Re: [DNSOP] DLVs and ITAR

[Jim Reid <[e-mail]>]

On 11 Sep 2009, at 10:48, Stephane Bortzmeyer wrote:

>> Now please suggest how someone can perform that due diligence in
>> circumstances where there are unknown (to them) actors
>
> If dlv.isc.org is an unknown actor to a DNSSEC-signed TLD, they indeed
> have a big problem!

Stephane, you are picking nits instead of addressing the points I made.
These focus on the fact that there are informal undocumented  
arrangements around the operation of a DLV registry, how and where  
that registry gets its keying material, how that registry publishes  
the info, what its operating practices and service commitments are,  
how others use that DLV registry for validation, what problem  
reporting and escalation procedures are available, etc, etc. These are  
the unknown actors I was referring to.

It appears there was no procedure for .pr to give ISC a heads-up about  
the key rollover. Or for ISC to nudge .pr about the problem caused by  
the changed key. That worries me. It should worry you too.

At one level this is no big deal in the context of minimal DNSSEC  
deployment and only some fraction of that being dependent on  
dlv.isc.org. However we are talking about something that affects core  
Internet infrastructure, namely a TLD. IMO, more care is needed. If  
the Internet people don't do that, there is a strong possibility their  
toys will one day get taken away because governments will decide they  
have intervene to impose order on something that appears to them to be  
(a) important; (b) unsatisfactorily supervised.

> Can you blame DLV, ISC or an unknown actor for that?

I am not blaming anyone or seeking to apportion blame. I'm simply  
pointing out that it's not wise for the operation of things like DLV  
to be based on unstated assumptions and goodwill best efforts (however  
noble these things are) instead of documented processes/procedures.

> Currently, almost no one (outside of this mailing list) uses
> DNSSEC. Yet, you say that there are people in this very small
> community that are not aware of dlv.isc.org and not aware that it
> mirrors ITAR? Come on.

No I'm not saying that. I am saying that it is not wise to work from  
assumption (correct or otherwise) that dlv.isc.org is the only DLV in  
town.
If someone claims there is no other DLV, then the onus on them is to  
prove that.