Re: [Danish] Proposed WG Charter

[Michael Richardson <[e-mail]>]

Viktor Dukhovni <[e-mail]> wrote:
    >> I can also say from personal experience that deploying DNSSEC in
    >> a large complex enterprise remains extremely challenging. Some of the
    >> largest commercial DNS providers in the world have had constant
    >> challenges handling the scale of my employer's signed DNS (ask me
    >> offline sometime and I'll spill the beans). And just a few weeks ago, I
    >> found another critical DNSSEC bug in one of the major open source
    >> DNS implementations.

    > For new applications one need not sign an existing legacy domain,
    > it is easy to register a new dedicated domain that's signed from
    > the getgo.

I was going to say the same thing.
It also has the advantage of not having to deal with the marketing department.

{However, it's a shame that example.com can't register devices.example.com
directly.... or rather that DNSSEC can't jump over the insecured
example.com.}
So one winds up with devices-example.com or some such situation.

    > There may be some minor obstacles along the way, but it rather looks
    > like the software stacks are or will soon be ready to meet them head on.

    > The specs produced by DANISH will not change the world overnight, the
    > design should not be anchored in the past.

We are in agreement here:  that's why I removed the mitigation as a work item
from the initial charter.  I think that we should still think about it though.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide