Subject: RE: Last call reminder:

From: Philip Hallam-Baker <[email-masked]>
Date: Wed, 8 Mar 2000 07:56:55 -0800

My experience of the URN working group is that no RFCs is usually better
than bad RFCs. Anyone trying to do any work on URNs will find the
detritus from the failed URN working group in the way. Every bad
design decision of the group is now fixed by authority of an RFC.

I believe that we have to deploy a security infrastructure for the 
internet name system system in a very short timescale. I am somewhat
disturbed by the fact that there are RFCs at proposed standard that
do not appear to have been reviewed by the commercial providers of
name infrastructure or PKI infrastructure.

Furthermore there does not appear to be any commitment to deploy the
specifications from the principal operating systems vendors - with the
exception of SRV.

Before deployment the easiest thing to change is the specifications.

		Phill

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Michael Mealling <[email-masked]>
Date: Wed, 08 Mar 2000 08:55:23 -0800

> design decision of the group is now fixed by authority of an RFC.

Huh? Failed? The group is just about finished and implementations
are under way. One of the two larger uses can be found in 
the upcoming XML URN and the work being done in ENUM.

-MM

-- 
--------------------------------------------------------------------------------
Michael Mealling	|      Vote Libertarian!       | www.rwhois.net/michael
Sr. Research Engineer   |   www.ga.lp.org/gwinnett     | ICQ#:         14198821
Network Solutions	|          www.lp.org          |  [email-masked]

---

From: Peter Deutsch <[email-masked]>
Date: Wed, 08 Mar 2000 10:53:43 -0800

[ enough.  can we take this one elsewhere please?  -- rb ]

Guys,

> the upcoming XML URN and the work being done in ENUM.

       And so it came to pass that the Pope in Avignon sent out
       his forces to do battle with the forces of the Pope in Rome.
       And there was misery and woe upon the land...

In other words, some people don't believe in URNs as defined by that
working group. So don't use them.

We used to welcome diversity. Yeesh...

				- peterd

---

From: John Gilmore <[email-masked]>
Date: Wed, 08 Mar 2000 15:38:39 -0800

> internet name system system in a very short timescale.

Why do you believe this, particularly the timescale?

>							   I am somewhat

ISC and NSI and CORE and IANA all reviewed it.  I think ICANN has had
its hands full with politics, legalism and bureacracy, and is only
starting to be able to deal with technology issues.

As for PKI infrastructure, DNSSEC *competes* with PKI infrastructure.
Isn't that why Verisign bought NSI?  PKI has been heavily based on
deliberate anti-privacy information collection ("voluntary" disclosure
to Dun&Bradstreet, which then sells your info, is required to get a
cert for secure web serving), cumbersome ISO encoding, and centralized
providers protected by patent monopolies who are maneuvering to
collect tolls from everyone on the Internet.  We should expect
companies invested in X.509 and PKI certificate models -- such as your
own, Philip -- to want to kill or cripple DNSSEC.  It is only to the
extent that they didn't notice DNSSEC, or didn't believe that it was
viable, that it has survived.  Though perhaps with NSI firmly in hand,
Verisign can arrange to collect tolls from DNSSEC users too, so now
wants to see it deployed.

> specifications from the principal operating systems vendors.

A collection of Unix companies is funding BIND v9 development and
support, with the intent of incorporating it into their products.

As for Microsoft, they have been tracking the standards, but who would
believe them if they said they'd implement it as written?  When it
serves their interest to do something else, they do something else.

	John

---

From: Mark Kosters <[email-masked]>
Date: Wed, 8 Mar 2000 20:50:16 -0500

> starting to be able to deal with technology issues.

You are more confident than I that ICANN is past the non-technical issues 
and has extra cycles to think about signing the root.  Nevertheless, there 
are a couple of things that need to happen to make this a reality from
my prospective (and this list may not be complete):

 1) EDNS0 needs to be deployed for dnssec to happen at the roots. Running
    TCP retries due to udp packet overflows will be bad if we were to deploy
    this now.
 2) Software needs to work. The dnssec workshops that I've participated
    in have had less than stellar results over the past year.
 3) More thought has to go into key rollovers for delegations. The idea
    of the millions of .coms having to deal resigning their keys with
    the parent is suboptimal at this point.*  That reminds me - what
    happened to the draft that Donald and Mark wrote almost a year ago?

Regards,
Mark

*I've written a keyserver to authenticate the child using the 
registrar/registry model. This is cool but am unsure if every admin really
wants to do this on a frequent basis outside of DNS.

-- 

Mark Kosters             [email-masked]       Network Solutions, Inc.
PGP Key fingerprint =  1A 2A 92 F8 8E D3 47 F9  15 65 80 87 68 13 F6 48

---

From: [email-masked]
Date: Thu, 09 Mar 2000 14:28:23 +1100

>     happened to the draft that Donald and Mark wrote almost a year ago?

	We are still working on it.  We want to use SRV records to be able
	to seperate the server from the signer if wanted.
	
	Mark

--
Mark Andrews, Nominum Inc. / Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Bill Manning <[email-masked]>
Date: Wed, 8 Mar 2000 18:26:18 -0800 (PST)

% On Wed, Mar 08, 2000 at 03:38:39PM -0800, John Gilmore wrote:
% > ISC and NSI and CORE and IANA all reviewed it.  I think ICANN has had
% > its hands full with politics, legalism and bureacracy, and is only
% > starting to be able to deal with technology issues.
% 
% You are more confident than I that ICANN is past the non-technical issues 
% and has extra cycles to think about signing the root.  Nevertheless, there 
% are a couple of things that need to happen to make this a reality from
% my prospective (and this list may not be complete):

	Echo Marks concerns.
	I believe that ICANN has a couple of technical steps ahead 
	of itself before it could begin to be prepared to think of how
	to deploy DNSSEC.

%  1) EDNS0 needs to be deployed for dnssec to happen at the roots. Running
%     TCP retries due to udp packet overflows will be bad if we were to deploy
%     this now.

	The problem would not be a root issue once the g & cc TLDs are 
	migrated off the roots to their own servers. It would still be
	an issue.

%  2) Software needs to work. The dnssec workshops that I've participated
%     in have had less than stellar results over the past year.

	Well, it does work, but with significant manual intervention.
	I am concerned that there is a lack of compatability between
	versions.  Still too fluid for a production system for my tastes.

%  3) More thought has to go into key rollovers for delegations. The idea
%     of the millions of .coms having to deal resigning their keys with
%     the parent is suboptimal at this point.*  That reminds me - what
%     happened to the draft that Donald and Mark wrote almost a year ago?
% 
% Regards,
% Mark
% 
% *I've written a keyserver to authenticate the child using the 
% registrar/registry model. This is cool but am unsure if every admin really
% wants to do this on a frequent basis outside of DNS.

	Nifty!  
% 
% -- 
% 
% Mark Kosters             [email-masked]       Network Solutions, Inc.
% PGP Key fingerprint =  1A 2A 92 F8 8E D3 47 F9  15 65 80 87 68 13 F6 48
% 
% 
% to unsubscribe send a message to [email-masked] with
% the word 'unsubscribe' in a single line as the message text body.
% 

-- 
--bill