[{"author": "Tim Wicinski", "text": "

Good evening all - even IQUERY Roy

", "time": "2024-07-26T01:31:03Z"}, {"author": "Roy Arends", "text": "

:-)

", "time": "2024-07-26T01:31:27Z"}, {"author": "Tim Wicinski", "text": "

Also - from last time 2931 could use a refresh if it's not been put in the bin

", "time": "2024-07-26T01:33:41Z"}, {"author": "Donald Eastlake", "text": "

MACSEC = 802.1AE

", "time": "2024-07-26T01:39:00Z"}, {"author": "Shane Kerr", "text": "

Am I in the wrong room? I feel like I ended up in v6ops... :yum:

", "time": "2024-07-26T01:44:17Z"}, {"author": "Tim Wicinski", "text": "

your DNS Load Balancer sent you to the wrong room Shane

", "time": "2024-07-26T01:44:50Z"}, {"author": "Lorenzo Colitti", "text": "

you don't need to deprecate dns64 to deprecate 7050

", "time": "2024-07-26T01:49:10Z"}, {"author": "David Schinazi", "text": "

The fun part is we can just remove ipv4only.arpa. from .arpa and break all 7050 implementations worldwide

", "time": "2024-07-26T01:49:59Z"}, {"author": "Jim Reid", "text": "

What?? All 2 of them? :-)

", "time": "2024-07-26T01:50:29Z"}, {"author": "Tim Wicinski", "text": "

Let's do that on a Friday Dave

", "time": "2024-07-26T01:50:35Z"}, {"author": "Erik Nygren", "text": "

+1 to what Lorenzo --- that may be the thing to be clear about is that this is deprecating 7050 not DNS64, as lots of large mobile networks rely heavily on DNS64 and handsets out there have a long lifetime.

", "time": "2024-07-26T01:50:52Z"}, {"author": "David Schinazi", "text": "

Sounds good. we can blame it on Crowdstrike

", "time": "2024-07-26T01:50:56Z"}, {"author": "Q Misell", "text": "

taking bets now on who would even notice

", "time": "2024-07-26T01:51:22Z"}, {"author": "Peter DeVries", "text": "

Was the remote room for this discussion available? I couldn't connect using the link on side meetings. Is there a recording?

", "time": "2024-07-26T01:51:27Z"}, {"author": "Jessica Krynitsky", "text": "

too soon, David :')

", "time": "2024-07-26T01:51:50Z"}, {"author": "Benno Overeinder", "text": "

This is the link to the full client https://meetings.conf.meetecho.com/ietf120/?session=33061

", "time": "2024-07-26T01:52:13Z"}, {"author": "Jim Reid", "text": "

let's call this list stupiddnstricks@...

", "time": "2024-07-26T01:52:58Z"}, {"author": "Peter DeVries", "text": "

I meant the side meeting yesterday

", "time": "2024-07-26T01:52:59Z"}, {"author": "Benno Overeinder", "text": "

Peter, ack.

", "time": "2024-07-26T01:53:24Z"}, {"author": "Jessica Krynitsky", "text": "

I like it Jim

", "time": "2024-07-26T01:53:29Z"}, {"author": "Tommy Jensen", "text": "

STUpid Dns trickS (STUDS)

", "time": "2024-07-26T01:54:16Z"}, {"author": "Tim Wicinski", "text": "

there are so many stupiddnstricks, I won;t know where to start

", "time": "2024-07-26T01:54:33Z"}, {"author": "Shane Kerr", "text": "

There was a typo in the link for the webex for the side meeting yesterday. :disappointed:

", "time": "2024-07-26T01:54:52Z"}, {"author": "Jim Reid", "text": "

@Tim, we generally start in the DNS with a mailing list. :-)

", "time": "2024-07-26T01:55:38Z"}, {"author": "Jim Reid", "text": "

whoops s/DNS/IETF/

", "time": "2024-07-26T01:55:53Z"}, {"author": "Tim Wicinski", "text": "

I want to thank Tommy for this talk, as DNS folks are so welcoming and happy to help

", "time": "2024-07-26T02:01:56Z"}, {"author": "Kazunori Fujiwara", "text": "

A research paper proposes a DNS system that can flexible access control with TSIG key mechanism
\nfor each DNS updates.

