From cathy.zhou@huawei.com Thu Aug 1 02:39:14 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D82E321F8F24 for ; Thu, 1 Aug 2013 02:39:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.598 X-Spam-Level: X-Spam-Status: No, score=-6.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W66PkGJ5lYLw for ; Thu, 1 Aug 2013 02:39:10 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) by ietfa.amsl.com (Postfix) with ESMTP id 4A58D21F9CD9 for ; Thu, 1 Aug 2013 02:39:10 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml203-edg.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.5-GA FastPath queued) with ESMTP id AVQ13277; Thu, 01 Aug 2013 09:39:08 +0000 (GMT) Received: from LHREML403-HUB.china.huawei.com (10.201.5.217) by lhreml203-edg.huawei.com (172.18.7.221) with Microsoft SMTP Server (TLS) id 14.1.323.7; Thu, 1 Aug 2013 10:38:54 +0100 Received: from SZXEML456-HUB.china.huawei.com (10.82.67.199) by lhreml403-hub.china.huawei.com (10.201.5.217) with Microsoft SMTP Server (TLS) id 14.1.323.7; Thu, 1 Aug 2013 10:39:07 +0100 Received: from SZXEML513-MBS.china.huawei.com ([169.254.8.100]) by szxeml456-hub.china.huawei.com ([10.82.67.199]) with mapi id 14.01.0323.007; Thu, 1 Aug 2013 17:38:35 +0800 From: "Zhouqian (Cathy)" To: "dnsop@ietf.org" Thread-Topic: Meeting time this afternoon? Thread-Index: Ac6Omk1+oH+Wyk++QpqinsPo+T6pqg== Date: Thu, 1 Aug 2013 09:38:34 +0000 Message-ID: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.200.216.60] Content-Type: multipart/alternative; boundary="_000_A6A061BEE5DDC94A9692D9D81AF776DF3266681Aszxeml513mbschi_" MIME-Version: 1.0 X-CFilter-Loop: Reflected Subject: [DNSOP] Meeting time this afternoon? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 09:39:15 -0000 --_000_A6A061BEE5DDC94A9692D9D81AF776DF3266681Aszxeml513mbschi_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi all, When is the dnsop meeting time? It shows 17:30-18:30 (UTC-4) on the agenda = below: http://www.ietf.org/proceedings/87/agenda/agenda-87-dnsop. I think it is not correct. Can anyone tell me the exact time? Thanks, Cathy --_000_A6A061BEE5DDC94A9692D9D81AF776DF3266681Aszxeml513mbschi_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi all,

When is the dnsop meeting time?= It shows 17:30-18:30 (UTC-4) on the agenda below:

http://www.ietf.org/proceedings/87/a= genda/agenda-87-dnsop.

I think it is not correct. Can = anyone tell me the exact time?

 

Thanks,

Cathy

--_000_A6A061BEE5DDC94A9692D9D81AF776DF3266681Aszxeml513mbschi_-- From tim.wicinski@teamaol.com Thu Aug 1 02:40:40 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 128DD21F9CE3 for ; Thu, 1 Aug 2013 02:40:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lEFRKHgMY9gr for ; Thu, 1 Aug 2013 02:40:36 -0700 (PDT) Received: from omr-d08.mx.aol.com (omr-d08.mx.aol.com [205.188.109.207]) by ietfa.amsl.com (Postfix) with ESMTP id C4D3521F9CE7 for ; Thu, 1 Aug 2013 02:40:34 -0700 (PDT) Received: from AOLDTCMEI34.ad.aol.aoltw.net (aoldtcmei34.office.aol.com [10.180.121.151]) by omr-d08.mx.aol.com (Outbound Mail Relay) with ESMTP id 35126700441D2; Thu, 1 Aug 2013 05:40:33 -0400 (EDT) Received: from tjw.local (172.17.8.193) by AOLDTCMEI34.ad.aol.aoltw.net (10.180.121.151) with Microsoft SMTP Server id 14.3.123.3; Thu, 1 Aug 2013 05:40:32 -0400 Message-ID: <51FA2D0F.8000904@teamaol.com> Date: Thu, 1 Aug 2013 11:40:31 +0200 From: Tim Wicinski User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:23.0) Gecko/20100101 Thunderbird/23.0 MIME-Version: 1.0 To: "Zhouqian (Cathy)" , "dnsop@ietf.org" References: In-Reply-To: Content-Type: multipart/alternative; boundary="------------090200090004070004010605" X-Originating-IP: [172.17.8.193] Subject: Re: [DNSOP] Meeting time this afternoon? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 09:40:40 -0000 --------------090200090004070004010605 Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit Correct time should be 15:20 - 16:50 tim On 8/1/13 11:38 AM, Zhouqian (Cathy) wrote: > > Hi all, > > When is the dnsop meeting time? It shows 17:30-18:30 (UTC-4) on the > agenda below: > > http://www.ietf.org/proceedings/87/agenda/agenda-87-dnsop. > > I think it is not correct. Can anyone tell me the exact time? > > Thanks, > > Cathy > > > > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop --------------090200090004070004010605 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit Correct time should be 15:20 - 16:50

tim

On 8/1/13 11:38 AM, Zhouqian (Cathy) wrote:

Hi all,

When is the dnsop meeting time? It shows 17:30-18:30 (UTC-4) on the agenda below:

http://www.ietf.org/proceedings/87/agenda/agenda-87-dnsop.

I think it is not correct. Can anyone tell me the exact time?

 

Thanks,

Cathy



_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop

--------------090200090004070004010605-- From dengguangqing@cnnic.cn Thu Aug 1 02:53:19 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E91721F9F95 for ; Thu, 1 Aug 2013 02:53:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.722 X-Spam-Level: X-Spam-Status: No, score=-1.722 tagged_above=-999 required=5 tests=[AWL=0.876, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i+fejt+vThA7 for ; Thu, 1 Aug 2013 02:53:15 -0700 (PDT) Received: from cnnic.cn (smtp.cnnic.cn [218.241.118.7]) by ietfa.amsl.com (Postfix) with SMTP id 1ACF021F9F20 for ; Thu, 1 Aug 2013 02:53:10 -0700 (PDT) X-EYOUMAIL-SMTPAUTH: dengguangqing@cnnic.cn Received: from unknown127.0.0.1 (HELO user-think) (127.0.0.1) by 127.0.0.1 with SMTP; Thu, 01 Aug 2013 17:52:55 +0800 Date: Thu, 1 Aug 2013 17:52:56 +0800 From: "Guangqing Deng" To: dnsop References: , <51FA2D0F.8000904@teamaol.com> X-Priority: 3 X-Has-Attach: no X-Mailer: Foxmail 7.0.1.91[cn] Mime-Version: 1.0 Message-ID: <201308011752552177052@cnnic.cn> Content-Type: multipart/alternative; boundary="----=_001_NextPart848204236660_=----" Subject: Re: [DNSOP] Meeting time this afternoon? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 09:53:19 -0000 This is a multi-part message in MIME format. ------=_001_NextPart848204236660_=---- Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SXQgc2VlbXMgdGhhdCB0aGUgc2xpZGVzIG9mIEROU09QIFdHIGFyZSBzdGlsbCBub3QgYXZhaWxh YmxlIG9uIHdlYnNpdGUgeWV0LiBIb3BlIHN1Y2ggc2xpZGVzIGNhbiBiZSBwb3N0ZWQgYmVmb3Jl IG1lZXRpbmcgdGltZS4NCg0KDQoNCg0KR3VhbmdxaW5nIERlbmcNCkNOTklDIA0KDQpGcm9tOiBU aW0gV2ljaW5za2kNCkRhdGU6IDIwMTMtMDgtMDEgMTc6NDANClRvOiBaaG91cWlhbiAoQ2F0aHkp OyBkbnNvcEBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtETlNPUF0gTWVldGluZyB0aW1lIHRoaXMg YWZ0ZXJub29uPw0KQ29ycmVjdCB0aW1lIHNob3VsZCBiZSAxNToyMCAtIDE2OjUwDQoNCnRpbQ0K DQoNCk9uIDgvMS8xMyAxMTozOCBBTSwgWmhvdXFpYW4gKENhdGh5KSB3cm90ZToNCg0KSGkgYWxs LA0KV2hlbiBpcyB0aGUgZG5zb3AgbWVldGluZyB0aW1lPyBJdCBzaG93cyAxNzozMC0xODozMCAo VVRDLTQpIG9uIHRoZSBhZ2VuZGEgYmVsb3c6DQpodHRwOi8vd3d3LmlldGYub3JnL3Byb2NlZWRp bmdzLzg3L2FnZW5kYS9hZ2VuZGEtODctZG5zb3AuDQpJIHRoaW5rIGl0IGlzIG5vdCBjb3JyZWN0 LiBDYW4gYW55b25lIHRlbGwgbWUgdGhlIGV4YWN0IHRpbWU/DQogDQpUaGFua3MsDQpDYXRoeQ0K DQogDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpE TlNPUCBtYWlsaW5nIGxpc3QNCkROU09QQGlldGYub3JnDQpodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2Ruc29w ------=_001_NextPart848204236660_=---- Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable =EF=BB=BF
It seems that the slides of DNSOP WG&n= bsp;are=20 still not available on website yet. Hope such slides can be post= ed=20 before meeting time.
 

Guangqing=20 Deng
CNNIC 
 
Date: 2013-08-01 17:40
Subject: Re: [DNSOP] Meeting time this=20 afternoon?
Correct time should be 15:20 -= =20 16:50

tim

On 8/1/13 11:38 AM, Zhouqian (Cathy) wrote:

Hi all,

When is the dnsop meeting time? = It shows=20 17:30-18:30 (UTC-4) on the agenda below:

http://www.ietf.org/proceedings/87/agenda/agend= a-87-dnsop.

I think it is not correct. Can a= nyone tell=20 me the exact time?

 

Thanks,

Cathy



__=
_____________________________________________
DNSOP mailing list
DNSOP@i=
etf.org
https://www.ietf.org/mailman/listinfo/dnsop

------=_001_NextPart848204236660_=------ From jabley@hopcount.ca Thu Aug 1 02:57:44 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2264F21F9E62 for ; Thu, 1 Aug 2013 02:57:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gZPt1xQrPIm3 for ; Thu, 1 Aug 2013 02:57:43 -0700 (PDT) Received: from mail-pa0-x22e.google.com (mail-pa0-x22e.google.com [IPv6:2607:f8b0:400e:c03::22e]) by ietfa.amsl.com (Postfix) with ESMTP id B31EE21F9E13 for ; Thu, 1 Aug 2013 02:57:42 -0700 (PDT) Received: by mail-pa0-f46.google.com with SMTP id fa1so1963048pad.33 for ; Thu, 01 Aug 2013 02:57:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=subject:mime-version:content-type:from:x-priority:in-reply-to:date :cc:message-id:references:to:x-mailer; bh=Uc0oyBWZ9FUpKB0m1+8S0GnmOgKrOI/7CX9pIsE4t3Q=; b=LHKAva3s0Qa8K+ziQLyHWxaSZWLqvpmCwK0ndDgciFkc4XJRcUdeSpBSXRnHbeIC+q IhMAATtl3pzGhXOL4LMX8N/gRwb8BTnunUQEe/VTCe2M7JOIQKFd9CeK6HP4lk7aWfJ+ NFeKSh7VET7BPdI5FmIfKuMM8SgOU2QL1jYz0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=subject:mime-version:content-type:from:x-priority:in-reply-to:date :cc:message-id:references:to:x-mailer:x-gm-message-state; bh=Uc0oyBWZ9FUpKB0m1+8S0GnmOgKrOI/7CX9pIsE4t3Q=; b=OTSEHyGDkRAnX7M3RUADwoxK9sePu+ALcRcxhCvAemfKSW7/ioyAN01Axh2TL8UzKZ nGS3zR9kAiMeYP4cTctT9Be3kopsdUVp3qwAdZ90APMdZQZ3/W2rUpedtF+Y97gt6AfX EoLC+w0SLWdbin2tRK7dJKoqM1mVjvHQQMoty1GqYqjTnshET1ILgdPjoR2XXUKawyd/ a7iba89gvKPCHuNpAAQSDZfQTQLUArPX2a5JcnublL9EVos+q0YAB+MQvdsLbSqoFYjf HGwW6i2/F217v564CHYCH5Ntx9s2c8hS4cxzpIgAoYSbiw/CbvxeIUH2WURZC0VMSCOb qXYw== X-Received: by 10.68.52.200 with SMTP id v8mr943849pbo.48.1375351062124; Thu, 01 Aug 2013 02:57:42 -0700 (PDT) Received: from ?IPv6:2001:df8::64:797e:bb2b:260b:b4f6? ([2001:df8:0:64:797e:bb2b:260b:b4f6]) by mx.google.com with ESMTPSA id tr10sm3091366pbc.22.2013.08.01.02.57.37 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 01 Aug 2013 02:57:41 -0700 (PDT) Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) Content-Type: multipart/signed; boundary="Apple-Mail=_7366A80D-35B5-4455-926D-2B2C80062E3D"; protocol="application/pgp-signature"; micalg=pgp-sha1 From: Joe Abley X-Priority: 3 In-Reply-To: <201308011752552177052@cnnic.cn> Date: Thu, 1 Aug 2013 11:56:58 +0200 Message-Id: <0D3FF051-CBBF-4D3F-A27E-58BD30205D1C@hopcount.ca> References: , <51FA2D0F.8000904@teamaol.com> <201308011752552177052@cnnic.cn> To: Guangqing Deng X-Mailer: Apple Mail (2.1508) X-Gm-Message-State: ALoCoQmPkzWt2oWY1NjlfhjMdZwPMYupGo5ls4yye5j7t7EqfTN/v0XRhHm54IXeppfag8wsZpq8 Cc: dnsop Subject: Re: [DNSOP] Meeting time this afternoon? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 09:57:44 -0000 --Apple-Mail=_7366A80D-35B5-4455-926D-2B2C80062E3D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 2013-08-01, at 11:52, Guangqing Deng wrote: > It seems that the slides of DNSOP WG are still not available on = website yet. Hope such slides can be posted before meeting time. As one of the people guilty for not sending slides to the chairs = earlier, I apologise. But Tim has my slides now, and I am sure they will = appear directly. Will do better next time. Joe --Apple-Mail=_7366A80D-35B5-4455-926D-2B2C80062E3D Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlH6MOsACgkQNI8MvYZSOixOzwCggdY9/fzw/d0OEK9asJuly9yV ucsAoLMDGz2NYex3plZxP82Ty9iIalGq =6Y/V -----END PGP SIGNATURE----- --Apple-Mail=_7366A80D-35B5-4455-926D-2B2C80062E3D-- From tim.wicinski@teamaol.com Thu Aug 1 02:59:13 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CCBD021F9E6A for ; Thu, 1 Aug 2013 02:59:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w-5z04reCrGf for ; Thu, 1 Aug 2013 02:59:09 -0700 (PDT) Received: from omr-m09.mx.aol.com (omr-m09.mx.aol.com [64.12.143.82]) by ietfa.amsl.com (Postfix) with ESMTP id B27D521F938E for ; Thu, 1 Aug 2013 02:59:08 -0700 (PDT) Received: from aoldtcmei32.ad.aol.aoltw.net (aoldtcmei32.office.aol.com [10.180.121.111]) by omr-m09.mx.aol.com (Outbound Mail Relay) with ESMTP id B52F2700865FE; Thu, 1 Aug 2013 05:59:06 -0400 (EDT) Received: from tjw.local (172.17.8.193) by aoldtcmei32.ad.aol.aoltw.net (10.180.121.111) with Microsoft SMTP Server id 14.3.123.3; Thu, 1 Aug 2013 05:59:06 -0400 Message-ID: <51FA3168.10604@teamaol.com> Date: Thu, 1 Aug 2013 11:59:04 +0200 From: Tim Wicinski User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:23.0) Gecko/20100101 Thunderbird/23.0 MIME-Version: 1.0 To: Joe Abley , Guangqing Deng References: , <51FA2D0F.8000904@teamaol.com> <201308011752552177052@cnnic.cn> <0D3FF051-CBBF-4D3F-A27E-58BD30205D1C@hopcount.ca> In-Reply-To: <0D3FF051-CBBF-4D3F-A27E-58BD30205D1C@hopcount.ca> Content-Type: multipart/alternative; boundary="------------050301040703020508000305" X-Originating-IP: [172.17.8.193] Cc: dnsop Subject: Re: [DNSOP] Meeting time this afternoon? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 09:59:14 -0000 --------------050301040703020508000305 Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit I was not going to be one to point fingers, but yes, they will all be up very shortly, including all the extras I've received. tim On 8/1/13 11:56 AM, Joe Abley wrote: > On 2013-08-01, at 11:52, Guangqing Deng wrote: > >> It seems that the slides of DNSOP WG are still not available on website yet. Hope such slides can be posted before meeting time. > As one of the people guilty for not sending slides to the chairs earlier, I apologise. But Tim has my slides now, and I am sure they will appear directly. Will do better next time. > > > Joe > > > > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop --------------050301040703020508000305 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit I was not going to be one to point fingers, but yes, they will all be up very shortly, including all the extras I've received.

tim


On 8/1/13 11:56 AM, Joe Abley wrote:
On 2013-08-01, at 11:52, Guangqing Deng <dengguangqing@cnnic.cn> wrote:

It seems that the slides of DNSOP WG are still not available on website yet. Hope such slides can be posted before meeting time.
As one of the people guilty for not sending slides to the chairs earlier, I apologise. But Tim has my slides now, and I am sure they will appear directly. Will do better next time.


