Subject: Re: Proposal to fix NSEC

From: [email-masked] (Ted Lindgreen)
Date: Wed, 19 May 2004 15:16:09 +0200

[Quoting Ben Laurie, on May 19, 15:02, in "Re: Proposal to fix  ..."]

> [email-masked] wrote:
...
> > 	I guess that I remain unconvinced.
> > 	What -registrant- data is stored in the DNS?
> > 	In most cases, -registrant- data is stored in
> > 	some whois-like database.
> 
> NSEC provides an index to whois.

That is correct: the whois data is the (privacy legislation) problem,
and being able to walk the tree exposes this problem even more, and
certainly makes it more visible.

However, "fixing NSEC" will not fix the real (whois) problem.

-- teds

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Wed, 19 May 2004 14:33:42 +0000

> However, "fixing NSEC" will not fix the real (whois) problem.

i agree with ted.  dns is a publication mechanism, and if you don't want
something published you probably shouldn't be putting it into dns at all.
and, if your only way to keep whois safe is to hide its index, then you
have probably got other troubles.  parts of the "index" are exposed every
day in server logs or in-addr.arpa/ip6.arpa walks.