<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Nothing is ever set in stone that hard. Sorry they wrote scripts for it. All apologies they decided to use Elmer's glue instead of high tensile strength super carbon based cement. They will just have to amend those temp scripts with some test cases or you can write a compatibility shim with an expiration clause with an annoying warning message.</div><div><br></div><div>I recall spending a LOT of time with DNSSEC figuring out all the nonsense but like anything else stability and friendliness has to start somewhere. And development should not be impeded by adoption of bad practices. Fix the root cause not the symptom.<br><br><div><div style="color: rgb(163, 163, 163); font-family: Ubuntu-Regular; font-size: 16px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.294118); -webkit-composition-fill-color: rgba(175, 192, 227, 0.231373);">-- </div><div style="color: rgb(163, 163, 163); font-family: Ubuntu-Regular; font-size: 16px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.294118); -webkit-composition-fill-color: rgba(175, 192, 227, 0.231373);"> Jason Hellenthal</div><div style="color: rgb(163, 163, 163); font-family: Ubuntu-Regular; font-size: 16px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.294118); -webkit-composition-fill-color: rgba(175, 192, 227, 0.231373);"> Voice: <span style="-webkit-tap-highlight-color: rgba(26, 26, 26, 0.301961); -webkit-composition-fill-color: rgba(175, 192, 227, 0.235294);">95.30.17.6/616</span></div></div><div style="color: rgb(163, 163, 163); font-family: Ubuntu-Regular; font-size: 16px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.294118); -webkit-composition-fill-color: rgba(175, 192, 227, 0.231373);"> JJH48-ARIN</div></div><div><br>On Mar 6, 2014, at 3:11, Evan Hunt <<a href="mailto:each@isc.org">each@isc.org</a>> wrote:<br><br></div><blockquote type="cite"><div><span>On Thu, Mar 06, 2014 at 08:55:28AM +0100, Carsten Strotmann wrote:</span><br><blockquote type="cite"><span>I agree that it might be nice to change "dnssec-keygen" to make the tool</span><br></blockquote><blockquote type="cite"><span>more userfriendly. The current state-of-things is because of historic</span><br></blockquote><blockquote type="cite"><span>developments in how DNSSEC came to birth.</span><br></blockquote><span></span><br><span>...and lots of people dealing with dnssec-keygen's user-unfriendliness</span><br><span>by writing shell scripts to run it, which will break if we change its</span><br><span>interface now. A lot of old mistakes have gotten chiseled into stone</span><br><span>by that.</span><br><span></span><br><span>I've long wanted to write a replacement for the zone key functions</span><br><span>of dnssec-keygen (or at least a sensible wrapper), so that DNSSEC</span><br><span>keys could be generated according to a configured policy rather</span><br><span>than command-line alphabet soup.</span><br><span></span><br><span>For generating host keys, I suggest "ddns-confgen" rather than</span><br><span>"dnssec-keygen".</span><br><span></span><br><span>-- </span><br><span>Evan Hunt -- <a href="mailto:each@isc.org">each@isc.org</a></span><br><span>Internet Systems Consortium, Inc.</span><br><span>_______________________________________________</span><br><span>Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list</span><br><span></span><br><span>bind-users mailing list</span><br><span><a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a></span><br><span><a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a></span><br></div></blockquote></body></html>