Re: [DNSOP] Practical issues deploying DNSSEC into the home.

On Sep 11, 2013, at 9:18 AM, Phillip Hallam-Baker <hallam(_at_)gmail(_dot_)com> 
wrote:
> The DNS is the naming infrastructure of the Internet. While it is in theory 
> possible to use the DNS to advertise very rapid changes to Internet 
> infrastructure, the practice is that the Internet infrastructure will look 
> almost exactly the same in one hour's time as it does right now.
>  
> Using DNS data from 24 hours earlier might create reliability issues but 
> should never introduce a security risk. Anyone who is relying on the DNS for 
> data that is more time sensitive than 1 hour is doing it wrong.
I disagree.  DNSSEC is not just DNS: its the only available, deployed, and 
(mostly) accessible global PKI currently in existence which also includes a 
constrained path of trust which follows already established business 
relationships.

Dynamic DNSSEC applications, where signatures are generated on the fly, are 
almost certainly going to be developed to utilize this infrastructure.

--
Nicholas Weaver                  it is a tale, told by an idiot,
nweaver(_at_)icsi(_dot_)berkeley(_dot_)edu                full of sound and 
fury,
510-666-2903                                 .signifying nothing
PGP: http://www1.icsi.berkeley.edu/~nweaver/data/nweaver_pub.asc

signature.asc
Description: Message signed with OpenPGP using GPGMail