data request on Sitefinder

[Steve Bellovin <smb () research att com>]

The session this morning ran out of time, so I didn't get to ask my 
question.

Verisign's review panel has identified a number of problems -- I won't 
argue if they're minor or not -- that are addressable with software 
changes.  We heard this morning that Postfix is an application that 
will need to be changed to handle the proposed new version of 
Sitefinder's MX record.  Of course, it's generally considered a good 
idea to test sofware before deploying it.

So -- how much notice would the operator community want before 
deploying new software?  What about for enterprises?  (We all know that 
stuff *can* be deployed more quickly in emergency circumstances.  We 
also know the problems that that can lead to, which is why we generally 
want testing and controlled deployment.)

                --Steve Bellovin, http://www.research.att.com/~smb