Subject: [dane] Deployment focus? Re: IETF 85 - meet or not to meet?

From: Dan York <[email-masked]>
Date: Mon, 1 Oct 2012 09:37:51 -0400

Warren and Ondřej,

>>> Any comments (if saying yes, please also say why and attach an agenda item suggestion :))?

I see more of a "strategic" reason for meeting at IETF 85 in that I am seeing a lot of positive response to the value of DANE when I am speaking about it within industry circles. It's clear to me that DANE can provide real value to companies/organizations and that it can also provide a strong reason for organizations to be interested in deploying DNSSEC.  I guess I feel that NOT meeting feels a bit like "taking the foot off the gas pedal" at a time when we need to be pushing people towards getting DANE deployed.

Having said that, I agree there's not much point in meeting if there is only one draft to discuss.

Could we perhaps have an agenda more focused on the question of "what comes next?" and looking at obstacles to DANE deployment?

Some ideas:
 - Discussion of what needs to be done to get DANE more widely deployed, specifically:
      1. What steps do we collectively need to take to get adding DANE support on the radar of browser vendors?
      2. What do we need to do to get more registrars/DNS hosting providers accepting TLSA records?
      3. What do we need to do to get more organizations publishing TLSA records? 
 - Exploration of the various tools available (some discussed recently on the list) and identification of tools that need to be created (Could we perhaps include some quick demos of those tools?)
 - Discussion of what "Using DANE With $foo Protocol" documents would be logical to create (where $foo is the various networking protocols) and identification of people willing to create such drafts
 - Discussion of ways to measure DANE deployment (how can we do that?)

I'd certainly be willing to present and lead a discussion on the first of those ideas and to participate in other discussions.  If a draft is needed for agenda time I can probably work something up before the -00 deadine of October 15th.  

We could of course discuss Paul's S/MIME draft as it fits into the "Using DANE with $foo" category.

Thoughts?  Comments?

Dan

On Sep 30, 2012, at 5:00 AM, Warren Kumari wrote:

> 
> On Sep 24, 2012, at 3:10 PM, Ondřej Surý <[email-masked]> wrote:
> 
>> More specifically, we are going to cancel the session after Oct 4th unless we hear from you that you want to meet and we have an agenda.
>> 
> 
> Apologies all -- due to the contention for meeting slots and the difficulty of scheduling all these slots we are moving the cutoff to the 2nd.
> 
> W
> 
> 
>> O.
>> 
>> On 23. 9. 2012, at 12:28, Ondřej Surý <[email-masked]> wrote:
>> 
>>> Dear WG,
>>> 
>>> we did register a slot for IETF 85 (just in case), but from the volume of the mailing list and just one WG draft (we have just adopted), we are quite unsure if there's enough interest in meeting.
>>> 
>>> I am personally inclined of canceling this meeting and reschedule for next year.
>>> 
>>> Any comments (if saying yes, please also say why and attach an agenda item suggestion :))?
>>> 
>>> O.
>>> --
>>> Ondřej Surý -- Chief Science Officer
>>> -------------------------------------------
>>> CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
>>> Americka 23, 120 00 Praha 2, Czech Republic
>>> mailto:[email-masked]    http://nic.cz/
>>> tel:+420.222745110       fax:+420.222745112
>>> -------------------------------------------
>>> 
>>> _______________________________________________
>>> dane mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/dane
>> 
>> --
>> Ondřej Surý -- Chief Science Officer
>> -------------------------------------------
>> CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
>> Americka 23, 120 00 Praha 2, Czech Republic
>> mailto:[email-masked]    http://nic.cz/
>> tel:+420.222745110       fax:+420.222745112
>> -------------------------------------------
>> 
>> _______________________________________________
>> dane mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/dane
> 
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

-- 
Dan York  [email-masked]
http://www.danyork.me/   skype:danyork
Phone: +1-802-735-1624
Twitter - http://twitter.com/danyork

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 1 Oct 2012 07:24:26 -0700

On Oct 1, 2012, at 6:37 AM, Dan York <[email-masked]> wrote:

> I see more of a "strategic" reason for meeting at IETF 85 in that I am seeing a lot of positive response to the value of DANE when I am speaking about it within industry circles. It's clear to me that DANE can provide real value to companies/organizations and that it can also provide a strong reason for organizations to be interested in deploying DNSSEC.  

