Subject: [Dbound] Request to participate in DBOUND discussions

From: Jothan Frakes <[email-masked]>
Date: Wed, 5 Feb 2014 15:23:56 -0800

Hi-

Thank you for forming the DBOUND BoF.  I hope it will evolve into a working
group.  This is an area of massive need within the developer community -
and that need is exacerbated by the rapid expansion underway with new TLDs
from ICANN.

I am a long time volunteer with the Public Suffix List and want to be
included in the discussions around DBOUND, as I have a substantial amount
of exposure to the pros and cons of it that would be helpful towards
minimum requirements of a successor from within the IETF, as well as a good
understanding of the needs/wants from the community.

Some background:
I have been active in the domain name industry since the early 1990s.  I
was around to watch the challenges for developers that work with internet
domain names in 2001 when TLDs like INFO or MUSEUM appeared and didn't
immediately function.

Most application developers used a static list at best or had very base
logic about a dot followed by 3 or fewer letters.  This got more
sophisticated over time to reflect the subdelegations such as co.uk,
co.jpor com.au stubs and systems like CentralNic's
uk.com subdomains, but typically followed a static list.

ICANN's glacial pace of introducing new TLDs over the 13 years that
followed perpetuated the use of static lists.

Cookies and security around cookies created the need for something that
could keep pace with and map to the diversity of the ccTLD and subdomain
space, and Jo Hermans founded the PSL.

The PSL was among a number of different extension lists maintained by a
variety of volunteers and commercial interests.

PSL has become the survivor over time, with others falling into decay or
atrophy.

The diversity of internet applications and uses for PSL expanded rapidly,
either former alternatives merging in, or new innovative uses evolved.

This happened because it was the least awful, most comprehensive resource
out there that was being maintained.

That and the IANA list was not as comprehensive to reckognize valid vs
invalid delegations under ccTLDs at the third or deeper level, and would
not include CentralNic (there are others but I use them only as a
brightline example of legitimate participants that should receive
non-discriminatory treatment of strings) meet the real-world needs of the
development community at large.

And Currently:
The pace of the new TLD introductions currently under way has most everyone
in scaling PSL under the deployment rate that ICANN - and saw the benefit
to the development community

I fear this BoF is quite reactive and late phase work to address a real
need for a list of extensions that enhances the IANA TLD list (co.uk,
org,uk et al vs just UK) without prejudice for sub-domaining providers.

I am currently fielding many requests from within the registry operators
who want to understand why their new TLDs do not work from the start within
applications / software NOW.

ICANN has done some very light informational work around suggested
practices, but I think if this group could arrive at a competent solution
that covers the needs of the developer community which caused the thing to
form in the first place, DBOUND might replace the PSL need in the developer
community, gradually.

I understand you have Gerv Marham from Mozilla in mind to participate.  He
is outstanding and I would further enhance his participation through mine
as I have experience with PSL as well as exposure to the ICANN gTLD and
ccTLD community of registry operators and DNS system, coupled with ongoing
requests from within many of the community of developers or consumers of
the PSL - so I understand many of the things that would attract current PSL
consumers to make an adaptation to a different system.

I would like to contribute my experience and time to help with DBOUND so
that it could be a replacement that has a potential to be a legitimate and
comprehensive replacement to PSL.

I and the other maintainers of PSL would welcome a competent successor - we
are not a point of resistance.  In fact, we pragmatically view the PSL as
the least awful, most comprehensive and frequently updated resource of its
kind.

It exists because there is not a viable alternative available.

I also fear the work might lean too far towards forcing authority at the
cost of viability as a PSL successor.  One can look no farther than the
depth and pace of DNSSEC adoption to identify the pace that an
authoritative registry might implement a DNS based solution.

The most important thing to consider about a successor would be to keep in
mind that if the successor fails to meet the community needs/wants or has
spotty adaptation by central authorities such as we see with the DNSSEC
implementation pace or that of IPv6 transitions - I doubt the developers
will migrate in the manner we'd all like to see, which would perpetuate the
need for a resource that is maintained by the community.

So, we have some challenges to address together towards a viable successor.
 I would like to help shape DBOUND into a viable alternative so that it
might have some hope of traction.

Thank you for including me in this discussion.

-Jothan

Jothan Frakes
+1.206-355-0230 tel
+1.206-201-6881 fax

---

From: "Olaf Kolkman" <[email-masked]>
Date: Fri, 07 Feb 2014 11:19:01 +0100

On 6 Feb 2014, at 0:23, Jothan Frakes wrote:

> I would like to contribute my experience and time to help with DBOUND so that it could be a replacement that has a potential to be a legitimate and comprehensive replacement to PSL.

Jothan,

You are most welcome. 

I think that at this moment we'd derive most value from your (and anybody else's) contributions if it culminates in a comprehensive problem statement.

