Subject: DNSSEC is hard to get right

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 31 Aug 2010 08:41:40 +0200

% check-sig iab.org
Name iab.org has an expired signature (20100829223019)

:-(

---

From: "Richard L. Barnes" <[email-masked]>
Date: Tue, 31 Aug 2010 07:07:21 -0400

Another view, for the visually inclined:
<http://dnsviz.net/d/iab.org/dnssec/>

On Aug 31, 2010, at 2:41 AM, Stephane Bortzmeyer wrote:

> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf

---

From: "Jiankang YAO" <[email-masked]>
Date: Tue, 31 Aug 2010 14:55:08 +0800

I propose a lightweight DNSSEC.

http://www.ietf.org/id/draft-yao-dnsext-msig-00.txt

which may push the dnssec to be deployed easily.

:)

Jiankang Yao

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 31 Aug 2010 09:34:40 -0400

DNSSEC is a PKI and running a PKI is never a trivial matter.

One of the reasons I have serious concern about the prospects for
deployment of DNSSEC is that the answer to many of my questions is
either a blank stare, an off the cuff answer clearly made up on the
spot or the claim that it is something for the market to decide on.

As things stand we have an excellent architecture for securing
distribution of DNS A and AAAA records. We are thus confident of our
ability to transfer attacks from the DNS system where the effect of
attacks is pretty much localized to the BGP system whose fragility was
demonstrated only last Friday by RIPE. Is this really progress?

Out in Iraq, there is a water treatment plant that cost $110 million
to build. So far it has delivered absolutely no clean water to any
homes because nobody considered the need to build a pipe to connect
the water treatment plant to the city water mains.

There is a metaphor there if people want to see it.

-- 
Website: http://hallambaker.com/