> So what? While the root will be an issue EVERY other zone goes > INSECURE as people migrate to new algorithms and lookups DO NOT > FAIL. This is how DNSSEC was designed to work. To have GRACEFUL > fallback with old validators. > > This attempt to break the bargain we made with the world is WRONG. > It is bad engineering.
I think it is very bad idea for security protocols if software that it at least a decade out of date and that has marginal (remaining) deployment can block useful progress. Whether and how to sign is a decision of the zone owner. There is no requirement to sign is a way that is incompatible with those old validators. It is just that we should allow a zone owner to say: we don't care about people running obsolete security software. The people using that software can turn it off if they can't update. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
