<html theme="default-dark" iconset="color"><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head><body text="#000000"><br>
<br>
<span>Paul Ebersman wrote on 2021-09-30 14:30:</span><br>
<blockquote type="cite"
cite="mid:20210930213034.D072D14F5EA7@fafnir.remote.dragon.net">
<pre wrap="">...
NTAs in production use aren't even vaguely new. They've been in wide use
for 8-10 years that I'm aware of. They are part of why folks like
google, cloudflare, comcast et al are willing to do DNSSEC validation in
production.</pre>
</blockquote>
<br>
i know that. i just don't like it. without backpressure, sloppiness will
normalize. (always.)<br>
<br>
<blockquote type="cite"
cite="mid:20210930213034.D072D14F5EA7@fafnir.remote.dragon.net">
<pre wrap="">
Doing it automatically is bad, as per RFC 7646, but it is a valid
response if it's a large site and mistake rather than malicious.
</pre>
</blockquote>
<br>
when considering only one's own ring queue / ticket queue, that's
certainly so.<br>
<br>
i hope that there's a long enough long tail on NTA deployment that the
cost of getting one's keys or signatures mixed up is still horrific. i
don't know how to measure that.<br>
<br>
vixie<br>
<br>
<div class="moz-signature">-- <br>
<div>Sent from <a href="https://www.postbox-inc.com"><span style="color:
rgb(0, 157, 247);">Postbox</span></a></div></div>
</body></html>