Joe



_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop

--------------050301040703020508000305-- From tim.wicinski@teamaol.com Thu Aug 1 04:21:53 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7830221F9E6B for ; Thu, 1 Aug 2013 04:21:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t+hZqY+DsWFE for ; Thu, 1 Aug 2013 04:21:49 -0700 (PDT) Received: from omr-m04.mx.aol.com (omr-m04.mx.aol.com [64.12.143.78]) by ietfa.amsl.com (Postfix) with ESMTP id 7DD9F21F9306 for ; Thu, 1 Aug 2013 04:21:40 -0700 (PDT) Received: from aoldtcmei32.ad.aol.aoltw.net (aoldtcmei32.office.aol.com [10.180.121.111]) by omr-m04.mx.aol.com (Outbound Mail Relay) with ESMTP id 07543700000B4; Thu, 1 Aug 2013 07:21:38 -0400 (EDT) Received: from tjw.local (172.17.8.193) by aoldtcmei32.ad.aol.aoltw.net (10.180.121.111) with Microsoft SMTP Server id 14.3.123.3; Thu, 1 Aug 2013 07:21:37 -0400 Message-ID: <51FA44C0.4050304@teamaol.com> Date: Thu, 1 Aug 2013 13:21:36 +0200 From: Tim Wicinski User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:23.0) Gecko/20100101 Thunderbird/23.0 MIME-Version: 1.0 To: Jay Daley , Paul Hoffman References: <77772FDC-CF32-4797-BB79-EABE559BA97E@nzrs.net.nz> <7B662C88-D969-4586-A01F-5D36E5B8DA53@vpnc.org> <58D17552-D4DD-45FC-9975-236D61635347@nzrs.net.nz> In-Reply-To: <58D17552-D4DD-45FC-9975-236D61635347@nzrs.net.nz> Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [172.17.8.193] Cc: dnsop WG Subject: Re: [DNSOP] dnsxml - A standard XML representation of DNS data X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 11:21:53 -0000 Jay I agree it's just "formats" and therefore it's just 'a simple bit of code', I tend to find the XML specifications get a bit heavy, and what I liked in Stephane's draft is that it has a very lightweight feel to it. (I will mention that the IESG is looking for reviewers for draft-manderson-rdns-xml-01 in case anyone feels extra motivated to assist in this). tim On 7/31/13 10:01 AM, Jay Daley wrote: > Hi Paul > > On 31/07/2013, at 7:53 PM, Paul Hoffman wrote: > >> Please also see draft-bortzmeyer-dns-json. JSON encoders and parsers are lighter-weight than XML ones, and for the data in question (everything DNS), it seems like JSON might be a better text format for the use cases (particularly logging). > I'm aware of Stephane's draft as noted in my original email but I haven't had a chance to read it. I will though. > > Rather than picking a winner between JSON and XML I've always found it prudent to recognise that the two have different characteristics that support different uses. Not only can JSON and XML co-exist but also, if needed, the JSON can be derived from the XML via XSLT: > > http://controlfreak.net/xml-to-json-in-xslt-a-toolkit/ > > cheers > Jay > >> --Paul Hoffman >> _______________________________________________ >> DNSOP mailing list >> DNSOP@ietf.org >> https://www.ietf.org/mailman/listinfo/dnsop > From jay@nzrs.net.nz Thu Aug 1 04:50:19 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8881921F9A38 for ; Thu, 1 Aug 2013 04:50:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i12mlWTqsWGZ for ; Thu, 1 Aug 2013 04:50:11 -0700 (PDT) Received: from srsomail.nzrs.net.nz (srsomail.nzrs.net.nz [202.46.183.22]) by ietfa.amsl.com (Postfix) with ESMTP id F340F21F9967 for ; Thu, 1 Aug 2013 04:50:10 -0700 (PDT) Received: from localhost (localhost.localdomain [127.0.0.1]) by srsomail.nzrs.net.nz (Postfix) with ESMTP id 046CC4B24F1; Thu, 1 Aug 2013 23:50:07 +1200 (NZST) Received: from srsomail.nzrs.net.nz ([202.46.183.22]) by localhost (srsomail.office.nzrs.net.nz [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f3qFBEI8GP+W; Thu, 1 Aug 2013 23:50:06 +1200 (NZST) Received: from [192.168.1.230] (121-74-100-115.telstraclear.net [121.74.100.115]) (Authenticated sender: jay) by srsomail.nzrs.net.nz (Postfix) with ESMTPSA id 8E40D4B243C; Thu, 1 Aug 2013 23:50:06 +1200 (NZST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) From: Jay Daley In-Reply-To: <51FA44C0.4050304@teamaol.com> Date: Thu, 1 Aug 2013 23:50:06 +1200 Content-Transfer-Encoding: quoted-printable Message-Id: <832EBD76-826E-4905-A09C-8B4325430E7A@nzrs.net.nz> References: <77772FDC-CF32-4797-BB79-EABE559BA97E@nzrs.net.nz> <7B662C88-D969-4586-A01F-5D36E5B8DA53@vpnc.org> <58D17552-D4DD-45FC-9975-236D61635347@nzrs.net.nz> <51FA44C0.4050304@teamaol.com> To: Tim Wicinski X-Mailer: Apple Mail (2.1508) Cc: dnsop WG , Paul Hoffman Subject: Re: [DNSOP] dnsxml - A standard XML representation of DNS data X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 11:50:19 -0000 On 1/08/2013, at 11:21 PM, Tim Wicinski = wrote: > Jay >=20 > I agree it's just "formats" and therefore it's just 'a simple bit of = code', I tend to find the XML specifications get a bit heavy, and what I = liked in Stephane's draft is that it has a very lightweight feel to it. XML, especially in the IETF context, gets heavy because people use = xml-schema or relaxng to define schemas to define and validate the XML. = JSON is not yet at that stage and so seems lighter, but that's generally = due to simpler functionality. When JSON schema is readily available I'm = sure the differences will diminish. > (I will mention that the IESG is looking for reviewers for = draft-manderson-rdns-xml-01 in case anyone feels extra motivated to = assist in this). There's so little to it I'm happy to review and will do soon. Jay >=20 > tim >=20 >=20 > On 7/31/13 10:01 AM, Jay Daley wrote: >> Hi Paul >>=20 >> On 31/07/2013, at 7:53 PM, Paul Hoffman = wrote: >>=20 >>> Please also see draft-bortzmeyer-dns-json. JSON encoders and parsers = are lighter-weight than XML ones, and for the data in question = (everything DNS), it seems like JSON might be a better text format for = the use cases (particularly logging). >> I'm aware of Stephane's draft as noted in my original email but I = haven't had a chance to read it. I will though. >>=20 >> Rather than picking a winner between JSON and XML I've always found = it prudent to recognise that the two have different characteristics that = support different uses. Not only can JSON and XML co-exist but also, if = needed, the JSON can be derived from the XML via XSLT: >>=20 >> http://controlfreak.net/xml-to-json-in-xslt-a-toolkit/ >>=20 >> cheers >> Jay >>=20 >>> --Paul Hoffman >>> _______________________________________________ >>> DNSOP mailing list >>> DNSOP@ietf.org >>> https://www.ietf.org/mailman/listinfo/dnsop >>=20 >=20 > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop --=20 Jay Daley Chief Executive .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 931 6977 mobile: +64 21 678840 linkedin: www.linkedin.com/in/jaydaley From terry.manderson@icann.org Thu Aug 1 04:53:12 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1A1321E80CF for ; Thu, 1 Aug 2013 04:53:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dYu8bhzGf6JW for ; Thu, 1 Aug 2013 04:53:06 -0700 (PDT) Received: from EXPFE100-2.exc.icann.org (expfe100-2.exc.icann.org [64.78.22.237]) by ietfa.amsl.com (Postfix) with ESMTP id A533A21F9DC9 for ; Thu, 1 Aug 2013 04:52:57 -0700 (PDT) Received: from EXVPMBX100-1.exc.icann.org ([64.78.22.232]) by EXPFE100-2.exc.icann.org ([64.78.22.237]) with mapi; Thu, 1 Aug 2013 04:52:54 -0700 From: Terry Manderson To: Tim Wicinski , Jay Daley , Paul Hoffman Date: Thu, 1 Aug 2013 04:52:49 -0700 Thread-Topic: [DNSOP] dnsxml - A standard XML representation of DNS data Thread-Index: Ac6OraeSdcQzQGlaT7K6xTsTuCYKUw== Message-ID: In-Reply-To: <51FA44C0.4050304@teamaol.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.6.130613 acceptlanguage: en-US Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3458238769_51659862" MIME-Version: 1.0 Cc: dnsop WG Subject: Re: [DNSOP] dnsxml - A standard XML representation of DNS data X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2013 11:53:12 -0000 --B_3458238769_51659862 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit Tim and all, On 1/08/13 9:21 PM, "Tim Wicinski" wrote: >Jay > >I agree it's just "formats" and therefore it's just 'a simple bit of >code', Code is always changeable so long at there is solid motivation to do so. >I tend to find the XML specifications get a bit heavy, and what I >liked in Stephane's draft is that it has a very lightweight feel to it. Yes, XML can sometimes be a heavy solution, but also has a set of positives. It really depends on the implementation in which it is being used. Classic "it depends" response - sorry! ;) > >(I will mention that the IESG is looking for reviewers for >draft-manderson-rdns-xml-01 in case anyone feels extra motivated to >assist in this). Love to iterate this, draft-manderson-rdns-xml-01 was submitted via the rfc-ise as it really is a specific item targeted at a provisioning portion of the DNS hierarchy that has been in production for a number of years. The draft is more to allow the transparency of ICANN operations in such areas that makes sense with the hope that it can provide information to other folk looking to implement similar systems, or spark the thought processes in others that might come up with viable improvements. Cheers Terry --B_3458238769_51659862 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIITvAYJKoZIhvcNAQcCoIITrTCCE6kCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC EYgwggcDMIIF66ADAgECAhAPz2lJUZsAlD35l4oJxf0FMA0GCSqGSIb3DQEBBQUAMGIxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2Vy dC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFzc3VyZWQgSUQgQ0EtMTAeFw0xMjAzMjcwMDAw MDBaFw0xNTAzMjcxMjAwMDBaMIGsMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p YTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0 aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczEXMBUGA1UECxMORE5TIE9wZXJh dGlvbnMxGDAWBgNVBAMTD1RlcnJ5IE1hbmRlcnNvbjCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAKRhZ4W3U6MnfS2woYEFCIyN+g1MNILokbUKk+PTl5mmK3QtWQxTSOu2sdzN xHMy6p2RoT9BMGOamttFq2WswSru6/7JT1TflytGaPHfK5kMP/pI47hmcwUEm9Z169I5ar7z BTiEAQA06cGKtgJ8XiiLFUIHLVuRq3WGxjnFTHlAHXY6mdgDT/ntAnoEvvPVm4XqUnjJiZTS ojzyr1q2RqFvyXs2blOARumDqvLI33yLGcUuaEL+A+hgodzM/fL4kdoy964mXvmEerpm4d4f Y/JfbRUWxc0Eomu9nwGFNk6ijO41qk+OIboct2qeA+5PPclXJNNHYVfzT2dyWfGgxaMCAwEA AaOCA2gwggNkMB8GA1UdIwQYMBaAFBUAEisTmLKZB+0e36K+Vw0rZwLNMB0GA1UdDgQWBBSz wvR2YXpP9XjS9cknMX5g3LM2jTAkBgNVHREEHTAbgRl0ZXJyeS5tYW5kZXJzb25AaWNhbm4u b3JnMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwfQYD VR0fBHYwdDA4oDagNIYyaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJl ZElEQ0EtMS5jcmwwOKA2oDSGMmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFz c3VyZWRJRENBLTEuY3JsMIIBxQYDVR0gBIIBvDCCAbgwggG0BgpghkgBhv1sBAECMIIBpDA6 BggrBgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBvc2l0b3J5 Lmh0bTCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABp AHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABh AGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABD AFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5 ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBi AGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjB3BggrBgEFBQcBAQRr MGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1 aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEQ0EtMS5jcnQw DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAYpwxK/KvdhbyQqrKp2ylMQpNzqVH ofo4hPILTnp/o+UyYVn6daWSilaV+XNBzE5Rm/f7ms2iA1zBzOvGv55pLH0n6lgIRTeuAGzf KIsPCwPvYQkkMAPXHzh9A44m19hvigTgOPNyjzcOTiHqwwCJSDTEZx17CEkrzQPq1vfG1Lvk +AWjEtxCsGmsuCHHaZjwQ8SsGI7W5cA1Y4RTcQf6S9eIpSsOwXIYdDgWq9Uhi/amW7ryW06Y GH7BHaitqgmm32MZuid3UzJUU6+Ljx7uGA9Fe6k1uPEHhaXTAoobPSpPdOgGmnxUCRQu2OI7 +I8vHiSe7DC/LmxEDC5kB+lUTjCCBsIwggWqoAMCAQICEAoE3yF0XU0rjOozcgUAUOkwDQYJ KoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcG A1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBS b290IENBMB4XDTA2MTExMDAwMDAwMFoXDTIxMTExMDAwMDAwMFowYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEA6IItmfnKwkKVpYBzQHDSnlZUXKnE0kEGj8kz/E1FkVyBn+0snPgWWd+etSQV wpi5tHdJ3InECtqvy15r7a2wcTHrzzpADEZNk+yLejYIA6sMNP4YSYL+x8cxSIB8HqIPkg5Q ycaH6zY/2DDD/6b3+6LNb3Mj/qxWBZDwMiEWicZwiPkFl32jx0PdAug7Pe2xQaPtP77blUjE 7h6z8rwMK5nQxl0SQoHhg26Ccz8mSxSQrllmCsSNvtLOBq6thG9IhJtPQLnxTPKvmPv2zkBd XPao8S+v7Iki8msYZbHBc63X8djPHgp0XEK4aH631XcKJ1Z8D2KkPzIUYJX9BwSiCQIDAQAB o4IDbzCCA2swDgYDVR0PAQH/BAQDAgGGMDsGA1UdJQQ0MDIGCCsGAQUFBwMBBggrBgEFBQcD AgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCDCCAcYGA1UdIASCAb0wggG5MIIBtQYL YIZIAYb9bAEDAAQwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9z c2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUA cwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMA dABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQA aQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkA aQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwA aQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8A cgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMA ZQAuMA8GA1UdEwEB/wQFMAMBAf8wfQYIKwYBBQUHAQEEcTBvMCQGCCsGAQUFBzABhhhodHRw Oi8vb2NzcC5kaWdpY2VydC5jb20wRwYIKwYBBQUHMAKGO2h0dHA6Ly93d3cuZGlnaWNlcnQu Y29tL0NBQ2VydHMvRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8EejB4MDqg OKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu Y3JsMDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdDgQWBBQVABIrE5iymQftHt+ivlcNK2cCzTAfBgNVHSMEGDAWgBRF 66Kv9JLLgjEtUYunpyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAhGFOQR64dgQqtbbvj/JV hbldVv4KmObkvWWKfUAp0/yxXUX9OrgqWzNLJFzNubTkc61hXXatdDOKZtUjr0wfcm5F2XVA u6I7z41JL8BBsOIpo1E4Q1CZFKwzBjViiX13qVIH5WwgV7aBum+8s8KU7XYCgNl8zoWoHOzH Q0pLsVfPcs7f9SU8yyJP/Z9S0TfLCLs4PuDVPm95Ca1bfDGzdzXD5GP5aAqYB+dGOHeE0j6X vAqgqKwlT0RukeHSWq9r7zAcjaNEQrMQiyP61+Y1dDesz+urWB/JiCP/NtQH6jRqR+qdlWye KU9T7eMrlSBOKs+WYHr4LIDwlVLOKZaBYjCCA7cwggKfoAMCAQICEAzn4OUX2Eb+j+Vg/Bvw MDkwDQYJKoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IElu YzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJl ZCBJRCBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowZTELMAkGA1UE BhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNv bTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMIIBIjANBgkqhkiG9w0B AQEFAAOCAQ8AMIIBCgKCAQEArQ4VzuRDgFyxh/O3YPlxEqWu3CaUiKr0zvUgOShYYAz4gNqp FZUyYTy1sSiEiorcnwoMgxd6j5Csiud5U1wxhCr2D5gyNnbM3t08qKLvavsh8lJh358g1x/i sdn+GGTSEltf+VgYNbxHzaE2+Wt/1LA4PsEbw4wz2dgvGP4oD7Ong9bDbkTAYTWWFv5ZnIt2 bdfxoksNK/8LctqeYNCOkDXGeFWHIKHP5W0KyEl8MZgzbCLph9AyWqK6E4IR7TkXnZk6cqHm +qTZ1Rcxda6FfSKuPwFGhvYoecix2uRXF8R+HA6wtJKmVrO9spftqqfwt8WoP5UW0P+hlusI Xxh3TwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E FgQUReuir/SSy4IxLVGLp6chnfNtyA8wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNt yA8wDQYJKoZIhvcNAQEFBQADggEBAKIOvN/i7fDjcnN6ZJS/93Jm2DLkQnVirofr8tXZ3laz n8zOFCi5DZdgXBJMWOTTPYNJRViXNWkaqEfqVsZ5qxLYZ4GE338JPJTmuCYsIL09syiJ91// IuKXhB/pZe+H4N/BZ0mzXeuyCSrrJu14vn0/K/O3JjVtX4kBtklbnwEFm6s9JcHMtn/C8W+G xvpkaOuBLZTrQrf6jB7dYvG+UGe3bL3z8R9rDDYHFn83fKlbbXrxEkZgg9cnBL5Lzpe+w2cq aBHfgOcMM2a/Ew0UbvN/H2MQHvqNGyVtbI+lt2EBsdKjJqEQcZ2t4sP5w5lRtysHCM4u5lCy p/oKRS+i8PIxggH8MIIB+AIBATB2MGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFz c3VyZWQgSUQgQ0EtMQIQD89pSVGbAJQ9+ZeKCcX9BTAJBgUrDgMCGgUAoF0wIwYJKoZIhvcN AQkEMRYEFMw3NYZcNEWuiUzC2fZFWNWmludLMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw HAYJKoZIhvcNAQkFMQ8XDTEzMDgwMTExNTI0OVowDQYJKoZIhvcNAQEBBQAEggEAPp9ph8pZ zHnIfZxdi1bDsD5HzkScoyw0n2k4TWVYuvOCxeKxjMVVLg3ROGFWetFDRTYXO6nRBf9SHmfy FAdx++Gn7pS8cmhDEgLN1bBeXr534Tndij1P6yVg7S0lJ9WxvgzKJDVt7K9pE02uv4bcfziG wsPg3T4mocIdy+oeZlQ5tv05YDRjd+RVt+SRjilm82C2akgbK1Sc76myVSzJlFbnGkEl3gVz dVDhH/F/QAyKBqXmrDin7RJMAGHKjfrWLDIUbRlNleEmYpQNUmRx1ev5m9NMXqqeispJppVc h33MPiGH98jjKuS7H3KoBYrY7BHSHfu0OGGFD/skibawEQ== --B_3458238769_51659862-- From tim.wicinski@teamaol.com Fri Aug 2 03:15:15 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C308711E8257 for ; Fri, 2 Aug 2013 03:15:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.001, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f6InB0DOc9pW for ; Fri, 2 Aug 2013 03:15:11 -0700 (PDT) Received: from omr-d05.mx.aol.com (omr-d05.mx.aol.com [205.188.109.202]) by ietfa.amsl.com (Postfix) with ESMTP id C593521E809C for ; Fri, 2 Aug 2013 03:15:08 -0700 (PDT) Received: from AOLDTCMEI34.ad.aol.aoltw.net (aoldtcmei34.office.aol.com [10.180.121.151]) by omr-d05.mx.aol.com (Outbound Mail Relay) with ESMTP id C6A9670007CD9 for ; Fri, 2 Aug 2013 06:15:07 -0400 (EDT) Received: from tjw.local (172.17.8.193) by AOLDTCMEI34.ad.aol.aoltw.net (10.180.121.151) with Microsoft SMTP Server id 14.3.123.3; Fri, 2 Aug 2013 06:15:07 -0400 Message-ID: <51FB86AA.7030500@teamaol.com> Date: Fri, 2 Aug 2013 12:15:06 +0200 From: Tim Wicinski User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:23.0) Gecko/20100101 Thunderbird/23.0 MIME-Version: 1.0 To: dnsop WG Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [172.17.8.193] Subject: [DNSOP] Draft DNSOP Meeting Minutes X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2013 10:15:15 -0000 Hi Draft minutes from Thursday meeting are available http://www.ietf.org/proceedings/87/minutes/minutes-87-dnsop . Please let the chairs know if find something incorrectly recorded. Thanks to Olaf for the note taking. tim From tim.wicinski@teamaol.com Fri Aug 2 03:59:55 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 69FC321E832F for ; Fri, 2 Aug 2013 03:59:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g4ar8Wx6Ltzy for ; Fri, 2 Aug 2013 03:59:51 -0700 (PDT) Received: from omr-m06.mx.aol.com (omr-m06.mx.aol.com [64.12.143.80]) by ietfa.amsl.com (Postfix) with ESMTP id B195E11E8241 for ; Fri, 2 Aug 2013 03:59:39 -0700 (PDT) Received: from aoldtcmei32.ad.aol.aoltw.net (aoldtcmei32.office.aol.com [10.180.121.111]) by omr-m06.mx.aol.com (Outbound Mail Relay) with ESMTP id 98ED37003165E for ; Fri, 2 Aug 2013 06:59:35 -0400 (EDT) Received: from tjw.local (172.17.8.193) by aoldtcmei32.ad.aol.aoltw.net (10.180.121.111) with Microsoft SMTP Server id 14.3.123.3; Fri, 2 Aug 2013 06:59:35 -0400 Message-ID: <51FB9116.8070809@teamaol.com> Date: Fri, 2 Aug 2013 12:59:34 +0200 From: Tim Wicinski User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:23.0) Gecko/20100101 Thunderbird/23.0 MIME-Version: 1.0 To: dnsop WG Content-Type: multipart/alternative; boundary="------------060204040101040309050208" X-Originating-IP: [172.17.8.193] Subject: [DNSOP] DNSOP slides fully updated X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2013 10:59:55 -0000 --------------060204040101040309050208 Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit All, I have pushed up all the slides and materials for IETF 87. You can find them all here: http://tools.ietf.org/wg/dnsop/agenda Particular, I point out all the interesting stuff we never got around to, such as: DNSSEC Roadblock Avoidance using PCP to trigger dynamic DNS updates DNS No Response Issue Root Zone KSK Roll DNSSEC side effect, Increase in DS Queries I wanted to point out the the outside draft brought in by Cathy Zhou from the PCP group http://tools.ietf.org/id/draft-deng-pcp-ddns-03.txt http://tools.ietf.org/agenda/87/slides/slides-87-dnsop-4.pdf This is mostly DDNS updates and is more of an Informational document. I was hoping we can pass over the document and provide some operational insight. Additionally, I'll start sending out some emails to verify adopting documents in the working group, per the meeting. I'll send them out in emails based on how they were presented, instead of all in one email to prevent cross talk. I believe the consensus from the meetings was we confirm the adoptions. tim --------------060204040101040309050208 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit All,

I have pushed up all the slides and materials for IETF 87.  You can find them all here:

    http://tools.ietf.org/wg/dnsop/agenda

Particular, I point out all the interesting stuff we never got around to, such as:

DNSSEC Roadblock Avoidance
using PCP to trigger dynamic DNS updates
DNS No Response Issue
Root Zone KSK Roll
DNSSEC side effect, Increase in DS Queries

I wanted to point out the the outside draft brought in by Cathy Zhou from the PCP group  
    http://tools.ietf.org/id/draft-deng-pcp-ddns-03.txt
    http://tools.ietf.org/agenda/87/slides/slides-87-dnsop-4.pdf

This is mostly DDNS updates and is more of an Informational document. I was hoping we can pass over the document and provide some operational insight.  

Additionally, I'll start sending out some emails to verify adopting documents in the working group, per the meeting.  I'll send them out in emails based on how they were presented, instead of all in one email to prevent cross talk.  I believe the consensus from the meetings was we confirm the adoptions.

