Re: [dnsext] Issues in WGLC of dnssec-bis-updates

Andrew Sullivan <ajs@anvilwalrusden.com> Wed, 08 February 2012 18:56 UTC

Date: Wed, 08 Feb 2012 13:56:17 -0500
From: Andrew Sullivan <ajs@anvilwalrusden.com>
To: dnsext@ietf.org
Message-ID: <20120208185617.GH11475@mail.yitter.info>
References: <20120207151820.GE9478@crankycanuck.ca> <4F31449C.9040604@nlnetlabs.nl> <a06240801cb570a945202@192.168.128.143> <CACU5sD=bUC9bC_OW4SeH2h6DPM+d3+-JkZyz=6u=dpmj+7rVjw@mail.gmail.com> <4F3232B6.3060505@nlnetlabs.nl>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <4F3232B6.3060505@nlnetlabs.nl>
User-Agent: Mutt/1.5.21 (2010-09-15)
Subject: Re: [dnsext] Issues in WGLC of dnssec-bis-updates
Precedence: list
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: dnsext-bounces@ietf.org
Errors-To: dnsext-bounces@ietf.org

No hat.

On Wed, Feb 08, 2012 at 09:30:46AM +0100, W.C.A. Wijngaards wrote:
> 
> On 02/07/2012 08:51 PM, Mohan Parthasarathy wrote:
> 
> > How does it help the application to make this more fine grained ?
> 
> No, the application just wants all bogus data to be removed.  Data that
> is secure and data that is not DNSSEC signed is what it wants. 

It seems to me that the above is either a matter of policy or a matter
of implementation.  That is, some applications will surely only want
data that they can know for sure is valid, and in particular will not
want any unsigned data no matter what.

This could be implemented in more than one way.  One is to hand the
application everything that is validated and unsigned, and let the
application work out which it wants.  But another would be for the
application to be able to signal this choice to the resolver.  No?

A
-- 
Andrew Sullivan
ajs@anvilwalrusden.com
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext

Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
[dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Edward Lewis
[dnsext] What is indeterminate Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mohan Parthasarathy
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mark Andrews
Re: [dnsext] What is indeterminate Mark Andrews
Re: [dnsext] What is indeterminate Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mark Andrews
Re: [dnsext] Issues in WGLC of dnssec-bis-updates bmanning
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Eric Brunner-Williams
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mohan Parthasarathy
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mark Andrews
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mohan Parthasarathy
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Edward Lewis
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mark Andrews
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mohan Parthasarathy
Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Samuel Weiler
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Wes Hardaker