Re: DS and Opt-in - a proposal

[Greg Hudson <ghudson@mit.edu>]

On Sat, 2001-12-29 at 02:45, bert hubert wrote:
> > In the Unix world, at least, the applications shouldn't have to get
> > involved, just the recursive resolver (named, traditionally) and to some
> > extent the stub resolver in libc.  The application may be interested in
> 
> You must live in a parallel universe from mine. The application developer
> has needs. If DNSSEC is unable to meet, or worse, not interested in those
> needs, s/he will ignore it. It is not a unix question.

What needs?

Your initial message said "DNSSEC is going nowhere if they [browsers]
aren't going to use it!"  I was arguing that DNSSEC is useful even if
browsers stay the same as the are, at least in the Unix world.  If:

  * DNSSEC is deployed at the root,
  * the recursive resolver is DNSSEC-aware and knows the root's key,
  * com, amazon.com, and www.amazon.com are signed, and
  * the path from the stub resolver to the recursive resolver isn't easy
    to attack (because they're on the same machine, the path is behind a
    firewall which the attacker can't get behind, or the path is
    protected by TSIG)

then it becomes prohibitively difficult to spoof the address of
www.amazon.com, even if the browser is completely ignorant of DNSSEC. 
That's a win over the current situation, where it is relatively easy to
spoof that address (especially if you can watch the query, but in many
cases even if you can't).

> There is no difference. Right now DNSSEC is purely academic with some
> laboratory experiments. Some fairy may come along and suddenly make all user
> applications DNSSEC aware, but don't count on it. It's not that you write
> the RFC and suddenly people start implementing it.

The only reason I can think of why most user applications would need to
be DNSSEC-aware is to convey to the user whether a domain is signed or
not.  Since most users don't understand what that means, I don't think
that's the most important part of DNSSEC.

> Just saying 'it is transparent from an applications' point of view' does not
> cut it. 

Why not?

> Interesting to note is that I'm told that IE has its own resolver, separate
> from the regular windows one.

Its own stub resolver or its own recursive resolver?  If the latter
(which I somewhat doubt; it wouldn't work so well with firewalls), then
like any other recursive resolver, that would need to implement DNSSEC
in order to benefit.



to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.