[DNSOP] Re: Call for adoption: draft-huque-dnsop-multi-alg -rules-08 (Ends 2026-08-31)

Michael Richardson <[email protected]> Sat, 15 Aug 2026 15:18:22 -0400

Newsgroups	gmane.ietf.dnsop
Message-ID	<[email protected]>

Philip Homburg <[email protected]> wrote:
    >> This is a I want a pony draft. It will not work for every validator.
    >> Validator operators shouldnt have to add NTAs, assuming that there
    >> implementation supports them, because people are to lazy to do due
    >> diligence when moving operators.

    > This is a weird use of the concept 'pony'. It causes problems for the small
    > percentage of people running validators that haven't been update for more
    > than a decade. Those validators cannot validate half of the DNSSEC

Lest someone wonder why anyone would have such an old validator...

A reason is because one has to unarchive some ancient VM (or container) in
order to validate a bug in some old system.  Or worse, because one needs the
toolchain contained within in order to build a patch for some old (in the
field) system.

And the first thing that happens is that one needs a few new things inside
the VM, the absolute last patches to gcc 11 and openssl 1.1.1QAZT... and
guess what... the DNS resolver libraries, or **localhost DNS-validator**
inside are also old.   The VM won't be alive very long, and isn't exposed
otherwise to the network...

{I recently had to bisect a node v16 thing with react-js 16, against a
dependancy that broke with newer stuff. }

I find that this is one of the serious downsides of Docker: it trivially and
often unknowingly locks down ancient code.  The SBOM part of it is not yet
used enough for knowing what's broken.

--
Michael Richardson <[email protected]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

**       My working hours and your working hours may be different.         **
** Please do not feel obligated to reply outside your normal working hours **

_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 487 B)