tim
--------------060204040101040309050208-- From jay@nzrs.net.nz Mon Aug 12 15:06:15 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE4AD21E8054 for ; Mon, 12 Aug 2013 15:06:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.67 X-Spam-Level: X-Spam-Status: No, score=-1.67 tagged_above=-999 required=5 tests=[AWL=-0.930, BAYES_20=-0.74] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n2z5OR9sP8yb for ; Mon, 12 Aug 2013 15:06:11 -0700 (PDT) Received: from srsomail.nzrs.net.nz (srsomail.nzrs.net.nz [202.46.183.22]) by ietfa.amsl.com (Postfix) with ESMTP id C5C6521F9EB6 for ; Mon, 12 Aug 2013 15:06:10 -0700 (PDT) Received: from localhost (localhost.localdomain [127.0.0.1]) by srsomail.nzrs.net.nz (Postfix) with ESMTP id 66A604B5200 for ; Tue, 13 Aug 2013 10:06:07 +1200 (NZST) X-Virus-Scanned: Debian amavisd-new at srsomail.office.nzrs.net.nz Received: from srsomail.nzrs.net.nz ([202.46.183.22]) by localhost (srsomail.office.nzrs.net.nz [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OlAnSj+o1qfa for ; Tue, 13 Aug 2013 10:06:00 +1200 (NZST) Received: from [192.168.1.230] (121-74-100-115.telstraclear.net [121.74.100.115]) (Authenticated sender: jay) by srsomail.nzrs.net.nz (Postfix) with ESMTPSA id 388834B4F03 for ; Tue, 13 Aug 2013 10:06:00 +1200 (NZST) From: Jay Daley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-Id: <92F4C715-FF72-4CEE-9C17-134932228F13@nzrs.net.nz> Date: Tue, 13 Aug 2013 10:05:59 +1200 To: dnsop WG Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) X-Mailer: Apple Mail (2.1508) Subject: [DNSOP] Review of draft-manderson-rdns-xml-01 X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Aug 2013 22:06:16 -0000 Firstly, just to confirm that I've read the previous email from Terry = Manderson that this draft was published more for reasons of transparency = and starting a conversation than anything else. So here are my comments = in light of that: 1. There were a number of places in this draft where I found myself = asking "why didn't they just use EPP?". For example: - it's a registry provisioning protocol - it's a registry provisioning protocol for NS and DS records! - it has a feature for requests to be queued and a message list to be = polled 2. Unless I'm being dumb (and my RelaxNG is not very good) I can't see = any definition of either - responses to non-queued requests - errors other than the implicit standard HTTP response/error codes. 3. It's too tightly bound to the underlying HTTP interface. The = response/errors is one example, another is the queue element field: # The HTTP method used to update attribute method { "PUT" | "DELETE" }, That would be better as a logical operation code (i.e. Add, Delete) that = were mapped onto HTTP operations.=20 4. Some of the key data elements that need to be provisioning are = defined the most loosely - name the rdata field. So overall I'm pretty surprised that this path was chosen in 2011 rather = than EPP which the rest of the known universe uses for this sort of = thing. I realise ICANN is very much taken with lightweight REST but = this seems to be forcing the solution onto every problem, even then = solved ones. However, this is indeed ICANN's choice, it is a trivial = protocol and is working in production. But what it isn't is a candidate = for becoming an RFC. If the authors are interested in doing this in EPP then I would be = willing to help. cheers Jay --=20 Jay Daley Chief Executive .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 931 6977 mobile: +64 21 678840 linkedin: www.linkedin.com/in/jaydaley From jabley@hopcount.ca Mon Aug 12 15:58:05 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 597DB11E80DC for ; Mon, 12 Aug 2013 15:58:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id grqkQMyaDreo for ; Mon, 12 Aug 2013 15:58:04 -0700 (PDT) Received: from mail-oa0-x22b.google.com (mail-oa0-x22b.google.com [IPv6:2607:f8b0:4003:c02::22b]) by ietfa.amsl.com (Postfix) with ESMTP id 5B25311E80E4 for ; Mon, 12 Aug 2013 15:58:00 -0700 (PDT) Received: by mail-oa0-f43.google.com with SMTP id i10so10415663oag.2 for ; Mon, 12 Aug 2013 15:58:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=references:from:mime-version:in-reply-to:date:message-id:subject:to :cc:content-type:content-transfer-encoding; bh=cUtWjx2gQWmD/ho5OEPVW9vvJCd1E0gqPvWyo7Bbez0=; b=eHq+N+ERGF4EWIgHVXxr3/mwZ73i56J5geOFr6Zm2ldUTg94YFsQ6oGb+N/9E3WViY 2FxVkxagxsyMyJNgMVjhmx7DSRMN2Ataag1WI/cpVmUMC5qVOrTdqSPRQRsi4h9Hdv4M 97Fc6tGKYf2YCPGGJ609GpGd6t3ZgRa5zeLIA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-gm-message-state:references:from:mime-version:in-reply-to:date :message-id:subject:to:cc:content-type:content-transfer-encoding; bh=cUtWjx2gQWmD/ho5OEPVW9vvJCd1E0gqPvWyo7Bbez0=; b=iBjPTYKwFzW6X2djABgu8Ycr0ZZE9+CLXMs4sQdxgsvPtag8cKVrVEv+DWpBaC1OsO eWEFaJ7gMXS7YqhTPac/K3qoR0qygMakWOBmFGwW/qAbk81HpGZjHqEb1DRDCMqlIXGg GXGENUpvTBWwMRALcX6dp0WcMEqGJeo/UpAteg35ZmmEtvSJnO432Hmz8EGEPf41dFAD wZFZk4L3mDmaIl8us+aTf5Cmu29iTwAYowEQ8HtY7tcwSjIMse4f/iUDMQqV6BDZHHuH QDGYMDsqLNeZE9hGoTBiBfht2W3/1uv7rum8noLsg/HqDjKptRcYloyIjNwnONWgvLy+ +HZw== X-Gm-Message-State: ALoCoQnVtWNtGLNMfrxnvnmVqYwgeu7W+ixLSs4HJ/VI0wi7Rar1vt10l8/pc4NPibftYvy7pD+l X-Received: by 10.60.84.205 with SMTP id b13mr1239571oez.61.1376348280521; Mon, 12 Aug 2013 15:58:00 -0700 (PDT) References: <92F4C715-FF72-4CEE-9C17-134932228F13@nzrs.net.nz> From: Joe Abley Mime-Version: 1.0 (1.0) In-Reply-To: <92F4C715-FF72-4CEE-9C17-134932228F13@nzrs.net.nz> Date: Mon, 12 Aug 2013 18:57:58 -0400 Message-ID: <8247861913252083991@unknownmsgid> To: Jay Daley Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: dnsop WG Subject: Re: [DNSOP] Review of draft-manderson-rdns-xml-01 X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Aug 2013 22:58:05 -0000 Hi Jay, I'm not sure I understand your conclusion. Why do you think this running system should not be documented in an RFC? If it was a private-use protocol being used for private purposes, I could see what you're getting at. However, it's neither: it's a protocol in use between different organisations being used to support an aspect of public infrastructure (the reverse DNS trees). I don't agree that there's nothing to be gained by documenting it (I realise that's not exactly what you wrote, but it could be read that way) and to me, the RFC series is a plausible place for that to happen. What am I missing? (ObDisclaimer: Terry and I work together, but this is a personal perspective; he's big and ugly enough to fight his own battles :-) Joe Aue Te Ariki! He toki ki roto taku mahuna! On 2013-08-12, at 18:06, Jay Daley wrote: > Firstly, just to confirm that I've read the previous email from Terry Man= derson that this draft was published more for reasons of transparency and s= tarting a conversation than anything else. So here are my comments in ligh= t of that: > > 1. There were a number of places in this draft where I found myself aski= ng "why didn't they just use EPP?". For example: > > - it's a registry provisioning protocol > - it's a registry provisioning protocol for NS and DS records! > - it has a feature for requests to be queued and a message list to be pol= led > > > 2. Unless I'm being dumb (and my RelaxNG is not very good) I can't see a= ny definition of either > > - responses to non-queued requests > - errors > > other than the implicit standard HTTP response/error codes. > > > 3. It's too tightly bound to the underlying HTTP interface. The respons= e/errors is one example, another is the queue element field: > > # The HTTP method used to update > attribute method { "PUT" | "DELETE" }, > > That would be better as a logical operation code (i.e. Add, Delete) that = were mapped onto HTTP operations. > > 4. Some of the key data elements that need to be provisioning are define= d the most loosely - name the rdata field. > > So overall I'm pretty surprised that this path was chosen in 2011 rather = than EPP which the rest of the known universe uses for this sort of thing. = I realise ICANN is very much taken with lightweight REST but this seems to= be forcing the solution onto every problem, even then solved ones. Howeve= r, this is indeed ICANN's choice, it is a trivial protocol and is working i= n production. But what it isn't is a candidate for becoming an RFC. > > If the authors are interested in doing this in EPP then I would be willin= g to help. > > cheers > Jay > > -- > Jay Daley > Chief Executive > .nz Registry Services (New Zealand Domain Name Registry Limited) > desk: +64 4 931 6977 > mobile: +64 21 678840 > linkedin: www.linkedin.com/in/jaydaley > > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop From jay@nzrs.net.nz Mon Aug 12 16:28:57 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2FC921F8FB4 for ; Mon, 12 Aug 2013 16:28:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.483 X-Spam-Level: X-Spam-Status: No, score=-2.483 tagged_above=-999 required=5 tests=[AWL=0.116, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rLxIydZrU30P for ; Mon, 12 Aug 2013 16:28:53 -0700 (PDT) Received: from srsomail.nzrs.net.nz (srsomail.nzrs.net.nz [202.46.183.22]) by ietfa.amsl.com (Postfix) with ESMTP id 4E95121F8FF8 for ; Mon, 12 Aug 2013 16:28:52 -0700 (PDT) Received: from localhost (localhost.localdomain [127.0.0.1]) by srsomail.nzrs.net.nz (Postfix) with ESMTP id 43BF94B54B2; Tue, 13 Aug 2013 11:28:50 +1200 (NZST) X-Virus-Scanned: Debian amavisd-new at srsomail.office.nzrs.net.nz Received: from srsomail.nzrs.net.nz ([202.46.183.22]) by localhost (srsomail.office.nzrs.net.nz [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WU5IuTRANqqx; Tue, 13 Aug 2013 11:28:43 +1200 (NZST) Received: from [192.168.1.230] (121-74-100-115.telstraclear.net [121.74.100.115]) (Authenticated sender: jay) by srsomail.nzrs.net.nz (Postfix) with ESMTPSA id 080914B53B2; Tue, 13 Aug 2013 11:28:42 +1200 (NZST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) From: Jay Daley In-Reply-To: <8247861913252083991@unknownmsgid> Date: Tue, 13 Aug 2013 11:28:41 +1200 Content-Transfer-Encoding: quoted-printable Message-Id: <9B4EAB28-0301-474D-9F87-2BC49E55DB01@nzrs.net.nz> References: <92F4C715-FF72-4CEE-9C17-134932228F13@nzrs.net.nz> <8247861913252083991@unknownmsgid> To: Joe Abley X-Mailer: Apple Mail (2.1508) Cc: dnsop WG Subject: Re: [DNSOP] Review of draft-manderson-rdns-xml-01 X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Aug 2013 23:28:57 -0000 On 13/08/2013, at 10:57 AM, Joe Abley wrote: > Hi Jay, >=20 > I'm not sure I understand your conclusion. Why do you think this > running system should not be documented in an RFC? >=20 > If it was a private-use protocol being used for private purposes, I > could see what you're getting at. However, it's neither: it's a > protocol in use between different organisations being used to support > an aspect of public infrastructure (the reverse DNS trees). I'm not sure how you can describe this as anything other than a private = protocol. Yes it is part of the public infrastructure but then there are = a myriad of private EPP extensions out there that also work on the = public infrastructure and yet would equally not be suitable for an RFC. = So I don't think the 'public infrastructure' argument holds water. For it to be an RFC I would hope that meets a decent threshold, namely: 1. there is at least some sense of architectural positioning in = relation to other protocols. This draft doesn't have that as it seems = to do a small part of an otherwise perfectly good protocol, EPP, without = any reference/recognition of how the two fit together. 2. there is a relatively clean separation of layers. This is not the = case with this draft as it tightly binds onto HTTP. 3. it is a public protocol. For this to be a public protocol the rules = are pretty clear - two implementations in different contexts. AFAICT = this has only one server implementation and multiple clients in the same = context. While 2. can be fixed I'm not sure 1. and 3. can be. > I don't agree that there's nothing to be gained by documenting it (I > realise that's not exactly what you wrote, but it could be read that > way) and to me, the RFC series is a plausible place for that to > happen. There is every benefit to this being documented, I am glad that it is = and would not wish that to change. However using the RFC process for a = private protocol is inappropriate and it would be better if there was a = web site had a section that documented all the ICANN private protocols, = in much the same way many TLD operators do. > What am I missing? I really do not mean to cause any offence by this so apologies in = advance if I do, but is this a case of ICANN mistaking its position = here? Yes you are the excellent operator of a key part of the public = infrastructure but that doesn't mean that every protocol you develop = related to your technical function automatically becomes an RFC when = documented to a sufficient standard. cheers Jay >=20 > (ObDisclaimer: Terry and I work together, but this is a personal > perspective; he's big and ugly enough to fight his own battles :-) >=20 >=20 > Joe >=20 > Aue Te Ariki! He toki ki roto taku mahuna! >=20 > On 2013-08-12, at 18:06, Jay Daley wrote: >=20 >> Firstly, just to confirm that I've read the previous email from Terry = Manderson that this draft was published more for reasons of transparency = and starting a conversation than anything else. So here are my comments = in light of that: >>=20 >> 1. There were a number of places in this draft where I found myself = asking "why didn't they just use EPP?". For example: >>=20 >> - it's a registry provisioning protocol >> - it's a registry provisioning protocol for NS and DS records! >> - it has a feature for requests to be queued and a message list to be = polled >>=20 >>=20 >> 2. Unless I'm being dumb (and my RelaxNG is not very good) I can't = see any definition of either >>=20 >> - responses to non-queued requests >> - errors >>=20 >> other than the implicit standard HTTP response/error codes. >>=20 >>=20 >> 3. It's too tightly bound to the underlying HTTP interface. The = response/errors is one example, another is the queue element field: >>=20 >> # The HTTP method used to update >> attribute method { "PUT" | "DELETE" }, >>=20 >> That would be better as a logical operation code (i.e. Add, Delete) = that were mapped onto HTTP operations. >>=20 >> 4. Some of the key data elements that need to be provisioning are = defined the most loosely - name the rdata field. >>=20 >> So overall I'm pretty surprised that this path was chosen in 2011 = rather than EPP which the rest of the known universe uses for this sort = of thing. I realise ICANN is very much taken with lightweight REST but = this seems to be forcing the solution onto every problem, even then = solved ones. However, this is indeed ICANN's choice, it is a trivial = protocol and is working in production. But what it isn't is a candidate = for becoming an RFC. >>=20 >> If the authors are interested in doing this in EPP then I would be = willing to help. >>=20 >> cheers >> Jay >>=20 >> -- >> Jay Daley >> Chief Executive >> .nz Registry Services (New Zealand Domain Name Registry Limited) >> desk: +64 4 931 6977 >> mobile: +64 21 678840 >> linkedin: www.linkedin.com/in/jaydaley >>=20 >> _______________________________________________ >> DNSOP mailing list >> DNSOP@ietf.org >> https://www.ietf.org/mailman/listinfo/dnsop > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop --=20 Jay Daley Chief Executive .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 931 6977 mobile: +64 21 678840 linkedin: www.linkedin.com/in/jaydaley From terry.manderson@icann.org Mon Aug 12 16:59:29 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E6A621F9D9A for ; Mon, 12 Aug 2013 16:59:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aV5O5lRCD6u4 for ; Mon, 12 Aug 2013 16:59:24 -0700 (PDT) Received: from EXPFE100-2.exc.icann.org (expfe100-2.exc.icann.org [64.78.22.237]) by ietfa.amsl.com (Postfix) with ESMTP id E032E21F9BF3 for ; Mon, 12 Aug 2013 16:59:23 -0700 (PDT) Received: from EXVPMBX100-1.exc.icann.org ([64.78.22.232]) by EXPFE100-2.exc.icann.org ([64.78.22.237]) with mapi; Mon, 12 Aug 2013 16:59:23 -0700 From: Terry Manderson To: Jay Daley , dnsop WG Date: Mon, 12 Aug 2013 16:59:20 -0700 Thread-Topic: [DNSOP] Review of draft-manderson-rdns-xml-01 Thread-Index: Ac6Xt/dzXq0ovekJR0uGnkANfsWs6Q== Message-ID: In-Reply-To: <92F4C715-FF72-4CEE-9C17-134932228F13@nzrs.net.nz> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.6.130613 acceptlanguage: en-US Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3459232760_64899443" MIME-Version: 1.0 Subject: Re: [DNSOP] Review of draft-manderson-rdns-xml-01 X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Aug 2013 23:59:29 -0000 --B_3459232760_64899443 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit Hi Jay, I'll try to answer your questions, but the intent was to solicit reviews for the RFC-ISE. If you would like to be a reviewer in that direction please do so! On 13/08/13 8:05 AM, "Jay Daley" wrote: >Firstly, just to confirm that I've read the previous email from Terry >Manderson that this draft was published more for reasons of transparency >and starting a conversation than anything else. So here are my comments >in light of that: > >1. There were a number of places in this draft where I found myself >asking "why didn't they just use EPP?". For example: > >- it's a registry provisioning protocol >- it's a registry provisioning protocol for NS and DS records! >- it has a feature for requests to be queued and a message list to be >polled While it's nice to assume that everyone should use some particular protocol for a solution, sometimes business desires overtake any particular technical position. EPP was considered, and this document should not be "why we didn't use EPP", but the end consideration was that the objects in question did not fall into the classical registry/registrar approach as the rights of assignment of the overarching objects (the IP address blocks) fall in a process and policy that sits on a level well above the provisioning of DNSSEC records. Also EPP, while extensible, was also considered waaaaaay to heavy for the slim function that was being targeted. > > >2. Unless I'm being dumb (and my RelaxNG is not very good) I can't see >any definition of either > >- responses to non-queued requests >- errors > >other than the implicit standard HTTP response/error codes. Correct, the service is a RESTFUL application, and with that the HTTP error codes are considered the most atomic feature, and the item that should be passed back first and foremost. > > >3. It's too tightly bound to the underlying HTTP interface. The >response/errors is one example, another is the queue element field: > ># The HTTP method used to update > attribute method { "PUT" | "DELETE" }, > >That would be better as a logical operation code (i.e. Add, Delete) that >were mapped onto HTTP operations. "too tightly"? I think "intended". :-) While it is possible to abstract such items in the XML, the underlying statement is that this system will not (ever) operate on anything other than HTTPS. It's also note worthy that the HTTP method describes precisely the operation undertaken. > > >4. Some of the key data elements that need to be provisioning are >defined the most loosely - name the rdata field. Yes. The RDATA is one part I was never really super-duper ecstatic about. But it stuck. (perfect was the enemy of good) > >So overall I'm pretty surprised that this path was chosen in 2011 rather >than EPP which the rest of the known universe uses for this sort of >thing. I realise ICANN is very much taken with lightweight REST but this >seems to be forcing the solution onto every problem, even then solved >ones. However, this is indeed ICANN's choice, it is a trivial protocol >and is working in production. But what it isn't is a candidate for >becoming an RFC. I think, Jay, you might be one step removed from what the problem was. It wasn't "how can we use EPP here", nor was it "how can we use REST there". In terms of a candidate becoming an RFC, please cast your eyes over http://www.rfc-editor.org/indsubs.html and if you still feel that way, drop me a personal note and we can discuss why/why-not offline. > >If the authors are interested in doing this in EPP then I would be >willing to help. The system is implemented, it has been for a number of years, and operates precisely as designed. Should someone, amongst the 'customers' of the system, request ICANN to make this system EPP and provide good reason - then I will certainly put you on the top on my "to call" list. Cheers Terry --B_3459232760_64899443 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIITvAYJKoZIhvcNAQcCoIITrTCCE6kCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC EYgwggcDMIIF66ADAgECAhAPz2lJUZsAlD35l4oJxf0FMA0GCSqGSIb3DQEBBQUAMGIxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2Vy dC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFzc3VyZWQgSUQgQ0EtMTAeFw0xMjAzMjcwMDAw MDBaFw0xNTAzMjcxMjAwMDBaMIGsMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p YTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0 aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczEXMBUGA1UECxMORE5TIE9wZXJh dGlvbnMxGDAWBgNVBAMTD1RlcnJ5IE1hbmRlcnNvbjCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAKRhZ4W3U6MnfS2woYEFCIyN+g1MNILokbUKk+PTl5mmK3QtWQxTSOu2sdzN xHMy6p2RoT9BMGOamttFq2WswSru6/7JT1TflytGaPHfK5kMP/pI47hmcwUEm9Z169I5ar7z BTiEAQA06cGKtgJ8XiiLFUIHLVuRq3WGxjnFTHlAHXY6mdgDT/ntAnoEvvPVm4XqUnjJiZTS ojzyr1q2RqFvyXs2blOARumDqvLI33yLGcUuaEL+A+hgodzM/fL4kdoy964mXvmEerpm4d4f Y/JfbRUWxc0Eomu9nwGFNk6ijO41qk+OIboct2qeA+5PPclXJNNHYVfzT2dyWfGgxaMCAwEA AaOCA2gwggNkMB8GA1UdIwQYMBaAFBUAEisTmLKZB+0e36K+Vw0rZwLNMB0GA1UdDgQWBBSz wvR2YXpP9XjS9cknMX5g3LM2jTAkBgNVHREEHTAbgRl0ZXJyeS5tYW5kZXJzb25AaWNhbm4u b3JnMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwfQYD VR0fBHYwdDA4oDagNIYyaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJl ZElEQ0EtMS5jcmwwOKA2oDSGMmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFz c3VyZWRJRENBLTEuY3JsMIIBxQYDVR0gBIIBvDCCAbgwggG0BgpghkgBhv1sBAECMIIBpDA6 BggrBgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBvc2l0b3J5 Lmh0bTCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABp AHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABh AGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABD AFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5 ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBi AGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjB3BggrBgEFBQcBAQRr MGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1 aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEQ0EtMS5jcnQw DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAYpwxK/KvdhbyQqrKp2ylMQpNzqVH ofo4hPILTnp/o+UyYVn6daWSilaV+XNBzE5Rm/f7ms2iA1zBzOvGv55pLH0n6lgIRTeuAGzf KIsPCwPvYQkkMAPXHzh9A44m19hvigTgOPNyjzcOTiHqwwCJSDTEZx17CEkrzQPq1vfG1Lvk +AWjEtxCsGmsuCHHaZjwQ8SsGI7W5cA1Y4RTcQf6S9eIpSsOwXIYdDgWq9Uhi/amW7ryW06Y GH7BHaitqgmm32MZuid3UzJUU6+Ljx7uGA9Fe6k1uPEHhaXTAoobPSpPdOgGmnxUCRQu2OI7 +I8vHiSe7DC/LmxEDC5kB+lUTjCCBsIwggWqoAMCAQICEAoE3yF0XU0rjOozcgUAUOkwDQYJ KoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcG A1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBS b290IENBMB4XDTA2MTExMDAwMDAwMFoXDTIxMTExMDAwMDAwMFowYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEA6IItmfnKwkKVpYBzQHDSnlZUXKnE0kEGj8kz/E1FkVyBn+0snPgWWd+etSQV wpi5tHdJ3InECtqvy15r7a2wcTHrzzpADEZNk+yLejYIA6sMNP4YSYL+x8cxSIB8HqIPkg5Q ycaH6zY/2DDD/6b3+6LNb3Mj/qxWBZDwMiEWicZwiPkFl32jx0PdAug7Pe2xQaPtP77blUjE 7h6z8rwMK5nQxl0SQoHhg26Ccz8mSxSQrllmCsSNvtLOBq6thG9IhJtPQLnxTPKvmPv2zkBd XPao8S+v7Iki8msYZbHBc63X8djPHgp0XEK4aH631XcKJ1Z8D2KkPzIUYJX9BwSiCQIDAQAB o4IDbzCCA2swDgYDVR0PAQH/BAQDAgGGMDsGA1UdJQQ0MDIGCCsGAQUFBwMBBggrBgEFBQcD AgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCDCCAcYGA1UdIASCAb0wggG5MIIBtQYL YIZIAYb9bAEDAAQwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9z c2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUA cwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMA dABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQA aQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkA aQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwA aQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8A cgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMA ZQAuMA8GA1UdEwEB/wQFMAMBAf8wfQYIKwYBBQUHAQEEcTBvMCQGCCsGAQUFBzABhhhodHRw Oi8vb2NzcC5kaWdpY2VydC5jb20wRwYIKwYBBQUHMAKGO2h0dHA6Ly93d3cuZGlnaWNlcnQu Y29tL0NBQ2VydHMvRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8EejB4MDqg OKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu Y3JsMDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdDgQWBBQVABIrE5iymQftHt+ivlcNK2cCzTAfBgNVHSMEGDAWgBRF 66Kv9JLLgjEtUYunpyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAhGFOQR64dgQqtbbvj/JV hbldVv4KmObkvWWKfUAp0/yxXUX9OrgqWzNLJFzNubTkc61hXXatdDOKZtUjr0wfcm5F2XVA u6I7z41JL8BBsOIpo1E4Q1CZFKwzBjViiX13qVIH5WwgV7aBum+8s8KU7XYCgNl8zoWoHOzH Q0pLsVfPcs7f9SU8yyJP/Z9S0TfLCLs4PuDVPm95Ca1bfDGzdzXD5GP5aAqYB+dGOHeE0j6X vAqgqKwlT0RukeHSWq9r7zAcjaNEQrMQiyP61+Y1dDesz+urWB/JiCP/NtQH6jRqR+qdlWye KU9T7eMrlSBOKs+WYHr4LIDwlVLOKZaBYjCCA7cwggKfoAMCAQICEAzn4OUX2Eb+j+Vg/Bvw MDkwDQYJKoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IElu YzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJl ZCBJRCBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowZTELMAkGA1UE BhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNv bTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMIIBIjANBgkqhkiG9w0B AQEFAAOCAQ8AMIIBCgKCAQEArQ4VzuRDgFyxh/O3YPlxEqWu3CaUiKr0zvUgOShYYAz4gNqp FZUyYTy1sSiEiorcnwoMgxd6j5Csiud5U1wxhCr2D5gyNnbM3t08qKLvavsh8lJh358g1x/i sdn+GGTSEltf+VgYNbxHzaE2+Wt/1LA4PsEbw4wz2dgvGP4oD7Ong9bDbkTAYTWWFv5ZnIt2 bdfxoksNK/8LctqeYNCOkDXGeFWHIKHP5W0KyEl8MZgzbCLph9AyWqK6E4IR7TkXnZk6cqHm +qTZ1Rcxda6FfSKuPwFGhvYoecix2uRXF8R+HA6wtJKmVrO9spftqqfwt8WoP5UW0P+hlusI Xxh3TwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E FgQUReuir/SSy4IxLVGLp6chnfNtyA8wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNt yA8wDQYJKoZIhvcNAQEFBQADggEBAKIOvN/i7fDjcnN6ZJS/93Jm2DLkQnVirofr8tXZ3laz n8zOFCi5DZdgXBJMWOTTPYNJRViXNWkaqEfqVsZ5qxLYZ4GE338JPJTmuCYsIL09syiJ91// IuKXhB/pZe+H4N/BZ0mzXeuyCSrrJu14vn0/K/O3JjVtX4kBtklbnwEFm6s9JcHMtn/C8W+G xvpkaOuBLZTrQrf6jB7dYvG+UGe3bL3z8R9rDDYHFn83fKlbbXrxEkZgg9cnBL5Lzpe+w2cq aBHfgOcMM2a/Ew0UbvN/H2MQHvqNGyVtbI+lt2EBsdKjJqEQcZ2t4sP5w5lRtysHCM4u5lCy p/oKRS+i8PIxggH8MIIB+AIBATB2MGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFz c3VyZWQgSUQgQ0EtMQIQD89pSVGbAJQ9+ZeKCcX9BTAJBgUrDgMCGgUAoF0wIwYJKoZIhvcN AQkEMRYEFEVyXDoC8okETxoAZAKRH306maOSMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw HAYJKoZIhvcNAQkFMQ8XDTEzMDgxMjIzNTkyMFowDQYJKoZIhvcNAQEBBQAEggEAUCc8F5vo cHKlgtiZGweR+4KK9PPpC7U39cTqrdHsvTNB3Ekh2TSo6vYT4VcedYerhJijJCaFaFWwVgpK gfhSXR7Rrsfx9S+QYBoZtcPnloeb/eA+8lX5zwg1P1zN1o4kjBJ/0LYdbr3w1MFmHtDXcNEk 6mbLz7juvaQ5LBA5seP7sMLimI2h5RDSleKh7QXBXlHNy3dXOkgg+tsvoPYfnylcbuo0H/Kw 45pFh9eya3zSY3iQfa5dDiAaLwRVcu+di3iAhtrRD5vqmy518QAiWldioEPREfQXUUIwxc2g 6DWord4R2tg5GjpHe8DaaifZ4DCWFM3VCOdehe+1A10D9g== --B_3459232760_64899443-- From ggm@algebras.org Mon Aug 12 17:04:24 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5F1511E80F0 for ; Mon, 12 Aug 2013 17:04:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.443 X-Spam-Level: X-Spam-Status: No, score=-2.443 tagged_above=-999 required=5 tests=[AWL=0.533, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oY+Wc0G4OSH1 for ; Mon, 12 Aug 2013 17:04:21 -0700 (PDT) Received: from mail-pb0-f53.google.com (mail-pb0-f53.google.com [209.85.160.53]) by ietfa.amsl.com (Postfix) with ESMTP id 04E9111E80ED for ; Mon, 12 Aug 2013 17:04:20 -0700 (PDT) Received: by mail-pb0-f53.google.com with SMTP id up15so7302011pbc.26 for ; Mon, 12 Aug 2013 17:04:20 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=VZJ+XCgSXu00qAM3L3rDNwtNJTO6aTl2gTkhUPYFsXQ=; b=YjN0XD/N2Bt06U5wFaWZWl/+Scfqc1qzeK/0KieADduQlSQpzjQm/2QU1sDb0ATkKX QJISqKe7o2CROHjoIFGD8LPwaWpv699YQ3xlEnLxyQ1CQlRyoQPkpmMmHZXRYUARnktn rYUzgcawRAhNycT55fG6fuA/jLjDKwqev8rACTXK4YTDQ/t8b+GSEyj00hc+QVFyt74a dLfxsXnYgdnuXp9ikh3qSE46pJ3H2p3wiC7RcTE9ZjTjvg1LL8tpeFzx7RoQvOZx6Hfy wTd0h3Y7uN08wKBQ/UKmoNbmQz1dEyQJ994xlUHPF+psmlpOf6J2VNmRfm6iYVymQob1 Eb0Q== X-Gm-Message-State: ALoCoQkHjOD9WGYAC5ZIdXWgaNKTETUelje9psTFh0X1sBgU3SwoYPo/2aKBH5IEVyjgg3vkyl0m MIME-Version: 1.0 X-Received: by 10.66.163.199 with SMTP id yk7mr1539868pab.136.1376352260619; Mon, 12 Aug 2013 17:04:20 -0700 (PDT) Received: by 10.70.19.98 with HTTP; Mon, 12 Aug 2013 17:04:20 -0700 (PDT) X-Originating-IP: [2001:dc0:a000:4:b135:e004:f9ed:5af3] In-Reply-To: <9B4EAB28-0301-474D-9F87-2BC49E55DB01@nzrs.net.nz> References: <92F4C715-FF72-4CEE-9C17-134932228F13@nzrs.net.nz> <8247861913252083991@unknownmsgid> <9B4EAB28-0301-474D-9F87-2BC49E55DB01@nzrs.net.nz> Date: Tue, 13 Aug 2013 10:04:20 +1000 Message-ID: From: George Michaelson To: Jay Daley Content-Type: multipart/alternative; boundary=047d7b86e54094949704e3c8fbbc Cc: dnsop WG , Joe Abley Subject: Re: [DNSOP] Review of draft-manderson-rdns-xml-01 X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Aug 2013 00:04:25 -0000 --047d7b86e54094949704e3c8fbbc Content-Type: text/plain; charset=ISO-8859-1 My personal view, from deep time, is that this protocol was offered into the process facing upwards, as a result of an applications REST interface which was developed in APNIC facing downwards. Terry may have a different perspective but thats my sense: we had this working in-house as a lightweight mechanism to solve a specific problem and it happened to be a good fit for a very similar problem facing our parents in reverse-DNS provisioniong. We have frequently discussed EPP for Internet Number Resources (INR) in the RIR system, and never found it a good fit. Ed Lewis demonstrated extensions at an APNIC meeting in my deep memory. The critique is: its hugely complex, and based on binary prototcols in ways we don't find tractable. The positives are that many holders of INR have an investment in EPP to do their provisioning for customers with domain names. The break point is that while the provisioning investment has been made, its different people inside the INR holding entity, and the current number holders are more familiar with textual update mechanisms like RPSL, whois objects, and REST. I think EPP's time window to be deployed has come and gone. thats just my personal opinion. -G On Tue, Aug 13, 2013 at 9:28 AM, Jay Daley wrote: > > On 13/08/2013, at 10:57 AM, Joe Abley wrote: > > > Hi Jay, > > > > I'm not sure I understand your conclusion. Why do you think this > > running system should not be documented in an RFC? > > > > If it was a private-use protocol being used for private purposes, I > > could see what you're getting at. However, it's neither: it's a > > protocol in use between different organisations being used to support > > an aspect of public infrastructure (the reverse DNS trees). > > I'm not sure how you can describe this as anything other than a private > protocol. Yes it is part of the public infrastructure but then there are a > myriad of private EPP extensions out there that also work on the public > infrastructure and yet would equally not be suitable for an RFC. So I > don't think the 'public infrastructure' argument holds water. > > For it to be an RFC I would hope that meets a decent threshold, namely: > > 1. there is at least some sense of architectural positioning in relation > to other protocols. This draft doesn't have that as it seems to do a small > part of an otherwise perfectly good protocol, EPP, without any > reference/recognition of how the two fit together. > > 2. there is a relatively clean separation of layers. This is not the > case with this draft as it tightly binds onto HTTP. > > 3. it is a public protocol. For this to be a public protocol the rules > are pretty clear - two implementations in different contexts. AFAICT this > has only one server implementation and multiple clients in the same context. > > While 2. can be fixed I'm not sure 1. and 3. can be. > > > I don't agree that there's nothing to be gained by documenting it (I > > realise that's not exactly what you wrote, but it could be read that > > way) and to me, the RFC series is a plausible place for that to > > happen. > > There is every benefit to this being documented, I am glad that it is and > would not wish that to change. However using the RFC process for a > private protocol is inappropriate and it would be better if there was a web > site had a section that documented all the ICANN private protocols, in much > the same way many TLD operators do. > > > What am I missing? > > I really do not mean to cause any offence by this so apologies in advance > if I do, but is this a case of ICANN mistaking its position here? Yes you > are the excellent operator of a key part of the public infrastructure but > that doesn't mean that every protocol you develop related to your technical > function automatically becomes an RFC when documented to a sufficient > standard. > > cheers > Jay > > > > > > > (ObDisclaimer: Terry and I work together, but this is a personal > > perspective; he's big and ugly enough to fight his own battles :-) > > > > > > Joe > > > > Aue Te Ariki! He toki ki roto taku mahuna! > > > > On 2013-08-12, at 18:06, Jay Daley wrote: > > > >> Firstly, just to confirm that I've read the previous email from Terry > Manderson that this draft was published more for reasons of transparency > and starting a conversation than anything else. So here are my comments in > light of that: > >> > >> 1. There were a number of places in this draft where I found myself > asking "why didn't they just use EPP?". For example: > >> > >> - it's a registry provisioning protocol > >> - it's a registry provisioning protocol for NS and DS records! > >> - it has a feature for requests to be queued and a message list to be > polled > >> > >> > >> 2. Unless I'm being dumb (and my RelaxNG is not very good) I can't see > any definition of either > >> > >> - responses to non-queued requests > >> - errors > >> > >> other than the implicit standard HTTP response/error codes. > >> > >> > >> 3. It's too tightly bound to the underlying HTTP interface. The > response/errors is one example, another is the queue element field: > >> > >> # The HTTP method used to update > >> attribute method { "PUT" | "DELETE" }, > >> > >> That would be better as a logical operation code (i.e. Add, Delete) > that were mapped onto HTTP operations. > >> > >> 4. Some of the key data elements that need to be provisioning are > defined the most loosely - name the rdata field. > >> > >> So overall I'm pretty surprised that this path was chosen in 2011 > rather than EPP which the rest of the known universe uses for this sort of > thing. I realise ICANN is very much taken with lightweight REST but this > seems to be forcing the solution onto every problem, even then solved ones. > However, this is indeed ICANN's choice, it is a trivial protocol and is > working in production. But what it isn't is a candidate for becoming an > RFC. > >> > >> If the authors are interested in doing this in EPP then I would be > willing to help. > >> > >> cheers > >> Jay > >> > >> -- > >> Jay Daley > >> Chief Executive > >> .nz Registry Services (New Zealand Domain Name Registry Limited) > >> desk: +64 4 931 6977 > >> mobile: +64 21 678840 > >> linkedin: www.linkedin.com/in/jaydaley > >> > >> _______________________________________________ > >> DNSOP mailing list > >> DNSOP@ietf.org > >> https://www.ietf.org/mailman/listinfo/dnsop > > _______________________________________________ > > DNSOP mailing list > > DNSOP@ietf.org > > https://www.ietf.org/mailman/listinfo/dnsop > > > -- > Jay Daley > Chief Executive > .nz Registry Services (New Zealand Domain Name Registry Limited) > desk: +64 4 931 6977 > mobile: +64 21 678840 > linkedin: www.linkedin.com/in/jaydaley > > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop > --047d7b86e54094949704e3c8fbbc Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
My personal view, from deep time, is that this protocol wa= s offered into the process facing upwards, as a result of an applications R= EST interface which was developed in APNIC facing downwards. Terry may have= a different perspective but thats my sense: we had this working in-house a= s a lightweight mechanism to solve a specific problem and it happened to be= a good fit for a very similar problem facing our parents in reverse-DNS pr= ovisioniong.

