Re: [RAM] DNS usage in NERD

[Roland Dobbins <rdobbins at cisco.com>]

On Jun 16, 2007, at 4:47 AM, Eliot Lear wrote:

> The way I see it, when we start to see real exploits we *probably*  
> have a way to get around them, and operators might become more  
> motivated to implement DNSSEC (regardless of whether NERD is  
> deployed).

I don't want to waste bandwidth here on the reasons that many believe  
that DNSSEC fails to solve a series of posited non-problems, but  
suffice it to say that DNSSEC isn't universally as providing useful  
security functionality, and furthermore, some believe it introduces  
problems of its own.  For purposes of this discussion, let's  
stipulate that additional security mechanisms will probably be added  
to the DNS at some point in the future, at leave it at that.

> But in this case, I would think the risk is limited to that of a  
> denial of service, because the database and updates are signed.   
> Perhaps a few words are in order in the draft?

A more thorough analysis would be useful, but that's my initial take,  
too.

----------------------------------------------------------------------
Roland Dobbins <rdobbins at cisco.com> // 408.527.6376 voice

                   Equo ne credite, Teucri.

    		          -- Laocoön




_______________________________________________
RAM mailing list
RAM at iab.org
https://www1.ietf.org/mailman/listinfo/ram