Yes.

> I guess I feel that NOT meeting feels a bit like "taking the foot off the gas pedal" at a time when we need to be pushing people towards getting DANE deployed.

The IETF is not a protocol promotion body. We do it sometimes, but often with bad results.

> Having said that, I agree there's not much point in meeting if there is only one draft to discuss.

And there is no draft on "how to promote DANE usage".

>  - Discussion of ways to measure DANE deployment (how can we do that?)

That proposed agenda is much more in the realm of Internet Society work than IETF work. Perhaps you should talk to people at ISOC about hosting an meeting to discuss these things? :-)

> We could of course discuss Paul's S/MIME draft as it fits into the "Using DANE with $foo" category.

Jakob and I will have another draft this week that covers the issue brought up earlier about us not dealing with the TLS-specific topic diffs. It is not at all clear that a face-to-face meeting will be useful in finding more of those or in fixing other errors in our draft.

--Paul Hoffman

---

From: Dan York <[email-masked]>
Date: Mon, 1 Oct 2012 11:07:13 -0400

Paul,

> The IETF is not a protocol promotion body. We do it sometimes, but often with bad results.

Good point... and I realize that my first idea listed is well off in the "promotion" area. Perhaps a better/safer area to discuss would be "are there technical issues or barriers that would prevent DANE from being deployed?"

> That proposed agenda is much more in the realm of Internet Society work than IETF work. Perhaps you should talk to people at ISOC about hosting an meeting to discuss these things? :-)

(smiling) I assume by the :-) that you know that these kind of deployment issues are precisely what I am employed by the Internet Society to work on via the Deploy360 Programme.  So yes, my brain is kind of hard-wired into looking at "creating these standards is nice, but how do we get people to actually *use* them?"

Certainly ISOC *could* hold a meeting to discuss how to get DANE more widely deployed ... and the people that would need to be at that meeting would be, well, probably pretty much many of the people who would be at the DANE working group meeting at IETF! 

Regards,
Dan

---

From: SM <[email-masked]>
Date: Mon, 01 Oct 2012 08:22:52 -0700

At 06:37 01-10-2012, Dan York wrote:
>Could we perhaps have an agenda more focused on the question of 
>"what comes next?" and looking at obstacles to DANE deployment?
>
>Some ideas:
>       1. What steps do we collectively need to take to get adding 
> DANE support on the radar of browser vendors?

Send patch is usually a first step.

> providers accepting TLSA records?

There have been some long threads about a similar question.

In my opinion it's not making effective use of a meeting slot if 
there isn't any WG issues which need face time.

Regards,
-sm

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 1 Oct 2012 08:52:46 -0700

> Good point... and I realize that my first idea listed is well off in the "promotion" area. Perhaps a better/safer area to discuss would be "are there technical issues or barriers that would prevent…

If there are, that would be an excellent topic for the dnsop WG. That is, if there are technical issues with DANE, there are likely to be issues with other new RRtypes as well.

> Certainly ISOC *could* hold a meeting to discuss how to get DANE more widely deployed ... and the people that would need to be at that meeting would be, well, probably pretty much many of the peopl…

We fully disagree there. Protocol developers are often not protocol deployers. For example, I do not contribute to DNS server or DNS admin projects; the same would be true for the large majority of the people who contributed ideas and comments to the DANE protocol.

ISOC could pull together a meeting of such protocol deployers, as well as enterprises who might find DANE useful, and I suspect the overlap between people at that meeting and the last DANE WG meeting would be very small.

--Paul Hoffman

---

From: Dan York <[email-masked]>
Date: Tue, 2 Oct 2012 15:34:57 -0400

Paul,

> ISOC could pull together a meeting of such protocol deployers, as well as enterprises who might find DANE useful, and I suspect the overlap between people at that meeting and the last DANE WG meeti…

Sigh... I will have to confess that you are probably on target here, particularly as no one else has chimed in on this general thread in the last 24 hours. 