--Olaf

---

From: Joe Abley <[email-masked]>
Date: Fri, 7 Feb 2014 09:08:40 -0500

> I think that at this moment we'd derive most value from your (and anybody else's) contributions if it culminates in a comprehensive problem statement.

One thing that came up the other day whilst watching a demo of a proof-of-concept tool for data collection on nameservers was making on-the-fly, automated decisions about how to reduce a set of QNAMEs to a sensible bucket for maintaining counters (as well as distinguishing between typos and new gTLDs we haven't heard of this week yet).

I think the general question of the sensible label boundary to infer an administrative separation is most usually asked in the context of user interfaces and cookie policy in browsers, but it has a useful part to play in operational measurement, too.

Joe

---

From: Jothan Frakes <[email-masked]>
Date: Fri, 7 Feb 2014 11:50:35 -0800

​Hi Joe-

​
I realize we might be at an early stage
​ (pre BoF)​
, but
​completely ​
we should "wish list" this a bit...

I think there is an opportunity in formation of the problem statement that
we identify potential uses like you are describing and capture them in a
manner that organizes them into buckets.

I think we will have different consumers of a resource seeking different
things, looking at the other internet drafts and "case history".

​Here is a start at header, high level and low level uses of the string as
well as some of the data that I have been asked about or thought should be
present inside of these entries of DBOUNDs.  It is certainly not exhaustive
and could certainly benefit from others adding on.

1. Administrative / Authoritative Records
1.1 Version
1.2 Timestamp
1.3 URL of Unified DIFF from previous
​1.4 Changelog Synopsis​
​
And here is some of the use cases and potential data

​2. ​
Name apex aggregate uses: (could use collapsed form of the list
​ ​
)

​2.1​
 UI form entry / programming validation

2.2​
 Mailer / security validation

​2.3​
 log / parsing / monitoring

​
Record level use (detailed info per apex
​ / "registry"​
)
​3.record​

​3.1​
  apex behavior
​3.1.1 Cookies ​
(browser security)
​
3.1.2 DNSSEC Active + ZSK/KSK if deemed appropriate
3.1.3 "official" sub-apex(es)  (ie .foo would identify bar.foo and kung.foo
as 'official' / explicit subs)

3.2​
 Zone Whois replacement - Self management of contact information

​3.2.1 Zone
contacts, address of responsible part​
y​
​ 3.3
 "Registry" detail Resource records

​3.3.1​
   URI and ports / style of Whois server for 'zone'
​ (ie port 43, whois.foo.hostname; web port 80,
www.address.of.that/plus/subpath; REST JSON etc )​

​3.3.2​
   "registry" website URL(s)
​   3.3.2.1 Primary "registry" URL​
​   3.3.2.2 Additional "registry" Resources (ie TWITTER, @​twitterhandle;
RSS, url.to.feed.address.example/atom.rss; etc)

​3.3.2.3

​"registry" ​
Policies

​3.3.2.3.1 ​
​Substring "r
egistration
​"​
 ​

3.3.2.3.1.1 ​Allowed ​
Sub domain length
​(s)​
​
​

​
3.3.2.
​3
.1.1
​.1​
 Min
 ​​
​

​
​​
3.3.2.
​3
.1.1
​.2​
 M
​ax
​
​
​
3.3.2.
​3
.1.1
​.3​
 Explicitly Disallowed​
​ Lengths (ie no 2 char)​

​​

3.3.2.3.1.2 ​
​
Regex of allowed strings
           3.3.2.3.1.2 Disallowed Strings
           3.3.2.3.1.2.1 static list of restricted / unavailable strings
           3.3.2.3.1.2.2 regex of disallowed strings

​3.3.2.3.2​
 sub domain IDN support details

​
​​
3.3.2.
​3
.2​
​.1 ​
URI of allowed characters

​
​
3.3.2.
​3
.2​
​.2
URI of IDN policy, etc

​3.3.2.3.3 ​
"parent relationship"
​ (would identify if tied to parent, could be paired with 3.1.3 of parent
to validate)​
    3.3.2.3.4 Allowed RTYPEs in DNS zone (would be explicit list, and what
is not listed is disallowed - could be overridden in child zones by that
child's sub-apex entry)
3.4 entry last change
3.4.1 timestamp
3.4.2 updated by
3.4.3 validated by

​Just thought I'd get it started...
​I'd welcome others' questions, consolidations, or friendly amendments, as
I am certain there are more.

​Most consumers I am exposed to would have a focus on  3 & 3.1.1 or ​3 &
some mix of elements within 3.3.2.3, but more are looking for a mix and
match of things within the sub-elements of 3.

