Re: [dane] Behavior in the face of no answer?

[Andrew Sullivan <[e-mail]>]

On Mon, May 07, 2012 at 08:23:06AM -0700, Nicholas Weaver wrote:
> 
> The cynic in me observes that without end-host validation, DANE is
> just a connectionless version of the existing browser Certificate
> Revocation List protocol:

Not every browser is in a home or public network with an ISP's
corrupted resolver upstream.  Just because that is the main network
model you test doesn't make it the Internet, as I already pointed out
in this thread.

MSFT's main DNSSEC offering depends on IPSec and doing validation in
the central resolver.  That approach -- which I personally happen not
to like -- is enabled by the DNSSEC specifications.  Their stuff isn't
unusual in enterprise deployments.  We don't get to pooh-pooh that for
DANE just because we don't like it.  If we think that model is broken,
then we need to deprecate it.  If we're not going to deprecate it --
and I wish you luck -- then DANE needs to work for that DNSSEC
deployment, too.

Best,

A

-- 
Andrew Sullivan
[e-mail]