Re: [Add] some background on split DNS with DNSSEC

[Eliot Lear <[e-mail]>]

Bill:

On 09.11.21 17:13, Bill Woodcock wrote:
> If what you’re saying is that when we depend upon tools to cover fragile or overly-complicated things with abstraction layers to “solve the problem” that we’re actually adding complexity and fragility, and that that’s a bad idea (“when you’re in a hole, stop digging”), then yes, I agree with that as well.
>
> The biggest problem I see with standards development now is the desire to solve many problems within single monolithic protocols, rather than making small, simple, easily-comprehended modular building blocks that can be put together in different ways to solve different problems.

While I don't disagree with what you say, what I'm saying is that DNSSEC 
has had PLENTY of time to diffuse and hasn't done so.  In fact, I would 
argue that new new impediments have shown up that lend themselves to 
centralization, which is the risk of amplification attacks that have led 
secondary services to charge extra.

And my admittedly snide initial comment was meant to convey that we 
ought to think of taking another look at naming and security that 
accommodates mechanisms like split views, rather than simply says, 
“Those are bad!”

Eliot