Subject: RE: Confirming the Nominet position

From: "Loomis, Rip" <[email-masked]>
Date: Thu, 27 May 2004 16:40:02 -0400

> >    That aside, I suspect that -IF- one were to waive some of the 
> >    fundamental design principles of the DNS and DNSSEC, it would be
> >    possible to design a technical solution to your particular policy
> >    drivers. 
> 
> This is the crux of it.  With DNS no fundamental principles 
> are waived. We enforce our policy by controlling AXFR.
> With DNSSECbis that is no longer possible.

With all due respect, I believe that your policy is based
on a capability that is implementation-specific, not part
of the protocol, and was therefore specifically not a
requirement when DNSSEC was being designed.  I would
further state that in a reasonably-size TLD with which I
have some familiarity, we believe that even zone enumeration
down to the level of each individual host is acceptable if
it's what's necessary to make DNSSEC work (and I do still
believe that signed proof of non-existence is necessary,
although someone's working hard to convince me otherwise).
Yes, the TLD I mention currently has requirements for the
use of split DNS and restriction of AXFR--but those are
policy items based on the capabilities and tradeoffs
at the time the policy was created.  The policy details
and implementation will likely change.

The fact that someone can more easily enumerate a zone
does not make the individual records within that zone any
more "vulnerable" or less "private".  This applies whether
those records are individual hosts, or delegations.  If
someone does not want their information to be made public,
then do not place it in the public DNS.  Even in the
aggregate, the total list of hosts in any DNS zone does not
represent a vulnerability or a loss of privacy--because
there was a conscious choice to put the information in DNS
in the first doggone place.  Or is your statement that
it's okay for a notional bad guy to obtain 10% of the
.org.uk zone and abuse that information, but the other
90% will really get you angry?

I believe that you are, in fact, going against a fundamental
principle of DNS right now.  The fact that "it always worked
that way" (not strictly true, but close enough) doesn't mean
that the capability will always work in the exact same
way in the future.

My $0.019.

  --Rip

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>