Subject: RE: chairs' message on opt-in

From: [email-masked] (Ted Lindgreen)
Date: Mon, 5 May 2003 18:43:02 +0200

[Quoting "Hallam-Baker, Phillip", on May  5, 17:39, in "RE: chairs' message  ..."]
> 
> > 1. It took until 1999/2000 before an implementation was ready
> >    for test, in fact, two implementations became available short
> >    after each other: BIND8.2.2p5 and BIND9. That is three years
> >    ago, not ten years.
> 
> I said that the protocol has been undeployable for ten years.
> 
> If Ted can tell me how the protocol could have been deployed 
> without code I am interested to hear it.

It could not, that was my statement: trail deployments take place
for three years now, much too long, but not ten years.

> As Ted points out the trial deployments uncovered a large number
> of problems, including the large zone issue. If one of the chairs 
> .......

1. I certainly never pointed out anything like that.
   On the contrairy: the trial deployments uncovered surprisingly
   few problems. Especially they uncovered that the much feared
   "large zone" problem, was a non-issue: we showed that even with
   an entry-level desktop computer, a Compaq DS-10, we could sign
   and run the .de and .com zonefiles. Of course the .com zone was
   smaller at that time, but computer-power has grown an order of
   magnitude more than the .com zone has grown since.

   Phillip must have missed large parts of the DNSSEC development
   since 2000, so I'll repeat:
     The one and only serious deployment problem we uncovered was
     the maintenance of the registrants KEY in the registry's
     zonefile. This problem has been fixed by the DS RR.
     As a side-effect, with the DS RR we also got rid of the null-key,
     and this further reduced the already manageable "large zone"
     issue by a factor of two for  large zones with few secured
     delegations.

2. Please stop this childish "chair bashing" game.

-- ted

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Mon, 5 May 2003 19:08:57 +0200 (CEST)

On Mon, 5 May 2003, Ted Lindgreen wrote:

> the trial deployments uncovered surprisingly few problems. Especially
> they uncovered that the much feared "large zone" problem, was a
> non-issue: we showed that even with an entry-level desktop computer, a
> Compaq DS-10, we could sign and run the .de and .com zonefiles. Of
> course the .com zone was smaller at that time, but computer-power has
> grown an order of magnitude more than the .com zone has grown since.

Sure, with a reliable, secure and homogeneous network, zero latency,
infinite bandwith, stable topology, zero transport cost and a single
administrator [1], I can imagine it is quite possible, today, but only
today, with 64 bit, no crypto-certified hardware, meanwhile hoping that
IPv6, IDN and ENUM never takes off, since the .com zone might grow, and
the argument will not hold sway.

It took 3 years before moore's law projected on todays hw with 3 yr old
stats would become valid.

Applying Moore's law is valid when applied to all variables, including
data size, not just the ones that fits the argument.

Today's DNSSEC just doesn't scale.

Roy

[1] The Eight Fallacies of Distributed Computing.
    http://java.sun.com/people/jag/fallacies.html

---

From: Paul Vixie <[email-masked]>
Date: Mon, 05 May 2003 18:39:01 +0000

>     http://java.sun.com/people/jag/fallacies.html

i have two observations.

1. you're not going to convince anybody to change their mind about opt-in
using this approach, or indeed any other approach.  the debate is polarized
and no minds will change now.

2. dnssec can be made to scale.  its nondeployability due to lack of opt-in
is an L9 issue not an L1 issue.  (a compelling L9 issue, to be sure, but
the point is, this isn't a hardware problem.)

paul