", "time": "2024-07-26T02:03:29Z"}, {"author": "Kazunori Fujiwara", "text": "

https://www.jstage.jst.go.jp/article/jssst/28/4/28_4_4_97/_pdf/-char/ja

", "time": "2024-07-26T02:03:54Z"}, {"author": "Kazunori Fujiwara", "text": "

(Sorry, Japanese language)

", "time": "2024-07-26T02:04:04Z"}, {"author": "Andrew Campling", "text": "

It sounds like Ben is suggesting it should be a BCP?

", "time": "2024-07-26T02:04:51Z"}, {"author": "Roy Arends", "text": "

I was trying to say the same. Looks more like suggesting a good practice.

", "time": "2024-07-26T02:05:38Z"}, {"author": "Tom Hill", "text": "

The hat definitely gives Tom Bombadil vibes

", "time": "2024-07-26T02:13:05Z"}, {"author": "Evan Hunt", "text": "

i'm a \"no opinion\" because I haven't had time to consider the alternative working groups and whether they'd be a better fit than dnsop

", "time": "2024-07-26T02:14:17Z"}, {"author": "Jessica Krynitsky", "text": "

This is meant to be informational/best practice, not normative

", "time": "2024-07-26T02:14:35Z"}, {"author": "Erik Nygren", "text": "

It may be the same set of people if it is here or ADD, so getting it done somewhere is what might matter.

", "time": "2024-07-26T02:15:45Z"}, {"author": "Tommy Jensen", "text": "
\n

I want to thank Tommy for this talk, as DNS folks are so welcoming and happy to help

\n
\n

Thanks, and seriously, this was a super productive room for talks that included auth in DNS and DNS64. go dnsop!

", "time": "2024-07-26T02:16:33Z"}, {"author": "Matthew Pounsett", "text": "

ADD feels less right than DNSOP. My instinct is DNSOP or something new.

", "time": "2024-07-26T02:16:54Z"}, {"author": "Benjamin Schwartz", "text": "

I think the mTLS thing should go to ADD

", "time": "2024-07-26T02:16:58Z"}, {"author": "Shane Kerr", "text": "

Zone walking as a \"problem\". :neutral:

", "time": "2024-07-26T02:17:45Z"}, {"author": "Jim Reid", "text": "

+1 Matt. Ben, if the mTLS stuff gets watered down, would you prefer the ID to be adopted in dnsop or add?

", "time": "2024-07-26T02:17:57Z"}, {"author": "Tobias Fiebig", "text": "

@matthew for some reason '... or something new' feels surprisingly common for tommy's drafts

", "time": "2024-07-26T02:18:01Z"}, {"author": "Benjamin Schwartz", "text": "

Jim Reid said:

\n
\n

+1 Matt. Ben, if the mTLS stuff gets watered down, would you prefer the ID to be adopted in dnsop or add?

\n
\n

I would prefer ADD.

", "time": "2024-07-26T02:18:36Z"}, {"author": "Jim Reid", "text": "

Thanks Ben. I prefer dnsop. So there! :-)

", "time": "2024-07-26T02:19:35Z"}, {"author": "Tommy Jensen", "text": "
\n

for some reason '... or something new' feels surprisingly common for tommy's drafts

\n
\n

m'bad...

", "time": "2024-07-26T02:19:54Z"}, {"author": "Shane Kerr", "text": "

And IBM NS1!!! We do black lies compact denial of existence!!!

", "time": "2024-07-26T02:20:00Z"}, {"author": "Tobias Fiebig", "text": "

maybe we just need a TJDNS-WG ;-)

", "time": "2024-07-26T02:20:15Z"}, {"author": "Jessica Krynitsky", "text": "

^ supportive of this

", "time": "2024-07-26T02:20:38Z"}, {"author": "Jessica Krynitsky", "text": "

:laughing:

", "time": "2024-07-26T02:20:50Z"}, {"author": "Shane Kerr", "text": "

With a curve-based algorithm signing is not expensive on the fly.

", "time": "2024-07-26T02:21:52Z"}, {"author": "Tommy Jensen", "text": "

I don't like a trade-off of not having DNSSEC confirmation of negative answers...

", "time": "2024-07-26T02:23:14Z"}, {"author": "Jim Reid", "text": "

depends on how many on the fly signatures are needed...