We have frequently discussed EPP for Internet Number Resourc= es (INR) in the RIR system, and never found it a good fit. Ed Lewis demonst= rated extensions at an APNIC meeting in my deep memory. The critique is: it= s hugely complex, and based on binary prototcols in ways we don't find = tractable. The positives are that many holders of INR have an investment in= EPP to do their provisioning for customers with domain names. The break po= int is that while the provisioning investment has been made, its different = people inside the INR holding entity, and the current number holders are mo= re familiar with textual update mechanisms like RPSL, whois objects, and RE= ST.

I think EPP's time window to be deployed has come a= nd gone. thats just my personal opinion.

-G
<= div>



On Tue, Aug 13, 2013 at 9:28 AM, Jay Daley <jay@nzrs.net.nz> w= rote:

On 13/08/2013, at 10:57 AM, Joe Abley <jabley@hopcount.ca> wrote:

> Hi Jay,
>
> I'm not sure I understand your conclusion. Why do you think this > running system should not be documented in an RFC?
>
> If it was a private-use protocol being used for private purposes, I > could see what you're getting at. However, it's neither: it= 9;s a
> protocol in use between different organisations being used to support<= br> > an aspect of public infrastructure (the reverse DNS trees).

I'm not sure how you can describe this as anything other than a p= rivate protocol. Yes it is part of the public infrastructure but then there= are a myriad of private EPP extensions out there that also work on the pub= lic infrastructure and yet would equally not be suitable for an RFC. =A0So = I don't think the 'public infrastructure' argument holds water.=

For it to be an RFC I would hope that meets a decent threshold, namely:

1. =A0there is at least some sense of architectural positioning in relation= to other protocols. =A0This draft doesn't have that as it seems to do = a small part of an otherwise perfectly good protocol, EPP, without any refe= rence/recognition of how the two fit together.

2. =A0there is a relatively clean separation of layers. =A0This is not the = case with this draft as it tightly binds onto HTTP.

3. =A0it is a public protocol. =A0For this to be a public protocol the rule= s are pretty clear - two implementations in different contexts. =A0AFAICT t= his has only one server implementation and multiple clients in the same con= text.

While 2. can be fixed I'm not sure 1. and 3. can be.

> I don't agree that there's nothing to be gained by documenting= it (I
> realise that's not exactly what you wrote, but it could be read th= at
> way) and to me, the RFC series is a plausible place for that to
> happen.

There is every benefit to this being documented, I am glad that it is= and would not wish that to change. =A0However using the =A0RFC process for= a private protocol is inappropriate and it would be better if there was a = web site had a section that documented all the ICANN private protocols, in = much the same way many TLD operators do.

> What am I missing?

I really do not mean to cause any offence by this so apologies in advance i= f I do, but is this a case of ICANN mistaking its position here? =A0Yes you= are the excellent operator of a key part of the public infrastructure but = that doesn't mean that every protocol you develop related to your techn= ical function automatically becomes an RFC when documented to a sufficient = standard.

cheers
Jay



>
> (ObDisclaimer: Terry and I work together, but this is a personal
> perspective; he's big and ugly enough to fight his own battles :-)=
>
>
> Joe
>
> Aue Te Ariki! He toki ki roto taku mahuna!
>
> On 2013-08-12, at 18:06, Jay Daley <jay@nzrs.net.nz> wrote:
>
>> Firstly, just to confirm that I've read the previous email fro= m Terry Manderson that this draft was published more for reasons of transpa= rency and starting a conversation than anything else. =A0So here are my com= ments in light of that:
>>
>> 1. =A0There were a number of places in this draft where I found my= self asking "why didn't they just use EPP?". =A0For example:<= br> >>
>> - it's a registry provisioning protocol
>> - it's a registry provisioning protocol for NS and DS records!=
>> - it has a feature for requests to be queued and a message list to= be polled
>>
>>
>> 2. =A0Unless I'm being dumb (and my RelaxNG is not very good) = I can't see any definition of either
>>
>> - responses to non-queued requests
>> - errors
>>
>> other than the implicit standard HTTP response/error codes.
>>
>>
>> 3. =A0It's too tightly bound to the underlying HTTP interface.= =A0The response/errors is one example, another is the queue element field:=
>>
>> # The HTTP method used to update
>> =A0 =A0 =A0attribute method { "PUT" | "DELETE"= },
>>
>> That would be better as a logical operation code (i.e. Add, Delete= ) that were mapped onto HTTP operations.
>>
>> 4. =A0Some of the key data elements that need to be provisioning a= re defined the most loosely - name the rdata field.
>>
>> So overall I'm pretty surprised that this path was chosen in 2= 011 rather than EPP which the rest of the known universe uses for this sort= of thing. =A0I realise ICANN is very much taken with lightweight REST but = this seems to be forcing the solution onto every problem, even then solved = ones. =A0However, this is indeed ICANN's choice, it is a trivial protoc= ol and is working in production. =A0But what it isn't is a candidate fo= r becoming an RFC.
>>
>> If the authors are interested in doing this in EPP then I would be= willing to help.
>>
>> cheers
>> Jay
>>
>> --
>> Jay Daley
>> Chief Executive
>> .nz Registry Services (New Zealand Domain Name Registry Limited) >> desk: +64 4 931 6977
>> mobile: = +64 21 678840
>> linkedin: www.linkedin.com/in/jaydaley
>>
>> _______________________________________________
>> DNSOP mailing list
>> DNSOP@ietf.org
>> https://www.ietf.org/mailman/listinfo/dnsop
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop


--
Jay Daley
Chief Executive
.nz Registry Services (New Zealand Domain Name Registry Limited)
desk: +64 4 93= 1 6977
mobile: +64 21 67= 8840
linkedin: www.linkedin.com/in/jaydaley

_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
h= ttps://www.ietf.org/mailman/listinfo/dnsop

