Re: Interpreting DNSSEC was Re: [dnsext] flip-flopping secure and unsecure DNAME/CNAME

[Ben Laurie <[e-mail]>]

Edward Lewis wrote:
> At 21:35 +0100 10/13/08, Ben Laurie wrote:
> 
>> Broadly I agree, except I think you can also choose BOGUS == UNSECURE ==
>> UNKNOWN.
> 
> Such a strategy is akin to (today) only using IPv6. ;)  That is, most of
> the network is not doing DNSSEC and not doing IPv6.
> 
> Equating SEURE, UNSECURE, and UNKNOWN is what I think is more to the
> spirit of DNSSEC and incremental deployment.  It's a recognition that
> what can be secure is but you still have access to the legacy network.
> 
> Equating BOGUS, UNSECURE, and UNKNOWN is a paranoid strategy, only
> trusting what you can see and touch.
> 
> In some circles I can understand the paranoia.  But most of the economy
> needs open access and a willingness to accept risk.

In other words: you agree that you can also choose it.

> 
>> Anyone who wants anything more nuanced than that can (and will, anyway)
>> write their own s/w :-)
> 
> I hope they also realize they are a, umm, niche market... ;)


-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>