Subject: Re: I-D regarding access control in DNS

From: Måns Nilsson <[email-masked]>
Date: Wed, 19 Mar 2003 04:13:42 +0100

--On Thursday, February 06, 2003 00:14:15 +0900 Tatsuya Baba
<[email-masked]> wrote:

> Hi all,
> 
> I wrote an I-D regarding access control in DNS.
> 
>    draft-baba-dnsext-acl-reqts-00.txt
> 
> I know that DNSSEC specification states "the DNS design philosophy calls
> for all DNS data to be public."  However, I also know that there are
> many people who would like to control access to DNS data.
> 
> Is there anyone who is interested in this area?

Having seen your presentation I would like to stand on the traditional side
and argue that creating a data hiding mechanism in the public DNS is
contradictional with both intention and perception of the DNS system; and
most of the ACL mechanisms presently available are frequently breaking
service, most often due to the administrator failing to comprehend the
scope of his or her actions. So, we have all the foot-shot armament we
could use. 

Best regards, 
-- 
Måns Nilsson            Systems Specialist
+46 70 681 7204         KTHNOC  MN1334-RIPE

We're sysadmins. To us, data is a protocol-overhead.