Re: [Dnsmasq-discuss] [Cerowrt-devel] Problems with DNSsec on Comcast, with Cero 3.10.38-1/DNSmasq 4-26-2014

2014-05-01 Thread Simon Kelley
On 29/04/14 21:57, Phil Pennock wrote: > On 2014-04-29 at 14:22 +0100, Simon Kelley wrote: >> secure no DS means that the original unsigned answer should be accepted, >> except that it shouldn't. There's no way to distinguish between secure >> lack of DS because we've reached an unsigned branch of

Re: [Dnsmasq-discuss] [Cerowrt-devel] Problems with DNSsec on Comcast, with Cero 3.10.38-1/DNSmasq 4-26-2014

2014-05-01 Thread Simon Kelley
On 30/04/14 18:26, Dave Taht wrote: > On Tue, Apr 29, 2014 at 1:57 PM, Phil Pennock > wrote: >> On 2014-04-29 at 14:22 +0100, Simon Kelley wrote: >>> secure no DS means that the original unsigned answer should be accepted, >>> except that it shouldn't. There's no way to distinguish between secure

Re: [Dnsmasq-discuss] [Cerowrt-devel] Problems with DNSsec on Comcast, with Cero 3.10.38-1/DNSmasq 4-26-2014

2014-05-01 Thread Dave Taht
On Thu, May 1, 2014 at 1:26 PM, Rich Brown wrote: > > On May 1, 2014, at 2:37 PM, Simon Kelley wrote: > >> On 30/04/14 18:26, Dave Taht wrote: >>> On Tue, Apr 29, 2014 at 1:57 PM, Phil Pennock >>> wrote: > > snip, snip snip... > >>> Is the consensus to not run with negative proofs on at this jun