Subject: Re: Summary: DNSEXT WGLC: To OPT-IN or not to OPT_IN

From: [email-masked] (Ted Lindgreen)
Date: Mon, 28 Apr 2003 10:29:19 +0200

[Quoting "Hallam-Baker, Phillip", on Apr 27, 16:44, in "Summary: DNSEXT WGLC ..."]

> Folk may want to check I recorded their statement correctly. ...

Please count my position as "I oppose OPT-IN".

-- ted (NLnet Labs)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Mon, 28 Apr 2003 14:15:41 -0400

I'm opposed to opt-in (yes, dnsext context).

Eric

---

From: [email-masked] (Ted Lindgreen)
Date: Tue, 29 Apr 2003 16:18:36 +0200

[Quoting "Hallam-Baker, Phillip", on Apr 29, 15:03, in "RE: Summary: DNSEXT  ..."]
> Your actual statement was in response to Rob who stated he did not
> think Opt-in was a good idea but would not object for the sake of
> consensus.

Sorry, but according to my e-mail archive it appears that Rob
had written something different:

 [Quoting Rob Austein, on Mar 27, 11:14, in "Re: DNSEXT WGLC: To  ..."]
 > I oppose opt-in, but would be willing to stand aside if the WG were to
 > approach consensus in favor of opt-in, because I strongly agree that
 > we need to make a decision and put this behind us.

I interpreted Rob's words as that he would be willing to stand aside
if the WG were to approach consensus in favor of opt-in. And that
was also my position.

However, giving the fact that the WG is NOT approaching consensus
about opt-in, makes the "but would ..." part of the sentence no
longer relevant.

So _my_ position was, is and remains:

   I oppose opt-in

> I do not believe that I misrepresented your statement during the last
> call period.

I believe you did, anyway, this is now straightend out.

> Given the procedural manipulations and abuses by one of the chairs I
> think folk will understand why this has to be played strictly by the 
> originally stated rules at this point.

And please don't do this. I, and everybody I've spoken with during
the years that I have been involved with the IETF, have high respect
for the chairs and I have never seen manipulations or abuses by
them. On the contrary, I think they do a terrific job.
The fact that not everybody applauds the OptIn idea is not because
of the chairs, it's because of the OptIn idea.

-- ted

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 29 Apr 2003 09:10:29 -0700

> the years that I have been involved with the IETF, 

I have no respect for Randy and he told me during the very first 
meeting I attended, before I had ever said a word beyond my name and
company, that he had no respect for me.

Several people have represented to me that I am the one creating this
issue. That is simply untrue and unsupported by the facts. On the
contrary you will find that in the past 36 months I have been a
signficiant if not principal contributor to the core specifications
of Web Services Security. I have brokered many of the agreements 
between the fiercest rivals in the space.

I suggest that the opponents of OPTIN consider their actions and
ask whether my statements that I may not accept the decision of
the group might have been based on their own statements such as
'I don't believe deployment in .com is important'. If a WG decides
not to address my needs I am under no duty, moral or otherwise
to accept the decision of that group. If telling you that gives
offense then take it.

If it really is true that this working group cannot work with me
then that speaks more for this group than it does for me.

I have two choices here, appeal or simply deploy a DNS Security solution
without IETF sanction. 

I do not believe that the sanction of this group counts for very much 
in the cryptography world, and it is that world my world, which will 
decide whether to sanction deployment of any DNS Security solution or not.

This group has repeatedly told me not to make statements of this
type that they feel are threatening. Well, sorry if it bursts your
bubble if I tell you that in the world of commercial deployment of
cryptographic protocols you will find that I am the only major voice
with standing that is supporting DNSSEC at all.

Name one other front line champion from the commercial cryptography
world who is going to persuade Microsoft or any other major vendor 
to deploy DNSSEC. IF DNSSEC is not deployed in end points the end
to end argument collapses and you are better off with link security
which will be easier to deploy.

This process has been a farce from beginning to end. The only reason
that I am willing to make an appeal is that I believe that the actions
of this group do not reflect those of the IETF in general.