And thus we continue with the challenge that we in the IETF typically define something as "done" when "the protocol is defined" and not when "people can actually use the protocol".  

Here we have this truly awesome piece of work, DANE, and here it will linger in limbo until eventually maybe someday someone somewhere can implement it in some fashion that some people can use in some way.

Certainly I can - and will - do everything I can both personally and within ISOC's various means to get people talking about DANE and moving toward deployment.  Within the Deploy360 Programme, we've been talking to a good number of people about how to advance the advocacy and promotion of DNSSEC... and we have been planning to incorporate DANE into that effort.  But as much as we can do, we're still one organization - or even a group of organizations and companies.  We need many more people involved.

I know you may not think of yourself as a "protocol deployer", Paul, but I would argue that we do need everyone on this list thinking about how we can get DANE deployed.

DANE is far too awesome - and far too powerful - to let it linger in limbo.

My 2 cents,
Dan

---

From: Warren Kumari <[email-masked]>
Date: Tue, 2 Oct 2012 17:27:47 -0400

> DANE is far too awesome - and far too powerful - to let it linger in limbo.

Thanks, we are glad you like it :-)

More seriously though, this is yet another chicken-and-egg problem…

In this particular case I think that the easiest / fastest way to get better deployment is to convince the browser manufactures to include support for DANE -- this will incentivize[0] folk to deploy records…

W

[0]: Whoohoo, "incentivize" !

---

From: "Daniel Piggott" <[email-masked]>
Date: Wed, 3 Oct 2012 16:58:39 +0100

Is google not already using this in chrome?

-----Original Message-----
From: Warren Kumari [mailto:[email-masked]] 
Sent: 02 October 2012 22:28
To: Dan York
Cc: Paul Hoffman; dane WG list
Subject: Re: [dane] Deployment focus? Re: IETF 85 - meet or not to meet?

On Oct 2, 2012, at 3:34 PM, Dan York <[email-masked]> wrote:

>>> Certainly ISOC *could* hold a meeting to discuss how to get DANE more
widely deployed ... and the people that would need to be at that meeting
would be, well, probably pretty much many of the people who would be at the
DANE working group meeting at IETF! 
>> 
>> We fully disagree there. Protocol developers are often not protocol
deployers. For example, I do not contribute to DNS server or DNS admin
projects; the same would be true for the large majority of the people who
contributed ideas and comments to the DANE protocol.
>> 
>> ISOC could pull together a meeting of such protocol deployers, as well as
enterprises who might find DANE useful, and I suspect the overlap between
people at that meeting and the last DANE WG meeting would be very small.
> 
> Sigh... I will have to confess that you are probably on target here,
particularly as no one else has chimed in on this general thread in the last
24 hours. 
> 
> And thus we continue with the challenge that we in the IETF typically
define something as "done" when "the protocol is defined" and not when
"people can actually use the protocol".  
> 
> Here we have this truly awesome piece of work, DANE, and here it will
linger in limbo until eventually maybe someday someone somewhere can
implement it in some fashion that some people can use in some way.
> 
> Certainly I can - and will - do everything I can both personally and
within ISOC's various means to get people talking about DANE and moving
toward deployment.  Within the Deploy360 Programme, we've been talking to a
good number of people about how to advance the advocacy and promotion of
DNSSEC... and we have been planning to incorporate DANE into that effort.
But as much as we can do, we're still one organization - or even a group of
organizations and companies.  We need many more people involved.
> 
> I know you may not think of yourself as a "protocol deployer", Paul, but I
would argue that we do need everyone on this list thinking about how we can
get DANE deployed.

More seriously though, this is yet another chicken-and-egg problem.

In this particular case I think that the easiest / fastest way to get better
deployment is to convince the browser manufactures to include support for
DANE -- this will incentivize[0] folk to deploy records.

W

---

From: Warren Kumari <[email-masked]>
Date: Wed, 3 Oct 2012 13:50:44 -0400

> Is google not already using this in chrome?

