Subject: DNSEXT (premature?) obituary notice

From: Edward Lewis <[email-masked]>
Date: Mon, 2 Apr 2007 11:04:06 -0400

Nothin' like an obituary to bring out all the 
love...see the "action items" I clipped from this 
thread attached below.

It seems like there is a long laundry list of 
work items that fit under the WG's charter, plus 
some more that don't (e.g., expansion of record 
synthesis).  What I read from this is that there 
is a demand/need for furthering DNS work.

What I also read from this lingering list of 
wants and needs is that there isn't a lot of real 
desire to finish off the work.  It's not that 
folks are lazy, the desire to finish off work 
comes from the work being meaningful and 
rewarding.  I don't see DNS'ers sitting under 
palm trees drinking mai-tais while this list 
lingers, we are busy doing other work.

Or perhaps we do have time we could spend on this 
work, but there's been no "bolt of lightening" to 
stir the pot and cause reactions to happen.

There have been stalled WG's in the past, and I 
think DNSEXT is about there too.  Other cases 
have been caused by two competing approaches head 
butting each other, or maybe IPR claims, or maybe 
social/political/etc. issues which are not 
technical.  I don't think we suffer that here, it 
just seems like there's been no push to really 
finish off the work.

If the group is to stay open, what is going to 
make this work get done?  A chair saying "read 
and comment on ASAP" is not making us jump, 
that's apparently not an effective motivational 
tool in an all-volunteer environment.  What would 
be more interesting that a list of "I'd like to 
see..." is a list of "Here's what's going to make 
this happen if we have review..."  I'm not 
accusing any of the below folks of issuing 
"unfunded mandates" because it is good just to 
have a list of work items - but the list isn't 
going to shrink through success unless someone 
(else) does or leads the work.

Even if a need exists but there is no will to do 
it, the list of needs will shrink if we "give up 
the dream."

I'm in no hurry to see the WG close, but I wonder 
- who cares if the work list is completed?  Does 
anyone (outside of the WG) care?  *If no one 
cares*, I think it is time we all moved on even 
with unfinished business.  If anyone cares, how 
can they help the WG along to finishing off the 
list?

The main burst of DNSSEC energy is situated in 
Sweden, there was an ICANN panel last week of 6 
presentations, 5 from Sweden and another from 
Bulgaria.  In the presentation from an ISP (Mats 
Dufberg, TeliaSonera, 
(http://icann.org/meetings/lisbon/presentation-dnssec-28mar07-dufberg.pdf) 
he mentions the need for a signed root.  He's one 
of many.  Is anyone listening to these requests?

On one hand I want to encourage the WG to clean 
up the milestones to match what's below and 
organize the work around it.  On the other hand, 
I don't see that the work will be pay off.  Maybe 
we all would be more useful to society under a 
palm trees and drinking mai-tais.

Should we itemize this list into milestones? 
Should we just forget about it?  Where's the 
energy for all this?  Those are my thoughts.

At 20:36 -0400 3/26/07, Ólafur Guðmundsson /DNSEXT co-chair wrote:
>All the remaining work in the group are close to completion,
>with the exception of
>	ECC DNSKEY specification.
>	advancing RFC's up the standards track.
>Both of these items have not had great interest or activity.
>A potential new item for the working group is the provide input on the
>processing of RFC2929bis templates while that process is stabilizing.

At 1:13 +0000 3/27/07, Paul Vixie wrote:
>i'd like to see roy's version of DLV standardized before we quit, that's all.

At 21:55 -0400 3/26/07, Edward Lewis wrote:
>What about DNAME?  That's the only topic that caused any stir of engineering
>at the meeting last week.

