IETF Logo Mail Archive

Re: Interpreting DNSSEC was Re: [dnsext] flip-flopping secure and unsecure DNAME/CNAME

Edward Lewis <Ed.Lewis@neustar.biz> Tue, 14 October 2008 14:30 UTC

Return-Path: <owner-namedroppers@ops.ietf.org>
X-Original-To: ietfarch-dnsext-archive@core3.amsl.com
Delivered-To: ietfarch-dnsext-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 47AAA28C1D8; Tue, 14 Oct 2008 07:30:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.182
X-Spam-Level:
X-Spam-Status: No, score=0.182 tagged_above=-999 required=5 tests=[AWL=-0.812, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nDiaoCaQ62YF; Tue, 14 Oct 2008 07:30:26 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6243E28C1D6; Tue, 14 Oct 2008 07:30:26 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1Kpkrj-0002Ok-Uj for namedroppers-data@psg.com; Tue, 14 Oct 2008 14:27:15 +0000
Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from <Ed.Lewis@neustar.biz>) id 1KpkrZ-0002NX-Ae for namedroppers@ops.ietf.org; Tue, 14 Oct 2008 14:27:08 +0000
Received: from [192.168.1.101] (mail.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.2/8.14.2) with ESMTP id m9EEQbLk018173; Tue, 14 Oct 2008 10:26:37 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz)
Mime-Version: 1.0
Message-Id: <a06240803c51a5b57d9fa@[192.168.1.101]>
In-Reply-To: <48F3B11B.8090202@links.org>
References: <Your message of "Mon, 22 Sep 2008 15:12:44 -0400." <E1KhqqB-000CE1-QD@psg.com> <200809230016.m8N0GS9E069236@drugs.dv.isc.org> <E1Khwdp-000J3V-QJ@psg.com> <a06240804c4ffc42abc16@[10.122.105.108]> <E1KicTm-000ANO-PO@psg.com> <a06240800c50fd3decd5b@[192.168.1.101]> <48F2DE42.1060209@links.org> <E1KpLkt-000HQ3-Is@psg.com> <48F33C34.3010901@nlnetlabs.nl> <D3AA46B662F334B8639E08CF@Ximines.local> <48F35170.30900@links.org> <4B27E2458EBA97669B259355@Ximines.local> <a06240800c5190d86422c@[192.168.1.101]> <STNTEXCH12OdHa24ABv00004495@stntexch12.cis.neustar.com> <a06240805c5193b226886@[10.31.201.38]> <48F3B11B.8090202@links.org>
Date: Tue, 14 Oct 2008 10:26:05 -0400
To: Ben Laurie <ben@links.org>
From: Edward Lewis <Ed.Lewis@neustar.biz>
Subject: Re: Interpreting DNSSEC was Re: [dnsext] flip-flopping secure and unsecure DNAME/CNAME
Cc: Edward Lewis <Ed.Lewis@neustar.biz>, Michael StJohns <mstjohns@comcast.net>, Alex Bligh <alex@alex.org.uk>, Wouter Wijngaards <wouter@NLnetLabs.nl>, namedroppers@ops.ietf.org
Content-Type: text/plain; charset="us-ascii"; format="flowed"
X-Scanned-By: MIMEDefang 2.64 on 10.20.30.4
Sender: owner-namedroppers@ops.ietf.org
Precedence: bulk
List-ID: <namedroppers.ops.ietf.org>

At 21:35 +0100 10/13/08, Ben Laurie wrote:

>Broadly I agree, except I think you can also choose BOGUS == UNSECURE ==
>UNKNOWN.

Such a strategy is akin to (today) only using IPv6. ;)  That is, most 
of the network is not doing DNSSEC and not doing IPv6.

Equating SEURE, UNSECURE, and UNKNOWN is what I think is more to the 
spirit of DNSSEC and incremental deployment.  It's a recognition that 
what can be secure is but you still have access to the legacy network.

Equating BOGUS, UNSECURE, and UNKNOWN is a paranoid strategy, only 
trusting what you can see and touch.

In some circles I can understand the paranoia.  But most of the 
economy needs open access and a willingness to accept risk.

>Anyone who wants anything more nuanced than that can (and will, anyway)
>write their own s/w :-)

I hope they also realize they are a, umm, niche market... ;)
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Never confuse activity with progress.  Activity pays more.

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

v2.23.0 | Report a Bug | By Email