Randy has deliberately constructed this procedure to give himself
the maximum opportunities to obtain the result he has wanted from
the outset.

My purpose in summarising the votes was not to address the consensus
issue, it was to force the chairs to announce their decision so
the process can move on to the next stage. 

I am not prepared to play another round of procedural games in
this forum.

The issue of consensus is not the principal issue that the appeal
is based on. The principal issues are technical merit and due 
process. 

Frankly the consensus of this group on the issue of facilitating
deployment by the largest operator of DNS services does not appear
to me to be a useful question to ask.

		Phill

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 29 Apr 2003 10:02:58 -0700

Actually there was consensus recognized on the technical issues in the
previous last call.

The last call before that had no comments, but those in favor were under the
impression that the last call was a last chance for those opposed to say so
or forever hold their peace.

I would certainly have posted if not for the request of opt-in opponents to
avoid striring up more argument in the group, to simply let the matter pass
quietly. My trust was abused on that occasion, never again.

There was also consensus at the first last call. Otherwise it would not have
been necessary to make the unanounced referral to the DNS Directorate which
held the process up for 6 months but never reported to the group.

The procedures that this group has acted under are simply not defensible. 

Fortunately the decision is no longer in the hands of this group or Randy.
Further argument here is futile, but that won't stop it of course.

		Phill

> -----Original Message-----
> From: Brian Wellington [mailto:[email-masked]]
> Sent: Tuesday, April 29, 2003 12:23 PM
> To: Hallam-Baker, Phillip
> Cc: [email-masked]
> Subject: RE: Summary: DNSEXT WGLC: To OPT-IN or not to OPT_IN
> 
> 
> On Tue, 29 Apr 2003, Hallam-Baker, Phillip wrote:
> 
> > The last call was the FOURTH, each time the last call failed to go
> > the way Randy wanted a new last call was staged. 
> 
> Rather than making unfounded accusations, maybe you should 
> consider the
> fact that during the first 3 calls, as well as this one, 
> there was nothing
> resembling working group consensus in either direction.
> 
> Brian
> 
> --

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 29 Apr 2003 10:25:11 -0700

I was responding to the following question:

"I've said quite a bit on the topic, yet you don't list which side you 
think I am on.  Don't I get a vote too?"

And yes I too pointed out that, no Edward does not get a 'vote'.

When Bush is involved you have to wait for the decision of the 
Supreme Court.

		Phill

> From: Randy Bush [mailto:[email-masked]]
> Sent: Tuesday, April 29, 2003 1:13 PM
> > the call for votes was very clear
> 
> there was never a call for votes.  no surprise, this is the ietf.
> 
> there was a call for people to state their expert opinions.  thanks
> to those who have done so.
> 
> randy
>

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 30 Apr 2003 13:45:04 -0700

> Hallam-Baker, Phillip writes:
> > All anyone is talking about is adding crypto to the DNS
> 
> Security is not some optional feature that we want a few 
> people to ``opt
> in'' to. We need a security system that works for _all_ DNS records.

Tough, there is no way of securing www.xyz.com unless xyz.com chooses
to deploy DNSSEC in the zone.

So your argument does cut both ways.

> Evidently the .com people don't think they can sign all their records.
> That's a serious problem. It has to be fixed. Opt-in doesn't fix it.
> 
> > What value do you claim there is to securing the delegation without
> > any security on the delegated zone?
> 
> Communication from the zone server is often secured by 
> mechanisms other
> than DNSSEC. But this is a side issue.

no it isn't it is absolutely the central issue.

Trying to pretend that securing dotCOM is relevant if the subdomains 
are insecure is precisely the bogus security you are arguing against.

> I'm talking about a different situation, the situation we're 
> aiming for:
> namely, having _all_ zones signed. The .com people can't handle this.
> Opt-in doesn't help the .com people handle it. Opt-in tends 
> to hide the
> fact that they can't handle it.

If you want dotcom signed then best provide a spec that meets the
criteria of the operator.

If you want to propose an alternative that meets those criteria
then do so.

	Phill