Philip Homburg <[email protected]> wrote: >> This is a I want a pony draft. It will not work for every validator. >> Validator operators shouldnt have to add NTAs, assuming that there >> implementation supports them, because people are to lazy to do due >> diligence when moving operators.
> This is a weird use of the concept 'pony'. It causes problems for the
small
> percentage of people running validators that haven't been update for more
> than a decade. Those validators cannot validate half of the DNSSEC
Lest someone wonder why anyone would have such an old validator...
A reason is because one has to unarchive some ancient VM (or container) in
order to validate a bug in some old system. Or worse, because one needs the
toolchain contained within in order to build a patch for some old (in the
field) system.
And the first thing that happens is that one needs a few new things inside
the VM, the absolute last patches to gcc 11 and openssl 1.1.1QAZT... and
guess what... the DNS resolver libraries, or **localhost DNS-validator**
inside are also old. The VM won't be alive very long, and isn't exposed
otherwise to the network...
{I recently had to bisect a node v16 thing with react-js 16, against a
dependancy that broke with newer stuff. }
I find that this is one of the serious downsides of Docker: it trivially and
often unknowingly locks down ancient code. The SBOM part of it is not yet
used enough for knowing what's broken.
--
Michael Richardson <[email protected]> . o O ( IPv6 IøT consulting )
Sandelman Software Works Inc, Ottawa and Worldwide
** My working hours and your working hours may be different. **
** Please do not feel obligated to reply outside your normal working hours **
signature.asc
Description: PGP signature
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
