Subject: [Dbound] Online vs Offline modes

From: Jeffrey Walton <[email-masked]>
Date: Fri, 4 Jul 2014 21:53:27 -0400

I think one thing to consider with the Dbound is online vs offline modes.

It looks like the two drafts [1,2] both have online requirements. I
don't mind the online requirement when collecting information or
building a list as a prep step to compiling my program. But when my
program operates in the field, I want to avoid going online.

The extra online query is an additional point of network failure.
Plus, I don't know that I'm getting an authentic answer under many
circumstances. I can tolerate the potential failures when gathering
information or building a list. But at runtime, I don't want to
introduce the additional risks.

This might be a unrealistic requirement when solving the general
problem, but I think its reasonable in my case. My case is validating
host name data in an X509 certificate with an emphasis on catching
wildcards in gTLDs and ccTLDs. I'm less concerned about administrative
boundaries in subdomains.

[1] draft-levine-orgboundary
[2] draft-sullivan-domain-policy-authority

---

From: Gervase Markham <[email-masked]>
Date: Mon, 07 Jul 2014 13:34:50 +0100

> program operates in the field, I want to avoid going online.

This is the same for browsers, for performance and reliability reasons.
There are large efforts going on to reduce or remove side-lookups (e.g.
OCSP) when browsing. Adding new ones is not a step forward.

Gerv

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 7 Jul 2014 11:13:41 -0400

> program operates in the field, I want to avoid going online.

What I've actually been assuming will happen, at least in the case of
SOPA, is that there'll be a PSL in consumer-use programs, and it will
be updated and maintained opportunistically using SOPA records.  In
other words, you don't have an online requirement in practice, but you
use the online mode for maintenance when you have it.  I can't imagine
that any web browser, for instance, is going to tolerate the
additional latency that would be imposed by having to do the
additional lookup.  But you might do an additional lookup to find out
if an arrangement is more permissive than you assumed, or something
like that.

> circumstances.

I don't understand this claim.  You're getting exactly as authentic an
answer as you ever get from the DNS.  If you need strong
authentication of the answer, surely you should be using DNSSEC, no?

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: "John Levine" <[email-masked]>
Date: 7 Jul 2014 19:52:12 -0000

>OCSP) when browsing. Adding new ones is not a step forward.

In general I agree with you, but I think there's a meaningful difference
between a single DNS query and OCSP, which is a full http transaction.

R's,
John

---

From: Jeffrey Walton <[email-masked]>
Date: Mon, 7 Jul 2014 22:54:45 -0400

Hi Andrew,

> authentication of the answer, surely you should be using DNSSEC, no?
Embarrassingly, I can't tell you what the default behavior is for
.Net, Python, PERL, Cocoa, Java and friends. Shooting from the hip,
I'm guessing they are *not* using DNSSEC to authenticate queries. That
means I get whatever goodness comes from the cable or wifi hotspot
provider.

My solution is primitive: don't use DNS. I gather the information at
compile time and build it into the program. Then, use a trusted
distribution channel to ensure the data is not tampered. That reduces
the number of potential failures to one (the list that's built prior
to compiling).

Jeff