Subject: [dbound] draft-brotman-rdbd?

From: Andrew Sullivan <[email-masked]>
Date: Thu, 28 Feb 2019 03:46:41 -0500

Is draft-brotman-rdbd being discussed here or elsewhere?  I have some
observations.

A

-- 
Andrew Sullivan
[email-masked]

---

From: "Jiankang Yao" <[email-masked]>
Date: Thu, 28 Feb 2019 16:59:10 +0800

Maybe here. Is it time to wake up this WG?

Jiankang Yao

From: Andrew Sullivan
Date: 2019-02-28 16:46
To: dbound
Subject: [dbound] draft-brotman-rdbd?
Is draft-brotman-rdbd being discussed here or elsewhere?  I have some
observations.

A

-- 
Andrew Sullivan
[email-masked]

_______________________________________________
dbound mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dbound

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 28 Feb 2019 10:05:08 +0000

Hi Andrew,

On 28/02/2019 08:46, Andrew Sullivan wrote:
> Is draft-brotman-rdbd being discussed here or elsewhere?  

I think Barry Leiba suggested to Alex to use this list,
which works I guess.

> I have some

Great, looking forward to that.

Thanks,
S.

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 28 Feb 2019 05:59:03 -0500

Hi,

Since this is the place, I read draft-brotman-rdbd-00 and have a few
observations.

I'm slightly concerned at the way this is being conceived, because I
think it has a conceptual separation in it that is troublesome.  It's
found here:

   RDBD is intended to demonstrate a relationship between registered
   domains, not individual hostnames.  That is to say that the
   relationship should exist between "example.com" and "dept-
   example.com", not "foo.example.com" and "bar.dept-example.com".

The problem, of course, is that foo.example.com, bar.dept-example.com,
and really.long.set.of.labels.example.com are all _perfectly good_
domains.  Now, maybe what the above intends to communicate is that
RDBD is intended to demonstrate a relationship between the owner name
at an apex and all the subsidiary names in that zone (i.e. up until
any subordinate zone cut), and the owner name at an apex and all the
subsidiary names in _that_ zone.  Alternatively, maybe what the above
intends to communicate is that RDBD is intended to demonstrate a
relationship between owner names immediately below a so-called public
suffix.  I can imagine use cases for either, though I am not sure
they're as general purpose as people might think.

I am more than a little worried about the parent/secondary split.
(Also, both of these are already well-used terms in the DNS, so I
really strongly urge some other terms.  We have enough trouble with
overloading DNS terms without doing so with two of the most frequently
used terms in DNS operations, particularly when this mixes terms from
delegation and from zone transfers.)  It isn't clear to me, from the
discussion, that it is obviously true in most of the use cases people
have that one of the domains people want to talk about is "the main
one".  More importantly, it is quite likely that someone trying to
query this will have a different idea about which is "main" than the
domain operator, so if this isn't a fully bidirectional operation
(which it's not in -00) there could easily be problems in use.  (This
is part of why SOPA was proposed to be two-way.)

If you're going to do this with TXT records, then you definitely need
an underscore label, or the apex name is going to be a mess.  But that
will mean that this won't work for DNAME.  That consideration is part
of why SOPA defined a new RRTYPE and put the RR at the name that was
supposed to be related.

I hope these comments are useful.  I have limited cycles to spend on
IETF stuff these days, but this was always a topic close to my heart
(and I'm super annoyed the DBOUND WG failed), so I'll try to keep up.

A

-- 
Andrew Sullivan
[email-masked]

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 28 Feb 2019 11:52:43 +0000

Hiya,

Thanks for the good comments.

> they're as general purpose as people might think.

I think that's Alex's text so I'll leave it to him to
explain:-) From my POV though, see my answer to Paul
Wouters on the (lack of;-) semantics here. (That was
on a different list but is at [1].) Not sure if that'll
clarify or muddy the waters though, so it may be easier
to chat about this f2f in Prague if we get a chance.

   [1] https://mailarchive.ietf.org/arch/msg/art/DaqhhnrNRSrIePbQTWDLCDuaw6k

> delegation and from zone transfers.)  

Fair point. Better terms welcome. If we don't get handed
some, we'll try invent a couple.

