<HTML>
<HEAD>
<META http-equiv="Content-Type" content="text/html; charset=UTF-16">
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-16">
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.0.6396.0">
<TITLE>Re: Verisign brain damage and DNSSec.....Was:Re: What *are* they smoking?</TITLE>
</HEAD><BODY ><DIV>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>On Tue, 16 Sep 2003 11:27:08 PDT, bmanning@karoshi.com said:</FONT>
</P>
<P><FONT SIZE=2>> if vt.edu wants to place a: </FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> * in a 198.82.247.53</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> in the vt.edu zone, why should anyone complain that now vt.edu</FONT>
<BR><FONT SIZE=2>> doesn't return NXDOMAIN for all un-delegated entries? You want</FONT>
<BR><FONT SIZE=2>> that everyone should hack the DNS to force NXDOMAINS for your</FONT>
<BR><FONT SIZE=2>> wildcard? Feh.</FONT>
</P>
<P><FONT SIZE=2>So you're saying it's OK when Verisign does the same exact thing one level up?</FONT>
<BR><FONT SIZE=2>Or are you surprised that people are coding it for the Verisign case?</FONT>
</P>
<P><FONT SIZE=2>The difference is when we urinate in our zone of the DNS, it's OUR zone.</FONT>
<BR><FONT SIZE=2>When Verisign does it, they're not urinating in *THEIR* .COM, they're</FONT>
<BR><FONT SIZE=2>urinating in a .COM they were holding in the public trust.</FONT>
</P>
<P><FONT SIZE=2>If in fact .COM is now Verisign's playground rather than a public trust,</FONT>
<BR><FONT SIZE=2>then that's a different matter.</FONT>
</P>
<P><FONT SIZE=2>> DNSSEC will tell a validating resolver the signature of each</FONT>
<BR><FONT SIZE=2>> party that signed part of the chain. If Verisign wishes to </FONT>
<BR><FONT SIZE=2>> sign bits of data that might exist under the delegation point</FONT>
<BR><FONT SIZE=2>> they have responsibility for, I'm in favor. Its not "make-believe"</FONT>
<BR><FONT SIZE=2>> ... or perhaps I don't understand your angst.</FONT>
</P>
<P><FONT SIZE=2>The point is they're not signing data that might exist, they're signing data that</FONT>
<BR><FONT SIZE=2>doesn't exist. If a query comes in for www.never-existed.com comes in, what</FONT>
<BR><FONT SIZE=2>exactly is getting signed? (Yes, if it's a synthesized reply based on a wildcard,</FONT>
<BR><FONT SIZE=2>you can count the NXT's and stuff to determine that - but I quite frankly don't</FONT>
<BR><FONT SIZE=2>trust the Verisign people to not intentionally obfuscate the replies to make this</FONT>
<BR><FONT SIZE=2>impossible.....)</FONT>
</P>
</DIV>
<P> </P></BODY></HTML>