Subject: OASIS and new RR types

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 8 Aug 2006 19:30:19 +0200

Page 32 of the following document:
http://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf

shows that the DNS community has not yet fully succeed in convincing the
rest of the IT-world that it is easy and natural to register new RR types.

BTW, is not the listed method a bit cumbersome since you apparently
must enumerate *all* NAPTR records of a certain domain?

It *still* seems that "typed labels" and TXT records would be potentially
faster and not impose limitations on other uses of TXT records or DNS
itself.  In a nutshell:

1. Requester wants meta-data belonging to a name-space like "urn:oasis:something".

2. Provider insert such data as (using a sample rewrite scheme):
$ORIGIN example.com
urn_0oasis_0something  TXT  "the stuff"

2. Requester queries for TXT records with label "urn_0oasis_0something.example.com"

This should not clash with other uses and you should only get back the relevant TXT records.

It may be a kludge, but IMHO a relatively moderate such.

Anders

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Douglas Otis <[email-masked]>
Date: Tue, 8 Aug 2006 15:37:26 -0700

> It may be a kludge, but IMHO a relatively moderate such.

The desire is to establish a policy assertion for a domain and all  
subdomain unless an existing policy record is within the subdomain.   
That means a bad actor may attempt to use a non-existent subdomain to  
avoid a policy being applied.  To avoid this situation, the wildcard  
scheme being suggested is reduces the number of transactions used to  
search for a policy assertion found at a specific prefix label.  The  
prefix makes searching less efficient.  This scheme was to improve  
upon an upward search terminated by a policy record or the TLD.   
Currently the policy record is placed at a specific prefix to isolate  
a generic TXT record.

-Doug

---

From: David Conrad <[email-masked]>
Date: Tue, 8 Aug 2006 13:21:35 -0700

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

I find this whole thing with getting RRs allocated a bit confusing.

Would creating a form on IANA's website make this less of an issue?   
Or would that make things worse?

Thanks,
-drc

---

From: Mark Andrews <[email-masked]>
Date: Fri, 11 Aug 2006 13:33:54 +1000

> Or would that make things worse?

	I don't think it will change a thing.  Too many keep spreading
	FUD and being Microsoft apologists.

	If Microsoft's DNS API can't handle new types then Microsoft
	needs to fix the API.  The 20 year old libresolv API can
	handle arbitary types.  There was no excuse for Microsoft
	writing a API that can't handle unknown types.

	If a firewall can't handle a unknown type then the firewall
	is broken.  You get the firewall fixed or you replace the
	firewall with one from a vendor that knows how to handle
	DNS.

	It's not the ease of getting a type anymore.  It is easy
	to get new types.  A couple of pages like RFC 4431 is all
	that is required.

	Mark

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]