Subject: [Dbound] multiple PSL-equivalents exist (was: algorithmic background material for BoF

From: =JeffH <[email-masked]>
Date: Thu, 13 Nov 2014 18:50:45 -0800

> In my adventures I've come across a similar chunk of PSL-like
 > functionality, specifically in the land of PassiveDNS:
 >
 > https://archive.farsightsecurity.com/Passive_DNS/passive-dns-architecture.pdf

My understanding is that every CA has their own equivalent to the PSL 
(rather than relying directly on the PSL) and there's mumblings of similar 
lists in various other places.

and apparently there is skew between all these lists...

=JeffH

---

From: manning bill <[email-masked]>
Date: Thu, 13 Nov 2014 19:28:17 -0800

Pumpkin Spiced Latte?
Puşcă Semiautomată cu Lunetă?
personal seat license?
Private Sewer Lateral? 
Power Standards Lab?

/bill
PO Box 12317
Marina del Rey, CA 90295
310.322.8102

On 13November2014Thursday, at 18:50, =JeffH <[email-masked]> wrote:

> My understanding is that every CA has their own equivalent to the PSL (rather than relying directly on the PSL) and there's mumblings of similar lists in various other places.
> 
> _______________________________________________
> Dbound mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dbound

---

From: Gervase Markham <[email-masked]>
Date: Fri, 14 Nov 2014 14:16:57 +0000

On 14/11/14 02:50, =JeffH wrote:
> (rather than relying directly on the PSL) and there's mumblings of
> similar lists in various other places.
> 

Well, the Baseline Requirements specifically mention the PSL, although
they don't mandate its use. However, this lack of mandate was to make it
open to the possibility that a standard solution may one day come along.

Gerv

---

From: Rick Andrews <[email-masked]>
Date: Fri, 14 Nov 2014 14:58:02 -0800

Public Suffix List (https://publicsuffix.org)

Jeff, Symantec doesn't have its own equivalent of the PSL (we rely on Mozilla's), and I believe other major CAs rely on it too instead of building their own.

-Rick
	
-----Original Message-----
From: manning bill [mailto:[email-masked]] 
Sent: Thursday, November 13, 2014 7:28 PM
To: =JeffH
Cc: [email-masked]
Subject: Re: [Dbound] multiple PSL-equivalents exist (was: algorithmic background material for BoF

Pumpkin Spiced Latte?

/bill
PO Box 12317
Marina del Rey, CA 90295
310.322.8102

---

From: Rob Stradling <[email-masked]>
Date: Mon, 17 Nov 2014 09:26:21 +0000

> Jeff, Symantec doesn't have its own equivalent of the PSL (we rely on Mozilla's), and I believe other major CAs rely on it too instead of building their own.

Ditto for Comodo.

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online

---

From: Casey Deccio <[email-masked]>
Date: Mon, 17 Nov 2014 09:10:06 -0500

On Mon, Nov 17, 2014 at 4:26 AM, Rob Stradling <[email-masked]>
wrote:

>> Jeff, Symantec doesn't have its own equivalent of the PSL (we rely on
>> Mozilla's), and I believe other major CAs rely on it too instead of
>> building their own.
>>
>
> Ditto for Comodo.
>

Can anyone speak to the contrary, i.e., anecdotally identify consumption
and/or maintenance of a PSL-like resource other than the PSL?

Cheers,
Casey

---

From: Gervase Markham <[email-masked]>
Date: Mon, 17 Nov 2014 14:13:41 +0000

> and/or maintenance of a PSL-like resource other than the PSL?

Now that IE has switched to using the PSL, I don't know of any others.

Gerv

---

From: Jeremy.Rowley <[email-masked]>
Date: Mon, 17 Nov 2014 08:01:19 -0700

There's also this one maintained by IANA:

http://data.iana.org/TLD/tlds-alpha-by-domain.txt

Jeremy

On 11/17/2014 7:10 AM, Casey Deccio wrote:
> On Mon, Nov 17, 2014 at 4:26 AM, Rob Stradling 
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>         Jeff, Symantec doesn't have its own equivalent of the PSL (we
>         rely on Mozilla's), and I believe other major CAs rely on it
>         too instead of building their own.
>
>
>     Ditto for Comodo.
>
>
> Can anyone speak to the contrary, i.e., anecdotally identify 
> consumption and/or maintenance of a PSL-like resource other than the PSL?
>
> Cheers,
> Casey
>
>

---

From: Casey Deccio <[email-masked]>
Date: Mon, 17 Nov 2014 10:20:54 -0500

> http://data.iana.org/TLD/tlds-alpha-by-domain.txt

Thanks, Jeremy.  I note that this particular listing doesn't tell us
anything more than what's in the root zone (it's exactly the list of TLDs
delegated in the root zone), so I might hesitate to call it PSL-like in
that sense.

Best regards,
Casey

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 17 Nov 2014 09:02:41 -0800

This is interesting (good) news, because the claim about CAs maintaining a list of changes to the PSL that we added to the SOPA draft was inspired by a remark Phill Hallam-Baker made at a mic.  

A

-- 
Andrew Sullivan 
Please excuse my clumbsy thums. 

> On Nov 17, 2014, at 1:26, Rob Stradling <[email-masked]> wrote:
>

---

From: "John Levine" <[email-masked]>
Date: 17 Nov 2014 18:56:06 -0000

>http://data.iana.org/TLD/tlds-alpha-by-domain.txt

That's not a PSL, that's the authoritative list of actual TLDs.  If
all of the authority cuts were directly below the TLD, we wouldn't
need to have this discussion.

R's,
John

---

From: Rob Stradling <[email-masked]>
Date: Mon, 17 Nov 2014 22:01:33 +0000

> This is interesting (good) news, because the claim about CAs maintaining a list of changes to the PSL that we added to the SOPA draft was inspired by a remark Phill Hallam-Baker made at a mic.

Hi Andrew.  I asked Phill to comment.  He thought you might be getting 
mixed up with this requirement from the CABForum BRs...

   "11.5 High Risk Requests
    The CA SHALL develop, maintain, and implement documented procedures
    that identify and require additional verification activity for High
    Risk Certificate Requests prior to the Certificate’s approval, as
    reasonably necessary to ensure that such requests are properly
    verified under these Requirements."

Each CA tends to have their own home grown list of "hot domains" to 
address this requirement.

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Mon, 17 Nov 2014 23:08:07 +0100

On 11/17/2014 11:01 PM, Rob Stradling wrote:
>> This is interesting (good) news, because the claim about CAs 
>> maintaining a list of changes to the PSL that we added to the SOPA 
>> draft was inspired by a remark Phill Hallam-Baker made at a mic.
>

wouldn't it be, uhm, strange, if CA's would trust some 3rd party to 
provide this information?

/rolf

---

From: Rob Stradling <[email-masked]>
Date: Tue, 18 Nov 2014 13:40:07 +0000

> provide this information?

Yes, I think it would be strange.  However, I think we're drifting 
off-topic...unless...

Could DBOUND specify an "evil bit" so that we can easily recognize dodgy 
domains ?  ;-)

http://en.wikipedia.org/wiki/Evil_bit

---

From: "John Levine" <[email-masked]>
Date: 18 Nov 2014 15:45:26 -0000

>Could DBOUND specify an "evil bit" so that we can easily recognize dodgy 

If you want DNSBLs, you know where to find them.

R's,
John