Re: [dane] Behavior in the face of no answer?

[Martin Rex <[e-mail]>]

Warren Kumari wrote:
> > 
> > I don't think people have been talking about suggesting that the
> > application let the user choose between strict and not-strict;
> > I think most people here are against that.
> 
> This may be my fault -- a long time back (in this thread) I proposed
> having implmentations default to not-strict and then, in a few years
> (once there is less DNSSEC breakage by CPE, etc), vendors would turn
> the knob to strict mode. Educated / security concious users would
> also be able to turn the knob if they so  desired.
> 
> This was just an idea, and perhaps a bad one!

That was a perfectly reasonable one, and is the approach that is being
used for the TLS renegotiation_info extension (rfc5746):

  http://tools.ietf.org/html/rfc5746#section-4

And no, the world did not end because of browsers and other TLS-clients
not being strict about TLS renegotiation (i.e. hard-failing on
servers that do not support it).


-Martin