Subject: RE: What I mumbled at the mike today...

From: "David A. Ulevitch" <[email-masked]>
Date: Mon, 9 Aug 2004 11:13:07 -0700 (PDT)

<quote who="Hallam-Baker, Phillip">
>> the people who agree with you and are serious about such, are already
>> using split-view dns.  outsiders don't see things that they shouldn't
>> see.
>
> Split DNS has absolutely no viability in a Web Services extranet
> application.

Okay, so don't use it there.  Split DNS, by definition, would be
considered tangential to an extranet.  ie, the extranet is on one side of
the split and doesn't know about the other.  If your extranet needs a peek
inside, I suggest evaluating a VPN or alternate solution.

>
> The UDDI services used to advertise an connect the services is protected
> using SSL and access control.

...unrelated...?

>
> If it is not possible to store names securely in DNS then either that
> function will have to be served in UDDI or we will have to develop
> a suitable DNS security fix in another forum.

define "store names securely" -- the machine can be secured, the split
horizons (or views) can be secure.  the network can be secure.  what part
of secure do you really want?  The ability for it to not be enumerated?  I
thought this discussion was over.

-davidu

----------------------------------------------------
   David A. Ulevitch - Founder, EveryDNS.Net
   http://david.ulevitch.com -- http://everydns.net
----------------------------------------------------

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Alex Bligh <[email-masked]>
Date: Mon, 09 Aug 2004 19:34:03 +0100

> Split DNS has absolutely no viability in a Web Services extranet
...
> a suitable DNS security fix in another forum.

Seems to me the above argument is equally applicable, mutatis mutandis,
to interorganization SIP & SIP URIs.

Alex