--047d7b86e54094949704e3c8fbbc-- From jay@nzrs.net.nz Mon Aug 12 17:17:28 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A37411E80F4 for ; Mon, 12 Aug 2013 17:17:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.496 X-Spam-Level: X-Spam-Status: No, score=-2.496 tagged_above=-999 required=5 tests=[AWL=0.103, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OrgTqXakkho8 for ; Mon, 12 Aug 2013 17:17:24 -0700 (PDT) Received: from srsomail.nzrs.net.nz (srsomail.nzrs.net.nz [202.46.183.22]) by ietfa.amsl.com (Postfix) with ESMTP id 71C8811E80FD for ; Mon, 12 Aug 2013 17:17:06 -0700 (PDT) Received: from localhost (localhost.localdomain [127.0.0.1]) by srsomail.nzrs.net.nz (Postfix) with ESMTP id 18ED04B2714; Tue, 13 Aug 2013 12:17:06 +1200 (NZST) X-Virus-Scanned: Debian amavisd-new at srsomail.office.nzrs.net.nz Received: from srsomail.nzrs.net.nz ([202.46.183.22]) by localhost (srsomail.office.nzrs.net.nz [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WthztwHcWpHG; Tue, 13 Aug 2013 12:16:59 +1200 (NZST) Received: from [192.168.1.230] (121-74-100-115.telstraclear.net [121.74.100.115]) (Authenticated sender: jay) by srsomail.nzrs.net.nz (Postfix) with ESMTPSA id D23244B25B0; Tue, 13 Aug 2013 12:16:58 +1200 (NZST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) From: Jay Daley In-Reply-To: Date: Tue, 13 Aug 2013 12:16:57 +1200 Content-Transfer-Encoding: quoted-printable Message-Id: <772E8104-9C1B-4372-B404-3C9C854B601F@nzrs.net.nz> References: To: Terry Manderson X-Mailer: Apple Mail (2.1508) Cc: dnsop WG Subject: Re: [DNSOP] Review of draft-manderson-rdns-xml-01 X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Aug 2013 00:17:28 -0000 Hi Terry For most of the things that we disagree about I'll just leave it there, = but I would like to correct what I think are misconceptions about EPP: > EPP was considered, and this document should not be "why we didn't use > EPP", but the end consideration was that the objects in question did = not > fall into the classical registry/registrar approach as the rights of > assignment of the overarching objects (the IP address blocks) fall in = a > process and policy that sits on a level well above the provisioning of > DNSSEC records. EPP is used extensively in scenarios where the request is queued and = processed offline by a higher order process that determines rights to = the resource. It was designed with that in mind. > Also EPP, while extensible, was also considered waaaaaay to heavy for = the > slim function that was being targeted. I would be interested to know what you think is heavy about EPP? I've heard it said that EPP is heavy because of the use of a schema to = define the message format, but then your draft also does. I've also = heard it said that EPP is heavy because it uses XML but again your draft = does that. At its core EPP is a simple set of verbs that can carry any data = payload. Your application clearly doesn't need the data that would come = in the standard domain name payload or all the verbs but it is easy to = define a new payload format that has just the data you need and the = verbs you want. This would then be as short as your relaxNG but much = cleaner in terms of separation of layers and better supported by = libraries and the wider registry community. cheers Jay >=20 >>=20 >>=20 >> 2. Unless I'm being dumb (and my RelaxNG is not very good) I can't = see >> any definition of either >>=20 >> - responses to non-queued requests >> - errors >>=20 >> other than the implicit standard HTTP response/error codes. >=20 > Correct, the service is a RESTFUL application, and with that the HTTP > error codes are considered the most atomic feature, and the item that > should be passed back first and foremost. >=20 >>=20 >>=20 >> 3. It's too tightly bound to the underlying HTTP interface. The >> response/errors is one example, another is the queue element field: >>=20 >> # The HTTP method used to update >> attribute method { "PUT" | "DELETE" }, >>=20 >> That would be better as a logical operation code (i.e. Add, Delete) = that >> were mapped onto HTTP operations. >=20 > "too tightly"? I think "intended". :-) >=20 > While it is possible to abstract such items in the XML, the underlying > statement is that this system will not (ever) operate on anything = other > than HTTPS. >=20 > It's also note worthy that the HTTP method describes precisely the > operation undertaken. >=20 >>=20 >>=20 >> 4. Some of the key data elements that need to be provisioning are >> defined the most loosely - name the rdata field. >=20 > Yes. The RDATA is one part I was never really super-duper ecstatic = about. > But it stuck. > (perfect was the enemy of good) >=20 >>=20 >> So overall I'm pretty surprised that this path was chosen in 2011 = rather >> than EPP which the rest of the known universe uses for this sort of >> thing. I realise ICANN is very much taken with lightweight REST but = this >> seems to be forcing the solution onto every problem, even then solved >> ones. However, this is indeed ICANN's choice, it is a trivial = protocol >> and is working in production. But what it isn't is a candidate for >> becoming an RFC. >=20 > I think, Jay, you might be one step removed from what the problem was. = It > wasn't "how can we use EPP here", nor was it "how can we use REST = there". >=20 > In terms of a candidate becoming an RFC, please cast your eyes over > http://www.rfc-editor.org/indsubs.html and if you still feel that way, > drop me a personal note and we can discuss why/why-not offline. >=20 >>=20 >> If the authors are interested in doing this in EPP then I would be >> willing to help. >=20 > The system is implemented, it has been for a number of years, and = operates > precisely as designed. > Should someone, amongst the 'customers' of the system, request ICANN = to > make this system EPP and provide good reason - then I will certainly = put > you on the top on my "to call" list. >=20 > Cheers > Terry > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop --=20 Jay Daley Chief Executive .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 931 6977 mobile: +64 21 678840 linkedin: www.linkedin.com/in/jaydaley From terry.manderson@icann.org Mon Aug 12 17:56:08 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37C7011E80F0 for ; Mon, 12 Aug 2013 17:56:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AczEjUevs2XO for ; Mon, 12 Aug 2013 17:56:02 -0700 (PDT) Received: from EXPFE100-2.exc.icann.org (expfe100-2.exc.icann.org [64.78.22.237]) by ietfa.amsl.com (Postfix) with ESMTP id CFF0A11E80E9 for ; Mon, 12 Aug 2013 17:56:01 -0700 (PDT) Received: from EXVPMBX100-1.exc.icann.org ([64.78.22.232]) by EXPFE100-2.exc.icann.org ([64.78.22.237]) with mapi; Mon, 12 Aug 2013 17:56:01 -0700 From: Terry Manderson To: Jay Daley Date: Mon, 12 Aug 2013 17:55:57 -0700 Thread-Topic: [DNSOP] Review of draft-manderson-rdns-xml-01 Thread-Index: Ac6Xv+DemRK+PPpaT2qyk/HZ5R9yXg== Message-ID: In-Reply-To: <9B4EAB28-0301-474D-9F87-2BC49E55DB01@nzrs.net.nz> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.6.130613 acceptlanguage: en-US Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3459236158_65058050" MIME-Version: 1.0 Cc: dnsop WG Subject: Re: [DNSOP] Review of draft-manderson-rdns-xml-01 X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Aug 2013 00:56:08 -0000 --B_3459236158_65058050 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit Hi Jay, On 13/08/13 9:28 AM, "Jay Daley" wrote: > >I really do not mean to cause any offence by this so apologies in advance >if I do, but is this a case of ICANN mistaking its position here? No offence taken, and certainly a good question to ask. >Yes you are the excellent operator of a key part of the public >infrastructure but that doesn't mean that every protocol you develop >related to your technical function automatically becomes an RFC when >documented to a sufficient standard. I am not sensing that ICANN is mistaking its position here at all. There are no demands for the document to become an RFC via the ISE. It is a respectful thought, on my part, to offer the documentation of the technical portion first to the IETF, and should the IETF choose to not to absorb that then ICANN has done the appropriate action. In that case then ICANN might publish the documentation as a whitepaper on a website somewhere. But the effort has been made to be clear and transparent to the broader technical community, and not hide nor bury anything. Cheers Terry --B_3459236158_65058050 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIITvAYJKoZIhvcNAQcCoIITrTCCE6kCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC EYgwggcDMIIF66ADAgECAhAPz2lJUZsAlD35l4oJxf0FMA0GCSqGSIb3DQEBBQUAMGIxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2Vy dC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFzc3VyZWQgSUQgQ0EtMTAeFw0xMjAzMjcwMDAw MDBaFw0xNTAzMjcxMjAwMDBaMIGsMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p YTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0 aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczEXMBUGA1UECxMORE5TIE9wZXJh dGlvbnMxGDAWBgNVBAMTD1RlcnJ5IE1hbmRlcnNvbjCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAKRhZ4W3U6MnfS2woYEFCIyN+g1MNILokbUKk+PTl5mmK3QtWQxTSOu2sdzN xHMy6p2RoT9BMGOamttFq2WswSru6/7JT1TflytGaPHfK5kMP/pI47hmcwUEm9Z169I5ar7z BTiEAQA06cGKtgJ8XiiLFUIHLVuRq3WGxjnFTHlAHXY6mdgDT/ntAnoEvvPVm4XqUnjJiZTS ojzyr1q2RqFvyXs2blOARumDqvLI33yLGcUuaEL+A+hgodzM/fL4kdoy964mXvmEerpm4d4f Y/JfbRUWxc0Eomu9nwGFNk6ijO41qk+OIboct2qeA+5PPclXJNNHYVfzT2dyWfGgxaMCAwEA AaOCA2gwggNkMB8GA1UdIwQYMBaAFBUAEisTmLKZB+0e36K+Vw0rZwLNMB0GA1UdDgQWBBSz wvR2YXpP9XjS9cknMX5g3LM2jTAkBgNVHREEHTAbgRl0ZXJyeS5tYW5kZXJzb25AaWNhbm4u b3JnMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwfQYD VR0fBHYwdDA4oDagNIYyaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJl ZElEQ0EtMS5jcmwwOKA2oDSGMmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFz c3VyZWRJRENBLTEuY3JsMIIBxQYDVR0gBIIBvDCCAbgwggG0BgpghkgBhv1sBAECMIIBpDA6 BggrBgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBvc2l0b3J5 Lmh0bTCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABp AHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABh AGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABD AFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5 ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBi AGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjB3BggrBgEFBQcBAQRr MGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1 aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEQ0EtMS5jcnQw DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAYpwxK/KvdhbyQqrKp2ylMQpNzqVH ofo4hPILTnp/o+UyYVn6daWSilaV+XNBzE5Rm/f7ms2iA1zBzOvGv55pLH0n6lgIRTeuAGzf KIsPCwPvYQkkMAPXHzh9A44m19hvigTgOPNyjzcOTiHqwwCJSDTEZx17CEkrzQPq1vfG1Lvk +AWjEtxCsGmsuCHHaZjwQ8SsGI7W5cA1Y4RTcQf6S9eIpSsOwXIYdDgWq9Uhi/amW7ryW06Y GH7BHaitqgmm32MZuid3UzJUU6+Ljx7uGA9Fe6k1uPEHhaXTAoobPSpPdOgGmnxUCRQu2OI7 +I8vHiSe7DC/LmxEDC5kB+lUTjCCBsIwggWqoAMCAQICEAoE3yF0XU0rjOozcgUAUOkwDQYJ KoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcG A1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBS b290IENBMB4XDTA2MTExMDAwMDAwMFoXDTIxMTExMDAwMDAwMFowYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEA6IItmfnKwkKVpYBzQHDSnlZUXKnE0kEGj8kz/E1FkVyBn+0snPgWWd+etSQV wpi5tHdJ3InECtqvy15r7a2wcTHrzzpADEZNk+yLejYIA6sMNP4YSYL+x8cxSIB8HqIPkg5Q ycaH6zY/2DDD/6b3+6LNb3Mj/qxWBZDwMiEWicZwiPkFl32jx0PdAug7Pe2xQaPtP77blUjE 7h6z8rwMK5nQxl0SQoHhg26Ccz8mSxSQrllmCsSNvtLOBq6thG9IhJtPQLnxTPKvmPv2zkBd XPao8S+v7Iki8msYZbHBc63X8djPHgp0XEK4aH631XcKJ1Z8D2KkPzIUYJX9BwSiCQIDAQAB o4IDbzCCA2swDgYDVR0PAQH/BAQDAgGGMDsGA1UdJQQ0MDIGCCsGAQUFBwMBBggrBgEFBQcD AgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCDCCAcYGA1UdIASCAb0wggG5MIIBtQYL YIZIAYb9bAEDAAQwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9z c2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUA cwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMA dABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQA aQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkA aQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwA aQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8A cgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMA ZQAuMA8GA1UdEwEB/wQFMAMBAf8wfQYIKwYBBQUHAQEEcTBvMCQGCCsGAQUFBzABhhhodHRw Oi8vb2NzcC5kaWdpY2VydC5jb20wRwYIKwYBBQUHMAKGO2h0dHA6Ly93d3cuZGlnaWNlcnQu Y29tL0NBQ2VydHMvRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8EejB4MDqg OKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu Y3JsMDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdDgQWBBQVABIrE5iymQftHt+ivlcNK2cCzTAfBgNVHSMEGDAWgBRF 66Kv9JLLgjEtUYunpyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAhGFOQR64dgQqtbbvj/JV hbldVv4KmObkvWWKfUAp0/yxXUX9OrgqWzNLJFzNubTkc61hXXatdDOKZtUjr0wfcm5F2XVA u6I7z41JL8BBsOIpo1E4Q1CZFKwzBjViiX13qVIH5WwgV7aBum+8s8KU7XYCgNl8zoWoHOzH Q0pLsVfPcs7f9SU8yyJP/Z9S0TfLCLs4PuDVPm95Ca1bfDGzdzXD5GP5aAqYB+dGOHeE0j6X vAqgqKwlT0RukeHSWq9r7zAcjaNEQrMQiyP61+Y1dDesz+urWB/JiCP/NtQH6jRqR+qdlWye KU9T7eMrlSBOKs+WYHr4LIDwlVLOKZaBYjCCA7cwggKfoAMCAQICEAzn4OUX2Eb+j+Vg/Bvw MDkwDQYJKoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IElu YzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJl ZCBJRCBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowZTELMAkGA1UE BhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNv bTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMIIBIjANBgkqhkiG9w0B AQEFAAOCAQ8AMIIBCgKCAQEArQ4VzuRDgFyxh/O3YPlxEqWu3CaUiKr0zvUgOShYYAz4gNqp FZUyYTy1sSiEiorcnwoMgxd6j5Csiud5U1wxhCr2D5gyNnbM3t08qKLvavsh8lJh358g1x/i sdn+GGTSEltf+VgYNbxHzaE2+Wt/1LA4PsEbw4wz2dgvGP4oD7Ong9bDbkTAYTWWFv5ZnIt2 bdfxoksNK/8LctqeYNCOkDXGeFWHIKHP5W0KyEl8MZgzbCLph9AyWqK6E4IR7TkXnZk6cqHm +qTZ1Rcxda6FfSKuPwFGhvYoecix2uRXF8R+HA6wtJKmVrO9spftqqfwt8WoP5UW0P+hlusI Xxh3TwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E FgQUReuir/SSy4IxLVGLp6chnfNtyA8wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNt yA8wDQYJKoZIhvcNAQEFBQADggEBAKIOvN/i7fDjcnN6ZJS/93Jm2DLkQnVirofr8tXZ3laz n8zOFCi5DZdgXBJMWOTTPYNJRViXNWkaqEfqVsZ5qxLYZ4GE338JPJTmuCYsIL09syiJ91// IuKXhB/pZe+H4N/BZ0mzXeuyCSrrJu14vn0/K/O3JjVtX4kBtklbnwEFm6s9JcHMtn/C8W+G xvpkaOuBLZTrQrf6jB7dYvG+UGe3bL3z8R9rDDYHFn83fKlbbXrxEkZgg9cnBL5Lzpe+w2cq aBHfgOcMM2a/Ew0UbvN/H2MQHvqNGyVtbI+lt2EBsdKjJqEQcZ2t4sP5w5lRtysHCM4u5lCy p/oKRS+i8PIxggH8MIIB+AIBATB2MGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFz c3VyZWQgSUQgQ0EtMQIQD89pSVGbAJQ9+ZeKCcX9BTAJBgUrDgMCGgUAoF0wIwYJKoZIhvcN AQkEMRYEFIhrpYeTT8CEK93Zy8Hv5KEAH+e2MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw HAYJKoZIhvcNAQkFMQ8XDTEzMDgxMzAwNTU1OFowDQYJKoZIhvcNAQEBBQAEggEATIyX6jTH 7wn97U30dgscSpfPMJNz98Em2a+LnkdeK6cP2OAPZA6Un5/oSFwJN5uxBjrQnKCf+GBAbjeI QvuTgTSTMJz0LMdvyxcWswu6L9Tts6odU1m5jzDNAoL6aCDe7u1aplbfnz3k3IgyugOce6km ZU1qupU0AbYDCAskymAODI7TME7BNYOmKES3i3+W+9xm90j1cpfam3D02JxZUUAyylqM/0Hj wO3xHJEMDO4ilW8A9WskbttR2KFMMl19Ax4Nno1SfqVqnGkNYDUuaE6zroVcuohu4MihROFb vssSlq3Cn3QaYD/B6Iamhi4gU1jANzFKoE7Ji992jWsO2A== --B_3459236158_65058050-- From jaap@NLnetLabs.nl Mon Aug 19 02:32:46 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F8BB11E8224 for ; Mon, 19 Aug 2013 02:32:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.741 X-Spam-Level: X-Spam-Status: No, score=-0.741 tagged_above=-999 required=5 tests=[BAYES_20=-0.74, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D1wxe0S6c-4J for ; Mon, 19 Aug 2013 02:32:41 -0700 (PDT) Received: from bela.nlnetlabs.nl (bela.nlnetlabs.nl [IPv6:2001:7b8:206:1:222:4dff:fe55:4ccb]) by ietfa.amsl.com (Postfix) with ESMTP id 14A2511E822E for ; Mon, 19 Aug 2013 02:32:27 -0700 (PDT) Received: from bela.nlnetlabs.nl (localhost [IPv6:::1]) by bela.nlnetlabs.nl (8.14.7/8.14.7) with ESMTP id r7J9WOB6036190; Mon, 19 Aug 2013 11:32:25 +0200 (CEST) (envelope-from jaap@NLnetLabs.nl) Authentication-Results: bela.nlnetlabs.nl; dmarc=none header.from=NLnetLabs.nl Message-Id: <201308190932.r7J9WOB6036190@bela.nlnetlabs.nl> To: Tim Wicinski From: Jaap Akkerhuis In-reply-to: <51FB86AA.7030500@teamaol.com> References: <51FB86AA.7030500@teamaol.com> Comments: In-reply-to Tim Wicinski message dated "Fri, 02 Aug 2013 12:15:06 +0200." Date: Mon, 19 Aug 2013 11:32:24 +0200 X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.4.3 (bela.nlnetlabs.nl [IPv6:::1]); Mon, 19 Aug 2013 11:32:26 +0200 (CEST) Cc: dnsop WG Subject: Re: [DNSOP] Draft DNSOP Meeting Minutes X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2013 09:32:46 -0000 Hi Draft minutes from Thursday meeting are available http://www.ietf.org/proceedings/87/minutes/minutes-87-dnsop . Please let the chairs know if find something incorrectly recorded. Thanks to Olaf for the note taking. tim _______________________________________________ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop From jaap@NLnetLabs.nl Mon Aug 19 02:34:11 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 69CBA11E822B for ; Mon, 19 Aug 2013 02:34:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.671 X-Spam-Level: X-Spam-Status: No, score=-1.671 tagged_above=-999 required=5 tests=[AWL=0.929, BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1v7fqMcLupPf for ; Mon, 19 Aug 2013 02:34:06 -0700 (PDT) Received: from bela.nlnetlabs.nl (bela.nlnetlabs.nl [IPv6:2001:7b8:206:1:222:4dff:fe55:4ccb]) by ietfa.amsl.com (Postfix) with ESMTP id DB9F111E8223 for ; Mon, 19 Aug 2013 02:34:04 -0700 (PDT) Received: from bela.nlnetlabs.nl (localhost [IPv6:::1]) by bela.nlnetlabs.nl (8.14.7/8.14.7) with ESMTP id r7J9Y266036666; Mon, 19 Aug 2013 11:34:02 +0200 (CEST) (envelope-from jaap@NLnetLabs.nl) Authentication-Results: bela.nlnetlabs.nl; dmarc=none header.from=NLnetLabs.nl Message-Id: <201308190934.r7J9Y266036666@bela.nlnetlabs.nl> To: Tim Wicinski From: Jaap Akkerhuis In-reply-to: <51FB86AA.7030500@teamaol.com> References: <51FB86AA.7030500@teamaol.com> Comments: In-reply-to Tim Wicinski message dated "Fri, 02 Aug 2013 12:15:06 +0200." Date: Mon, 19 Aug 2013 11:34:02 +0200 X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.4.3 (bela.nlnetlabs.nl [IPv6:::1]); Mon, 19 Aug 2013 11:34:03 +0200 (CEST) Cc: dnsop WG Subject: Re: [DNSOP] Draft DNSOP Meeting Minutes X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2013 09:34:11 -0000 (Oops, mail escaped too early, new trial). Draft minutes from Thursday meeting are available http://www.ietf.org/proceedings/87/minutes/minutes-87-dnsop . Please let the chairs know if find something incorrectly recorded. It incorrectly quotes me as stating that prefetching in unbound "is effective". What I really said is that experience learns that this is hardly effective. jaap From jabley@hopcount.ca Mon Aug 19 06:49:29 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0ADB11E8266 for ; Mon, 19 Aug 2013 06:49:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jQY24UnnvRQo for ; Mon, 19 Aug 2013 06:49:29 -0700 (PDT) Received: from mail-pa0-x22d.google.com (mail-pa0-x22d.google.com [IPv6:2607:f8b0:400e:c03::22d]) by ietfa.amsl.com (Postfix) with ESMTP id 0CEB211E827C for ; Mon, 19 Aug 2013 06:49:29 -0700 (PDT) Received: by mail-pa0-f45.google.com with SMTP id bg4so1731506pad.32 for ; Mon, 19 Aug 2013 06:49:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=KZkhlAWgS6YszB0KhafVm9G3vTt30rcxSmkXwwSELFo=; b=ja/fKRi110hn03Hnw9eE4xpHnXX5rPd26wSIEmuemtp99eCOuvKSdtsGneDxwdegu2 J0uPEkInVDkm9Hmdg9kc6/jCGsgsQptN3ZYc4nqK7w0kLP5dkGqDpuKahu5i3yVbFd3A nl4fVxr4CMkmwUpLzET4VDSu786d7eVJ4LgWU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=KZkhlAWgS6YszB0KhafVm9G3vTt30rcxSmkXwwSELFo=; b=mbFjKHo4aj3MNyFKxZG7b2pQOCnxBvc6/SdWHACjqrOY/3nRnQm3mQdQNCwtloxAvz /1nB3ahfQOD5uWG5HHrHpthh+ievxqBvPWBzXniRWtISGlPMNicDIq48+ANda12Lsl9a vW1PCuW7MaVP/KfOu9CcKfhidb+va8fjpFSN3Mz/mdctFw9mXBZZsqfy4ys7qD4mnK7M zkgpaOlm2n7/5aZ3U5BzrYjBWccaMlRr2nlDTlUWA+8iO1M0W/3PT+Y2S9AII8uiVyJZ UekXwXPcbEz0WpDg+dObyffO3hJvDqdk65DQJvx/j/nGC+8GKkncyZ3vUM8r4Tebn/jk rIBA== X-Gm-Message-State: ALoCoQk8b1hRb+TFpIM83Glkf3jbB3QJfxrzBUjfCoaIiIee9vI54u5CkfO4+T611Vbc6KiVwGDX X-Received: by 10.68.227.4 with SMTP id rw4mr1898661pbc.182.1376920168756; Mon, 19 Aug 2013 06:49:28 -0700 (PDT) Received: from [199.212.90.39] (198-84-196-106.cpe.teksavvy.com. [198.84.196.106]) by mx.google.com with ESMTPSA id iu7sm541812pbc.45.1969.12.31.16.00.00 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 19 Aug 2013 06:49:28 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) From: Joe Abley In-Reply-To: <51FB86AA.7030500@teamaol.com> Date: Mon, 19 Aug 2013 09:48:52 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <51FB86AA.7030500@teamaol.com> To: Tim Wicinski X-Mailer: Apple Mail (2.1508) Cc: dnsop WG Subject: Re: [DNSOP] Draft DNSOP Meeting Minutes X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2013 13:49:30 -0000 Hi Tim, Some small comments below. These are not suggested revisions to the = minutes, but rather points that derive from them. > 2.1) AS112 v2 Joint Discussion > draft-wkumari-dnsop-omniscient-as112 > draft-jabley-dnsop-as112-dname > Slides: http://tools.ietf.org/agenda/87/slides/slides-87-dnsop-0.pdf > Warren Kumari, Joe Abley >=20 > Warren cedes speaking to Joe.=20 >=20 > Problem statement: Zones are delegated to AS112 servers, but hard to = extend as operation is distributed and would create widespread lame = delegations. Joe suggested adding DNAME which would fix the downstream = requirements, but raises the larger question of whether DNAME is = suitable for production?=20 >=20 > Next Steps: > Experiment with DNAME first, then test DNAME in production > If this runs into problems, fall back to the Omniscenet-AS112 as = Plan B >=20 > Suggestion is to adopt both documents in the WG, proceed in parallel. >=20 > Chair asks room for adopting both documents, show of hands confirms WG = wants both documents to move forward at this tim. This is my recollection of the outcome of that discussion, but = subsequent (off-list) discussion suggests that the chairs' recollection = is that the working group agreed to adopt "the issue", and to defer = adoption of the documents until clarity on the practicality of the DNAME = approach is achieved. I'm happy either way (I'm not sure I understand what "wg adopts an = issue" means, however) but it seems reasonable to ask the Chairs to (a) = clarify, and (b) ask the list what people want. > 3.4a) Flushing DNS Caches > draft-jabley-dnsop-dns-flush-00 > Slides: http://tools.ietf.org/agenda/87/slides/slides-87-dnsop-8.pdf > Joe Abley >=20 > A different take on the cache flushing problem. He mentions some TLDs = which published incorrect zone information with long TTLs and caused = user outages. Equates this to a "Big Panic Button". Talks about doing = this using Notify on resolvers since that behavior has never been = defined.=20 >=20 > Lots of people jumping into line with comments.=20 > Antion: How is this scaleable?