Re: Summary: DNSEXT WGLC: To OPT-IN or not to OPT_IN

["D. J. Bernstein" <djb@cr.yp.to>]

Hallam-Baker, Phillip writes:
> the security considerations of an unsecured delegation and a secured
> delegation to an unsecured zone are exactly the same

The same argument cuts both ways. To fix the existing security disaster,
we have to secure all the zones _and_ we have to secure the delegations.
If the .com people were prepared for this, they wouldn't need opt-in.

Opt-in allows the .com people to claim full DNSSEC support when the
reality is that they can't handle a DNSSEC universe. It takes a failed
security system and tries to pretend that it's a working system.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>