<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>(Just using this to launch into a tirade.)</div><div><br></div><div>On Aug 22, 2013, at 15:59, <<a href="mailto:WBrown@e1b.org">WBrown@e1b.org</a>> <<a href="mailto:WBrown@e1b.org">WBrown@e1b.org</a>> wrote:</div><blockquote type="cite"><div>Running the DNS for 100+ school districts and 400,000+ devices I really, </div><div>REALLY don't want to be the one saying "Sorry, you can't use the site <br>called for in your lesson plan today because they messed up the DNSSEC <br>records." Management's response would be "Just make it work!"</div></blockquote></div><div><br></div><div>One thing that seems to need repeating from time to time is this passage in RFC 4033.</div><div><span class="Apple-style-span" style="font-family: monospace; white-space: pre-wrap; "><br></span></div><div><span class="Apple-style-span" style="font-family: monospace; white-space: pre-wrap; "> ... In the final</span></div><div><span class="Apple-style-span" style="font-family: monospace; white-space: pre-wrap; "> analysis, however, authenticating both DNS keys and data is a matter</span></div><div><span class="Apple-style-span" style="font-family: monospace; white-space: pre-wrap; "> of local policy, which may extend or even override the protocol</span></div><div><span class="Apple-style-span" style="font-family: monospace; white-space: pre-wrap; "> extensions defined in this document set. See Section 5 for further</span></div><div><span class="Apple-style-span" style="font-family: monospace; white-space: pre-wrap; "> discussion.</span></div><div><br></div><div>A responsibility (one of many) of a caching server operator is to "protect the integrity of the cache." DNSSEC is just a tool to help accomplish that. It carries ancillary data that a local cache administrator may use to filter out undesired responses. DNSSEC is not an enforcement mechanism, it's a resource.</div><div><br></div><div>When I see folks voice opinions that DNSSEC's recommended operation has to strictly followed, my gut reaction is that these folks have forgotten the purpose of all of our efforts. We don't secure protocols to make things work better. We don't operate the DNS because we like to run a well run machine. We don't run the Internet for the fun of it. (Some might enjoy running it, that's job satisfaction to some extent.)</div><div><br></div><div>At the end of the day all that matters is that what is being done benefits society. We run the Internet to enrich society. We prefer a well run DNS because it saps less resources than a poorly run DNS. We prefer secure protocols so that people don't become victims (in some sense of the word).</div><div><br></div><div>Make it work. Do what it takes to make it work. "Local policy" rules.</div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=<span></span>-=-=-=-<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>Edward Lewis <span></span> <br>NeuStar <span></span> You can leave a voice message at +1-571-434-5468<br><br>There are no answers - just tradeoffs, decisions, and responses.</div></div></div></span></span>
</div>
<br></body></html>