", "time": "2024-07-26T02:23:19Z"}, {"author": "Paul Hoffman", "text": "

Maybe call this \"rainbow lies\"

", "time": "2024-07-26T02:23:29Z"}, {"author": "Jim Reid", "text": "

Too many negatives in your comment Tommy at this time of the IETF day.

", "time": "2024-07-26T02:24:16Z"}, {"author": "Benjamin Schwartz", "text": "

This will fail hard when it runs into RFC 8198, as has already been noted and is about to be noted half a dozen times.

", "time": "2024-07-26T02:24:25Z"}, {"author": "Rahel Fainchtein", "text": "

Re: Done Hopping: Wouldn't the lack of authenticated negative answers allow for injection of negative responses?

", "time": "2024-07-26T02:24:27Z"}, {"author": "Rahel Fainchtein", "text": "

*zone hopping

", "time": "2024-07-26T02:24:39Z"}, {"author": "Tommy Jensen", "text": "
\n

Too many negatives in your comment Tommy at this time of the IETF day.

\n
\n

Sorry, I was busy writing a charter for Tobias -- let's try \"I do not like this approach of only signing positive answers\"

", "time": "2024-07-26T02:25:25Z"}, {"author": "Tobias Fiebig", "text": "

Charter for TJDNS, you mean? ;-P

", "time": "2024-07-26T02:25:58Z"}, {"author": "Tommy Jensen", "text": "

what else? :P

", "time": "2024-07-26T02:26:15Z"}, {"author": "Benjamin Schwartz", "text": "

Rahel Fainchtein said:

\n
\n

Re: Done Hopping: Wouldn't the lack of authenticated negative answers allow for injection of negative responses?

\n
\n

True!

", "time": "2024-07-26T02:26:16Z"}, {"author": "Shumon Huque", "text": "

online signing & nsec3 is probably good enough today. If we want something better for precomputed signatures, NSEC5 anyone? I'll duck now :(

", "time": "2024-07-26T02:26:53Z"}, {"author": "Tommy Jensen", "text": "

To be clear to the presenter (thank you for sharing!), addressing this problem is a good use of time, but I would expect to maintain signing of both positive and negative answers.

", "time": "2024-07-26T02:28:29Z"}, {"author": "Jim Reid", "text": "

Zone walking isn't a problem IMO. I'll duck and run away too.

", "time": "2024-07-26T02:29:03Z"}, {"author": "Tobias Fiebig", "text": "

@jim I would agree. DNS is public data.

", "time": "2024-07-26T02:29:19Z"}, {"author": "Tommy Jensen", "text": "

Lots of ducking going on, hope everyone is ok.

", "time": "2024-07-26T02:29:38Z"}, {"author": "Roy Arends", "text": "

I removed my hand, since all my points have been made.

", "time": "2024-07-26T02:30:14Z"}, {"author": "Tom Hill", "text": "

Evan mentioned NSEC5, so I'm outta the queue

", "time": "2024-07-26T02:30:21Z"}, {"author": "Tobias Fiebig", "text": "

i think the current presenter just made the same point as everyone in the queue wanted to make.

", "time": "2024-07-26T02:30:29Z"}, {"author": "Benno Overeinder", "text": "

Thanks Roy and Tom.

", "time": "2024-07-26T02:30:33Z"}, {"author": "Benjamin Schwartz", "text": "

Secrets that can't be rotated aren't secrets.

", "time": "2024-07-26T02:30:41Z"}, {"author": "Tobias Fiebig", "text": "

Working with passive DNS, I can note that you find _a lot_

", "time": "2024-07-26T02:30:51Z"}, {"author": "Roy Arends", "text": "

I can compile any zone by looking at DITL data.

", "time": "2024-07-26T02:31:13Z"}, {"author": "Jim Reid", "text": "

Access to DITL data is restricted to DNS-OARC

", "time": "2024-07-26T02:31:54Z"}, {"author": "Tobias Fiebig", "text": "

and it is not deterministic which names do (not) show up in passive DNS

", "time": "2024-07-26T02:32:04Z"}, {"author": "Tobias Fiebig", "text": "

@jim and farsight sells it.

", "time": "2024-07-26T02:32:19Z"}, {"author": "Shane Kerr", "text": "

To be fair, there is a difference between knowing one person's e-mail address and knowing the e-mail of everyone at an organization. A given DNS name being published is not exactly the same as knowing _all_ DNS names in a zone.

", "time": "2024-07-26T02:32:40Z"}]