Re: [Danish] Proposed WG Charter

[Shumon Huque <[e-mail]>]

On Mon, Jun 14, 2021 at 8:01 PM Viktor Dukhovni <[e-mail]>
wrote:

> On Mon, Jun 14, 2021 at 02:26:50PM -0700, Ash Wilson wrote:
>
> > > If the charter of this WG is to sink DNSSEC, that needs to be stated
> > > explicitly in the charter, and then say why this work should not be in
> > > other PKI-based WGs.
> >
> > This charter proposes the creation of an easier adoption path for
> > DNS-based identities, which includes DNSSEC. I don't think anyone here
> > wants to sink DNSSEC.
>
> Well, but it sends a needlessly discouraging message, many of the
> purported difficulties with signing authoritative DNSSEC zones are
> anecdotal and outdated.  Yes, not all registrars support DNSSEC equally
> well, but there are many registrars to choose from, vote with your feet
> and $$.  Almost 15.2 million domains are already signed, the time has
> come to stop working around the right way to securely publish data in
> DNS.
>
> Piling on work-arounds does in fact hinder DNSSEC adoption, and we
> should seriously consider putting an end to this.
>

The BoF proponents have no desire to sink DNSSEC. It's the opposite
in fact, but we also want to provide interim mechanisms for environments
that don't have DNSSEC yet.

I can also say from personal experience that deploying DNSSEC in
a large complex enterprise remains extremely challenging. Some of the
largest commercial DNS providers in the world have had constant
challenges handling the scale of my employer's signed DNS (ask me
offline sometime and I'll spill the beans). And just a few weeks ago, I
found another critical DNSSEC bug in one of the major open source
DNS implementations.

Shumon.