Subject: [Dbound] Another go at the charter

From: Andrew Sullivan <[email-masked]>
Date: Tue, 3 Feb 2015 17:53:57 -0500

Hi all,

Because I had a couple unscheduled minutes, to my surprise, I thought
I'd try banging away on the charter to address the issues that came up
during IESG review.  Here's a go at it.  Shred as appropriate.

A

-- 
Andrew Sullivan
[email-masked]

---

From: "John Levine" <[email-masked]>
Date: 4 Feb 2015 01:26:09 -0000

>There are two broad use cases that seem to be common. The first is a
>"top ancestor organization" case. In this case, the goal is to find a
>single superordinate name in the DNS tree that can properly make
>assertions about the policies and procedures of subordinate names. The
>second is to determine, given two different names, whether they are
>governed by the same administrative authority. ...

Where does the CA use case asking whether it's OK to put a wildcard
under a name, a/k/a is this a public or private name, fit in?

I realize we may have to add language to mollify people, but I
continue to believe that attempting to enumerate the use cases in the
charter other than perhaps "whatever people use the PSL for" is a
mistake.

R's,
John

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 3 Feb 2015 20:34:14 -0500

> under a name, a/k/a is this a public or private name, fit in?

"Problem for the WG to sort out"?

> charter other than perhaps "whatever people use the PSL for" is a

We'll never get chartered unless we make this change, so let's just do
it.  If we added more text (before the new sentences I added) that
said basically, "The current way most of this is handled is via a list
published at publicsuffix.org, and the general goal is to accommodate
anything people are using that for today.  However, there are broadly
speaking two use patterns," or something like that, would it work?

A

-- 
Andrew Sullivan
[email-masked]

---

From: Jothan Frakes <[email-masked]>
Date: Tue, 3 Feb 2015 17:45:58 -0800

Throwing this in if it is helpful.  Treat it like a buffet - take what you
want and leave the rest...

There is an enumeration of some of the use cases of PSL at this URL:
https://publicsuffix.org/learn/ and I suspect part of what this group would
want to do is identify which of those use cases would / could be better
served, more authoritatively served, or otherwise handled through what is
defined in DBOUND.

There is a lot there, very broadly defined in some cases.  For example, it
lists programming languages that are using PSL but not necessarily how or
what the derivative use those libraries might make of PSL.

BUT, there are use cases like the Document Object, cookies,
document.domain, or certs that might be ripe candidates for attention.

Perhaps referencing the URL as part of it?

Sample:
"The current way most of this is handled is via a list published at
publicsuffix.org, and the general goal is to accommodate those use cases
(as defined at https://publicsuffix.org/learn/) of how people are using
that today."

Jothan Frakes
Tel: +1.206-355-0230

On Tue, Feb 3, 2015 at 5:34 PM, Andrew Sullivan <[email-masked]>
wrote:

> _______________________________________________
> Dbound mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dbound
>

---

From: "John Levine" <[email-masked]>
Date: 4 Feb 2015 06:11:12 -0000

>speaking two use patterns," or something like that, would it work?

Personally, I think there are at least three and possibly more, but I
agree with you that in this case political expediency trumps accuracy.

R's,
John

---

From: Gervase Markham <[email-masked]>
Date: Wed, 04 Feb 2015 09:36:59 +0000

> under a name, a/k/a is this a public or private name, fit in?

Note that the PSL's role in CA wildcard determination is _advisory_, not
normative. That is to say, CAs are not forbidden from issuing
*.publicsuffix, but they have to use a "high risk" procedure for doing
so, which would involve more manual checks. This is intentional.

However, it does mean that a solution which produces the right answer
"most of the time" would be good enough for this use case, because
that's what the PSL does at the moment.

Gerv

---

From: Gervase Markham <[email-masked]>
Date: Wed, 04 Feb 2015 09:38:29 +0000

On 04/02/15 01:45, Jothan Frakes wrote:
> There is an enumeration of some of the use cases of PSL at this
> URL: https://publicsuffix.org/learn/ 

A better URL is this one:
https://wiki.mozilla.org/Public_Suffix_List/Uses
Edits welcome.

> There is a lot there, very broadly defined in some cases.  For example,
> it lists programming languages that are using PSL but not necessarily
> how or what the derivative use those libraries might make of PSL.

Indeed; we have little insight into how people are using various
PSL-wrapping libraries.

Gerv

---

From: "John Levine" <[email-masked]>
Date: 4 Feb 2015 20:38:07 -0000

In article <[email-masked]> you write:
>normative.

Well, sure.  Other than what you code into Mozilla products, the PSL's
role in everything is advisory.

---

From: Gervase Markham <[email-masked]>
Date: Thu, 05 Feb 2015 10:23:48 +0000

> role in everything is advisory.

Well, yes and no. What I meant by this is that the CAB Forum Baseline
Requirements (which CAs must follow to be in Mozilla's root program) say:

"Before issuing a certificate with a wildcard character (*) in a
CN or subjectAltName of type DNS-ID, the CA MUST establish and follow a
documented procedure† that determines if the wildcard character occurs
in the first label position to the left of a “registry-controlled” label
or “public suffix” (e.g. “*.com”, “*.co.uk”, see RFC 6454
Section 8.2 for further explanation).

If a wildcard would fall within the label immediately to the left of a
registry-controlled† or public suffix, CAs MUST refuse issuance unless
the applicant proves its rightful control of the entire Domain Namespace."

That is, they do not say MUST NOT ISSUE under any circumstances. They
could have said that, in which case I would not describe their role as
"advisory". But they don't. In practice, what happens is that CAs put
such requests into their "higher risk" process.

Gerv

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 23 Feb 2015 13:14:54 -0500

> agree with you that in this case political expediency trumps accuracy.

In the interests of keeping this moving, and given that Richard met with
Eliot and he seems to have a better understanding of what's going on here,
I've updated the charter as per Andrew's suggestion at the top and middle
of this thread, which is now visible here:

https://github.com/mskucherawy/docs/blob/master/charter-dbound

Richard, is this unblockable or do you still have issues for us to consider?

-MSK