[62176] in North American Network Operators' Group
Re: Verisign brain damage and DNSSec.....Was:Re: What *are* they smoking?
daemon@ATHENA.MIT.EDU (Valdis.Kletnieks@vt.edu)
Tue Sep 16 15:07:55 2003
To: bmanning@karoshi.com
Cc: bownes@web9.com (Keptin Komrade Dr. BobWrench III esq.),
gmaxwell@martin.fl.us (Greg Maxwell), haesu@towardex.com (Haesu),
marius@marius.org (Marius Strom), nanog@merit.edu
In-Reply-To: Your message of "Tue, 16 Sep 2003 11:27:08 PDT."
<200309161827.h8GIR8O23444@karoshi.com>
From: Valdis.Kletnieks@vt.edu
Date: Tue, 16 Sep 2003 15:06:44 -0400
Errors-To: owner-nanog-outgoing@merit.edu
--==_Exmh_-785861516P
Content-Type: text/plain; charset=us-ascii
On Tue, 16 Sep 2003 11:27:08 PDT, bmanning@karoshi.com said:
> if vt.edu wants to place a:
>
> * in a 198.82.247.53
>
> in the vt.edu zone, why should anyone complain that now vt.edu
> doesn't return NXDOMAIN for all un-delegated entries? You want
> that everyone should hack the DNS to force NXDOMAINS for your
> wildcard? Feh.
So you're saying it's OK when Verisign does the same exact thing one level up?
Or are you surprised that people are coding it for the Verisign case?
The difference is when we urinate in our zone of the DNS, it's OUR zone.
When Verisign does it, they're not urinating in *THEIR* .COM, they're
urinating in a .COM they were holding in the public trust.
If in fact .COM is now Verisign's playground rather than a public trust,
then that's a different matter.
> DNSSEC will tell a validating resolver the signature of each
> party that signed part of the chain. If Verisign wishes to
> sign bits of data that might exist under the delegation point
> they have responsibility for, I'm in favor. Its not "make-believe"
> ... or perhaps I don't understand your angst.
The point is they're not signing data that might exist, they're signing data that
doesn't exist. If a query comes in for www.never-existed.com comes in, what
exactly is getting signed? (Yes, if it's a synthesized reply based on a wildcard,
you can count the NXT's and stuff to determine that - but I quite frankly don't
trust the Verisign people to not intentionally obfuscate the replies to make this
impossible.....)
--==_Exmh_-785861516P
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001
iD8DBQE/Z19EcC3lWbTT17ARApQVAKDl+mDru1aYZFeN5SLhTgxTdbu1/ACeM4ig
VH2Z82eyCTcS+QhV3wAnw3A=
=d3N7
-----END PGP SIGNATURE-----
--==_Exmh_-785861516P--
