Subject: RE: DNSSEXT Yokohama Minutes

From: "Loomis, Rip" <[email-masked]>
Date: Mon, 16 Sep 2002 18:54:20 -0400

> > This will, I'm told by folks who run large zones (other 
> > than .COM), will result in DNSSEC not being deployed in
> > those zones.
> 
> Could you phrase their concerns ? Or do you know if there are 
> alternatives to their wildcard needs ?
> 
> I'm looking for the case where wildcards are vital, and for 
> which there is no alternative present. I can't think of any.

Roy--
I agree that I can't think of any case where there is no
alternative available.  However, from what little I know there
are some folks who run very large numbers of "small" zones,
and a few folks who run small numbers of "medium large" zones,
who currently do use wildcards.  The existence of an alternative
to wildcards does not mean that the alternative will be used,
unless those folks can in some way be convinced that wildcards
are broken and must in fact be fixed.  

Since I don't see such convincing happening (it hasn't to date),
if we tell them that they can't sign a zone with wildcards then
they're quite likely to reply, "Okay we won't sign it."  Then
again, many of those folks are unlikely to sign those zones in
the next five years regardless (IMHO), so I'm not sure we should
let them tie things in knots.

Perhaps David has a more complete and concrete answer.

--
Rip Loomis                         Senior Systems Security Engineer
SAIC Secure Business Solutions Group         www.saic.com/securebiz
Center for Information Security Technology   www.cist-east.saic.com

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Mon, 16 Sep 2002 23:19:52 +0000

> are broken and must in fact be fixed.  

for the case i think you're referring to, an apex DNAME is a better
solution in any case.  i volunteer to edit an i-d on the subject of
"alternatives to wildcarding" if you (and everyone else here) will
send me detailed cases to study.

> let them tie things in knots.

the quality (including simplicity if any) of the specification, and
its timeliness, and the availability of good tools, are all going to
have a much greater impact on the deployment curve than wildcarding.

---

From: Roy Arends <[email-masked]>
Date: Tue, 17 Sep 2002 01:23:38 +0200 (CEST)

> let them tie things in knots.

I'm not saying wildcards should be killed. I'm convinced that wildcard
support makes the system more complex, but not impossible. I'm simply
assessing arguments for and against it.

Thanks,

Regards,

Roy