> First, this is defeatism writ large – if we can’t develop anything new, ever, we may all just as well go home and give up. No, it means you need to consider

> First, this is defeatism writ large – if we can’t develop anything new, ever, we may all just as well go home and give up. No, it means you need to consider the existing realities when designing a new protocol. A good example is HTTP/2: Probably countless proxies would produce crap once they see an HTTP/2 packet. So people came to the conclusion that they need to wrap HTTP/2 in TLS in order to deploy it. (I know that there's HTTP/2 without tls, but nobody is using it for precisely that reason.) HTTP/2 was built with deployability in mind. DNSSEC was not. > Secondly, these things don’t exist in a vacuum; if a website failed because a user couldn’t access DANE or whatever, this would create pressure on all affected parties to fix the situation. This is simply not what's happening. What happens in the real world is that people blame their browser for breaking things that previously worked. There are countless examples for this.