Subject: Re: [Dbound] specific use cases & rationale ? (was: Draft problem statement and IETF "bar BoF"

From: =JeffH <[email-masked]>
Date: Sun, 09 Nov 2014 16:49:29 -0800

Fri, 7 Nov 2014 13:44:37 -0500, Jeffrey Walton <[email-masked]> said:
 >
 > On Fri, Nov 7, 2014 at 11:59 AM, Suzanne Woolf <[email-masked]> 
wrote:
 >>
 >> On Nov 5, 2014, at 4:47 PM, John Levine <[email-masked]> wrote:
 >>
 >>>> I'm not sure why the IETF feels its OK to issue a certificate for
 >>>> *.com, *.net, etc. I've looked in RFC 5280 and 6125, and I've never
 >>>> seen any reasoning.
 >>>
 >>> There are now vanity TLDs.  Why shouldn't a CA sign a cert for
 >>> *.neustar or *.williamhill if the TLD registrants (who are the same as
 >>> the registries) ask for them?
 >>> ...
 >>
 >> I had the same question John did. Isn't the question for the CA whether
 >> to issue a cert to the proper authority for the domain? TLDs have those
 >> just like domains further down the tree do.
 >>
 >> This actually further confuses me about why the cc/g distinction is
 >> important in this context.
 >
 > If I am reading it correctly, then there is no difference between
 > gTLDs and ccTLDs.

Possibly, depending on the use case and its context and perhaps not for your 
use case(s) -- tho more detail and rationale wrt your use cases would be 
possibly useful to the discussion (I'm curious).

there's some policy details here wrt "TLDs"..

https://www.iana.org/help/eligible-tlds

 > For my needs, I need to know how to recognize or detect gTLDs and
 > ccTLDs (and the vanities, as John pointed out). I also need to know
 > how to recognize second level domains, like *.co.uk (as someone else
 > mentioned).

why do you differentiate between so-called "2nd level domains" and TLDs?

Or is a short answer that everything that evaluates to being "public 
suffix"/eTLD according to https://publicsuffix.org/list/ satisfies the 
"needs" implied above?

 > Finally, it would be nice to know how to recognize
 > administrative boundaries, like between blogspot.com, foo.blogspot.com
 > and bar.blogspot.com.

yes, that's the more general approach that AndrewS and I have been working 
towards.

https://tools.ietf.org/html/draft-sullivan-zone-policy-assertions-01

 > I'm more concerned with the first two cases (gTLDs/ccTLDs and second
 > level domains). I'm concerned about these two cases because I have
 > witnessed attacks on them. A nice feature would be to avoid DNS and a
 > network call since each could be complicit in an attack on the TLD.
 > That's why I differentiate between top level/second level and the rest
 > of the zoo.

why are you assuming a network call here?  would not one have this info 
cached (as the browsers are doing (AFAIK))?

 > I'm less concerned with the administrative boundaries between, for
 > example, blogspot.com and foo.blogspot.com. Right now, I'm using a
 > PSL-like list for the administrative boundaries,

which list?

[ the fact that there's a bunch of PSL-like lists 'out there' is one of the 
driving issues for myself and Andrew ]

 > but I would like
 > something cleaner if its available.
 >
 > Finally, I need to know where to tell people to go look when their
 > software needs the same security controls. I can't say "You need to do
 > X" and not have a reference for X. I hope DBOUND will provide X so I
 > can say "You need to do X, and go look at DBOUND".

ultimately, yes, agreed.

HTH,

=JeffH