Re: [dssa] a thread for Dakar-meeting feedback

["James M. Galvin" <jgalvin@xxxxxxxxxxxx>]

Reputation systems and DNSSEC co-exist just fine.  I take issue with  
Paul's position as explained by Bill.
As I understand it, the issue is that DNSSEC will detect that somebody  
is mucking with your DNS responses but the user may not know why  
(perhaps it's intended because of the service they're using, i.e., the  
ISP is filtering for you because they know what's best for you).   
Worse, the user may not be able to "get around" the resolver that is  
inappropriately (or unexpectedly) mucking with DNS responses.
The overstated strong statement is that there is no recovery and  
therefore they do not co-exist.
That's the best that Bill could explain to me.  So, unless I'm missing  
something, there's no story here.  DNSSEC is doing its job by letting  
you know you have a problem.  The fact that you may be subjected to a  
reputation system unexpectedly is, well, a local problem.
We should not perpetuate this rumor without additional facts.

Jim





On Oct 24, 2011, at 3:20 PM, Mike O'Connor wrote:

> hi all,
>
> here's a little thread where you can all post comments/feedback you  
> receive during the course of the Dakar meeting.  i'll start it by  
> passing along a couple of notes i took during the DSSA-update  
> session at the GNSO yesterday.
> Jeff Neuman (NeuStar, Registries, Vice-Chair of the GNSO Council)  
> commented on our scope -- expressing concern that our scope is  
> perhaps too narrow and may be misperceived by people outside the  
> process as too focused on the root and TLD levels of the DNS.  he  
> made the point that "DNS" means a much broader thing to many and  
> they may be disappointed when they see our scope statement.  he  
> encouraged us to, at a minimum, make our scope statement really  
> clear in our final report
> Bill Manning and James Galvin had a conversation about the mutual  
> compatibility of  DNSSEC and DNS RPZ (here's a Paul Vixie blog post  
> about RPZ - https://www.isc.org/community/blog/201007/taking-back-dns-0) 
> .  Bill started with a comment that the two may be an either/or  
> choice, that they may not be compatible with each other.  James  
> questioned that.  Bill responded with reference to a very recent  
> interaction with Paul V. in which Paul said he didn't know how to  
> make the two approaches coexist.
> any other comments/ideas/feedback that people are hearing?  are you  
> finding copies of our "one pager" helpful?
> mikey
>
>
> - - - - - - - - -
> phone   651-647-6109
> fax             866-280-2356
> web     http://www.haven2.com
> handle	OConnorStP (ID for public places like Twitter, Facebook,  
> Google, etc.)