Subject: Revised draft charter for DNSEXT

From: Ólafur Guðmundsson /DNSEXT co-chair <[email-masked]>
Date: Sat, 07 Jul 2007 18:20:57 -0400

After applying feedback to previous draft charter, here is what
the chairs and AD propose.

Send comments soon so we can revise the charter soon.

         Olafur

The DNS is a critical Internet infrastructure, with a large installed base
and repertoire of protocol specifications. The DNSEXT WG group
will actively advance DNS protocol-related RFCs on the standards
track, while defending against further extensions of the DNS that
are of questionable value.

DNSEXT scope resides within the realm of the DNS protocols,
not operation of the DNS. Specifically, items that are under
its purview include:

  1. Any proposed changes that affect DNS protocols "on the wire"
  2. Any proposed changes that affect how DNS data is processed

Thus, the WG will limit itself to review of proposals for new extensions and
clarification of the DNS protocol, including extensions on DNSSEC.
Adoption of new work targeted for standards track will require changes
to this charter. The group does not intend to hold face to face 
meetings, though
may do so if deemed necessary for resolution of a specific issue at hand.

DNSEXT also maintains a living ID of errata for the DNSSECbis (RFC403[345])
documents, and will conduct the specified RFC2929bis review of RR templates
as they are posted.

Milestones:
July 2007 RFC2536bis and RFC2539bis advanced to IESG.
Sept 2007 DNAMEbis advanced to IESG
Oct  2007 Forgery Resilience advanced to IESG

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 9 Jul 2007 10:08:00 +0200

On Sat, Jul 07, 2007 at 06:20:57PM -0400,
 Ólafur Guðmundsson /DNSEXT co-chair <[email-masked]> wrote 
 a message of 43 lines which said:

> The DNS is a critical Internet infrastructure,

Someone whispered in my ear that "critical Internet infrastructure" is
an heavily loaded buzzword, specially in governance contexts (ICANN,
IGF, etc) which can even trigger legal consequences.

Why not a more neutral thing such as "The DNS is, in practice, a
mandatory component of most Internet services"?

---

From: Alex Bligh <[email-masked]>
Date: Mon, 09 Jul 2007 10:38:16 +0100

Olafur,

--On 07 July 2007 18:20 -0400 "Ólafur Guðmundsson /DNSEXT co-chair" 
<[email-masked]> wrote:

Nits only:

> The DNSEXT WG group

A. The word "group" is superfluous (WG /is/ a working "group").

B. This (possibly deliberately) reads in a slightly reactionary manner.
It (rightly) suggests DNSEXT should defend against questionable
"further" extensions, but the extensions DNSEXT should "advance"
are "RFCs on the standards track". This might be read that the
"defence" applies prospectively (i.e. to future RFCs), but the
"advance" only applies to existing RFCs (else what purpose
does the word "further" serve). Assuming it wasn't meant to be
quite that reactionary, I suggest either
(1) dropping the word "further"; or
(2) adding the qualifier "current and future" before "RFCs" in
    the first clause; or
(3) rewriting as "The DNSEXT WG will actively advance on the standards track
    those DNS protocol related RFCs and extensions that are of value, whilst
    defending against those which are not." [this formulation also loses
    any implication that RFCs and other extensions (IDs?) will be
    somehow be treated qualitatively differently]

> DNSEXT scope

C. I think that should be "The DNSEXT WG's scope"

> resides within the realm of the DNS protocols,
> Thus, the WG will limit itself to review of proposals for new extensions

D. I suspect "proposed" or "suggested" extensions would be better than
"new", as it then covers current proposals too.

> and clarification of the DNS protocol, including extensions on DNSSEC.
> Adoption of new work targeted for standards track will require changes to
> this charter. The group does not intend to hold face to face meetings,
> though may do so if deemed necessary for resolution of a specific issue
> at hand.
>
> DNSEXT

E. "The DNSEXT WG"

> also maintains a living ID of errata for the DNSSECbis
> (RFC403[345]) documents, and will conduct the specified RFC2929bis review
> of RR templates as they are posted.

Alex

---

From: Niall O'Reilly <[email-masked]>
Date: Mon, 09 Jul 2007 12:27:22 +0100

> mandatory component of most Internet services"?

	s/a mandatory/an indispensible/ ??

	It's not because someone has mandated it that we can't do
	without it, after all ...  8-)

	/Niall

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 9 Jul 2007 10:10:23 -0700

I would like to see a statement of purpose rather than just a claim of authority.

In particular I would like to see us get to the position where the DNS is both secure and can adapt to any current or foreseable application layer needs. Here I take a ten year view. What type of DNS do we need for a world where every lightswitch is IP addressable?

DNSSEC is certainly a big step forward. I am confident that DNSSEC is the right model for inter-network naming security, we might need to do some tweaks but I don't expect much more than tweakage. Applied to the intra-network I think we need to look into model that is a little more Kerberosy, and look into TSIG a little further. 

The problem with the pure end to end approach is that it puts a lot of processing requirement out at the periphery of the network. I don't want to be doing public key on an 8-bit microprocessor more than a few times a year. A model where the local DNS server is considered to be trustworthy and responsible for the trust path processing makes a lot of sense. What we are missing to support that model is a lightweight key agreement mechanism that allows the trust relationships to be established in a flexible and simple manner.

