Re: [DNSOP] CDS and/or CDNSKEY

On Oct 8, 2013, at 1:10 PM, Doug Barton <dougb@dougbarton.us> wrote:

> On 10/08/2013 12:52 PM, Paul Hoffman wrote:
>> On Oct 8, 2013, at 11:48 AM, Doug Barton <dougb@dougbarton.us> wrote:
>> 
>>> However I think a reasonable conclusion from the stalemates that have arisen from all of the previous attempts over the years would be, "There is no agreement on how to proceed, so we should not proceed."
>> 
>> That is the opposite of the feeling that I got from the DNSOP meeting in Berlin.
> 
> ... and yet, there is a larger world outside the select few able to attend the meetings. :)  One could even reasonably argue that the opinion of those who do attend the meetings is of questionable statistical validity due to volunteer bias.
> 
>>> But have we any evidence that if created, this mechanism will be used?
>> 
>> IIRC, there were at least a few TLD operators at the DNSOP WG in Berlin who indicated they would strongly consider it.
> 
> Translated, "The idea does not suck so much that we feel comfortable rejecting it out of hand, but we have no real interest in it."
> 
>>> I personally don't subscribe to the "If we build it, they will come" school of engineering. We have too many counterexamples in the DNS already.
>> 
>> That's fine; neither you or I (currently) run a TLD and we don't have to think about it yet. This is for the people do run TLDs, and the multitude who are going to be doing so soon.
> 
> ... which leads back to my previously expressed concern that the gTLD RRA framework may specifically prevent this kind of child-to-parent signaling from being possible.

Which is why the draft specifically talks about parental agents:
Parental Agent: "The entity that the child has relationship with,
      to change its delegation information."

and Appendix A has:
For example in many of the TLD cases there is the RRR model
   (Registry, Registrar and Registrant).  The Registry operates DNS for
   the TLD, the Registrars accept registrations and place information
   into the Registries database.  The Registrant only communicates with
   the Registrar; frequently the Registry is not allowed to communicate
   with the Registrant.  In that case as far as the registrant is
   concerned the Registrar == Parent.

Basically the 50'000ft view is:
In many regulatory environments (the polite way of saying where ICANN says "No!") the *registrar* will fetch the CDS / CDNSKEY and will push the updated records into the *registry* through existing mechanisms (like EPP).

W

> 
> To save everyone time and further responses, I've seen all the counter-arguments, and have followed the most recent thread in addition to the previous ones. I stand by my analysis that this is a solution in search of a problem, and that limited resources could be better spent elsewhere; for whatever that analysis is worth.
> 
> Doug
> 
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop
> 

--
"Have you got any previous convictions?"

"Well, I dunno... I suppose I used to believe very firmly that a penny saved is a penny earned--"
-- Terry Pratchett