Subject: [secdir] weirds and certificate naming

From: Sam Hartman <[email-masked]>
Date: Mon, 29 Jul 2013 09:31:02 -0400

Hi.
To the ADs and especially to the folks who have outstanding weirds
reviews.

Please chase down how a query name entered by a user makes its way into
a URI and how weirds validates the certificate in that URI.
I suspect that there are problems here.
For example, I suspect insecure DNS queries may be used to find parts of
that URI.
Alternatively  even if DNSsec is available, I suspect supporting DNSsec
may not be a MTI for weirds clients.
So, I'm dubious whether weirds will have an interoperable MTI security
mechanism.