Re: [Acme] Want client-defined callback port

[Richard Barnes <[e-mail]>]

On Wed, Apr 22, 2015 at 9:51 PM, Phillip Hallam-Baker <[e-mail]
> wrote:

> I think this discussion is getting way too deep into the weeds of
> policy. That isn't a concern IETF has generally taken a definitive
> stand on. If it had there would not have been the need to set up
> CABForum outside IETF.
>
> As I see it the specification should allow:
>
> * A mechanism for the client to indicate the proof(s) of DNS control
> it can provide.
>
> * A mechanism for the service to indicate the proof(s) of DNS control
> it will accept.
>

I thought that's what this thread was about :)


>
> Who offers and who chooses is something the protocol can make a
> decision on but it is probably best if a 'no' from the service is
> accompanied by a list of what is acceptable.
>
> It is useful for IETF to provide security considerations on particular
> proofs but IETF cannot and should not choose. That is ultimately up to
> the people who write the path validation code and the data it consumes
> (including root lists). They bear the liability, unless they can
> figure out how to hand the hot potato to someone else.
>
> Another reason to not make the choice in IETF is that this is not a
> once and for all decision. It is a decision that should be under
> constant review.
>