I've noted this and a couple of other issues raised in the
editor's version on github. [2] (And btw, if there're other
things from these mail threads I ought note there, anyone
can just ping me to add such.)

   [2]
https://github.com/abrotman/related-domains-by-dns/blob/master/rdbd.txt

> It isn't clear to me, from the

But if this stays unidirectional, one could always do the trick
twice I think. So I'm not sure I get why that'd be a problem?
(Assuming the syntax continues to allow that.)

I'm also not sure if always-being-bidirectional is the right
design myself, (see above wrt lack of semantics) but if it were
and didn't add a lot of complexity, I'd be ok with it.

> of why SOPA defined a new RRTYPE and put the RR at the name that was

Yep, fair enough. Personally I think a new RRTYPE is fine and
will get a couple of issues off the table so is likely the right
thing to do. I think Alex is also ok with that, in which case,
we'll see about whacking out a -01 along those lines before the
I-D cutoff. (And if not, we'll continue to be rightly beaten up
for yet more abuse of TXT:-)

> (and I'm super annoyed the DBOUND WG failed), so I'll try to keep up.

Excellent!

Cheers,
S.

---

From: "Brotman, Alexander" <[email-masked]>
Date: Thu, 28 Feb 2019 12:58:43 +0000

--
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast

> -----Original Message-----
> From: dbound <[email-masked]> On Behalf Of Stephen Farrell
> Sent: Thursday, February 28, 2019 6:53 AM
> To: Andrew Sullivan <[email-masked]>; [email-masked]
> Subject: Re: [dbound] draft-brotman-rdbd
> 
> 
> Hiya,
> 
> explain:-) From my POV though, see my answer to Paul Wouters on the (lack of;-
> ) semantics here. (That was on a different list but is at [1].) Not sure if that'll
> clarify or muddy the waters though, so it may be easier to chat about this f2f in
> Prague if we get a chance.
> 
>    [1]
> https://mailarchive.ietf.org/arch/msg/art/DaqhhnrNRSrIePbQTWDLCDuaw6k
[Brotman, Alexander] 

From my perspective, I was looking to create a relationship for the registered domains (I couldn't find a good RFC to use a reference for this), so I believe your comment about the apex is correct.  So looking to know that "example.com" and "dept-example.com" (or "example.com" and "example.co.uk", etc.) should have that link.

> Fair point. Better terms welcome. If we don't get handed some, we'll try invent a
> couple.
> 
> I've noted this and a couple of other issues raised in the editor's version on
> github. [2] (And btw, if there're other things from these mail threads I ought
> note there, anyone can just ping me to add such.)
> 
>    [2]
> But if this stays unidirectional, one could always do the trick twice I think. So I'm
> not sure I get why that'd be a problem?
> I'm also not sure if always-being-bidirectional is the right design myself, (see
> above wrt lack of semantics) but if it were and didn't add a lot of complexity, I'd
> be ok with it.
> 
> Yep, fair enough. Personally I think a new RRTYPE is fine and will get a couple of
> issues off the table so is likely the right thing to do. I think Alex is also ok with
> that, in which case, we'll see about whacking out a -01 along those lines before
> the I-D cutoff. (And if not, we'll continue to be rightly beaten up for yet more
> abuse of TXT:-)
> 
[Brotman, Alexander] 

I'm 100% okay with a new RRTYPE, and expected we would do so.  I do apologize for not having that be properly created in -00, but wanted to get some comments on the -00 draft, and ideally a -01 before Prague that incorporates feedback from folks.

---

From: "John Levine" <[email-masked]>
Date: 28 Feb 2019 11:47:16 -0500

In article <[email-masked]> you write:
>   domains, not individual hostnames. ...

I think the intention here is what's known in DMARC-ese as an
organizational domain, which in practice means a domain whose
immediate parent is in the PSL.

I agree with your point about RRs, and as I've said a few times,
depending on what you think is hard or what is easy, the signatures
seem to add implemenation complexity without adding much actual
utility.

R's,
John

>(and I'm super annoyed the DBOUND WG failed), so I'll try to keep up.

Me too and I never really understood why.  Near as I can tell, my
proposal and Casey's were quite similar, but Casey's had a whole bunch
of added stuff that was hard to understand (I didn't) so people gave
up.