Un-deprecating nss_hesiod?

[Zack Weinberg]

On Thu, Mar 4, 2021 at 9:55 AM Rich Felker <dalias@libc.org> wrote:
> On Mon, Mar 01, 2021 at 12:39:50PM +0100, Florian Weimer via Libc-alpha wrote:
> > * JFLF via Libc-alpha:
> >
> > > This is a very valid concern, but hasn't DNSSEC been implemented in
> > > the glibc resolver in 2019? If so, doesn't that make this point moot?
> >
> > The glibc stub resolver is still non-validating.
>
> And everyone needs to be running a dnssec-validating (which gives you
> caching for free, too) nameserver on localhost. Validation does not
> belong in glibc, but glibc should be pushing distros to ship with a
> default, out of the box configuration that makes this safe unless the
> user explicitly overrides/refuses it.

With the caveat that I think there are several use cases where the
application needs access to validation details and not just the "trust
me I validated this" bit, fully agreed.  unbound is easy to set up,
there's no reason not to have validation active by default.

zw