Re: OFFTOPIC: DNSSEC groupthink versus improving DNS

[Paul Vixie <[e-mail]>]

> From: Duane <[e-mail]>
> 
> bert hubert wrote:
> > Or 79 page presentations called "DNSSEC in six minutes" - giving people 4.6
> > seconds per page. It is just not real.
> > http://www.isc.org/sw/bind/docs/DNSSEC_in_6_minutes.pdf 
> 
> I've seen this document in the past and it actually turned me and others
> completely off the idea of DNSSEC, ...

you are both missing the point of that document.  it's not a six minute
presentation.  but after you sit through that presentation, you can get
dnssec running in six minutes.  (we've measured.)  which is not to say
that dnssec is easy -- i know that at ISC we're thinking seriously of
dedicating the whole BIND 9.7 release to dnssec tools and usability.

> ... which in part was what led to me playing with encryption funnily
> enough, because it seems to me most are promoting 30 day TTLs on the
> sigs, which means 30 days of replay attacks potentially, not to mention
> the whole re-signing every 30 days.

you can use whatever TTL you want.  but more importantly, are you saying
we should discard a protocol because of the quality of early implementations
especially in terms of usability?  because if that were true i'm pretty
sure TCP/IP should have been shot dead back in 1985 or so.  likewise X11,
BSD, Linux, Windows, and MAC/OS.

> Who ever thought that does not live in the real world, people
> administering servers with X.509 certs that expire yearly is bad enough,
> but every 30 days or less???
> 
> That alone is going to be a show stopped for most if not all admins with
> too many things to do and not enough time to do everything.

duane, i understand why bert's a dnssec denier.  but i urge you to study
the historical debates and the threat models document and think carefully
before you climb on that bandwagon.

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>