Re: Interpreting DNSSEC was Re: [dnsext] flip-flopping secure and unsecure DNAME/CNAME

[Edward Lewis <[e-mail]>]

At 12:38 -0400 10/13/08, Michael StJohns wrote:
>At 10:57 AM 10/13/2008, Edward Lewis wrote:
>>DNSSEC only says "this answer looks good" or "doesn't look good." 
>>Trying to figure out whether the answer's disposition is 
>>temporary/permanent, correct/incorrect, trustworthy/not takes more 
>>than just the DNS data and more than just the query at hand.
>
>
>DNSSEC says the answer looks good - SECURE
>or doesn't look good - BOGUS
>or DNSSEC told me I shouldn't care about DNSSEC past some point - UNSECURE
>or I have no information which would let me determine what DNSSEC 
>thinks about the data - UNKNOWN
>
>"Trustworthy" begs a definition here for what "looks good" means in 
>relationship to "trusting" DNS data.

This is the kind of debate that'll never end, judging from past 
incarnations of this thread.  To me, an answer that is under a trust 
anchor and below a null DS set is "looks good" as far as DNSSEC is 
concerned.  I.e., to me, UNSECURE == SECURE == UNKNOWN, when I 
consider the "bottom line" of the query-response.  I guess I have a 
Machiavellian (ends justify the means, i.e., all that matters are the 
ends) streak in me.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                [phone]
NeuStar

Never confuse activity with progress.  Activity pays more.

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>