Re: [dane] Behavior in the face of no answer?

[Paul Hoffman <[e-mail]>]

On May 7, 2012, at 8:56 AM, Nicholas Weaver wrote:

> On May 7, 2012, at 8:43 AM, Paul Hoffman wrote:
> 
>> If you believe that we should only standardize the perfect, not the good, that's fine. Others seek to standardize the good which can be upgraded to the perfect with no flag days, which is what is proposed here.
> 
> No, I believe we should standardize the good.

Good!

> If you wish to standardize the almost useless but can be upgraded to good with no flag day, but which upgrading to good requires replacing or bypassing a significant amount of brokenness on the Internet, say so.

I didn't say so because I don't consider the current proposal "almost useless". I hear that you do.

> Because DANE without nearly-hard-fail [1] on no data, not just BOGUS data, AND client-side validation, is no different that browser CRLs in terms of protection to the users in the face of an actual attack.

It is very different, but I hear that you don't believe that. Many of us believe that there can be integrity-protected communication with recursive resolvers that do DNSSEC, even if that is not common today.

--Paul Hoffman