[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [RAM] DNS usage in NERD

Roland, Ran,

The *only* way to remove potential security issues associated
with DNS is to deploy DNS Security.  Period.

There's hardly consensus within the operational community surrounding the utility of DNSSEC, if that's what you're referring to, so assertions of this nature aren't really supportable.


Obviously you're both right. The way I see it, when we start to see real exploits we *probably* have a way to get around them, and operators might become more motivated to implement DNSSEC (regardless of whether NERD is deployed). But in this case, I would think the risk is limited to that of a denial of service, because the database and updates are signed. Perhaps a few words are in order in the draft?

Eliot

_______________________________________________
RAM mailing list
RAM at iab.org
https://www1.ietf.org/mailman/listinfo/ram