At 22:14 -0400 3/26/07, Michael StJohns wrote:
>Would it be fair to characterize (B) as "We'll continue to be open to
>standardize new RR Types that don't require changes to the base DNS protocol,

At 12:27 +1000 3/27/07, Mark Andrews wrote:
>	We really do need to see interop from new vendors that
>	wern't around when a RFC is developed to be able to move
>	forward RFCs on the standards track.  We had a perfect
>	example of this in the weeks leading up to IETF 68.
>
>	I still want to see the RFCs advanced.  I would however be
>	happy with waiting a year or so before looking at them as
>	I feel that most of the wg feel slightly burnout at this
>	stage.  Recessing for a year or so would be a good idea.

At 8:20 +0200 3/27/07, Roy Arends wrote:
>As for DNSEXT, I don't think we're done at all. There is indeed DLV, and
>there is the last mile. There is also the transparency and the end-to-end
>paradigm I'd like to see written up, explicitly for the DNS. There is
>key-management, rollover, and once 2929-bis is done, I hope to see more
>record types hit the iana registry. Some of this can be wrapped up in
>DNSOP, but not all of it.

At 11:28 +0100 3/27/07, David Conrad wrote:
>Key rollover?

At 9:51 -0400 3/27/07, Ólafur Guðmundsson /DNSEXT co-chair wrote:
>[A] Read and comment on ASAP:
>http://ietf.org/internet-drafts/draft-ietf-dnsext-rfc2672bis-dname-01.txt
>http://ietf.org/internet-drafts/draft-ietf-dnsext-forgery-resilience-00.txt

At 11:14 -0400 3/27/07, Dean Anderson wrote:
>I think the working group needs to properly resolve AXFR-clarify.
>I will submit a draft to do this.
>
>IXFR also needs work.

At 11:48 -0400 3/27/07, Suresh Krishnaswamy wrote:
>The last time I asked informally, the answer that I got was that API work was
>not within the scope of this working group, and extruding detailed validation
>policy and authentication chain information on-the-wire, even though within
>scope, was a bad idea. Is this still the working groups sentiment? If
>draft-hayatnagarkar-dnsext-validator-api is not within scope for DNSEXT,
>which working group is better suited to 
>standardize last-mile issues/solutions?

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Sarcasm doesn't scale.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Mon, 02 Apr 2007 16:55:22 +0000

note, this isn't a rant on ed, it's just that his note crystalized some ideas.

> What I also read from this lingering list of wants and needs is that there
> isn't a lot of real desire to finish off the work.  It's not that folks are
> lazy, the desire to finish off work comes from the work being meaningful
> and rewarding.  I don't see DNS'ers sitting under palm trees drinking
> mai-tais while this list lingers, we are busy doing other work.

there's more to this malaise than being too busy.  there's exhaustion, and
there's what you said, lack of "meaningful and rewarding."  this working group
is a perfect demonstration of "tyranny of the majority".  thirteen (13) years
into the experiment, we're once again at the 11th hour of dnssec as we've been
five times before, and we're now being told that the "auth-follows-delegation"
model (DS vs DLV) are undeployable due to root domain politics and economics.
we are also still working our way through "zonewalking-isn't-acceptable"
(NSEC3 and whitelies), and are apparently about to readdress the previous
answer to "security-can't-be-optional" (opt-in).  most of the stuff we thought
was done, wasn't.  most of what we thought was deployable, isn't.  most of
the people who were willing to "do it over" five times are pondering this 6th.

now, most investors (and most gamblers, and most engineers, and most lovers)
are willing to double down if they think they've still got "a shot at it," but
most want to know "why will this time be any different?"  which requires being
able to determine "why have we failed every time up through now?"  which means
taking a look at the key decisions and processes and cultures that led to five
straight undeployable results (which is to say, "failures").  let's party like
it's still 1994:

2065 failed because eastlake didn't understand DNS and noone else understood
security, so it was effectively ships-passing-in-the-night, unreviewed work,
doomed to burst into flame when the rubber finally met the road.  the IESG
thought they fixed this by merging DNSSEC with DNSIND and calling it DNSEXT,
to make sure subsequent work wasn't done in a double-blind environment.  this
fix seems to have worked-- subsequent failures were all different from this.

