Re: [mdnsext] mDNSext features/requirements rollup

The problem has been that the POSIX and non-apple WAB component for
read/write DNS-SD under the bonjour stack has been broken and ignored
for years.

Integrating mDNS & WAB has been close on impossible because of this
(reference all the frustrations on the bonjour-dev mailing list without
resolution, again, it's been years!).

Alternate stacks such as avahi (non-cross platform) have waited for
"vital" security implementations for DNSSEC before implementing write
enabled DNS-SD (a big mistake IMHO!), and because DNSSEC is so hairy
this has not happened either (on their roadmap unimplemented/delayed for
years).

WAB & m~DNS has had the potential to be an exciting cross platform
Internet-wide resource publishing and discovery mechanism, but their
seems little interest in the past to make this happen,

Regards to all,

.v

On 29/01/2013 18:39, nudge wrote:
> On Tue, Jan 29, 2013, at 07:07 PM, Alf Watt wrote:
>>
>> I think Andrew's point is worth taking the time to seriously consider. We
>> already have dynamic DNS update but as previously mentioned configuration
>> of the DNS server and it's clients out has proven to be either too
>> difficult or not of interest to various OS vendors.
>>
>> It's worth mentioning that Apple has all the parts in place to pull this
>> off:
>>
>> - A Server OS with an embedded DNS server which they provide a UI to
>> manage
>> - Traditional and Mobile Clients with mDNSResolvers running on them
>> - A profile distribution system which make pushing configuration options
>> including keys easy
>>
>> Given the will to get the features implemented Apple could solve part of
>> the problem this without any changes to mdns.
>>
>> There are still things that fall outside of that scope which we should
>> consider, but ignoring the opportunity to uses the existing protocols
>> seems like a lot of effort to reproduce work that already exists.
>>
>> Best,
>> Alf
>>
> 
> As someone who successfully tested and implemented WAB with TSIG
> protected updates[1] in an Apple environment about a year or so ago, I
> would tend to agree. It wasn't as difficult as I imagined partly because
> of a lack of documentation. Of course, things have changed since and I
> need to test again soon. But back then you had to front-end named with
> dnsextd if you needed llq (obviously you do). If that's still true it
> blocks other useful stuff such as rpz and rrl and needs fixing IMO.
> 
> [1]I also tested TSIG protected reads DNSprivate, where's that going ?
> 
> _______________________________________________
> mdnsext mailing list
> mdnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/mdnsext
> 