Subject: RE: I-D ACTION:draft-iab-dns-choices-00.txt

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 18 Oct 2004 15:13:34 -0700

Bill writes:

> > The value of DNSSEC is going to come in authenticating policy 
> > publication, in particular security policy such as MASS, MARID
> > and others to come in the future. 
> > 
> 
> 	clearly you and i do not share a common perception of
> 	value wrt DNSSEC.  one may reasonably ask if we are two
> 	of the blind men  trying to describe an elephant.

Not necessarily, I was referring to the killer application for
DNSSEC which is not necessarily the same as the main use it
eventually finds.

A killer application is the one that creates the demand to build
infrastructure. Word processing was NOT the killer app for the PC,
the spreadsheet was. No manager would touch a keyboard in the 80s,
certainly not to type their own correspondence. The first PCs
were bought to do engineering spreadsheets.

The opportunity to establish a killer app is a narrow one. Having
blown opportunity after opportunity securing policy is the next
killer app opportunity that will be open for the next 18 months
or so.

If you try to sell DNSSEC as spoof protection at this point you
are not addressing a currently visible pain point and will not
get on network managers radar screens.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Mon, 18 Oct 2004 23:30:49 +0000

> Hallam-Baker, Phillip wrote:
> >  Bill writes:
> > > Hallam-Baker, Phillip wrote:

	again, you see this elephant differently.  i'm 
	not persuaded that the DNS is the right place to 
	encode policy...(Hey.. lets reuse TXT for that!!!)
	 although it is a where it might be done (and $DEITY 
	knows I've tried, ref: RIDE, IRRd, RPSL in the DNS, et.al.  
	from the previous decade) - 
	pretending that DNSSEC would be able to authenticate 
	such a publication method or to "secure policy"  requires 
	that you share more information about your presumptions 
	on DNSSEC capabilities.

	to paraphrase an old saying; "I hope you brought enough
	drugs for the whole class".   Or maybe I'm just too slow
	to keep up?  Perhaps you might take this offline and 
	help me understand what you are trying to acheive here?

> get on network managers radar screens.

	thats not the selling point i'd make, even if i thought
	dnssec was operationally feasable.