Re: [dane] Behavior in the face of no answer?

[Paul Wouters <[e-mail]>]

On Tue, 15 May 2012, Andrew Sullivan wrote:

>> warnings. It's really the same as disabling TLSA. Or else we're going to
>> have to teach browsers to remember previous TLSA state and only warn
>> when we knew the site used to publish TLSA, but now we are
>> indeterminate.
>
> Surely, that's just as bad an idea; the fact that the DNS used to
> contain a AAAA record is no guide to whether a site is supporting
> IPv6 today, by way of analogy.

Yes, it is as bad as the cert partrol plugin that tracks PKIX states
in a browser. But it's better then disabling TLSA at all in the face
of DNS errors (where we assume most errors are genuine network errors
and not attacks).

Paul