End to end ceases to have any value whatsoever once people attempt to
codify it into a rigid ideology.
Security does not respond at all well to ideological mandates. We have
tried to deploy end-to-end solutions and failed. In many cases we
could easily have succeeded if we had been less inflexible in the
approach.
You are not doing David any favors whatsoever here. He is not a
dogmatic ideologue. The end-to-end paper was originally written when
rigid ideologues such as yourself considered the telephone network to
be the ultimate communications infrastructure.
Above all, it is an argument against dogmatic approaches to system
architecture. You are completely misrepresenting his work.
On Wed, Jun 10, 2009 at 7:22 PM, Masataka
Ohta<mohta(_at_)necom830(_dot_)hpcl(_dot_)titech(_dot_)ac(_dot_)jp> wrote:
Phillip Hallam-Baker wrote:
I really see no value in debating whether DNSSEC is 'end to end'.
Being end to end has practical benefits, which is why the Internet
has been so successful, which is why some people have been insisting
on a false statement that DNSSEC were secure end to end.
For example, the following statement of you in another subthread:
The
current design would establish the root key holder as the perpetual
controller of the DNS.
means DNSSEC involves the root key holder as a third party and not
end to end.
Feel free to see no value on your statements.
Clearly DNSSEC is only one component in a security solution and
whether it is 'end-to-end' depends on what you decide to call an
endpoint.
According to the terminology of David Clark, DNSSEC is not end
to end.
When Kaminsky discovered his cache poisoning vulnerability, some
companies put out PR saying that the issue was already known, as if
that made things better somehow.
The issue is that the concept of "bailiwick" is broken, which
was already pointed out.
Kaminsky's attack can be protected against by proper handling
of glue, without which DNSSEC cache can also be poisoned.
Masataka Ohta
--
--
New Website: http://hallambaker.com/
View Quantum of Stupid podcasts, Tuesday and Thursday each week,
http://quantumofstupid.com/
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf