Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

[Stephen Farrell <[e-mail]>]

And there was me trying to stay out of this for a bit:-)

On 16/07/2019 20:31, Eric Rescorla wrote:
> Well, sort of. But in this case, 7435 is a Consensus document, it just
> doesn't have normative force. Thus, I think it's reasonably strong evidence
> that opportunistic security isn't inconsistent with 7258. IIRC Stephen
> Farrell was AD at the time, so perhaps he'd be willing to offer his
> perspective.

First, having been the AD at the time isn't IMO significant,
but I was involved in the discussions yes.

I don't think there's any contradiction between 7435 and 7258.
Different people do have different opinions when it comes to
opportunistic security, but I think many of the competing arguments
have some merit. Opportunistic security, for me, is generally a
step on the road to stricter security and is most useful where it's
not practical to move from little/no-security to strict security.
I guess the canonical argument for the utility of that relates
to SMTP/TLS between MTAs.

In terms of ADD, I guess there could be some scope for handling
signals as to the (non)-existence of a relevant policy in an
opportunistic manner, I'm not sure. But I don't see how that
might apply with the draft in the subject line, where an NXDOMAIN
indicates a policy exists somewhere between the stub and the
root zone.

Cheers,
S.