Re: Pimping DNSSEC (was Re: DNSSEC - Signature Only vs the MX/A issue.)

[bert hubert <bert.hubert@netherlabs.nl>]

On Mon, Dec 04, 2006 at 11:45:03AM +0100, Shane Kerr wrote:
> Isn't this always the case with security though? What is the direct, immediate
> RoI for putting a lock on your door?

Try removing the lock from your office building and you find out quickly
enough.

Security IS part of doing business, and if it is more effort than it is
perceived to be worth, people don't do it. 

Perception is the key word here though.

My feeling however is that the full cost of DNSSEC (even without NSEC3)
vastly outweighs any perceived (or even: real) benefit.

See http://ds9a.nl/secure-dns.html for some further discussion. I don't
doubt DNS needs better security, but it doesn't warrant anything really
complex.

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>