hat tip to .gov hostmasters
bmanning at vacation.karoshi.com
bmanning at vacation.karoshi.com
Mon Sep 22 15:30:44 UTC 2008
On Mon, Sep 22, 2008 at 05:24:00PM +0200, Florian Weimer wrote:
> * marcus sachs:
>
> > While we wait for applications to become DNSSEC-aware,
>
> Uhm, applications shouldn't be DNSSEC-aware. Down that road lies
> madness. What should an end user do when the browser tells him,
> "Warning: Could not validate DNSSEC signature on www.example.com,
> signature has expired. Continue to connect?"
>
> --
> Florian Weimer <fweimer at bfk.de>
actually, I am really hoping that at least one API
is standardized so that applications can use DNSSEC
data. We never finished the discussion on fail/open
fail/closed wrt DNSSEC.
--bill
More information about the NANOG
mailing list