Subject: RE: wildcards, dnssec, and opt-in

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 17 Sep 2002 18:01:14 -0700

> > The vast majority of users have zones that are IN .com so 
> for them the
> > issue is pretty damn important.
> 
> It's important for you, not for them.  Do you really think 
> the users care 
> how long it takes to sign .com?

They care if the impact of DNSSEC on .com is such that we do not deploy.

The time issue is far less important than the data volume issue. No
extension that causes an immediate and sudden increase in the
data volumes will be deployed.

> > Standards groups are a two way street, don't tell me my requirements
> > are irrelevant one day and then go and complain later if I 
> do something
> > you don't like.
> 
> This seems pretty off-topic.  I didn't intend to dismiss your claims;
> merely that they don't apply to most users.

On the contrary, they apply to the vast majority of users whose domains
are in .com and .net.

I do not believe it is off topic to point out that rejection of a 
set of requirements has consequences that will render the entire 
group irrelevant.

If you tell me that you are not going to address people's requirements you
have absolutely no reason to complain if they do not accept the decisions
made here. We already reached consensus here, but for Katherine Harris II
and her supreme cabal the drafts could have been RFCs by now. So don't
complain if people choose the original group consensus over the cabal, or
go form their own cabal somewhere else.

		Phill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jakob Schlyter <[email-masked]>
Date: Wed, 18 Sep 2002 10:32:26 +0200 (CEST)

> They care if the impact of DNSSEC on .com is such that we do not deploy.

people will deploy dnssec either to increase the security of the dns or to
make money. I would guess verisign falls into the second category.

	jakob

---

From: Roy Arends <[email-masked]>
Date: Wed, 18 Sep 2002 17:15:46 +0200 (CEST)

> make money. I would guess verisign falls into the second category.

Nonsense.

People will deploy dnssec to increase the security of the DNS and (or) not
to loose money (because of lack of security). These are effectively the
same.

Roy

---

From: Jakob Schlyter <[email-masked]>
Date: Wed, 18 Sep 2002 17:36:12 +0200 (CEST)

> to loose money (because of lack of security). These are effectively the

yes, that may be true for end-zone administrators - I was talking about
the registry.

	jakob

---

From: Roy Arends <[email-masked]>
Date: Wed, 18 Sep 2002 17:39:40 +0200 (CEST)

> yes, that may be true for end-zone administrators - I was talking about

fud, stop it :-)

---

From: David Conrad <[email-masked]>
Date: Wed, 18 Sep 2002 09:45:02 -0700

> data volumes will be deployed.

Just to be clear, this isn't really true.

The problem is that DNSSEC without opt-in implies a significant and
immediate increase in data volume _without any mechanism by which costs to
account for that increase can be recovered_.

When you are talking about instantaneously multiplying a 2-3GB memory image
by 8-10, I can see how people can get nervous, particularly on a 32 bit
architecture.

Of course, one might question whether keeping all that data in memory is a
good idea in the first place, but changing architecture also costs money.

Rgds,
-drc

---

From: David Conrad <[email-masked]>
Date: Wed, 18 Sep 2002 09:38:41 -0700

Roy,

>> yes, that may be true for end-zone administrators - I was talking about

This is not FUD.

Whether any registry deploys DNSSEC is a business decision of that registry.
The registry, by and large, is not affected by the integrity issues DNSSEC
protects against.  If the registry's customers really want (that is, be
willing to pay for) DNSSEC, it will get deployed, regardless of the
implications that deployment might have on the registry's infrastructure.

Unfortunately, to date, there has not been significant demand for DNSSEC
from customers.  As such, any registry that considers deploying it must be
willing to assume some risk, believing that in the future customers will
want DNSSEC.  What I take Phill's comments to mean is that Verisign is not
willing to take the risk.

Rgds,
-drc

---

From: Edward Lewis <[email-masked]>
Date: Wed, 18 Sep 2002 12:48:53 -0400

>willing to take the risk.

I don't mean to pick on my esteemed colleague quoted above, but let's 
drop picking on business models and the motivation behind deploying 
DNSSEC.  Let's instead get out hands on code that will let us look at 
our own personal "corner cases" to see just how (bad/painless/good) 
opt-in is.  I would think this is an action item from the proponents 
of the change.

Besides my FUD over wildcards and DNSSEC (and FUD it is as I can't 
test it), I have FUD over how an application might interpret the 
results of an opt-in impacted response.  I'm not saying "it ain't 
gonna work," I'm saying "I can't tell right now."

To the proponents of opt-in, don't take my (or others') skepticism as 
an unwillingness to adopt it.  Naturally, any change to a system that 
is in operation will be looked at suspiciously until it becomes clear 
the change is beneficial.  Scientists and engineers are naturally 
skeptical - new theories are only immediately adopted by trade rags 
and supermarket tabloids.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

---

From: Brian Wellington <[email-masked]>
Date: Wed, 18 Sep 2002 14:27:52 -0700 (PDT)

> opt-in is.  I would think this is an action item from the proponents 

As soon as there is working code, the argument becomes "There's working
code, how bad can it be?".  A decision should be made based on the merit
of the ideas, and I don't think the existence of an implementation should
ever be used to further progress.

> gonna work," I'm saying "I can't tell right now."

To my knowledge, no one's ever claimed that opt-in won't work.  Only
Phill, as far as I can tell, claims that DNSSEC won't work without opt-in.

Brian

---

From: Roy Arends <[email-masked]>
Date: Thu, 19 Sep 2002 18:21:46 +0200 (CEST)

> implications that deployment might have on the registry's infrastructure.

You just proved my point. Not deploying DNSSEC means loosing money. No
commercial entity will be healthy just living by the promise of loosing
money. But that might not be the only motivation.

> willing to take the risk.

Take Phill's comment for what they are, I was merely responding to the 2
extreme motivations to "deploy dnssec" that were presented by Jakob, as
if no other motivations where possible. That, and the fact that his
conclusions where based without motivation, and on a technical list like
this, lead me to conclude it was FUD. It still is.

roy