Re: OFFTOPIC: DNSSEC groupthink versus improving DNS

[Duane <[e-mail]>]

Brian Dickson wrote:

> I don't recall any specific cases being pointed out.

http://ops.ietf.org/lists/namedroppers/namedroppers.2008/msg01264.html

>> Only if you already know DNSSEC mechanisms exist and they haven't been
>> filtered.
> 
> You can't filter DNSSEC mechanisms without that filtration being
> detected (on a validating resolver).
> 
> This includes the ability to determine whether DNSSEC mechanisms exist.
> 
> (The above is predicated on some configured trust anchor, either a
> signed root or via locally configured trust anchors, or DLV.)

That was my point, you have to know about it already one way or another
for it to work, otherwise it can simply be ignored by upstream caching
servers.

> BTW - critical analysis of DNSSEC and alternatives is by no means
> discouraged, and I think any time anyone brings fresh eyes to the
> problem, only good things can come of it - if polite, reasoned discourse
> is the result.

Again I apologise if I've said anything that unduly offended anyone, I'm
merely expressing my opinions based on what I know about certain topics
and I may have made incorrect assumptions and I'm only too happy to be
corrected so I don't make the same mistakes in future.

-- 

Best regards,
 Duane

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>