=20 > PaulW: Scary censor ship > Warren: Likes > Johan: Your worst idea, only helps the bad operators=20 I think the phrase was "this is the worst idea I have ever heard of". = :-) > Roy: Wants a button as it is but thinks the problem is complex, and = not sure it is this right button=20 >=20 > Frank Martin: This will happen more often,=20 > Dan York: relaying MarkA,=20 >=20 > Peter Koch poses the questions to the group:=20 > 1. Is the problem worth pursuing? yes: strong, no: medium=20 > 2. Should we adopt this approach: yes: weak no: stronger=20 >=20 > Action is to let this fester for now, may revisit.=20 Warren and I have started discussing next steps. Our thought is to start = with a problem statement and some working requirements, and then to = think about solutions. If others are interested in helping to frame the = question (with the goal of bringing the results to the working group for = discussion) please let one of us know. Joe= From wwwrun@rfc-editor.org Wed Aug 21 03:37:40 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA06811E81BA for ; Wed, 21 Aug 2013 03:37:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.275 X-Spam-Level: X-Spam-Status: No, score=-102.275 tagged_above=-999 required=5 tests=[AWL=0.325, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OEFYjt8uTtnt for ; Wed, 21 Aug 2013 03:37:40 -0700 (PDT) Received: from rfc-editor.org (unknown [IPv6:2001:1890:123a::1:2f]) by ietfa.amsl.com (Postfix) with ESMTP id 16D1111E8128 for ; Wed, 21 Aug 2013 03:37:40 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 83B69B1E004; Wed, 21 Aug 2013 03:32:51 -0700 (PDT) To: olaf@nlnetlabs.nl, matthijs@nlnetlabs.nl, miek.gieben@sidn.nl, bclaise@cisco.com, joelja@bogus.com, tim.wicinski@teamaol.com, pk@ISOC.DE From: RFC Errata System Message-Id: <20130821103251.83B69B1E004@rfc-editor.org> Date: Wed, 21 Aug 2013 03:32:51 -0700 (PDT) Cc: dnsop@ietf.org, karolwendt@gmail.com, rfc-editor@rfc-editor.org Subject: [DNSOP] [Technical Errata Reported] RFC6781 (3706) X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2013 10:37:40 -0000 The following errata report has been submitted for RFC6781, "DNSSEC Operational Practices, Version 2". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=6781&eid=3706 -------------------------------------- Type: Technical Reported by: mateusz Section: tff Original Text ------------- Corrected Text -------------- Notes ----- Instructions: ------------- This errata is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party (IESG) can log in to change the status and edit the report, if necessary. -------------------------------------- RFC6781 (draft-ietf-dnsop-rfc4641bis-13) -------------------------------------- Title : DNSSEC Operational Practices, Version 2 Publication Date : December 2012 Author(s) : O. Kolkman, W. Mekking, R. Gieben Category : INFORMATIONAL Source : Domain Name System Operations Area : Operations and Management Stream : IETF Verifying Party : IESG From wwwrun@rfc-editor.org Wed Aug 21 03:38:16 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D81911E838E for ; Wed, 21 Aug 2013 03:38:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.289 X-Spam-Level: X-Spam-Status: No, score=-102.289 tagged_above=-999 required=5 tests=[AWL=0.311, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MoNViNBK70ie for ; Wed, 21 Aug 2013 03:38:13 -0700 (PDT) Received: from rfc-editor.org (unknown [IPv6:2001:1890:123a::1:2f]) by ietfa.amsl.com (Postfix) with ESMTP id E36DB11E81FE for ; Wed, 21 Aug 2013 03:38:13 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id EA4C48E018; Wed, 21 Aug 2013 03:33:24 -0700 (PDT) To: olaf@nlnetlabs.nl, matthijs@nlnetlabs.nl, miek.gieben@sidn.nl, bclaise@cisco.com, joelja@bogus.com, tim.wicinski@teamaol.com, pk@ISOC.DE From: RFC Errata System Message-Id: <20130821103324.EA4C48E018@rfc-editor.org> Date: Wed, 21 Aug 2013 03:33:24 -0700 (PDT) Cc: dnsop@ietf.org, karolwendt@gmail.com, rfc-editor@rfc-editor.org Subject: [DNSOP] [Technical Errata Reported] RFC6781 (3707) X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2013 10:38:16 -0000 The following errata report has been submitted for RFC6781, "DNSSEC Operational Practices, Version 2". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=6781&eid=3707 -------------------------------------- Type: Technical Reported by: mateusz Section: fdgh Original Text ------------- Corrected Text -------------- Notes ----- Gdg Instructions: ------------- This errata is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party (IESG) can log in to change the status and edit the report, if necessary. -------------------------------------- RFC6781 (draft-ietf-dnsop-rfc4641bis-13) -------------------------------------- Title : DNSSEC Operational Practices, Version 2 Publication Date : December 2012 Author(s) : O. Kolkman, W. Mekking, R. Gieben Category : INFORMATIONAL Source : Domain Name System Operations Area : Operations and Management Stream : IETF Verifying Party : IESG From arusso@amsl.com Wed Aug 21 08:04:38 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9EA8F11E8236 for ; Wed, 21 Aug 2013 08:04:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kewqCVbPqcu4 for ; Wed, 21 Aug 2013 08:04:34 -0700 (PDT) Received: from mail.amsl.com (mail.amsl.com [64.170.98.21]) by ietfa.amsl.com (Postfix) with ESMTP id 0DF1211E8223 for ; Wed, 21 Aug 2013 08:04:34 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by c9a.amsl.com (Postfix) with ESMTP id 34E52A61C1; Wed, 21 Aug 2013 08:04:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from c9a.amsl.com ([127.0.0.1]) by localhost (c9a.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xa-SVIWwkaBr; Wed, 21 Aug 2013 08:04:23 -0700 (PDT) Received: from rfc2.home (pool-173-73-60-7.washdc.fios.verizon.net [173.73.60.7]) by c9a.amsl.com (Postfix) with ESMTPSA id 19F04A6146; Wed, 21 Aug 2013 08:04:22 -0700 (PDT) Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: text/plain; charset=us-ascii From: Alice Russo In-Reply-To: <20130821103251.83B69B1E004@rfc-editor.org> Date: Wed, 21 Aug 2013 11:04:32 -0400 Content-Transfer-Encoding: 7bit Message-Id: References: <20130821103251.83B69B1E004@rfc-editor.org> To: RFC Editor X-Mailer: Apple Mail (2.1085) X-Mailman-Approved-At: Wed, 21 Aug 2013 08:15:45 -0700 Cc: matthijs@nlnetlabs.nl, dnsop@ietf.org, joel jaeggli , pk@ISOC.DE, miek.gieben@sidn.nl, Benoit Claise , tim.wicinski@teamaol.com Subject: Re: [DNSOP] [Technical Errata Reported] RFC6781 (3706) X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2013 15:04:38 -0000 FYI, this has been removed because it is junk. Thank you. RFC Editor/ar On Aug 21, 2013, at 6:32 AM, RFC Errata System wrote: > The following errata report has been submitted for RFC6781, > "DNSSEC Operational Practices, Version 2". > > -------------------------------------- > You may review the report below and at: > http://www.rfc-editor.org/errata_search.php?rfc=6781&eid=3706 > > -------------------------------------- > Type: Technical > Reported by: mateusz > > Section: tff > > Original Text > ------------- > > > Corrected Text > -------------- > > > Notes > ----- > > > Instructions: > ------------- > This errata is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party (IESG) > can log in to change the status and edit the report, if necessary. > > -------------------------------------- > RFC6781 (draft-ietf-dnsop-rfc4641bis-13) > -------------------------------------- > Title : DNSSEC Operational Practices, Version 2 > Publication Date : December 2012 > Author(s) : O. Kolkman, W. Mekking, R. Gieben > Category : INFORMATIONAL > Source : Domain Name System Operations > Area : Operations and Management > Stream : IETF > Verifying Party : IESG > From arusso@amsl.com Wed Aug 21 08:04:41 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9184111E8236 for ; Wed, 21 Aug 2013 08:04:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bPuFO184V3KS for ; Wed, 21 Aug 2013 08:04:41 -0700 (PDT) Received: from mail.amsl.com (mail.amsl.com [IPv6:2001:1890:126c::1:15]) by ietfa.amsl.com (Postfix) with ESMTP id 36EA711E8223 for ; Wed, 21 Aug 2013 08:04:41 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by c9a.amsl.com (Postfix) with ESMTP id 5D116A6146; Wed, 21 Aug 2013 08:04:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from c9a.amsl.com ([127.0.0.1]) by localhost (c9a.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xaq9WBJyVarp; Wed, 21 Aug 2013 08:04:30 -0700 (PDT) Received: from rfc2.home (pool-173-73-60-7.washdc.fios.verizon.net [173.73.60.7]) by c9a.amsl.com (Postfix) with ESMTPSA id 4518FA61CD; Wed, 21 Aug 2013 08:04:29 -0700 (PDT) Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: text/plain; charset=us-ascii From: Alice Russo In-Reply-To: <20130821103324.EA4C48E018@rfc-editor.org> Date: Wed, 21 Aug 2013 11:04:39 -0400 Content-Transfer-Encoding: 7bit Message-Id: <138A75EE-5327-4700-932B-7EBA2232AABA@amsl.com> References: <20130821103324.EA4C48E018@rfc-editor.org> To: RFC Editor X-Mailer: Apple Mail (2.1085) X-Mailman-Approved-At: Wed, 21 Aug 2013 08:15:47 -0700 Cc: matthijs@nlnetlabs.nl, dnsop@ietf.org, joel jaeggli , pk@ISOC.DE, miek.gieben@sidn.nl, Benoit Claise , tim.wicinski@teamaol.com Subject: Re: [DNSOP] [Technical Errata Reported] RFC6781 (3707) X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2013 15:04:41 -0000 FYI, this has been removed because it is junk. Thank you. RFC Editor/ar On Aug 21, 2013, at 6:33 AM, RFC Errata System wrote: > The following errata report has been submitted for RFC6781, > "DNSSEC Operational Practices, Version 2". > > -------------------------------------- > You may review the report below and at: > http://www.rfc-editor.org/errata_search.php?rfc=6781&eid=3707 > > -------------------------------------- > Type: Technical > Reported by: mateusz > > Section: fdgh > > Original Text > ------------- > > > Corrected Text > -------------- > > > Notes > ----- > Gdg > > Instructions: > ------------- > This errata is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party (IESG) > can log in to change the status and edit the report, if necessary. > > -------------------------------------- > RFC6781 (draft-ietf-dnsop-rfc4641bis-13) > -------------------------------------- > Title : DNSSEC Operational Practices, Version 2 > Publication Date : December 2012 > Author(s) : O. Kolkman, W. Mekking, R. Gieben > Category : INFORMATIONAL > Source : Domain Name System Operations > Area : Operations and Management > Stream : IETF > Verifying Party : IESG > From jabley@hopcount.ca Tue Aug 27 14:57:20 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2A6C21F9D95 for ; Tue, 27 Aug 2013 14:57:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.449 X-Spam-Level: X-Spam-Status: No, score=-102.449 tagged_above=-999 required=5 tests=[AWL=0.150, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vU8IqE35t48L for ; Tue, 27 Aug 2013 14:57:20 -0700 (PDT) Received: from mail-qc0-x233.google.com (mail-qc0-x233.google.com [IPv6:2607:f8b0:400d:c01::233]) by ietfa.amsl.com (Postfix) with ESMTP id 4F0AC21F9D99 for ; Tue, 27 Aug 2013 14:57:15 -0700 (PDT) Received: by mail-qc0-f179.google.com with SMTP id n7so1891899qcx.38 for ; Tue, 27 Aug 2013 14:56:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:content-type:content-transfer-encoding:subject:date:references :to:message-id:mime-version; bh=qRPTYgsbjzm+hWw1YmomEbatUv+ON8SdGyO40HtZPfE=; b=mHLQLHhjvR5ITH4z3E01mdJ/D8maUsPUfNSJNsX0cNwR21XpUHwqeGVcIpXo3jvvM4 c1xGI1rXPS6bqOItpJQk+n8sl3JuCcsy3eF7Os6QWFuAVsJaVdI8NH1nh0bfJkhpWOg3 O1+ovzPjXDnTByO0S/3R5i4zHsxHWS0qn9xSE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-gm-message-state:from:content-type:content-transfer-encoding :subject:date:references:to:message-id:mime-version; bh=qRPTYgsbjzm+hWw1YmomEbatUv+ON8SdGyO40HtZPfE=; b=JEYe5u1b+jypLSXYSAaEIzpnHsp2eZpFeVWQxsNS9xx8TBzoiJ3+2je92oQeeNfaCQ gKAnImY+lR13HOEc8+ENwogTfm4htW9P7i6sH3dMZXO66nuM43sVJpwmnoafqnE7QyY4 vTKxTFM5mBhwI162DeLK4LG+BcDPE7osrL/8JQ6ZYBncOfZVuZ5I2fp2VSkXwBNla+4U KQcBhJfJ0D7zPsr73VInt2yin/IGYG5v40XXJ9k+A+wAtzMCXPQ4BITlo1xPcTbijR2G TXn6IrC6xpidqu+/j9h4lErz7c5jR+EB3sus0ISYXIII1dOWJbiP5Mno3h9NJA7NdIcU vlSw== X-Gm-Message-State: ALoCoQlnt4Qgqy2EtRyZGuBWU/ApTbi3nCAyeyclq39riGcnaDaizCszYAmFVLGKG8vpxRLhL2+F X-Received: by 10.224.60.71 with SMTP id o7mr16052396qah.71.1377640613448; Tue, 27 Aug 2013 14:56:53 -0700 (PDT) Received: from [199.212.90.52] ([135.23.68.78]) by mx.google.com with ESMTPSA id y6sm32206116qaj.11.1969.12.31.16.00.00 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 Aug 2013 14:56:52 -0700 (PDT) From: Joe Abley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Tue, 27 Aug 2013 17:56:55 -0400 References: <731c2e320281011513df391ce28788eb@127.0.0.1> To: dnsop WG Message-Id: <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca> Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) X-Mailer: Apple Mail (2.1508) Subject: [DNSOP] wouldn't it be nice if there was an automatic mechanism to help with this? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Aug 2013 21:57:20 -0000 Just saying :-) Begin forwarded message: > From: "david@from525.com" > Subject: [dns-operations] Request To Clear Cache: NYTimes.com > Date: 27 August 2013 17:55:19 EDT > To: > Reply-To: david@from525.com > > All, > > I am a DNS Administrator at NYTimes.com. Earlier today we had issues with > our registrar updating our NS records on the root servers to a malicious > site. The registrar has since locked our domain with the registry on our > proper Name Servers. We have had reports that the malicious site that our > domain was redirected to was infecting users with malware. It would be a > great service to the internet if everyone could please clear their cache > for NYTimes.com. I understand that several other large websites/domains > are experience the same thing. I would not be surprised if several request > like this come in over the list today. > > Thanks, > David Porsche > Systems Administrator > The New York Times > _______________________________________________ > dns-operations mailing list > dns-operations@lists.dns-oarc.net > https://lists.dns-oarc.net/mailman/listinfo/dns-operations > dns-jobs mailing list > https://lists.dns-oarc.net/mailman/listinfo/dns-jobs From tim.wicinski@teamaol.com Tue Aug 27 15:03:52 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D444811E8236 for ; Tue, 27 Aug 2013 15:03:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aFjxCTHfk1Pb for ; Tue, 27 Aug 2013 15:03:48 -0700 (PDT) Received: from omr-d01.mx.aol.com (omr-d01.mx.aol.com [205.188.252.208]) by ietfa.amsl.com (Postfix) with ESMTP id BC62321E8099 for ; Tue, 27 Aug 2013 15:03:46 -0700 (PDT) Received: from AOLDTCMEI33.ad.aol.aoltw.net (aoldtcmei33-redir.office.aol.com [10.180.121.156]) by omr-d01.mx.aol.com (Outbound Mail Relay) with ESMTP id 2D9EE70000097; Tue, 27 Aug 2013 18:03:46 -0400 (EDT) Received: from still.local (172.17.8.193) by AOLDTCMEI33.ad.aol.aoltw.net (10.180.121.160) with Microsoft SMTP Server id 14.3.123.3; Tue, 27 Aug 2013 18:03:45 -0400 Message-ID: <521D2241.4050805@teamaol.com> Date: Tue, 27 Aug 2013 18:03:45 -0400 From: Tim Wicinski User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Thunderbird/24.0 MIME-Version: 1.0 To: Joe Abley , dnsop WG References: <731c2e320281011513df391ce28788eb@127.0.0.1> <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca> In-Reply-To: <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca> Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [172.17.8.193] Subject: Re: [DNSOP] wouldn't it be nice if there was an automatic mechanism to help with this? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Aug 2013 22:03:53 -0000 Joe Serendipity, as It appears they decided to apply the same process to one of our properties. tim On 8/27/13 5:56 PM, Joe Abley wrote: > Just saying :-) > > Begin forwarded message: > >> From: "david@from525.com" >> Subject: [dns-operations] Request To Clear Cache: NYTimes.com >> Date: 27 August 2013 17:55:19 EDT >> To: >> Reply-To: david@from525.com >> >> All, >> >> I am a DNS Administrator at NYTimes.com. Earlier today we had issues with >> our registrar updating our NS records on the root servers to a malicious >> site. The registrar has since locked our domain with the registry on our >> proper Name Servers. We have had reports that the malicious site that our >> domain was redirected to was infecting users with malware. It would be a >> great service to the internet if everyone could please clear their cache >> for NYTimes.com. I understand that several other large websites/domains >> are experience the same thing. I would not be surprised if several request >> like this come in over the list today. >> >> Thanks, >> David Porsche >> Systems Administrator >> The New York Times >> _______________________________________________ >> dns-operations mailing list >> dns-operations@lists.dns-oarc.net >> https://lists.dns-oarc.net/mailman/listinfo/dns-operations >> dns-jobs mailing list >> https://lists.dns-oarc.net/mailman/listinfo/dns-jobs > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop From sm@resistor.net Tue Aug 27 15:58:14 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85F0D21F9FD5 for ; Tue, 27 Aug 2013 15:58:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.516 X-Spam-Level: X-Spam-Status: No, score=-102.516 tagged_above=-999 required=5 tests=[AWL=0.083, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JR2Ovjh1pRG5 for ; Tue, 27 Aug 2013 15:58:13 -0700 (PDT) Received: from mx.ipv6.elandsys.com (mx.ipv6.elandsys.com [IPv6:2001:470:f329:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id CC54521F9FDA for ; Tue, 27 Aug 2013 15:58:12 -0700 (PDT) Received: from SUBMAN.resistor.net (IDENT:sm@localhost [127.0.0.1]) (authenticated bits=0) by mx.elandsys.com (8.14.5/8.14.5) with ESMTP id r7RMw4CL028659; Tue, 27 Aug 2013 15:58:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1377644289; bh=mPRChoRvu3qCJ/5ujOYoQdDKJ+OZs0KCiOSfH2ZR82w=; h=Date:To:From:Subject:Cc:In-Reply-To:References; b=3i6GDgUxao0ZKLx2LstHxpvR+NxrAMSqWAMBtUueLl2YHt9NKjz+1rvTn24miiZj+ L8jWQ2CpTyXWlnMgPyZ2kndNIsL74/gsSVHV2u5fkXK0uVQPCEe5zKKOjss8bUXZyU /795zcdX6s+UAsajHu0v36CdTGim+JApCGyVqpDA= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1377644289; i=@resistor.net; bh=mPRChoRvu3qCJ/5ujOYoQdDKJ+OZs0KCiOSfH2ZR82w=; h=Date:To:From:Subject:Cc:In-Reply-To:References; b=QLcbzIt12JJl0T81T0SvQem4x6R7dWseQiu2ef17yks8IBIOf7iWoeXNRtZgeGBSV PUOfaDrEdo0WQOggkMDsAPd4EnJxtsoNN0aYb301eikuDtoUaXlyWTziTo61JV3i5H PPfFrSNsc52vQfs0uyKVLUO/SDpa66ZCozPdxmvg= Message-Id: <6.2.5.6.2.20130827155214.0c5ef900@resistor.net> X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6 Date: Tue, 27 Aug 2013 15:53:37 -0700 To: Joe Abley From: SM In-Reply-To: <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca> References: <731c2e320281011513df391ce28788eb@127.0.0.1> <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Cc: dnsop@ietf.org Subject: Re: [DNSOP] wouldn't it be nice if there was an automatic mechanism to help with this? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Aug 2013 22:58:14 -0000 Hi Joe, At 14:56 27-08-2013, Joe Abley wrote: >Just saying :-) http://www.ietf.org/mail-archive/web/hybi/current/msg09174.html Regards, -sm From ietf@rozanak.com Wed Aug 28 00:01:34 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D97A11E8109 for ; Wed, 28 Aug 2013 00:01:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lgf8grHaTHCm for ; Wed, 28 Aug 2013 00:01:30 -0700 (PDT) Received: from mout.perfora.net (mout.perfora.net [74.208.4.195]) by ietfa.amsl.com (Postfix) with ESMTP id 6C08911E8147 for ; Wed, 28 Aug 2013 00:01:30 -0700 (PDT) Received: from oxuslxltgw06.lxa.perfora.net (oxuslxltgw06.lxa.perfora.net [172.19.206.8]) by mrelay.perfora.net (node=mrus4) with ESMTP (Nemesis) id 0MHXPg-1VBHy50Bn2-0047Zv; Wed, 28 Aug 2013 03:01:25 -0400 Date: Wed, 28 Aug 2013 03:01:24 -0400 (EDT) From: Hosnieh To: dnsop WG , Joe Abley Message-ID: <640728432.617331.1377673284710.open-xchange@email.1and1.com> In-Reply-To: <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca> References: <731c2e320281011513df391ce28788eb@127.0.0.1> <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_617330_1377137902.1377673284665" X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.2.2-Rev13 X-Provags-ID: V02:K0:FB3ncspyib2Pe4t0SypOzMaJ6KklETs91NySRinMnA2 0B3mL1dhue95fL/eo8glSFC4vmuGNlC8jE6VX/iyIzIorJhc32 aG0fFyG4u6rFH1GCPa0h/3xE0hnvaeEETYoMfDKW2kdecvZgua Ise7kbmbdaUyIuo9Z5kvSH4Iq0bZDddiJU9IyofZ+sfuSUZ9M6 ybnUi7y85LoLxjBpI8JyzqJJoT8rCeEe400DZ2QxoAv+I9m5S1 yO4Al2RYFP/lF9ZvRuJLj2ND9bzfo9fW6ledEmeg8qAdcLVTGj r6meabNI8o8NQnAoXvdFWk/5QyaWnyHDcnjAUixXaDuLTHrSOY mJnUynt3BsF0GMGd+hx34unLL+Biwd3HG7d+0Jv27kOKPVFuYF wGKYFuazQGRYFtyTIgSwhsqwSXKDer13y65rvRTFAc/KlVA8+F QXz0q Subject: Re: [DNSOP] wouldn't it be nice if there was an automatic mechanism to help with this? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Hosnieh List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Aug 2013 07:01:34 -0000 ------=_Part_617330_1377137902.1377673284665 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit I think this problem has a solution in IPv6, but I am not sure for IPv4. The current draft, cga-tsig proposed to automate the process of authentication of resolvers (DNS query resolution) and DNS servers (DNS update) in a secure manner. You can take a look on that draft. Best, Hosnieh > On August 27, 2013 at 5:56 PM Joe Abley wrote: > > > Just saying :-) > > Begin forwarded message: > > > From: "david@from525.com" > > Subject: [dns-operations] Request To Clear Cache: NYTimes.com > > Date: 27 August 2013 17:55:19 EDT > > To: > > Reply-To: david@from525.com > > > > All, > > > > I am a DNS Administrator at NYTimes.com. Earlier today we had issues with > > our registrar updating our NS records on the root servers to a malicious > > site. The registrar has since locked our domain with the registry on our > > proper Name Servers. We have had reports that the malicious site that our > > domain was redirected to was infecting users with malware. It would be a > > great service to the internet if everyone could please clear their cache > > for NYTimes.com. I understand that several other large websites/domains > > are experience the same thing. I would not be surprised if several request > > like this come in over the list today. > > > > Thanks, > > David Porsche > > Systems Administrator > > The New York Times > > _______________________________________________ > > dns-operations mailing list > > dns-operations@lists.dns-oarc.net > > https://lists.dns-oarc.net/mailman/listinfo/dns-operations > > dns-jobs mailing list > > https://lists.dns-oarc.net/mailman/listinfo/dns-jobs > > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop ------=_Part_617330_1377137902.1377673284665 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit
I think this problem has a solution in IPv6, but I am not sure for IPv4. The current draft, cga-tsig proposed to automate the process of authentication of resolvers (DNS query resolution) and DNS servers (DNS update) in a secure manner.
You can take a look on that draft.
 
Best,
Hosnieh

> On August 27, 2013 at 5:56 PM Joe Abley <jabley@hopcount.ca> wrote:
>
>
> Just saying :-)
>
> Begin forwarded message:
>
> > From: "david@from525.com" <david@from525.com>
> > Subject: [dns-operations] Request To Clear Cache: NYTimes.com
> > Date: 27 August 2013 17:55:19 EDT
> > To: <dns-operations@mail.dns-oarc.net>
> > Reply-To: david@from525.com
> >
> > All,
> >
> > I am a DNS Administrator at NYTimes.com. Earlier today we had issues with
> > our registrar updating our NS records on the root servers to a malicious
> > site. The registrar has since locked our domain with the registry on our
> > proper Name Servers. We have had reports that the malicious site that our
> > domain was redirected to was infecting users with malware. It would be a
> > great service to the internet if everyone could please clear their cache
> > for NYTimes.com. I understand that several other large websites/domains
> > are experience the same thing. I would not be surprised if several request
> > like this come in over the list today.
> >
> > Thanks,
> > David Porsche
> > Systems Administrator
> > The New York Times
> > _______________________________________________
> > dns-operations mailing list
> > dns-operations@lists.dns-oarc.net
> > https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> > dns-jobs mailing list
> > https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
>
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop
------=_Part_617330_1377137902.1377673284665-- From ietf@rozanak.com Wed Aug 28 00:03:28 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D95011E814F for ; Wed, 28 Aug 2013 00:03:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ycRxPa+FK1mm for ; Wed, 28 Aug 2013 00:03:23 -0700 (PDT) Received: from mout.perfora.net (mout.perfora.net [74.208.4.195]) by ietfa.amsl.com (Postfix) with ESMTP id 3337A11E814D for ; Wed, 28 Aug 2013 00:03:23 -0700 (PDT) Received: from oxuslxltgw06.lxa.perfora.net (oxuslxltgw06.lxa.perfora.net [172.19.206.8]) by mrelay.perfora.net (node=mrus4) with ESMTP (Nemesis) id 0LvlLA-1W6OoQ1sbs-017ra3; Wed, 28 Aug 2013 03:03:22 -0400 Date: Wed, 28 Aug 2013 03:03:22 -0400 (EDT) From: Hosnieh To: Joe Abley Message-ID: <61777604.617358.1377673402401.open-xchange@email.1and1.com> In-Reply-To: <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca> References: <731c2e320281011513df391ce28788eb@127.0.0.1> <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_617357_667945868.1377673402353" X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.2.2-Rev13 X-Provags-ID: V02:K0:kq/08r4WzSta+X2e4AiNz/JbkoJPrt9twAsVJJ2k3VY r0cNFR0DNEX/W0RbWS5dpZVVicO5WFjihPAiHpAqg0hjpuRjSO CEXhSnOthqTaaLNiijEAIQIHhIFS07KC6ia3d9lDHW5pxoyJ4X AXgYaw7LIKX5pgchKw2yBb+GO7zMwyDHrEaUHkWW1Cbn3HWMUv dCZbyU0h6+ryyb+rDQbAg6atC+DgYFQoYfl6imbZ/+F1kVHKmd CDlrAlsqdLEBK2+mnBTK7ZXUIXW0tdEpeYHv4DNm3Vi0+A63jP JK814maM4zFt28vbKboV4H5+7SfCCicYioTXb5vjfkcWo3yvLt B1+YpPLdxjr3WwF2pb45h71OQiWwNkOuMkVaFaxVLaHGwJf8R2 HybE3fQFQ4UMB7Z3NOZ7ajGc7MVBU5bRlY= Cc: dnsop WG Subject: Re: [DNSOP] wouldn't it be nice if there was an automatic mechanism to help with this? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Hosnieh List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Aug 2013 07:03:28 -0000 ------=_Part_617357_667945868.1377673402353 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Follow up, If you have a secure mechanism that does not allow attackers to do cache poisioning on the client's stub resolver, then this solve the problem of malicious websites as well. Best, Hosnieh ------=_Part_617357_667945868.1377673402353 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit
Follow up,
 
If you have a secure mechanism that does not allow attackers to do cache poisioning on the client's stub resolver, then this solve the problem of malicious websites as well.
 
Best,
Hosnieh
------=_Part_617357_667945868.1377673402353-- From dengguangqing@cnnic.cn Wed Aug 28 00:49:46 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FAD211E81A0 for ; Wed, 28 Aug 2013 00:49:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bKHOoAJUjXwG for ; Wed, 28 Aug 2013 00:49:42 -0700 (PDT) Received: from cnnic.cn (smtp.cnnic.cn [218.241.118.7]) by ietfa.amsl.com (Postfix) with SMTP id 181EF11E8158 for ; Wed, 28 Aug 2013 00:49:40 -0700 (PDT) X-EYOUMAIL-SMTPAUTH: dengguangqing@cnnic.cn Received: from unknown127.0.0.1 (HELO user-think) (127.0.0.1) by 127.0.0.1 with SMTP; Wed, 28 Aug 2013 15:49:30 +0800 Date: Wed, 28 Aug 2013 15:49:32 +0800 From: "Guangqing Deng" To: Hosnieh References: <731c2e320281011513df391ce28788eb@127.0.0.1> <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca>, <640728432.617331.1377673284710.open-xchange@email.1and1.com> X-Priority: 3 X-Has-Attach: no X-Mailer: Foxmail 7, 1, 2, 36[cn] Mime-Version: 1.0 Message-ID: <2013082815493182407827@cnnic.cn> Content-Type: multipart/alternative; boundary="----=_001_NextPart246416771441_=----" Cc: dnsop Subject: Re: [DNSOP] wouldn't it be nice if there was an automatic mechanism to help with this? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Aug 2013 07:49:46 -0000 This is a multi-part message in MIME format. ------=_001_NextPart246416771441_=---- Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 Q2dhLXRzaWcgYXBwcm9hY2ggY2FuIG1ha2Ugc3VyZSB0aGF0IHRoZSBjb250ZW50IHRyYW5zZmVy cmVkIGJldHdlZW4gcmVzb2x2ZXJzIGFuZCBETlMgc2VydmVycyBpcyBub3QgbWFsaWNpb3VzbHkg bW9kaWZpZWQgYnkgb3RoZXJzOyB3aGlsZSB0aGlzIGFwcHJvYWNoIGNhbm5vdCBwcmV2ZW50IHRo ZSBSZXNvdXJjZSBSZWNvcmQgKFJSKSBmcm9tIGJlaW5nIHdyb25nbHkgdXBkYXRlZCBieSB0aGUg cmVnaXN0cmFyIChuYW1lbHkgbWFuLW1hZGUgbWlzdGFrZXMpLiBUaGVuIGl0IHNlZW1zIHRoYXQg b25lIGtpbmQgb2YgUlIgY2hlY2tpbmcgdG9vbCAoZXNwZWNpYWxseSBmb3IgTlMgUlIpIGlzIG5l ZWRlZCBieSB0aGUgcmVnaXN0cmFyLCBhbmQgSSBhbSB3b25kZXJpbmcgdGhhdCBoYXZlIHRoZXJl IGJlZW4gYW55IHN1Y2ggdG9vbHMgYXZhaWxhYmxlIHlldD8gDQoNCg0KDQoNCkd1YW5ncWluZyBE ZW5nDQpDTk5JQyANCg0KRnJvbTogSG9zbmllaA0KRGF0ZTogMjAxMy0wOC0yOCAxNTowMQ0KVG86 IGRuc29wIFdHOyBKb2UgQWJsZXkNClN1YmplY3Q6IFJlOiBbRE5TT1BdIHdvdWxkbid0IGl0IGJl IG5pY2UgaWYgdGhlcmUgd2FzIGFuIGF1dG9tYXRpYyBtZWNoYW5pc20gdG8gaGVscCB3aXRoIHRo aXM/DQpJIHRoaW5rIHRoaXMgcHJvYmxlbSBoYXMgYSBzb2x1dGlvbiBpbiBJUHY2LCBidXQgSSBh bSBub3Qgc3VyZSBmb3IgSVB2NC4gVGhlIGN1cnJlbnQgZHJhZnQsIGNnYS10c2lnIHByb3Bvc2Vk IHRvIGF1dG9tYXRlIHRoZSBwcm9jZXNzIG9mIGF1dGhlbnRpY2F0aW9uIG9mIHJlc29sdmVycyAo RE5TIHF1ZXJ5IHJlc29sdXRpb24pIGFuZCBETlMgc2VydmVycyAoRE5TIHVwZGF0ZSkgaW4gYSBz ZWN1cmUgbWFubmVyLiANCllvdSBjYW4gdGFrZSBhIGxvb2sgb24gdGhhdCBkcmFmdC4gDQogDQpC ZXN0LCANCkhvc25pZWggDQoNCj4gT24gQXVndXN0IDI3LCAyMDEzIGF0IDU6NTYgUE0gSm9lIEFi bGV5IDxqYWJsZXlAaG9wY291bnQuY2E+IHdyb3RlOiANCj4gDQo+IA0KPiBKdXN0IHNheWluZyA6 LSkgDQo+IA0KPiBCZWdpbiBmb3J3YXJkZWQgbWVzc2FnZTogDQo+IA0KPiA+IEZyb206ICJkYXZp ZEBmcm9tNTI1LmNvbSIgPGRhdmlkQGZyb201MjUuY29tPiANCj4gPiBTdWJqZWN0OiBbZG5zLW9w ZXJhdGlvbnNdIFJlcXVlc3QgVG8gQ2xlYXIgQ2FjaGU6IE5ZVGltZXMuY29tIA0KPiA+IERhdGU6 IDI3IEF1Z3VzdCAyMDEzIDE3OjU1OjE5IEVEVCANCj4gPiBUbzogPGRucy1vcGVyYXRpb25zQG1h aWwuZG5zLW9hcmMubmV0PiANCj4gPiBSZXBseS1UbzogZGF2aWRAZnJvbTUyNS5jb20gDQo+ID4g DQo+ID4gQWxsLCANCj4gPiANCj4gPiBJIGFtIGEgRE5TIEFkbWluaXN0cmF0b3IgYXQgTllUaW1l cy5jb20uIEVhcmxpZXIgdG9kYXkgd2UgaGFkIGlzc3VlcyB3aXRoIA0KPiA+IG91ciByZWdpc3Ry YXIgdXBkYXRpbmcgb3VyIE5TIHJlY29yZHMgb24gdGhlIHJvb3Qgc2VydmVycyB0byBhIG1hbGlj aW91cyANCj4gPiBzaXRlLiBUaGUgcmVnaXN0cmFyIGhhcyBzaW5jZSBsb2NrZWQgb3VyIGRvbWFp biB3aXRoIHRoZSByZWdpc3RyeSBvbiBvdXIgDQo+ID4gcHJvcGVyIE5hbWUgU2VydmVycy4gV2Ug aGF2ZSBoYWQgcmVwb3J0cyB0aGF0IHRoZSBtYWxpY2lvdXMgc2l0ZSB0aGF0IG91ciANCj4gPiBk b21haW4gd2FzIHJlZGlyZWN0ZWQgdG8gd2FzIGluZmVjdGluZyB1c2VycyB3aXRoIG1hbHdhcmUu IEl0IHdvdWxkIGJlIGEgDQo+ID4gZ3JlYXQgc2VydmljZSB0byB0aGUgaW50ZXJuZXQgaWYgZXZl cnlvbmUgY291bGQgcGxlYXNlIGNsZWFyIHRoZWlyIGNhY2hlIA0KPiA+IGZvciBOWVRpbWVzLmNv bS4gSSB1bmRlcnN0YW5kIHRoYXQgc2V2ZXJhbCBvdGhlciBsYXJnZSB3ZWJzaXRlcy9kb21haW5z IA0KPiA+IGFyZSBleHBlcmllbmNlIHRoZSBzYW1lIHRoaW5nLiBJIHdvdWxkIG5vdCBiZSBzdXJw cmlzZWQgaWYgc2V2ZXJhbCByZXF1ZXN0IA0KPiA+IGxpa2UgdGhpcyBjb21lIGluIG92ZXIgdGhl IGxpc3QgdG9kYXkuIA0KPiA+IA0KPiA+IFRoYW5rcywgDQo+ID4gRGF2aWQgUG9yc2NoZSANCj4g PiBTeXN0ZW1zIEFkbWluaXN0cmF0b3IgDQo+ID4gVGhlIE5ldyBZb3JrIFRpbWVzIA0KPiA+IF9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIA0KPiA+IGRucy1v cGVyYXRpb25zIG1haWxpbmcgbGlzdCANCj4gPiBkbnMtb3BlcmF0aW9uc0BsaXN0cy5kbnMtb2Fy Yy5uZXQgDQo+ID4gaHR0cHM6Ly9saXN0cy5kbnMtb2FyYy5uZXQvbWFpbG1hbi9saXN0aW5mby9k bnMtb3BlcmF0aW9ucyANCj4gPiBkbnMtam9icyBtYWlsaW5nIGxpc3QgDQo+ID4gaHR0cHM6Ly9s aXN0cy5kbnMtb2FyYy5uZXQvbWFpbG1hbi9saXN0aW5mby9kbnMtam9icyANCj4gDQo+IF9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIA0KPiBETlNPUCBtYWls aW5nIGxpc3QgDQo+IEROU09QQGlldGYub3JnIA0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL2Ruc29wIA== ------=_001_NextPart246416771441_=---- Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable =EF=BB=BF
Cga-tsig approach can make sure that t= he=20 content transferred between resolvers and DNS servers is not maliciously=20 modified by others; while this approach cannot prevent the Resource Record= =20 (RR) from being wrongly updated by the registrar (namely man-made=20 mistakes). Then it seems that one kind of RR checking tool (especiall= y for=20 NS RR) is needed by the registrar, and I am wondering that have there been= any=20 such tools available yet? 
 

Guangqing=20 Deng
CNNIC 
 
From: Hosnieh
Date: 2013-08-28 15:01
To: dnsop WG; Joe Abley
Subject: Re: [DNSOP] wouldn't it be nice if there was an=20 automatic mechanism to help with this?
I think this problem has a solution in IPv6, but I am not sure for IP= v4.=20 The current draft, cga-tsig proposed to automate the process of authentica= tion=20 of resolvers (DNS query resolution) and DNS servers (DNS update) in a secu= re=20 manner.
You can take a look on that draft.
Best,
Hosnieh

> On August 27, 2013 at 5:56 PM Joe Abley <jabley@hopcount.= ca>=20 wrote:
>
>
> Just saying :-)
>
> Begin=20 forwarded message:
>
> > From: "david@from525.com"=20 <david@from525.com>
> > Subject: [dns-operations] Request = To=20 Clear Cache: NYTimes.com
> > Date: 27 August 2013 17:55:19 EDT=20
> > To: <dns-operations@mail.dns-oarc.net>
> >=20 Reply-To: david@from525.com
> >
> > All,
> >= =20
> > I am a DNS Administrator at NYTimes.com. Earlier today we ha= d=20 issues with
> > our registrar updating our NS records on the roo= t=20 servers to a malicious
> > site. The registrar has since locked = our=20 domain with the registry on our
> > proper Name Servers. We have= had=20 reports that the malicious site that our
> > domain was redirect= ed to=20 was infecting users with malware. It would be a
> > great servic= e to=20 the internet if everyone could please clear their cache
> > for=20 NYTimes.com. I understand that several other large websites/domains
&g= t; > are experience the same thing. I would not be surprised if several re= quest=20
> > like this come in over the list today.
> >
>= ; >=20 Thanks,
> > David Porsche
> > Systems Administrator >=20 > The New York Times
> >=20 _______________________________________________
> > dns-operatio= ns=20 mailing list
> > dns-operations@lists.dns-oarc.net
> >= =20 https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> >=20 dns-jobs mailing list
> >=20 https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
>
>=20 _______________________________________________
> DNSOP mailing lis= t=20
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dns= op=20
------=_001_NextPart246416771441_=------ From dengguangqing@cnnic.cn Wed Aug 28 01:03:43 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7B0A11E8165 for ; Wed, 28 Aug 2013 01:03:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JpTLsjEM-w4A for ; Wed, 28 Aug 2013 01:03:38 -0700 (PDT) Received: from cnnic.cn (smtp.cnnic.cn [218.241.118.7]) by ietfa.amsl.com (Postfix) with SMTP id 6D1C711E8160 for ; Wed, 28 Aug 2013 01:03:37 -0700 (PDT) X-EYOUMAIL-SMTPAUTH: dengguangqing@cnnic.cn Received: from unknown127.0.0.1 (HELO user-think) (127.0.0.1) by 127.0.0.1 with SMTP; Wed, 28 Aug 2013 16:03:35 +0800 Date: Wed, 28 Aug 2013 16:03:37 +0800 From: "Guangqing Deng" To: Hosnieh References: <731c2e320281011513df391ce28788eb@127.0.0.1> <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca>, <61777604.617358.1377673402401.open-xchange@email.1and1.com> X-Priority: 3 X-Has-Attach: no X-Mailer: Foxmail 7, 1, 2, 36[cn] Mime-Version: 1.0 Message-ID: <2013082816033700280731@cnnic.cn> Content-Type: multipart/alternative; boundary="----=_001_NextPart715580265011_=----" Cc: dnsop Subject: Re: [DNSOP] wouldn't it be nice if there was an automatic mechanism to help with this? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Aug 2013 08:03:44 -0000 This is a multi-part message in MIME format. ------=_001_NextPart715580265011_=---- Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 VXN1YWxseSwgRE5TU0VDIGNhbiBzdG9wIGNhY2hlIHBvaXNvbmluZyBhdHRhY2suIEFuZCBmb3Ig c3VjaCBldmVudCB3aGVyZSB0aGUgUmVzb3VyY2UgUmVjb3JkcyBhcmUgd3JvbmdseSB1cGRhdGVk LCBtYXliZSB0aGUgbWV0aG9kIHByb3ZpZGVkIGJ5IGRyYWZ0LWphYmxleS1kbnNvcC1kbnMtZmx1 c2gtMDAgaXMgdXNlZnVsIHRvIGZsdXNoIHRoZSBiYWQgcmVzb3VyY2UgcmVjb3JkcyBvbiByZWN1 cnNpdmUgRE5TIHNlcnZlcnMuDQoNCg0KDQoNCkd1YW5ncWluZyBEZW5nDQpDTk5JQyANCg0KRnJv bTogSG9zbmllaA0KRGF0ZTogMjAxMy0wOC0yOCAxNTowMw0KVG86IEpvZSBBYmxleQ0KQ0M6IGRu c29wIFdHDQpTdWJqZWN0OiBSZTogW0ROU09QXSB3b3VsZG4ndCBpdCBiZSBuaWNlIGlmIHRoZXJl IHdhcyBhbiBhdXRvbWF0aWMgbWVjaGFuaXNtIHRvIGhlbHAgd2l0aCB0aGlzPw0KRm9sbG93IHVw LCANCiANCklmIHlvdSBoYXZlIGEgc2VjdXJlIG1lY2hhbmlzbSB0aGF0IGRvZXMgbm90IGFsbG93 IGF0dGFja2VycyB0byBkbyBjYWNoZSBwb2lzaW9uaW5nIG9uIHRoZSBjbGllbnQncyBzdHViIHJl c29sdmVyLCB0aGVuIHRoaXMgc29sdmUgdGhlIHByb2JsZW0gb2YgbWFsaWNpb3VzIHdlYnNpdGVz IGFzIHdlbGwuIA0KIA0KQmVzdCwgDQpIb3NuaWVoIA== ------=_001_NextPart715580265011_=---- Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable =EF=BB=BF
Usually, DNSSEC can stop cache poisoni= ng=20 attack. And for such event where the Resource Records are wrongly updated,= =20 maybe the method provided by draft-jabley-dnsop-dns-flush-00 is = useful=20 to flush the bad resource records on recursive DNS servers.
 

Guangqing=20 Deng
CNNIC 
 
From: Hosnieh
Date: 2013-08-28 15:03
To: Joe Abley
Subject: Re: [DNSOP] wouldn't it be nice if there was an=20 automatic mechanism to help with this?
Follow up,
If you have a secure mechanism that does not allow attackers to do ca= che=20 poisioning on the client's stub resolver, then this solve the problem of=20 malicious websites as well.
Best,
Hosnieh
------=_001_NextPart715580265011_=------ From ietf@rozanak.com Wed Aug 28 07:53:07 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1ADE611E81F7 for ; Wed, 28 Aug 2013 07:53:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.298 X-Spam-Level: X-Spam-Status: No, score=-2.298 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, HTML_MESSAGE=0.001, J_CHICKENPOX_72=0.6] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6CMMQF98TaVp for ; Wed, 28 Aug 2013 07:53:02 -0700 (PDT) Received: from mout.perfora.net (mout.perfora.net [74.208.4.195]) by ietfa.amsl.com (Postfix) with ESMTP id 03BD411E81DB for ; Wed, 28 Aug 2013 07:53:01 -0700 (PDT) Received: from oxuslxltgw08.lxa.perfora.net (oxuslxltgw08.lxa.perfora.net [172.19.206.10]) by mrelay.perfora.net (node=mrus3) with ESMTP (Nemesis) id 0LqQjB-1VjvGl2RsX-00eJIQ; Wed, 28 Aug 2013 10:52:58 -0400 Date: Wed, 28 Aug 2013 10:52:58 -0400 (EDT) From: Hosnieh To: Guangqing Deng Message-ID: <2126786214.636445.1377701578329.open-xchange@email.1and1.com> In-Reply-To: <2013082815493182407827@cnnic.cn> References: <731c2e320281011513df391ce28788eb@127.0.0.1> <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca>, <640728432.617331.1377673284710.open-xchange@email.1and1.com> <2013082815493182407827@cnnic.cn> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_636444_1380456985.1377701578282" X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.2.2-Rev13 X-Provags-ID: V02:K0:R1DpraRUwtjSlwTMgz6rdkTPC8WW0/sccV/x8Gd97qg uAyNtff1WYcYB/fFYNLdhCD40YNU6K5a6OHjEEEznqfwhgIMSP zLaNKWYSGWLuzNSePndrBF9Yzjrh43rVqyxudtgeBc6xk1FIJ6 UnFnxRpKMg+XyJjhPpP3I43TwndAZXzSFtx4cRhmp3BFgtA7Ol FtyDqYj2w4VGrva5A7HUvy88TjB3jgARM14I7rbi2bAy3lz3Sb yY83ZJVrN7iRUJu3WPSxUrZ+FWMAUkYEM7gSX7U8So3Rw/ukOA ZVpcp0ZRJbp8g3yRJkRWcR69mIjxNZPAAF10JKfZuYlo9M3k82 jZpyBCV2jT55GnkQIMVyDtuIkPt1F+aaCt2WUc3CMobY4trr5s 0tnNL0jUWWXFA+Ne4fGpgqvpbsXU9bXl9+zRuModMusdF8F0yV unStl Cc: dnsop Subject: Re: [DNSOP] wouldn't it be nice if there was an automatic mechanism to help with this? X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Hosnieh List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Aug 2013 14:53:07 -0000 ------=_Part_636444_1380456985.1377701578282 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit It can provide that as well if you configure your DNS server with a list of authorized IP addresses for certain zones. In other words, you let your DNS server know from which IP addresses it can accept updates for a particular zone. In this case, CGA-TSIG can be helpful,as well, as it can provide the proof of address ownership for the node so that DNS servers will only accept updates from the ones whom it is sure are the owner of that IP address. This is also possible after the node chaning its IP address. Then this process is automatic and no need for any further manual configurations. Thanks, Best, Hosnieh > On August 28, 2013 at 3:49 AM Guangqing Deng wrote: > > Cga-tsig approach can make sure that the content transferred between > resolvers and DNS servers is not maliciously modified by others; while this > approach cannot prevent the Resource Record (RR) from being wrongly updated by > the registrar (namely man-made mistakes). Then it seems that one kind of RR > checking tool (especially for NS RR) is needed by the registrar, and I am > wondering that have there been any such tools available yet? > ------=_Part_636444_1380456985.1377701578282 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable =20 =20 =20
It can provide that as well if you co= nfigure your DNS server with a list of authorized IP addresses for certain = zones. In other words, you let your DNS server know from which IP addresses= it can accept updates for a particular zone. In this case, CGA-TSIG can be= helpful,as well, as it can provide the proof of address ownership for the = node so that DNS servers will only accept updates from the ones whom it is = sure are the owner of that IP address. This is also possible after the node= chaning its IP address. Then this process is automatic and no need for any= further manual configurations.
=20

Thanks,
=20
Best,
=20
Hosnieh
=20
 
=20
 
=20
 
=20
On August 28, 2013 at 3:49 AM Guangqing Deng <dengguangqing@cnnic.cn= > wrote:

=20
Cga-tsig approach can make sure that the content transferred between re= solvers and DNS servers is not maliciously modified by others; while this a= pproach cannot prevent the Resource Record (RR) from being wrongly upd= ated by the registrar (namely man-made mistakes). Then it seems that o= ne kind of RR checking tool (especially for NS RR) is needed by the registr= ar, and I am wondering that have there been any such tools available yet?&#= 160;
=20
=20
 
=20 ------=_Part_636444_1380456985.1377701578282-- From nweaver@icsi.berkeley.edu Wed Aug 28 08:15:50 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FA4811E80FA for ; Wed, 28 Aug 2013 08:15:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_24=0.6] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zo1GRH-X8So9 for ; Wed, 28 Aug 2013 08:15:45 -0700 (PDT) Received: from rock.ICSI.Berkeley.EDU (rock.ICSI.Berkeley.EDU [192.150.186.19]) by ietfa.amsl.com (Postfix) with ESMTP id C981821F9F8E for ; Wed, 28 Aug 2013 08:15:45 -0700 (PDT) Received: from localhost (localhost.localdomain [127.0.0.1]) by rock.ICSI.Berkeley.EDU (Postfix) with ESMTP id 9A7F62C402F for ; Wed, 28 Aug 2013 08:15:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at ICSI.Berkeley.EDU Received: from rock.ICSI.Berkeley.EDU ([127.0.0.1]) by localhost (maihub.ICSI.Berkeley.EDU [127.0.0.1]) (amavisd-new, port 10024) with LMTP id Cj6I1zUNEJIa; Wed, 28 Aug 2013 08:15:45 -0700 (PDT) Received: from gala.icir.org (gala [192.150.187.49]) (Authenticated sender: nweaver) by rock.ICSI.Berkeley.EDU (Postfix) with ESMTP id 35BE42C4002; Wed, 28 Aug 2013 08:15:45 -0700 (PDT) Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) Content-Type: multipart/signed; boundary="Apple-Mail=_9679FE61-54B4-471B-ABD9-54413F0D2FB9"; protocol="application/pgp-signature"; micalg=pgp-sha512 From: Nicholas Weaver X-Priority: 3 In-Reply-To: <2126786214.636445.1377701578329.open-xchange@email.1and1.com> Date: Wed, 28 Aug 2013 08:15:44 -0700 Message-Id: <6B89A582-B4FF-4BA6-85FB-A6B2E7CA5C1E@icsi.berkeley.edu> References: <731c2e320281011513df391ce28788eb@127.0.0.1> <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca>, <640728432.617331.1377673284710.open-xchange@email.1and1.com> <2013082815493182407827@cnnic.cn> <2126786214.636445.1377701578329.open-xchange@email.1and1.com> To: dnsop X-Mailer: Apple Mail (2.1508) Cc: Nicholas Weaver Subject: [DNSOP] SEA DNS w DNSSEC Hack thought... X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Aug 2013 15:15:50 -0000 --Apple-Mail=_9679FE61-54B4-471B-ABD9-54413F0D2FB9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii One thought on DNSSEC and this attack. DNSSEC couldn't have prevented this attack, as anyone authorized to = update the .com zone for a domain can update the DS records just as = easily as the NS+glue records. And the attack could have done orders of = magnitude more damage. Yet DNSSEC can create an anomaly that may prove useful: If the DS changes but the NS+glue does not, or the NS changes but the DS = does not, this is a legit change from the registrar viewpoint as someone = needs to change BOTH to be more than just a DOS on the domain. But if BOTH the DS and NS+glue records for a domain change in a single = event, this is NECESSARY for an attack that is more than a DOS, yet it = is NOT NECESSARY for a migration (as a migration can change one and then = the other). How does the following policy strike people for DNSSEC recursive = resolvers which perform validation: Keep all seen DS and PARENT NS+glue RRSETs in a much-longer-than-normal = (2 day timeout) cache. When the DS or parent NS+glue RRSET changes, record that change (but = still note the old version) in the cache. =20 If the other one changes, mark that domain as bogus until either 2 days = pass from the first change OR one or the other changes back to the older = value. What this accomplishes: Registrar hijacks are no longer silent in the face of DNSSEC: it will = result in a DOS on the domain rather than full control. The protection is temporary, and is assuming that the registrar will be = straightened out in two days. =20 Which is probably a reasonable assumption since registrar hijack is now = producing a DOS on the domain (making it visible) if its all done at = once. If the attacker first changes one and then the other, there is a = two-day window where the site operator can notice the attack by = monitoring the TLD status for the site's domain. While "proper" migrations under the scheme (2 days between DS change and = NS change) are always good, and "improper" migrations do produce a DOS, = the DOS is limited to 2 days. In terms of deployment, if Nominum would do this, now basically everyone = gets protected since Nominum's usage by Comcast for recursive resolver = validation guarentees that there is a large customer base which will be = behind such protection, making this very visible. Thoughts? Comments? -- Nicholas Weaver it is a tale, told by an idiot, nweaver@icsi.berkeley.edu full of sound and fury, 510-666-2903 .signifying nothing PGP: http://www1.icsi.berkeley.edu/~nweaver/data/nweaver_pub.asc --Apple-Mail=_9679FE61-54B4-471B-ABD9-54413F0D2FB9 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJSHhQgAAoJEG2B1w+SDi/uxmEQAMOS4/636ZV25F3r3LEIqJ2D n/BQyx3UtKa23n+M/Pi7dYZofLBadjkifcKKJ7tCQ69qKRh/+XjJIBSAQbAOvLq6 0JuqGgLaO8LtPgGscXyyooCVdtGmPJ14wwTvK+pd1ERP6jt5NeQDD/muszOhO2Pf B5NQp0WfMXQoQQLDWaU2aN7Uw4yHBG+KYHsw66qgBxOnwnH+50VqS5ex46N3YiLE h9UaLQCLH2a9PNUiBSElAr2LKxgfmPt+1sedYpqKKGwvraI0flfghKJ5Iro3SUOU x36nciDYxUm/x2dZh34DWlAeNlU9nyecYeYGLXzkHhtkPQ1IOJ7uJMjgK0HuSwvL WWN9lFmyI6pdWmzSTqf8sVE21Useu2VvAFULs68iosR0v2A2s5GXJU2sNp/62J3D WanfzsufOf9vJuCxESsxqeKrioR+cGwB0WsUAALcQ4GaGtmcNrvUcyCsVOd3Q+AJ eZsi+9PTe6GM0Q6ydxTyi/DTXg4U5xKFjwkfiiAOAtVGU1WOzWQBLmG9Lxoj+bjE zhJYIZQYu6bi2tXHVdJEsZdLtNziQf7EoAVeb8NGJjE5aYKHii25VGahdf5GUOxb 1Bz4o2xy7/3O+a0OymIUVLSGcuk8mLYUZ5eT3wDZsp+E4u1tejg7HGDv4dFcPK9Z c5WlKXM5pNf1E+H9Be/O =f4gk -----END PGP SIGNATURE----- --Apple-Mail=_9679FE61-54B4-471B-ABD9-54413F0D2FB9-- From paul@cypherpunks.ca Wed Aug 28 08:38:03 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B34CC11E81BA for ; Wed, 28 Aug 2013 08:38:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.299 X-Spam-Level: X-Spam-Status: No, score=-2.299 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, J_CHICKENPOX_24=0.6] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HFmS+KNXwblF for ; Wed, 28 Aug 2013 08:37:58 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) by ietfa.amsl.com (Postfix) with ESMTP id C89B511E819A for ; Wed, 28 Aug 2013 08:37:57 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3cQB0y3Cryz73l; Wed, 28 Aug 2013 11:37:54 -0400 (EDT) X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id 6ktGlIu2h9vC; Wed, 28 Aug 2013 11:37:53 -0400 (EDT) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) by mx.nohats.ca (Postfix) with ESMTP; Wed, 28 Aug 2013 11:37:53 -0400 (EDT) Received: by bofh.nohats.ca (Postfix, from userid 500) id 9E88583FE4; Wed, 28 Aug 2013 11:37:52 -0400 (EDT) Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 92770811F6; Wed, 28 Aug 2013 11:37:52 -0400 (EDT) Date: Wed, 28 Aug 2013 11:37:52 -0400 (EDT) From: Paul Wouters X-X-Sender: paul@bofh.nohats.ca To: Nicholas Weaver In-Reply-To: <6B89A582-B4FF-4BA6-85FB-A6B2E7CA5C1E@icsi.berkeley.edu> Message-ID: References: <731c2e320281011513df391ce28788eb@127.0.0.1> <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca>, <640728432.617331.1377673284710.open-xchange@email.1and1.com> <2013082815493182407827@cnnic.cn> <2126786214.636445.1377701578329.open-xchange@email.1and1.com> <6B89A582-B4FF-4BA6-85FB-A6B2E7CA5C1E@icsi.berkeley.edu> User-Agent: Alpine 2.10 (LFD 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII Cc: dnsop Subject: Re: [DNSOP] SEA DNS w DNSSEC Hack thought... X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Aug 2013 15:38:03 -0000 On Wed, 28 Aug 2013, Nicholas Weaver wrote: > How does the following policy strike people for DNSSEC recursive resolvers which perform validation: > > Keep all seen DS and PARENT NS+glue RRSETs in a much-longer-than-normal (2 day timeout) cache. > > When the DS or parent NS+glue RRSET changes, record that change (but still note the old version) in the cache. > > If the other one changes, mark that domain as bogus until either 2 days pass from the first change OR one or the other changes back to the older value. Sounds like certificate pinning or CT-DNSSEC. It has the same problems. There will be more false positives then actual attacks, and people will disable it. Paul From nweaver@ICSI.Berkeley.EDU Wed Aug 28 08:48:50 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 696FF11E81B8 for ; Wed, 28 Aug 2013 08:48:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.299 X-Spam-Level: X-Spam-Status: No, score=-2.299 tagged_above=-999 required=5 tests=[AWL=0.300, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Vg+Y9QjTcIr for ; Wed, 28 Aug 2013 08:48:45 -0700 (PDT) Received: from rock.ICSI.Berkeley.EDU (rock.ICSI.Berkeley.EDU [192.150.186.19]) by ietfa.amsl.com (Postfix) with ESMTP id C749711E80FA for ; Wed, 28 Aug 2013 08:48:45 -0700 (PDT) Received: from localhost (localhost.localdomain [127.0.0.1]) by rock.ICSI.Berkeley.EDU (Postfix) with ESMTP id 83E962C4002; Wed, 28 Aug 2013 08:48:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at ICSI.Berkeley.EDU Received: from rock.ICSI.Berkeley.EDU ([127.0.0.1]) by localhost (maihub.ICSI.Berkeley.EDU [127.0.0.1]) (amavisd-new, port 10024) with LMTP id Rsup8+br5onl; Wed, 28 Aug 2013 08:48:45 -0700 (PDT) Received: from gala.icir.org (gala [192.150.187.49]) (Authenticated sender: nweaver) by rock.ICSI.Berkeley.EDU (Postfix) with ESMTP id 19D7B2C402F; Wed, 28 Aug 2013 08:48:45 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_11D040F3-1D51-4A4A-B6E7-365A9C700C58"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) From: Nicholas Weaver In-Reply-To: Date: Wed, 28 Aug 2013 08:48:44 -0700 Message-Id: <861E34C4-5A2D-44A1-9188-073344B7B392@ICSI.Berkeley.EDU> References: <731c2e320281011513df391ce28788eb@127.0.0.1> <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca>, <640728432.617331.1377673284710.open-xchange@email.1and1.com> <2013082815493182407827@cnnic.cn> <2126786214.636445.1377701578329.open-xchange@email.1and1.com> <6B89A582-B4FF-4BA6-85FB-A6B2E7CA5C1E@icsi.berkeley.edu> To: Paul Wouters X-Mailer: Apple Mail (2.1508) Cc: dnsop , Nicholas Weaver Subject: Re: [DNSOP] SEA DNS w DNSSEC Hack thought... X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Aug 2013 15:48:50 -0000 --Apple-Mail=_11D040F3-1D51-4A4A-B6E7-365A9C700C58 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Aug 28, 2013, at 8:37 AM, Paul Wouters wrote: ... > Sounds like certificate pinning or CT-DNSSEC. It has the same = problems. > There will be more false positives then actual attacks, and people = will > disable it. Of course, that argument also says "Ditch DNSSEC altogether, bypass the = recursive resolver, and have a nice day": How many attacks has DNSSEC = stopped to date, vs false positives due to misconfiguration? That's also why its temporary (unlike most CERT pinning which is far = more semi-permanent). And there is the hurdle of "If you are actually = configuring DNSSEC, there is an assumed minimum clue level" Has anyone yet studied whether the DS and NS RRSETs tend to change at = the same time for major domains? -- Nicholas Weaver it is a tale, told by an idiot, nweaver@icsi.berkeley.edu full of sound and fury, 510-666-2903 .signifying nothing PGP: http://www1.icsi.berkeley.edu/~nweaver/data/nweaver_pub.asc --Apple-Mail=_11D040F3-1D51-4A4A-B6E7-365A9C700C58 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJSHhvcAAoJEG2B1w+SDi/u5VUP/0ofonXqeWGm8jypeauo9jq2 12J3uByg4ArhLRE6Hey9u0/HvXtn12vACFP1jQqs3E8rsHfAKu7Fiiy4X1U2o9Df cd1owZ2/rJchyHecsgIccxmZyVmcBoQA6KRKkmcxxcrUdTFebM8rBg+p2lHXQak2 urbA7fJ98kqXsbpnHtNtXIQ6NWJ3DILNQbL7IxiY3v4gpjEkF80UCuVvP431zcti hmds4a7HBuY7YHX6nRdhMLK3mMIHOYoV7Z5UmeC4ISMfuGqqzKzw15QmKiLvsyq4 tttp454eSPVaKHMCnRQeKAc94M9zyoIMW3KBwU+Nzj/cc+j1JyZmdh/LEZ9Ft25/ 0Rt8hUHsRdwVDbHD6PXVtBmv3zWrz3+M5FBTycVpvcQ+Th/IzwRcDzmFf41bVD51 eYTapNdkXvgJaE8z7oYvwsZRmVk2IOGqDgK2ak8UTfR8ybo7ufCsp7FgHOrUMJAU Z7Z6HogpLKpfLZoPfKFR9XoE5u38VgOoGXrCmqahoifSFhzjGn4ZMF5GVucg53sp BJwXuBpmrAF2Ig66cSRJDfD8Lr/1oSCr/1yTzoe4bSyAAIoR85YlL2RU4wC96lU5 HsGeRetp788I12tRtcrKKm85UPZ5RgZaOs2W1d1ieeLUvF78ossI8KxMYe5SovdS IdbeQOdvgXGWGobjdob6 =Dc0w -----END PGP SIGNATURE----- --Apple-Mail=_11D040F3-1D51-4A4A-B6E7-365A9C700C58-- From sca@andreasschulze.de Wed Aug 28 23:27:00 2013 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5801411E80DF for ; Wed, 28 Aug 2013 23:27:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.249 X-Spam-Level: X-Spam-Status: No, score=-2.249 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EgexAAxjTmLc for ; Wed, 28 Aug 2013 23:26:56 -0700 (PDT) Received: from mout.andreasschulze.de (mout.andreasschulze.de [84.201.4.158]) by ietfa.amsl.com (Postfix) with ESMTP id C979021F9FB4 for ; Wed, 28 Aug 2013 23:26:55 -0700 (PDT) X-Received: line deleted by mout X-Received: line deleted by mout DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=andreasschulze.de; s=GzhbMIk; t=1377757237; atpsh=sha256; atps=andreasschulze.de; r=y; bh=5IFJxhwNtBVoa7T94xxRkuKqFvu1u5j02WEI5SYl7D8=; h=Date:From:To:Subject:References:In-Reply-To; z=Date:=20Thu,=2029=20Aug=202013=2008:20:21=20+0200|From:=20Andreas =20Schulze=20|To:=20dnsop@ietf.org|Subject: =20Re:=20[DNSOP]=20SEA=20DNS=20w=20DNSSEC=20Hack=20thought...|Refe rences:=20<731c2e320281011513df391ce28788eb@127.0.0.1>=0D=0A=20<50 63609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca>=0D=0A=20<640728432 .617331.1377673284710.open-xchange@email.1and1.com>=0D=0A=20<20130 82815493182407827@cnnic.cn>=0D=0A=20<2126786214.636445.13777015783 29.open-xchange@email.1and1.com>=0D=0A=20<6B89A582-B4FF-4BA6-85FB- A6B2E7CA5C1E@icsi.berkeley.edu>|In-Reply-To:=20<6B89A582-B4FF-4BA6 -85FB-A6B2E7CA5C1E@icsi.berkeley.edu>; b=vYG+y47rMkmfNga//cfnGRO4xE+PA+GbYbRs8TA3GZb0wn4H2eCkJdCWtP/taCJX9 TZ3Y1dYLIIXn9E/RiXa2J4sXOCIBDA5frcaPd0nTXv4IlDqYePbpX9UTvsSQ6fjqz+ JVYSTXzFhkc4lQQb9yE5E9K1SnGGAy0esCX6HNHqkQFjxewPHiMt9gwxH4hQIob6qI iOCt7Q2OSY9AQHkLr8cXl8+LkFemsOwXFRXYgaoa1A0/BTbvROQ8N3E1hBGioLpv7R w/ZJvSexFD/evGr2o8xqRP1Ds61DPcNsIv9jj3pAU6QeohGVyXXnzE193vJvCliTyv +AEX70fvuUO7zNHi9MfjuBv5LHIDktWJx5V64FUwyjQGXFizdDVRnDC8QLWd/C5jTy wiWTbMdHywotcehwmriHM1MIWRAfHBOWn5Z7/Y9NcNijeb2+8PBug3pOwkAj6V/VrA 4EcZ6QGBSVRcecILXEQLr0jmx2ohUwoM1K4pzJAcvO2fQNOuRF3ufUHY1JLdtEdXE+ tnSER9bsSiS5BGOG8gu6tFGLBz0psAO/6vQQaohJKdS6F8QPAh1R+ajFIibyc9E2rz dbfoMzULg9xgZhEuAM9Wp2D8QOVnnzShXiUAwZfLfcG+VQjskkE+T+g/t0ftKSKdxM CikjGA1qS3MadrIvxBINkcbQ= X-Received: line deleted by mout Date: Thu, 29 Aug 2013 08:20:21 +0200 Message-ID: <20130829082021.Horde.HUSu-Y1dGSjRkBUOUFGLOw1@horde.andreasschulze.de> From: Andreas Schulze To: dnsop@ietf.org References: <731c2e320281011513df391ce28788eb@127.0.0.1> <5063609A-E78D-4F72-B444-4E1B0C2F8B93@hopcount.ca> <640728432.617331.1377673284710.open-xchange@email.1and1.com> <2013082815493182407827@cnnic.cn> <2126786214.636445.1377701578329.open-xchange@email.1and1.com> <6B89A582-B4FF-4BA6-85FB-A6B2E7CA5C1E@icsi.berkeley.edu> In-Reply-To: <6B89A582-B4FF-4BA6-85FB-A6B2E7CA5C1E@icsi.berkeley.edu> User-Agent: Internet Messaging Program (IMP) H5 (6.1.3) Content-Type: text/plain; charset=UTF-8; format=flowed; DelSp=Yes MIME-Version: 1.0 Content-Disposition: inline Subject: Re: [DNSOP] SEA DNS w DNSSEC Hack thought... X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Aug 2013 06:27:00 -0000 Zitat von Nicholas Weaver : > One thought on DNSSEC and this (nytimes.com) attack. Nickolas, your suggestion try to solve the problem by inspecting common behaviour. What about providing a policy statement? I imagine an extension, where the subdomain declares an explicit statement to the TLD - yes, my domain awaits a NS (+DS) change in the delegating domain - no, I do not authorise the delegating domain for any change - no statement at all ( compatibility / legacy mode) The statement could be a simple secret generated/assigned by the TLD and the Subdomainowner provide this as txt record. If the TLD receive any request for to update/change Delegation data, it first query all *current* NS for this policy statement. TLDs could implement this extension. If not, it don't hurt. It's similiar to the Look state, some TLDs just provide but move the storage of the "look information" away from the TLD to the domainowner. So an attacker must not only hack the registrar interface but also the domain he wish to attack. That's more difficult. Just my thoughts... Andreas