The session this morning ran out of time, so I didn't get to ask my question. Verisign's review panel has identified a number of problems -- I won't argue if they're minor or not -- that are addressable with software changes. We heard this morning that Postfix is an application that will need to be changed to handle the proposed new version of Sitefinder's MX record. Of course, it's generally considered a good idea to test sofware before deploying it. So -- how much notice would the operator community want before deploying new software? What about for enterprises? (We all know that stuff *can* be deployed more quickly in emergency circumstances. We also know the problems that that can lead to, which is why we generally want testing and controlled deployment.) --Steve Bellovin, http://www.research.att.com/~smb