Re: [DNSOP] pushing updates to the parent

2014-03-09 Thread Mark Andrews
In message , Paul Wouters w rites: > On Sat, 8 Mar 2014, Mark Andrews wrote: > > > Our audience should be the CPE developer with the one "turn on > > DNSSEC" button which generates the keys, signs the zone, pushes > > keys upstream at the right time. It has a username/password field > > for zone

Re: [DNSOP] An approach to DNS privacy

2014-03-09 Thread Phillip Hallam-Baker
On Sun, Mar 9, 2014 at 10:26 AM, Florian Weimer wrote: > * Phillip Hallam-Baker: > > > But first, cite actual legal authority because I don't believe your > > interpretation of the law is remotely correct. > > § 8 Abs. 3 TKÜV: > > | Wenn der Verpflichtete die ihm zur Übermittlung anvertraute > |

Re: [DNSOP] An approach to DNS privacy

2014-03-09 Thread Florian Weimer
* Phillip Hallam-Baker: > But first, cite actual legal authority because I don't believe your > interpretation of the law is remotely correct. § 8 Abs. 3 TKÜV: | Wenn der Verpflichtete die ihm zur Übermittlung anvertraute | Telekommunikation netzseitig durch technische Maßnahmen gegen | unbefugt

Re: [DNSOP] CPE devices doing DNSSEC

2014-03-09 Thread Patrick Mevzek
Le dimanche 09 mars 2014 à 08:28 +, Patrik Fältström a écrit : > > On 2014-03-08 09:00, Mark Andrews wrote: > > They have failed to invent / document a common standard way for > > machine updates to work. They could have quite easily got together > > anytime in the last decade and done a stan

Re: [DNSOP] CPE devices doing DNSSEC

2014-03-09 Thread Patrick Mevzek
Le samedi 08 mars 2014 à 20:00 +1100, Mark Andrews a écrit : > > > I know Registrars don't like to be told what to do > > > > +1 > > But they get told to do EPP to talk to the registries. > > They have failed to invent / document a common standard way for > machine updates to work. They could

Re: [DNSOP] An approach to DNS privacy

2014-03-09 Thread Phillip Hallam-Baker
On Sun, Mar 9, 2014 at 6:28 AM, Florian Weimer wrote: > * Phillip Hallam-Baker: > > > For a heavily trafficked resolver, the resolver-authoritative > > interaction can be addressed with caching and by pre-fetching the > > bulk of the requests. But this approach does not work so well for > > the

Re: [DNSOP] CPE devices doing DNSSEC

2014-03-09 Thread Patrik Fältström
On 2014-03-09 12:55, Patrik Wallstrom wrote: >> Given this pricing structure, and that registries do change their >> implementations far too often, where do you think registrars do spend >> the money they have? They MUST support what the changes the registries >> do, they do not HAVE TO implement

Re: [DNSOP] CPE devices doing DNSSEC

2014-03-09 Thread Patrik Fältström
On 2014-03-09 12:55, Patrik Wallstrom wrote: > > Yes, there is. Let me explain how. > > Registries are using variants of the same protocol, EPP. Registries are > typically serving exactly one name space. And this is where the lock-in for > the registrar come in - there are no other registries

Re: [DNSOP] CPE devices doing DNSSEC

2014-03-09 Thread Patrik Wallstrom
On 09 Mar 2014, at 13:19, Patrik Fältström wrote: > On 2014-03-09 10:19, Patrik Wallstrom wrote: >> But the fact is that EPP is several magnitudes better harmonized >> between TLDs compared to that registrars are offering their >> customers. There is no way around that today, and the registrars

Re: [DNSOP] CPE devices doing DNSSEC

2014-03-09 Thread Patrik Fältström
On 2014-03-09 10:19, Patrik Wallstrom wrote: > But the fact is that EPP is several magnitudes better harmonized > between TLDs compared to that registrars are offering their > customers. There is no way around that today, and the registrars have > no incentive at all to improve the situation. For a

Re: [DNSOP] An approach to DNS privacy

2014-03-09 Thread Florian Weimer
* Phillip Hallam-Baker: > For a heavily trafficked resolver, the resolver-authoritative > interaction can be addressed with caching and by pre-fetching the > bulk of the requests. But this approach does not work so well for > the lightly trafficked resolver and especially not a local resolver > d

Re: [DNSOP] CPE devices doing DNSSEC

2014-03-09 Thread Patrik Wallstrom
On 09 Mar 2014, at 09:28, Patrik Fältström wrote: > On 2014-03-08 09:00, Mark Andrews wrote: >> They have failed to invent / document a common standard way for >> machine updates to work. They could have quite easily got together >> anytime in the last decade and done a standardised update prot

Re: [DNSOP] CPE devices doing DNSSEC

2014-03-09 Thread Patrik Fältström
On 2014-03-08 11:47, Jim Reid wrote: > Correction: some registrars are obliged to use EPP to talk to some registries. Correction: epp is not one protocol. It is one protocol profile per backend registry. A big failure for IETF I must say. The architecture is broken, but, luckily IETF has now t

Re: [DNSOP] CPE devices doing DNSSEC

2014-03-09 Thread Patrik Fältström
On 2014-03-08 09:00, Mark Andrews wrote: > They have failed to invent / document a common standard way for > machine updates to work. They could have quite easily got together > anytime in the last decade and done a standardised update protocol. > > But they haven't. As long as the registries