who wants to do 2535?  my favorite of all time is still the folks who rained
on opt-in not because they didn't want to use it, but because they didn't want
verisign to be able to use it.  a close second is the folks who thought that
what US-DoC/VeriSign/ICANN needed in order to mend their fences and learn to
live together in peace and harmony was shared responsibility for all of the
world's electronic commerce security.  an honourable mention goes out to the
folks who figured that the TLD operators who tightly restricted AXFR would all
be eager to drop their pants the moment NSEC came out.  and the thing that
makes these most interesting, from an anthropological standpoint, is that the
decisions were all made by what heinlein called "aunt millie" -- well meaning
decent people who considered it their sacred duty to save others from folly.

> I'm in no hurry to see the WG close, but I wonder - who cares if the work
> list is completed?  Does anyone (outside of the WG) care?  *If no one
> cares*, I think it is time we all moved on even with unfinished business.
> If anyone cares, how can they help the WG along to finishing off the list?

i think folks are (rightly) afraid to care, since they've seen what happens
to others who cared.  the majority is still standing by, ready to tyrannize.
IETF is an open-door society, and unless one counts the DNS Directorate,
there is no way to get anything done that anybody objects to.  (noting that
we might now have nearly perfect IP mobility if A6/DNAME had not been killed,
and i mean killed by a non-open non-IETF-like process.)  (and also noting
that the problems now being faced by IPv6 include all of the ones warned
about by the promoters of TUBA.)

> Should we itemize this list into milestones? Should we just forget about
> it?  Where's the energy for all this?  Those are my thoughts.

i believe that the strong desire shown for killing this working group comes
from the irrational belief that if we start over with a new charter and a
new name, the current tryannizing majority will lose interest and/or not be
able to find the next working group, and that only the smart constructive
creative baggage-free non-hating types will join the next mailing list or
attend the next set of meetings.  that's never been seen to work, but hope
springs eternal.  (we should have put more effort into MODA, i guess.)

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 2 Apr 2007 14:00:18 -0400

On Mon, Apr 02, 2007 at 04:55:22PM +0000, Paul Vixie wrote:

> able to find the next working group,

I understand, but cannot agree with, this remark.  The desire seems to
be, from my point of view, the urge to end a "working group" that has
stopped working, and become mostly a group.  I suspect that if a
significant number of actual drafts and contributors to those drafts
showed up, the group might have a different reaction.  But I see
precious few actual drafts lining up with these ideas people have.  (I
am hereby explicitly promising review if I am pointed at some, FWIW.)

A
-- 
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
jabber: [email-masked]                 +1 416 646 3304 x4110

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 2 Apr 2007 18:51:28 -0700

> [mailto:[email-masked]] On Behalf Of Paul Vixie

> note, this isn't a rant on ed, it's just that his note 

Ditto

> now, most investors (and most gamblers, and most engineers, 
> and most lovers) are willing to double down if they think 
> they've still got "a shot at it," but most want to know "why 
> will this time be any different?"  which requires being able 
> to determine "why have we failed every time up through now?"  
> which means taking a look at the key decisions and processes 
> and cultures that led to five straight undeployable results 
> (which is to say, "failures").  let's party like it's still 1994:

I think that it's a continuation of the same impulse, namely considering the problem of DNS security as an exclusively technical exercise ignoring the fact that security is inescapably a social issue. Computers do not perform crime, people perform crime and they do so for social reasons (e.g. money).

I have spent quite a bit of time thinking (and modelling) the deployment problem. We have a double ended problem: there is no value for signers without verifiers and vice versa. How do we establish critical mass?

One possible answer I see is to use the DNS to distribute security sensitive information that provides a unilateral deployment benefit. Free Swan, SSH keys, DKIM and the like.

---

From: Jim Reid <[email-masked]>
Date: Tue, 3 Apr 2007 11:07:35 +0100

On Apr 2, 2007, at 16:04, Edward Lewis wrote:

> What I read from this is that there is a demand/need for furthering  
> DNS work.

I'm not so sure. There is recognition that there are other things  
this WG could do. Though it's not yet clear what, if anything, these  
other things are.

