Re: [dnsop] draft-krishnaswamy-dnsop-dnssec-split-view-03

[Andrew Sullivan <[e-mail]>]

On Wed, Aug 23, 2006 at 06:24:03PM -0400, Suresh Krishnaswamy wrote:

> added and portions moved to the appendix. I've also added some text  
> to suggest that this document is more a "DNSSEC" split-views  
> recommendation rather than a "DNS" split-views recommendation.

I continue to have a deep reservation about this document: the whole
thing depends on something like a reasonable set of practices around
split-view DNS.  Indeed, it seems to me that all of section 3 amounts
to a way to sneak that in through the back door.

Don't get me wrong: I'm not opposed, at least at first blush, to
anything in section 3, and it seems to me to be a nice outline of what
is needed.  But the simple fact that the only reference in that
section, in my quick reading, is to TSIG suggests to me that there is
a set of practices that are either undocumented or else uncited, but
which form the necessary condition for the practices outlined later
in this document.

The above is the reason that I suggested just before the Montreal
meeting that there are, in fact, two documents here.  I appreciate
that there is a certain vitriol that seeps out every time split-view
DNS is discussed.  But if we are not willing to come to some sort of
consensus on what an "ordinary" split-view DNS operator ought to
consider, I don't think we can seriously recommend anything for a
split-view DNS operator to consider in the presence of DNSSEC.  I
don't know of any document that outlines what a split-view DNS
operator ought to consider, and there isn't one listed in the
references of this draft.

The alternative, of course, is to make this into a document about
split-view generally, with a section that covers how it interacts
with DNSSEC.  (That seems to me to be a possibility, although it will
of course make the document a little more complex.)

That said,

> I personally think that there is enough agreement within the working  
> group that this topic, in general, is important. 

I agree.  I also think the draft is in general a good one.  I just
think that it either needs to be straightforwardly about split-view,
or that it should depend on another document that is about "vanilla"
split-view.

A

-- 
----
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[e-mail]>                              M2P 2A8
                                        [phone] x4110

.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html