Subject: Re: DNSEXT WGLC: To OPT_IN or not to OPT-IN

From: Brian Wellington <[email-masked]>
Date: Thu, 13 Mar 2003 11:18:03 -0800 (PST)

On Thu, 13 Mar 2003, David Conrad wrote:

> You all appear to be arguing that we should yet again modify DNSSEC, 
> increasing complexity and changing the security model, to include 
> functionality to address a temporary transition issue that only a 
> handful of folks will ever need and that many who have looked at the 
> problem believe is solvable in other arguably better ways?

I completely agree.

Furthermore, the main argument for opt-in has historically been that full 
DNSSEC would require too many resources.  Since this argument was 
originally used, probably 2 years ago, every conceivable resource has 
become both cheaper and faster, and the size of excessively large zones 
has more or less stayed the same.  This means that even if it had been a 
good argument in the past, it's days are over.

> If you want to support pushing opt-in forward, I believe it should be 
> done so with the belief that it is necessary, generally useful, and 
> improves the protocol, not a hack for a small set of outliers or "well, 
> it doesn't look like it will do any harm".

Exactly.

Brian

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Daniel Massey <[email-masked]>
Date: Thu, 13 Mar 2003 17:04:35 -0500

On Thursday, March 13, 2003, at 01:56  PM, David Conrad wrote:

> Sigh.  I've said I don't care what decision is made as long as a 
> decision is made and I still feel that way,

yes, there are no new technical issues being raised.    we need to make 
a decision.

> however this is a bit over the top.
>

No, to me it reflects that is trade-off rather than a clearly right or 
clearly wrong issue.  we are long past the time we should have decided 
on this trade-off.

as you suggest below, there may be "other arguably better ways" to 
address this "temporary transition issue".   But a decade from now, 
there will still be "other arguably better ways" that are better in 
some ways and worse in others.   I'm also not sure what is really 
"temporary", but in any event, this is a permanent change to the 
protocol.  It adds some complexity and that is bad, but the draft 
authors have convinced me much of the complexity I initially attributed 
to opt-in is actually inherent in DNSSEC.    I don't see anything more 
that authors could present and I think all the issues are on the table. 
   At some point, it has to come down to a decision.

my decision is I support the draft.   I can live with whatever the 
working group decides as long it decides.

Dan

> So, let me get this straight:
>
> On Thursday, March 13, 2003, at 06:09  AM, Olaf Kolkman wrote:
>> Although I would advise against its use in all other cases but the 
>> huge
>> zones out there, I do support the draft.
>
> On Thursday, March 13, 2003, at 10:47  AM, Scott Rose wrote:
>> As per Olaf's comment - I support the draft with the last round of 
>> comments.
>> And wish there was a good way of recommending OPT-IN for "huge zones" 
>> only.
>> However, I know what makes a zone "huge" would be a rathole debate.
>
> On Thursday, March 13, 2003, at 09:18  AM, Daniel Massey wrote:
>> same as above.  support for the draft with the last round of comments.
>
> improves the protocol, not a hack for a small set of outliers or 
> "well, it doesn't look like it will do any harm".
>
> Rgds,
> -drc