Re: [secdir] Review of draft-vixie-dns-rpz-04

[Paul Vixie <[e-mail]>]

thank you pwouters, i will see what i can do to address your comments in the 
next draft. meanwhile, some of our colleagues at cnnic have indicated a 
willingness to work on the -bis concept of including both the truth and the 
lie, with a dnssec proof of the truth, and a tsig or sig(0) of the lie, so 
that the client can be aware of both, and make its own choices. i'd be happy 
to be a part of that conversation, and, i wish that vernon or i had thought of 
this originally. dns firewalls are valuable as a feature, but should be usable 
on a permission model. note that in a private network like my home or 
business, i would not offer that choice. but for isp and other access 
networks, that choice should be available to every user.

thanks again for your review.

vixie