Re: NSEC version field (Re: NSEC2- and an Authenticated Denial Mechanism Flag)

[Edward Lewis <edlewis@arin.net>]

At 19:58 +0100 5/28/04, Roy Badami wrote:
> existence of a DS record -- that the v1-era resolver can't verify), I
> think it is desirably that a v1-verifier *always* regards a delegation
> from a v2-zone as insecure.  This avoids a false expectation of

If when you are confused you fail "open" you are very vulnerable. 
Ever try to just confuse a security guard to gain access to a 
building?  When it works, it's usually bad for the building (owner).

--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

Even the voices inside my head are refusing to talk to me anymore.

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>