Re: dane-openpgp 2nd LC resolution

[Warren Kumari <[e-mail]>]

On Tue, Mar 15, 2016 at 9:44 AM Doug Barton <[e-mail]> wrote:

> On 03/14/2016 04:18 PM, Paul Wouters wrote:
> > Yes, you are about 1.5 years late. And your arguments are (un)fortunately
> > not new arguments. Since the archive on this draft is rather huge, I can
> > understand that you missed part of this discussion. So for completeness
> > sake, I will answer your questions again.
>
> Thank you for your patience in explaining your reasoning, and again, I'm
> sorry for coming late to the party. And thanks as well for confirming
> that my memory is correct ... at one time I did hear that this topic was
> going in the direction of signatures rather than certs. Unfortunate that
> I didn't follow it closer.
>
>
I just wanted to mention that we have been working on this for a long time,
and there is a definite level of frustration (and some cultural mismatches
/ cross area chalenges), and many people are tired at this point. There
have been a large number of messages on the list related to this document
(and topic), so, following it closely is a challenge.



> Regarding what you said and what your goals are, I think that we are
> pretty far apart. I will send a detailed response to your message on the
> DANE list soon. In all likelihood I will also create a new I-D with my
> ideas specified in more detail.


Yes, please do - I think it would be useful to have a better understanding
/ more detail. I should mention again that at this point many people are
tired and / or frustrated, so we will to work to overcome that.


> Perhaps what is needed is more than one
> experiment. :)
>

Aaaargh! What could possibly go wrong!? :-P

W


> In regards to the current last call, while your explanations do help to
> alleviate a few of my concerns, in large part I am still not
> enthusiastic about this version of the draft proceeding.
>
> In particular I think the concern about these RRs being used for DDOS
> amplification remains. There is no mechanism in place currently in any
> name server software that I am aware of to limit responses to queries in
> the manner you describe (only send answers if the query comes over TCP
> or with DNS-Cookies). Further, I don't see that happening any time soon.
>
> Close behind that concern, the larger IETF community (or at least some
> very vocal segments of it) have serious concerns about this type of
> opportunistic encryption happening at all, or in my case, without user
> input. They (and to some extent I) remain unconvinced that your
> assertion that this type of opportunistic encryption is always better
> than the current state. Personally, I need to think more about that, but
> at least in the early stages of an experiment in tying PGP keys to DNS
> RRs, I'm definitely opposed.
>
> FWIW,
>
> Doug
>
>