Re: Interpreting DNSSEC was Re: [dnsext] flip-flopping secure and unsecure DNAME/CNAME

[Ben Laurie <[e-mail]>]

Edward Lewis wrote:
> At 12:38 -0400 10/13/08, Michael StJohns wrote:
>> At 10:57 AM 10/13/2008, Edward Lewis wrote:
>>> DNSSEC only says "this answer looks good" or "doesn't look good."
>>> Trying to figure out whether the answer's disposition is
>>> temporary/permanent, correct/incorrect, trustworthy/not takes more
>>> than just the DNS data and more than just the query at hand.
>>
>>
>> DNSSEC says the answer looks good - SECURE
>> or doesn't look good - BOGUS
>> or DNSSEC told me I shouldn't care about DNSSEC past some point -
>> UNSECURE
>> or I have no information which would let me determine what DNSSEC
>> thinks about the data - UNKNOWN
>>
>> "Trustworthy" begs a definition here for what "looks good" means in
>> relationship to "trusting" DNS data.
> 
> This is the kind of debate that'll never end, judging from past
> incarnations of this thread.  To me, an answer that is under a trust
> anchor and below a null DS set is "looks good" as far as DNSSEC is
> concerned.  I.e., to me, UNSECURE == SECURE == UNKNOWN, when I consider
> the "bottom line" of the query-response.  I guess I have a Machiavellian
> (ends justify the means, i.e., all that matters are the ends) streak in me.

Broadly I agree, except I think you can also choose BOGUS == UNSECURE ==
UNKNOWN.

i.e. either trust everything that isn't bogus, or trust everything that
is secure.

Anyone who wants anything more nuanced than that can (and will, anyway)
write their own s/w :-)

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>