​-Jothan​

On Friday, February 7, 2014, Joe Abley <[email-masked]> wrote:

> > I think that at this moment we'd derive most value from your (and
> anybody else's) contributions if it culminates in a comprehensive problem
> statement.
>
> One thing that came up the other day whilst watching a demo of a
> proof-of-concept tool for data collection on nameservers was making
> on-the-fly, automated decisions about how to reduce a set of QNAMEs to a
> sensible bucket for maintaining counters (as well as distinguishing between
> typos and new gTLDs we haven't heard of this week yet).
>
> I think the general question of the sensible label boundary to infer an
> administrative separation is most usually asked in the context of user
> interfaces and cookie policy in browsers, but it has a useful part to play
> in operational measurement, too.
>
>
> Joe
>

---

From: Joe Abley <[email-masked]>
Date: Fri, 7 Feb 2014 15:10:59 -0500

On 2014-02-07, at 14:50, Jothan Frakes <[email-masked]> wrote:

> ​I realize we might be at an early stage ​ (pre BoF)​, but ​completely ​we should "wish list" this a bit...

Your wishlist looks like you're assuming a solution that looks a lot like a better-managed and better-structured public suffix list.

Is the solution space wide enough to consider other options, e.g. publication of policy that communicates the same information in the form of data in the DNS, published as resource records?

I'm not saying that one is better than the other (or that the right solution requires just one approach, versus more than one), but it'd be nice to understand the part (if any) different such approaches could play as part of a working group discussion rather than as a pre-baked assumption.

[For illustrative purposes only, just to better explain the question above, not jumping to implementation assumptions, I mean something like

  (in the root zone)
  . IN SOA ...
  . IN PSL whois.iana.org. "http://www.root-servers.org/"

  (in the COM zone)
  COM. IN SOA ...
  COM. IN PSL whois.crsnic.net. "http://www.verisigninc.com/"

  (etc)

i.e. RRSets in the DNS at a zone apex that indicates the presence of a registry-like administrative boundary, using the scaffolding already present in the DNS to do versioning, cryptographic signatures, etc. No doubt any real candidate mechanism would be better fleshed out than the above, no need to point out the need for extra RDATA, etc, etc.]

Joe

---

From: Jothan Frakes <[email-masked]>
Date: Fri, 14 Feb 2014 13:37:01 -0800

Hi Joe-

Due to client obligations making a schedule conflict, I won't be able to
directly attend the upcoming IETF meeting in London to participate in the
BoF.   I will be in Singapore at the upcoming ICANN meeting and wanted to
participate in (or propose if it is not yet in existence) a BoF there.

Is that possible?

> Your wishlist looks like you're assuming a solution that looks a lot like
> a better-managed and better-structured public suffix list.
>
>
​Yeah, I can definitely see that the list looks like that - actually to be
honest, it is that...  Although I went all-out on a starting point to
include many, many things beyond PSL.   ​​Just wanted to get a wishlist
started.  :)

The list is a set of asks or personal requests I have been approached with
over the past 10-12 years related to different elements of domain
boundaries or domain validation.  This has been from LEA, Security, and DNS
providers but also from just general internet tool developers or people
writing simple web-forms or hosting companies.

I don't want us to get stuck to where we can't think big at the time there
is a blank canvas for us to paint, so why not get all the cans of paint
onto the table, and then let the group discussion evolve what we do.  I am
sure some of this would fall away depending upon group wisdom.

I don't want to necessarily prejudice the group's outcome, but rather
identify needs/wants towards a goal of whatever we would potentially draft
being inclusive of as many real world use cases as possible.  I and others
have participated in pre-Idraft dialog or ghostwriting them and seen them
fall into the ether or not get traction.

PSL exists because there really is not anything else.  It formed in a
vacuum to serve an important need.  We might solve some/all/more than these
needs through the dbound group work.

Full disclosure (and selfishly), I'd like to see something out of this
group that is a viable substitute for PSL.  PSL is volunteer-operated and
it is one of those "no good deed goes unpunished" efforts - the
shortcomings are highlighted frequently than the benefits - by the people
it benefits.  I personally have thousands of hours invested in PSL and
participate in it because I immediately recognized how it benefits
developers and the internet community, and operates in the public interest
- if it can keep up.

A decentralized version with authoritative origins would be far better -
getting registries to maintain something like their suffixes for their
zones in something centralized like PSL can take a lot of coordination and
effort in validating the data and the submission.  Similar to DNSSEC there
is no compulsion on authoritative operators to participate, and there is an
educational gap as to what it is (and isn't).  We also have the other side
of the equation in the 'consumers' within the development / application and
other communities who derive use from this resource to consider as well.

> Is the solution space wide enough to consider other options, e.g.
> publication of policy that communicates the same information in the form of
> data in the DNS, published as resource records?
>
>
I sure hope so.  I think DNS may be well suited for this, especially if
there's some means to decentralize things and place authority into the
hands of the appropriate party, such as the registry operator.

