Re: [dnsext] need new flag bit in EDNS, "do me no favours" (DMNF)

[[e-mail]]

On Sun, Oct 24, 2010 at 04:24:54PM -0700, David Conrad wrote:
> On Oct 24, 2010, at 4:01 PM, Roy Arends wrote:
> > On 10/24/10 6:52 PM, "Paul Vixie" <[e-mail]> wrote:
> >> opin?  i can write a short i-d on it before beijing.
> 
> I think a short i-d would be worthwhile.
> 
> > The end-game will be applications doing their own resolving. Real control.
> > No third party dependencies. No favors to ask.
> 
> And greatly reduced caching.

	well, at least a greatly reduced attack surface for any given cache that is 
	compromised.

> The problem with applications doing their own resolving is that the 'real control' implies there is someone at the other end of the application that has the understanding and knowledge to make use of that control.  Haven't we seen the implications of this approach with browsers that ask the end user whether or not to accept an SSL cert?

	yes and no.  if you posit that more than one application runs on a target platform,	
	then all apps that run there can use the same local resolver & validator. No real need
	for each app to take resolution into its own hands.  

	didn't we have this conversation about seven years ago?

--bill

> Regards,
> -drc
> 
>