Subject: RE: DNSEXT WGLC: To OPT-IN or not to OPT_IN

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 8 Apr 2003 07:17:51 -0700

> A large part of the reason the protocol has gone undeployed 
> for 10 years 
> is the complexity.  Opt-in won't make the protocol simpler.

I think the principal reason is actually lack of a killer 
application retrofitting security is hard because the marginal
advantage is very low if only a small fraction of the deployed
base is secure.

The same problem faces IPSEC, although it has managed to find
a niche that provides a bootstrap for deployment. I don't
think that this group has worked out how to find such a niche
for DNSSEC. If there is one it is likely to be SPAM.

> > If DNSSEC does not have an answer for deployment in .COM it
> > will never be deployed in the form defined by the IETF, it 
> > is as simple as that. 
> 
> Bullying the working group is not the right solution to this, or any, 
> problem.

Hmm, from my point of view the objective of some in the group has
been to bully VeriSign. In particular comments made on more than
one occasion at IETF meetings were 'we don't care about .COM', 
'if DNSSEC breaks large zones, that is a good thing, they should
not exist' etc.

All I have ever done is to lay out the brutal facts. The Internet
is a very large deployed infrastructure and it is going to take a
lot more than a draft becomming an RFC to allow success. There is
absolutely no point in the group comming up with a protocol that
is undeployable.

Even with OPT-IN the group cannot be successful without the 
active support of the major platform vendors. FreeSwan does
not meet that description, sorry. Instead of evangelising the
merits of DNSSEC to key players such as Microsoft, it appears
that many in the group would rather DNSSEC was UNIX only.

I am sorry, but application of a cluebat has ALWAYS been a part
of the IETF lexicon.

The leverage that some in the group thought and still thinks 
exists does not. You cannot bully a large infrastructure provider
into doing things your way, particularly with a process as closed
and crooked as this one has been. If the IETF is going to discuss
DNS protocols in a closed directorate without any representation
from the largest DNS infrastructure company then there is no
value in this forum any more and it is time to choose a new one.

You can call 'take my ball and go home' bullying, but really 
the only reason it looks that way is the relative strength of the
bargaining positions. Nobody interprets the flat earther view
to be bullying because they have no leverage and hence there is
no threat.

It should not have been necessary for that type of threat to be
made simply to get the benefit of due process in this group, but
it was. Perhaps if Randy had not started the relationship by 
telling me that he was predjudiced against my employer things
might have turned out differently, but I doubt it.

You can argue that maybe I could have approached the issue somewhat
differently and there might have been less resistance, the
presentation argument is always used when the case is lost. I
don't think that any other approach would have had any better
effect. We tried nice and we got nothing but insults and the 
DNS directorate discursion. 

I could sit back and just let the group be railroaded into
publishing drafts that are undeployable, if my objective was
to kill DNSSEC that is exactly what I would have done, I would
have let the group go to RFC then said we will wait for support
from 50% of the O/S platforms by market share before deployment.
The whole issue would be dead and burried by now, along with
DNSSEC, and over time DNS itself.

> If Verisign is incapable of serving a signed .COM, perhaps 
> they should 
> consider transferring ownership to someone who is.  No one 
> else thinks 
> it's impossible.

Hey, Brian, we are independent contributors, remember?

The application of that rule seems curious to me. It seems to
me that the true intention is to preserve the privileges of
seniority and allow the academics to denegrate the younger
engineers who are mostly employed in corporate research labs
when they feel like it as 'following company orders' while
preventing the corporate researchers from pointing out that in
the real world some folk have more influence than they do.

As for signing .COM being impossible, nobody ever said that,
I did say it was grossly uneconomic and that the incremental
cost of deployment was unacceptable for an experimental 
protocol that may never be used on a wide scale.

This group is not the only forum that gets to make comment 
on the quality of the group's work. If that quality is not
acceptable the specs produced will not be deployed. 

		Phill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>