Re: [dnsext] Issues in WGLC of dnssec-bis-updates

>>>>> On Thu, 8 Mar 2012 16:25:30 -0800, Paul Hoffman <paul.hoffman@vpnc.org> said:

PH> When not presented with the situation that more than one trust
PH> anchor is configured, DNSSEC validators SHOULD NOT expose policy
PH> choices such as those shown in these subsections in configuration
PH> options. That is, these policy choices SHOULD only be exposed
PH> when there are multiple options.

The problem with the wording is that you're really trying to say
something that dictates software implementation practices.  And this is
nearly impossible to get right because most software stacks really can't
do what you want.  Specifically, if a software stack accepts a
configuration file as an input for policy knobs there is no way you
"SHOULD NOT expose" knobs based on the number of trust anchors defined
somewhere else in the file.

Wouldn't it be better to state your actual intentions?

  It is recommended (RECOMMENDED?) that the policy options in the
  following subsections only be configured when multiple trust anchors
  are also configured.

If someone is writing a GUI configuration set (ha ha, like those exist),
then they can actually hide things.  Otherwise it's up to the operator
to not use the knobs in the section when writing a config file.

-- 
Wes Hardaker
SPARTA, Inc.
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext