Re: OFFTOPIC: DNSSEC groupthink versus improving DNS

[bert hubert <[e-mail]>]

On Thu, Aug 07, 2008 at 09:02:42PM +0200, Olaf Kolkman wrote:
> Imagine a person that has spend considerable amount of time, money and  
> energy in implementing DNSSEC in servers, tools and libraries; has  
> 'evanginered' DNSSEC for years in a consistently balanced way,  
> recognizing that implementing DNSSEC is far from easy; and has  
> provided multiple pieces of documentation. In other words a person who  
> has put the money where the mouth is.

Olaf - I can imagine only too well. Around 7 years ago I attended a talk by
you where you publicly wondered out loud which problem DNSSEC would solve,
and how it could actually be implemented. I was impressed by your
open-mindedness.

Over the years, I've seen the open mindedness disappear from the community.

As a decade passed away and DNSSEC stil hadn't caught on, self-doubt has
been replaced by the mantra that DNSSEC will soon be deployed, and that it
is ready - when there is much still up in the air.

> How would such person defend against being assessed to suffer from  
> groupthink or tunnelvission?

That is very valid criticism, and I spent quite some time tonight figuring
out what I'm actually hoping to achieve - besides what is described very
well on http://xkcd.com/386/ . 

The main thing I hope is that we won't forget the pre-DNSSEC world. In short
this means committing towards finding a solution in short order that will
address remaining spoofing dangers - 64% chance of success within 24 hours
using reasonable resources. Success in these terms might be "effectively
taking over the root for 100000 people".

I've already seen influential WG members state that we'll have only one
chance to seriously change DNS in the coming decade. And furthermore, that
we should use this one chance for implementing DNSSEC.

In addition, it has been reasoned that implementing DNSSEC is just as hard
or easy as implementing entropy additions.

The upshot of this all is that people are effectively saying they will not
be supporting anything *but* DNSSEC.

And that would be sad, if not dangerous, especially since quite a number of
wise people agree DNSSEC rollout will take years. We don't have years to
address the 64% chance.

> These sort of remarks are not very helpful for constructive  
> engineering and don't help to get the core of your message across:  
> "Keep an open mind in alternative interim(?) approaches and work on  
> making DNSSEC easier to operate"

I'd love to be able to put it less bluntly. What is also not helpful is the
near-religious mantra that DNSSEC is the only solution, a mantra which is
part of an astoundingly large part of recent postings and literature.

So - I apologise for accusing people of something it is hard to defend
against. 

But I sincerely hope we won't let the dream of large-scale DNSSEC deployment
over time stand in the way of doing something now.

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>