> I'm not saying that one is better than the other (or that the right
> solution requires just one approach, versus more than one), but it'd be
> nice to understand the part (if any) different such approaches could play
> as part of a working group discussion rather than as a pre-baked assumption.
>
> [For illustrative purposes only, just to better explain the question
> above, not jumping to implementation assumptions, I mean something like
>
>   (in the root zone)
>   . IN SOA ...
> i.e. RRSets in the DNS at a zone apex that indicates the presence of a
> registry-like administrative boundary, using the scaffolding already
> present in the DNS to do versioning, cryptographic signatures, etc. No
> doubt any real candidate mechanism would be better fleshed out than the
> above, no need to point out the need for extra RDATA, etc, etc.]
>
>
Thanks for the example.  Could be new record type, might be a few.​​  For
example, the boundaries might be different for Cookies than Whois in a
given zone.

In any event, if there was simply a pointer like that, consumers would want
there to be consistency to those resources, so a suggested structure of
file / resources available at the destination of whatever location would be
wise to include in our scope if our work takes us in that direction.

We would the authority chain to be clear, but also want to not prejudice
(nor introduce opportunity to prejudice) sub-domain providers like
Centralnic (EU.COM, UK.COM etc) or other similar providers from being able
to include resources.

---

From: Joe Abley <[email-masked]>
Date: Fri, 14 Feb 2014 16:46:36 -0500

Hi Jothan,

On 2014-02-14, at 16:37, Jothan Frakes <[email-masked]> wrote:

> Due to client obligations making a schedule conflict, I won't be able to directly attend the upcoming IETF meeting in London to participate in the BoF.   I will be in Singapore at the upcoming ICANN meeting and wanted to participate in (or propose if it is not yet in existence) a BoF there.
> 
> Is that possible?

I don't know (I'm not involved in the ICANN meeting or this list/BOF in any way other than an interested participant) but in general I'd say it's not hard to find a room at an ICANN meeting to discuss things.

I will be in Singapore and if such a thing was to happen, I would try to attend.

Thanks for the detailed and good answers to my questions! I like the way you're going with this.

Joe

---

From: Michele Neylon - Blacknight <[email-masked]>
Date: Fri, 14 Feb 2014 22:32:19 +0000

There's usually rooms
I could ask ICANN staff for a room if you want?

------------------------
Mr. Michele Neylon
Blacknight
http://Blacknight.tel

Via iPhone so excuse typos and brevity

> On 14 Feb 2014, at 21:47, "Joe Abley" <[email-masked]> wrote:
> 
> Hi Jothan,
> 
> _______________________________________________
> Dbound mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dbound

---

From: Eric Brunner-Williams <[email-masked]>
Date: Fri, 14 Feb 2014 16:43:17 -0800

> I will be in Singapore and if such a thing was to happen, I would try to attend.

My experience (while consulting for CORE) was that more often than not 
we were not able to obtain a room sufficient to hold meetings of the 
"working group on X" type.

For small meetings (single client business development) we were able to 
lease "business center" space (which was convenient for signage and 
literature storage pre- and post-show).

The venue bar has been a reliable venue, as have been off-property 
locations, usually restaurants.

My two beads worth of response to Joe's expectation (or hope) that 
off-program meeting space is easily available. If you can get the 
meeting room coordinator to get you a room you're doing better than we 
did, on average, for stuff we thought was reasonably useful.

Eric

---

From: Joe Abley <[email-masked]>
Date: Fri, 14 Feb 2014 21:23:51 -0500

On Feb 14, 2014, at 19:44, Eric Brunner-Williams
<[email-masked]> wrote:

> My two beads worth of response to Joe's expectation (or hope) that off-program meeting space is easily available. If you can get the meeting room coordinator to get you a room you're doing better than we did, on average, for stuff we thought was reasonably useful.

Well, I do know people. I can certainly try if that seems useful.

Joe

---

From: Eric Brunner-Williams <[email-masked]>
Date: Fri, 14 Feb 2014 19:49:11 -0800

> Well, I do know people. I can certainly try if that seems useful.
I thought I did too.

I'm not suggesting the experience I related was representative, only 
that when asking for "90 minutes use of a capacity 30+ room" for 
purposes such as creating policy and mechanism for ranking community 
rights along with trademark rights and general availability, or creating 
policy and mechanism for locality constrained applications of the DNS, 
that is, community and/or municipal service models, the requests went 
unanswered more often than not.

The bar across the street at Raffles is nice, and there is much more 
than just the Raffles bar. The national library has adequate rooms for 
rent also, just a short walk past the Raffles.

Less dull choices for a 30 room with audio are tour bus and water tour 
rentals, the audience gets better scenery than the standard hotel walls, 
they can walk a bit if there's a destination, and there is no impact 
upon, or dependency upon, the rooms available at the venue.

Eric Brunner-Williams
Eugene, Oregon