Nope -- Chrome does do pinning (http://www.imperialviolet.org/2011/05/04/pinning.html), HSTS, etc.

Perhaps you were thinking of DNSSEC stapled certificates (http://www.imperialviolet.org/2011/06/16/dnssecchrome.html ) -- this is similar, bit different to DANE…

W

---

From: Warren Kumari <[email-masked]>
Date: Wed, 3 Oct 2012 14:06:22 -0400

> Apologies all -- due to the contention for meeting slots and the difficulty of scheduling all these slots we are moving the cutoff to the 2nd.

And sadly enough it looks like we should cancel this slot.

I am very grateful to folk, Dan especially for wanting to meet, and for being interested in driving adoption, but it simply looks like we will not have a full enough schedule to justify using IETF meeting time….

We will try and spend some time (finally) getting the new charter organized, and also discuss deployment, etc…

Just to be clear -- DANE WILL NOT BE MEETING IN DALLAS….

W

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 3 Oct 2012 11:29:47 -0700

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Warren Kumari
> Sent: Wednesday, October 03, 2012 11:06 AM
> To: Ondrej Surý; Stephen Farrell
> Cc: dane WG list
> Subject: Re: [dane] IETF 85 - meet or not to meet?
> 
> 
> > On Sep 24, 2012, at 3:10 PM, Ondrej Sur� <[email-masked]> wrote:
> >
> >> More specifically, we are going to cancel the session after Oct 4th unless
> we hear from you that you want to meet and we have an agenda.
> >>
> >
> > Apologies all -- due to the contention for meeting slots and the difficulty of
> scheduling all these slots we are moving the cutoff to the 2nd.
> >
> 
> I am very grateful to folk, Dan especially for wanting to meet, and for being
> interested in driving adoption, but it simply looks like we will not have a full
> enough schedule to justify using IETF meeting time�.
> 
> We will try and spend some time (finally) getting the new charter organized,
> and also discuss deployment, etc�
> 
> Just to be clear -- DANE WILL NOT BE MEETING IN DALLAS�.

That is good, the IETF is meeting in Atlanta

Jim

> 
> W
> 
> 
> > W
> >
> >
> >> O.
> >>
> >> On 23. 9. 2012, at 12:28, Ondrej Sur� <[email-masked]> wrote:
> >>
> >>> Dear WG,
> >>>
> >>> we did register a slot for IETF 85 (just in case), but from the volume of
> the mailing list and just one WG draft (we have just adopted), we are quite
> unsure if there's enough interest in meeting.
> >>>
> >>> Ondrej Sur� -- Chief Science Officer
> >>> CZ.NIC, z.s.p.o.    --    Laboratore CZ.NIC
> >> Ondrej Sur� -- Chief Science Officer
> >> CZ.NIC, z.s.p.o.    --    Laboratore CZ.NIC

---

From: Warren Kumari <[email-masked]>
Date: Wed, 3 Oct 2012 15:07:56 -0400

Sorry, too many trips... 

Dallas was NANOG -- I meant Atlanta :-)

W

Warren Kumari
------
Please excuse typing, etc -- This was sent from a device with a tiny keyboard.

---

From: Dan York <[email-masked]>
Date: Thu, 4 Oct 2012 08:38:35 -0400

> More seriously though, this is yet another chicken-and-egg problem…

Agreed.

Indeed, but as you yourself noted in an earlier thread:

>> Something that would be very helpful for getting this deployed / implemented in browsers is number of folk (and more importantly, organizations) stating that they are planning on / would do DANE if the browsers supported it natively. Of course, even more helpful would be folk actually publishing TLSA records :-P
>> 
>> The browser vendors all have limited cycles, and many many things to implement -- showing that this is something that users (and not just security weenie users) want and plan to use helps to prioritize developer time. 

So the best way to get the attention of the browser manufacturers is to get *other* people talking about DANE and requesting DANE from the browser manufacturers.  Which speaks to the need for a broader outreach to people who might be consumers/users of the DANE protocol.

> [0]: Whoohoo, "incentivize" !

Ah, the joys of the English language "evolving"... :-)

Dan