I took a look at DNSCurve. Some points:
* It could certainly win.
* It is designed as a hack rather than an extension.
* It considers real world requirements that DNSSEC does not.
On the 'winning' front. Have people noticed that the IETF has only
ever succeeded in developing security standards by appropriating
systems that had already defeated the IETF generated solution? PGP was
not developed in house, it was a reaction to PEM. SSL was developed by
Netscape. X.509 came from OSI.
Given that record, why are we so sure that IETF processes are such a
good way to develop security specifications?
In practice the DNSEXT working group has been allowed to own this
issue for over a decade now. For the vast majority of that time the WG
has conducted itself as if it was in 'maintenance mode' for a
specification that has not been deployed. The response to each and
every real-world requirement that has been raised has been 'we have
been doing this too long to think about that'. And so it takes four
years to make fixes that should have been done in a month.
The W3C is not perfect by any means. But it does have a process that
has ensured that WGs begin with a wider range of requirements than
just what the people who bothered to show up for a BOF happened to be
interested in at the time. Each standards initiative begins with a
workshop that is open to all comers.
The problem with not holding that type of event at the start is that
it is much more difficult to hold one later.
We have a process that is focused on technology and on solutions. My
experience is that it is most important to focus on the problem.
On Wed, Feb 24, 2010 at 4:56 AM, Dearlove, Christopher (UK)
<Chris(_dot_)Dearlove(_at_)baesystems(_dot_)com> wrote:
http://twitter.com/joebaptista/status/9555178362
I'm probably not alone in working for a company that blocks
twitter.com, and as the very nature of tweets is that they
are short, posting the tweet rather than the link on lists
such as this might make more sense.
Actually (since I have access via my own resources) the only
content beyond the subject line above is s bit.ly link.
So ideally the posting here would probably be to the
resolved version of the link. For those who also don't have
access, that's
http://blog.opendns.com/2010/02/23/opendns-dnscurve/
(I don't have any comments on the subject in general, or
that posting in particular.)
--
Christopher Dearlove
Technology Leader, Communications Group
Networks, Security and Information Systems Department
BAE Systems Advanced Technology Centre
BAE Systems (Operations) Limited
Registered Office: Warwick House, PO Box 87,
Farnborough Aerospace Centre, Farnborough, Hants, GU14 6YU, UK
Registered in England & Wales No: 1996687
********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf
--
--
New Website: http://hallambaker.com/
View Quantum of Stupid podcasts, Tuesday and Thursday each week,
http://quantumofstupid.com/
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf