On 22.10.13 12:50, Tony Finch wrote:
Vernon Schryver <v...@rhyolite.com> wrote:
Have you turned on DNSSEC where you can? If not, why not?
Can we have less of the ad hominem please.
I find these questions quite reasonable.
When one claims "DNSSEC is difficult", while other claim it is not, then
something is wrong. Answering questions like there might help find out
where the wrong comes from and eventually fix it.
I for one, do not believe DNSSEC is any difficult. I have turned DNSSEC
wherever I can. It has become easier and easier in the past few years to
the point I would call deploying DNSSEC today trivial. I have therefore
changed my stance with people considering DNSSEC deployment from
"careful, this stuff needs special attention" to "good, encourage those
guys".
See, I can answer such questions. Why can't others?
As for port randomization, etc -- these things will obviously happen.
But the number of people that need to get involved is very small. These
people know already what to do and will do it. On the other hand, the
number of people needed to get involved with proper DNSSEC
implementation is pretty large -- and this is where we should put our
efforts.
Daniel
_______________________________________________
dns-operations mailing list
dns-operations@lists.dns-oarc.net
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
dns-jobs mailing list
https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
