Subject: RE: DNSEXT WGLC: To OPT-IN or not to OPT_IN

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 4 Apr 2003 17:25:55 -0800

When you have a protocol that has gone undeployed for ten years
it is probably time to stop thinking about long term optimizations
and start thinking about steps that can be taken to minimize
the cost of deployment and maximize the buy in from the 
operators concerned.

If DNSSEC does not have an answer for deployment in .COM it
will never be deployed in the form defined by the IETF, it 
is as simple as that. 

		Phill

> -----Original Message-----
> From: Steven M. Bellovin [mailto:[email-masked]]
> Sent: Thursday, March 27, 2003 1:52 PM
> To: Rob Austein
> Cc: [email-masked]
> Subject: Re: DNSEXT WGLC: To OPT-IN or not to OPT_IN 
> 
> 
> In message <[email-masked]>, 
> Rob Austein writes:
> >I oppose opt-in, but would be willing to stand aside if the 
> WG were to
> >approach consensus in favor of opt-in, because I strongly agree that
> >we need to make a decision and put this behind us.
> >
> >I've posted enough on this subject in the past that the reasons why I
> >oppose opt-in should be clear by this point (for an example, see my
> >message to this list on 4 February 2003).  The summary 
> version is that
> >opt-in trades some near-term pain (cost) for operators of large
> >servers against some ongoing pain (cost and complexity) for 
> developers
> >and resolver operators, and while I have some sympathy for the large
> >server operators, I don't think that this is a good tradeoff for the
> >Internet as a whole.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Brian Wellington <[email-masked]>
Date: Mon, 7 Apr 2003 19:05:54 -0700 (PDT)

> the cost of deployment and maximize the buy in from the 

A large part of the reason the protocol has gone undeployed for 10 years 
is the complexity.  Opt-in won't make the protocol simpler.

> will never be deployed in the form defined by the IETF, it 

Bullying the working group is not the right solution to this, or any, 
problem.

If Verisign is incapable of serving a signed .COM, perhaps they should 
consider transferring ownership to someone who is.  No one else thinks 
it's impossible.

Brian

---

From: Paul Vixie <[email-masked]>
Date: Tue, 08 Apr 2003 03:24:35 +0000

> is the complexity.  Opt-in won't make the protocol simpler.

let's consider the way that complexity has lengthened the timeline.  mostly
it's because of the lengthy debate which accompanied complex proposals.

> consider transferring ownership to someone who is.  No one else thinks 

verisign hasn't said it was impossible, either.  they say it's expensive,
because of the infrastructure that dnssec functionality would lay on top of.
they also say it's too expensive in the absence of any accompanying new short
term revenue to be worth deploying on speculation or using cross-subsidy.

however, that debate is pointless.  verisign as a zone publisher is
allowed to make decisions concerning their zone.  that's "autonomy".  anyone
who thinks they can get leverage on verisign to make them sign COM without
opt-in, or failing that, to get it moved to a different publisher, is not
being realistic.

therefore whatever verisign's reasons are do not matter, and the
practical point is that they've said they won't sign COM without either
opt-in or a larger market, and that larger market may never appear without
support for dnssec for COM subdomains.

unless you think they are bluffing, or you think dnssec has some
measurable difference in quality or purity with and without opt-in
(hint: ~zero = ~zero), then the debate, such as it was, is over, just
plain and simply over, and we ought to get on with stuff.