Thank You for the response. <div><br></div><div>There may be benefit to a common UI configuration layer for DNS in the router</div><div>that has a checkbox for [ ] DNSSEC - that transparently swaps out the DNS Server</div>
<div>for the end user - and could deliver the best of both worlds today. </div><div><br></div><div>Most of the DNS Configuration Options in the UI could be abstracted out to write</div><div>the correct configuration files for the DNS solution of your choice, and we could </div>
<div>remove the integration detail to scripts that process the UI settings and control</div><div>the appropriate Start / Stop Scripts. </div><div><br></div><div>It would take a small piece of MiddleWare called by the UI that can take **any** </div>
<div>plugin solution that could be put into the Apps Package List </div><div><br></div><div>This basic design principal might be useful in other areas of the router UI as </div><div>well, since there are probably a lot of &quot;Swap This For That&quot; options that will</div>
<div>be useful over the long term. </div><div><br></div><div>That probably deserves more thought. </div><div><br></div><div>G.</div><div><br></div><div><br></div><div><br><div><br><div class="gmail_quote">On Mon, Aug 20, 2012 at 4:14 PM, Evan Hunt <span dir="ltr">&lt;<a href="mailto:ethanol@gmail.com" target="_blank">ethanol@gmail.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">&gt; *** the following is mean to be an &quot;opinion for discussion - not intended to<br>
&gt; cause friction.&#39;  ***<br>
<br>
</div>Same here.  I have parental affection for BIND, but if something else<br>
does a better job of making the internet better, then something else<br>
ought to win.<br>
<div class="im"><br>
&gt; It is my opinion that - BIND9 should not be the only default install option,<br>
&gt; and there should probably be an either or choice DNS Security / or<br>
&gt; (Memory + Processor + Name Resolution Speed).<br>
&gt;<br>
&gt; I would agree that there is value in DNSSEC - for people who want it, but<br>
&gt; I believe that it should be optional due to the substantial performance<br>
&gt; penalty that comes from the combination of extra cpu and memory to run<br>
&gt; BIND9 - for those who do not expect DNSSEC, or see value in it.<br>
&gt;<br>
&gt; 3 years from now when the demand for DNSSEC may be higher -<br>
&gt; routers will have substantially more compute and memory, but today<br>
&gt; both of those are critical components in the overall solution.<br>
<br>
</div>I sort of agree and sort of don&#39;t.  If I&#39;m designing for the<br>
commonplace CPE of 2012, yeah, I&#39;m probably not going to want BIND.<br>
But I hope for cerowrt to blaze the trails people will be following<br>
three years from now.  By then, not only will we have beefier routers<br>
to run name servers on, but there&#39;ll probably be more choices of name<br>
servers that support the necessary feature set.  Taking the memory hit<br>
to run BIND now lets us learn lessons about how to deal with<br>
home-network naming in a DNSSEC-enabled world while the stakes are<br>
still relatively low.<br>
<br>
I like your idea of having multiple options and making the tradeoffs<br>
explicit though.<br>
<span class="HOEnZb"><font color="#888888"><br>
Evan<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br>P THINK BEFORE PRINTING: is it really necessary?<br><br>This e-mail and its attachments are confidential and solely for the<br>intended addressee(s). Do not share or use them without approval. If received in error, contact the sender<br>
and delete them.<br>
</div></div>