> What I also read from this lingering list of wants and needs is  
> that there isn't a lot of real desire to finish off the work.

To be fair, I think this WG has scared away anyone who had ideas that  
were not DNSSEC related. It might be necessary to do outreach beyond  
the WG to re-engage with these guys.

---

From: Dean Anderson <[email-masked]>
Date: Tue, 3 Apr 2007 11:07:25 -0400 (EDT)

On Mon, 2 Apr 2007, Paul Vixie wrote:

> to others who cared.  

Yes, as one of the several victims, I can agree.  When was the last time
that Dan Bernstein posted?  I know: April 6th, 2006. Almost one year
ago.  Do you suppose Dan doesn't care anymore?  Or might it be because
of abuse?  

> the majority is still standing by, ready to tyrannize. 

That may be.  I suspect that a certain majority has been discredited or
at least lost the cult status and deference they once enjoyed.  Further
bad news awaits a certain group.

> IETF is an open-door society, and unless one counts the DNS
> Directorate, there is no way to get anything done that anybody objects
> to.

Obviously, not so. The 'tyrannizing majority' just recently passed the
'not-open' secrecy-enabling NSID option, which benefits no one but root
server operators who don't want to be held accountable for misbehaving
anycast servers. [recall that NSID secrecy prevents non-root operators
from determining if they are talking to the same anycast instance over
several queries--this makes it difficult to test root anycast operations
over UDP. Fortunately, one can still do TCP testing directly.  
Unfortunately, one then cannot use open recursors to test from different
parts of the internet this way, so it may be hard to get to all the
Anycast clones.]

The blunt exercises of power tryannical majority are pretty recent.

		--Dean

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 03 Apr 2007 12:34:34 +0200

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

Jim Reid <[email-masked]> writes:

>> What I also read from this lingering list of wants and needs is that
>> there isn't a lot of real desire to finish off the work.
>

I agree.  I also believe that any further security-related work (e.g.,
DNSSEC) should be done in the Security Area, to get more appropriate
review.  If we'd done that sooner, I believe NO would not have been
killed and we'd avoided the multi-year wait for a NXT-replacement.

I don't believe WGs should live forever, and DNSEXT is one of the
longest living WGs I know.  If it is not clear that we have important
new DNS extensions to adopt, then that is a good indication that the
WG should be closed.

/Simon

---

From: Edward Lewis <[email-masked]>
Date: Fri, 13 Apr 2007 14:01:56 -0400

>killed and we'd avoided the multi-year wait for a NXT-replacement.

Just to fill in the history...the DNSSEC WG existed in the Security 
area from about 1994 (before my time) until 1999 when it was merged 
into the current DNSEXT WG.  Prior to the conclusion of DNSSEC WG we 
did talk in hallways about a hashed-based means of authenticated 
denial.

Adding some debatable perspective to my comments - the reason for the 
move of DNSSEC work from the Security Area to the Internet Area was a 
realization that the early versions of DNSSEC lacked a true 
understanding of the DNS protocol and were much more influenced by 
considerations for cryptography and asymmetric keys.  Off-line keys 
were proposed to keep the private key private.  The parent-child 
exchange wasn't operationally feasible.  The whole notion of "key 
strength" was unworkable in practice.

I don't know if this is a coincidence, but in 1998 or 1999, after a 
few years of work on RFC 2065, DNSSEC make its first appearance in 
BIND.  In May of 1999 there was the first field test/workshop in 
Knivsta, SE.  In July 1999 it was pretty much decided to end DNSSEC 
WG and merge it with DNSIND WG to make DNSEXT WG.  By 2002 the DS 
record was born and implemented and tested in November.  (DNSOP BoF 
was in March 1999 and that's where I added a laundry list of DNS 
operations work items.)

I think that the move from the Security Area was a good one.  I've 
since learned that it is better to know the underlying protocol than 
security theory when trying to "slap on" security.

Sarcasm doesn't scale.