Re: IESG feedback on dnsext-ad-is-secure

[Paul Vixie <paul@vix.com>]

> >   | I've been assuming that 'some of the required signatures are invalid'
> >   | would mean that the data wouldn't be returned to the client.
> 
> > Maybe it does, but I would certainly hope that's not the expected
> > interpretation (by default).
> 
> It has to be, or the major benefit of DNSSEC is lost.  [...]

So, six++ years into the experiment, we still don't agree on what problem
DNSSEC is supposed to solve, and what the underlying security model will be?

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>