Subject: RE: Proposed NSEC/NSEC3 transition mechanism

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 18 May 2006 09:07:46 -0700

> From: Edward Lewis [mailto:[email-masked]] 

> This may be the case, but "original premises" often become 
> historical footnotes.  (Recall my presentation about DNS to 
> the MARID interim meeting where I was told to stop telling 
> the amassed audience why things in DNS are the way they are - 
> blaming it on original premises.)

What people were complained about was your refusal to listen to anyone. Assuming you know what someone is going to say and then talking over them as they attempt to say it is not a particularly efficient form of communication even when you know what they are going to say which you did not.

I had to personally ask you to stop interrupting six times before I managed to say my first sentence.

I am not sure how you would know what I intended to say in the meeting since I am pretty sure that I forgot half of it while you were heckling. 

It is one thing to interrupt someone who has been talking for five minutes with a well placed point of information, quite a different thing to do as you did and drown out their attempt to complete a single sentence. 

> Looking at what NSEC3 offers, it goes beyond EU privacy regulations. 

True, but the point I was making was that NSEC has been determined to be incompatible with those regulations and so it is illogical to posit a requirement to plan a transition from NSEC3 to NSEC absent either contrary legal advice or a liklihood that the relevant laws will be changed.

> My raising this issue now could be seen as a means to delay 
> NSEC3, in the sense that asking for "one more thing to be 
> defined."  The "victims" of this are zones that have reasons 
> to not deploy NSEC, 

No the victims would be the billion plus users of the Internet who have waited far too long while this committee and others have traded concerns over minutiae and constantly argued and re-argued the question of whether to actually take account of real world operational constraints. Meanwhile we have an infrastructure that everyone agrees is critical that falls far short of providing acceptable security.

Operational issues are an issue for registrars and the customers they serve. 

In DKIM we are building infrastructure that effectively presupposes a certain level of security in the DNS infrastructure. I have no involvement in the VeriSign work on DNSSEC but I am most certainly working on infrastructures that presupose their timely deployment.

I have been asking this WG to deliver a set of standards that the registrars are prepared to deploy for six years now. Each time it appears that delivery of a standard that the registrars are prepared to deploy it has been trumped by procedural tactics and last minute invention of 'operational requirements' that are not endorsed by a registry planning to actually deploy the proposed scheme.

I suggest that unless Ed plans to actually deploy NSEC3 he should not be permitted to attach new requirements for advancement at this late stage in the process.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: bert hubert <[email-masked]>
Date: Fri, 19 May 2006 01:17:08 +0200

On Thu, May 18, 2006 at 09:07:46AM -0700, Hallam-Baker, Phillip wrote:

> No the victims would be the billion plus users of the Internet who have
> waited far too long while this committee and others have traded concerns
> over minutiae and constantly argued and re-argued the question of whether
> to actually take account of real world operational constraints. Meanwhile
> we have an infrastructure that everyone agrees is critical that falls far
> short of providing acceptable security.

Amen to that. So can we drop DNSSEC already? It has become so complex it is
a running gag in many places. Duke Nukem Forever is rumoured to appear
before DNSSEC is deployable. How about DNS2. It worked for POP3 and IPAM4.

This would give us the ability to add a signable "empty recordset" answer and
change the awkward semantics that have made DNSSEC the elephant it is today.

Think how simple life would be if we could send out recordsets instead of
sets of records, and sign such recordsets...

We could also sign empty recordsets, which would Just Work.

Registries could start offering DNS2 services, recursors would transparently
translate back to DNS1 for the vast masses that can't yet talk DNS2.

Etc etc. Think how much fun it would be to actually *achieve* something that
could be deployed! 

The amount of effort sunk into DNSSEC would've given us DNS2, 3 and 4 by
now..

Oh well, I can hope.

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services