Re: [DNSOP] Working Group Last Call - draft-ietf-dnsop-rfc5011-security-considerations

On Wed, Oct 25, 2017 at 4:16 PM, Paul Hoffman <paul.hoffman@vpnc.org> wrote:
> On 18 Oct 2017, at 4:16, tjw ietf wrote:
>
>> This starts a Working Group Last Call for:
>> draft-ietf-dnsop-rfc5011-security-considerations
>
>
> I support the publication of
> draft-ietf-dnsop-rfc5011-security-considerations either as-is or with an
> additional section on looking at timing from a second perspective (as
> detailed by Mike StJohns).

Thank you, Paul.

Dear WG - I know that this document has a limited audience, is kind of
an annoying read, and is filled with maths (gasp!).
Wes and I do believe that this is an important document - getting
these timers wrong potentially has really bad security implications;
there was intended to be a companion document to RFC5011, but seeing
as that wasn't created, I think it is really importantt that we
address this.

So, pretty please, review this document and send feedback. We've tried
hard to make it readable, but the topic is unfortunately complex and
can only be simplified so far - it is also really hard to talk about
sliding windows of time.

So, again, please review and comment,
W

>
> --Paul Hoffman
>
>
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf