zones/RRs against bad users/resolvers
but was aimed:
  to protect users/resolvers against bad zones/RRs

-- ted

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Paul Vixie <[email-masked]>
Date: Wed, 16 Jan 2002 01:43:37 -0800

>   to protect users/resolvers against bad zones/RRs

i'm actually glad to see this thread continue beyond the pale of death,
since some things are dredging up that are useful and illuminating.  like,
had there been a statement of work for dnssec, it would not have said
anything like either of the above.  i was there, i remember it clearly
enough.  the point of the exercise was (and in my view, remains):

    to make sure that the data seen by resolvers is that published by
    zone owners

if it's some other data, pretending to be zone data, then it ought to
fail authenticity.  of course, this doesn't help resolve the opt-in debate.

now, with the currently-proposed compromise, none of this matters.  i think
we are done.

but it's interesting what can happen when there's no written scope of work.