[dns-wg] RIPE NCC DNSSEC trust anchors

On 18 Nov 2014, at 15:51, Rob Evans <rhe at nosc.ja.net> wrote:

> I certainly don't want the RIPE community to be associated with theripen.cc domain, but if the RIPE NCC wants to use it (or at least reserve it), we might think it's a mistake, but it's the company's mistake to make unless we get into a level of micro-management that I think we, as a community, delegate to the Board.

I'm sort of in agreement with that Rob. Experiments and trying new stuff with other name spaces are fine, provided there's a clear understanding of what's going on and why. There also needs to be a clear exit or migration strategy. Cruft can't be allowed to just stagnate indefinitely or accumulate even more cruft along the way. There should be clear milestones around future go/no go decisions. There should be some reporting about all of the above, either to the DNS or NCC Services WG - whatever of the two is most appropriate.

None of that has been done for ripe.int, ripen.cc and their injection into DLV. Well OK, nothing apart from the accummulation of cruft.

My key question the has yet to be answered remains "why is the NCC putting keying material into ripe.int into DLV when the domain does not appear to be used and the case for continued DLV registration is vague to non-existent?". I would like some hard data about that.

That said, I think it is reasonable for the community to decide "ripe.foo is no longer used or needed. Please let it die.".