On the adaptability front I would like to see the principle adopted that we only extend the DNS infrastructure to support new naming functions, not to support uptake of those functions by specific applications.

It should be possible for any application that requires naming support to make use of the existing DNS infrastructure without confering with DNSEXT. In fact this has to be the case, with Web services the number of new applications protocols is going to baloon from a few tens of new proposals a year to thousands. Machine machine protocols are not subject to the same forces of conformity that limit the proliferation of human/machine protocols.

The problem is that protocols only become stadards after some considerable period of non-standard use. Even in the case of HTTP several years went by before the IETF working group was formed. Take a look at OpenID, they use every ad-hoc naming scheme imaginable, but not the naming scheme of the Internet architecture.

XPTR is simply a tweak, the larger idea is to push all service oriented naming schemes into a prefix based approach whether they require wildcards or not. This in turn gives us consistency and hence leverage when we look to deploy more interesting naming features. Consistency in the discovery mechanism allows us to introduce features such as geographically sensitive resolution services.

What we should aim for is to be able to close DNSEXT with the DNS a clearly defined entity that application designers can employ for precisely defined purposes with well understood security properties without having to understand the finer points of DNS architecture.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Ólafur 
> Guðmundsson /DNSEXT co-chair
> Sent: Saturday, July 07, 2007 6:21 PM
> To: [email-masked]
> Subject: Revised draft charter for DNSEXT
> 
> 
> After applying feedback to previous draft charter, here is 
> what the chairs and AD propose.
> 
> The DNS is a critical Internet infrastructure, with a large 
> installed base and repertoire of protocol specifications. The 
> DNSEXT WG group will actively advance DNS protocol-related 
> RFCs on the standards track, while defending against further 
> extensions of the DNS that are of questionable value.
> 
> Thus, the WG will limit itself to review of proposals for new 
> extensions and clarification of the DNS protocol, including 
> extensions on DNSSEC.
> Adoption of new work targeted for standards track will 
> require changes to this charter. The group does not intend to 
> hold face to face meetings, though may do so if deemed 
> necessary for resolution of a specific issue at hand.
> 
> DNSEXT also maintains a living ID of errata for the DNSSECbis 
> (RFC403[345]) documents, and will conduct the specified 
> RFC2929bis review of RR templates as they are posted.
> 
> Milestones:
> to unsubscribe send a message to 
> [email-masked] with the word 'unsubscribe' 
> in a single line as the message text body.

---

From: Kevin Darcy <[email-masked]>
Date: Tue, 10 Jul 2007 21:41:37 -0400

> IGF, etc) which can even trigger legal consequences.
Call a spade a spade. Clearly DNS is an infrastructure that is critical 
to the functioning of today's Internet -- if anyone doubts/disputes 
that, try taking it away for even a brief interval, and see what happens.

If there are legal consequences, so be it. We don't call a rabbit an 
elephant just because we're afraid some overzealous lawyer might file an 
annoying rabbit-related lawsuit some day, or some bureaucrat might claim 
control over all rabbit matters.

                     - Kevin

---

From: Jim Reid <[email-masked]>
Date: Wed, 11 Jul 2007 12:30:41 +0100

> If there are legal consequences, so be it. We don't call a rabbit  
> an elephant just because we're afraid some overzealous lawyer might  
> file an annoying rabbit-related lawsuit some day, or some  
> bureaucrat might claim control over all rabbit matters.

Stephane is right and you are wrong Kevin.

The phrase "critical Internet infrastructure" rings all sorts of  
alarm bells in places you don't live: regulators, governments,  
national security people, etc. If the IETF uses this phrase, the  
politicians and bureaucrats will quote it in other fora. But in a  
very different way: they'll use it to pursue their political  
objectives. That will mean more work and hassle for the engineers who  
have to engage with the lawyers and government types who turn up at  
the likes of ICANN, IGF and WSIS meetings. For instance, to reassure  
certain governments that their "critical Internet infrastructure"  
isn't under the control of the US government.

Unless you're prepared to spend your time in the trenches making  
those arguments to those bureaucrats Kevin, I suggest you back off.  
BTW you should be eternally grateful to the engineers -- and their  
employers! -- who do this thankless but vital work so that folk like  
you don't have to.

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Wed, 11 Jul 2007 14:20:59 +0200

Hello all,

After just reading the discussion between Stephan, Kevin and Darcy  
and having seen the first blog entries that put their own spin on the  
language I suggest to rephrase the first paragraph a tiny bit:

> The DNS protocol is an essential component of the Internet  
> architecture.
> It has a large installed base and repertoire of protocol  
> specifications.
> The DNSEXT WG group will actively advance DNS protocol-related RFCs on
> the standards track, while defending against further extensions of  
> the DNS
> that are of questionable value.
>

In that way the text talks about what we, as a group, are working on:  
a protocol and not the infrastructure. It probably doesnt fully  
prevent spin-doctors to read the Charter tea-leaves :-). I guess  
there are others that can phrase this much more eloquently.

hatless,

--Olaf

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

---

From: John Crain <[email-masked]>
Date: Wed, 11 Jul 2007 06:07:15 -0700

Hi Olaf, et al,

As one of those in the trenches, along with Jim and others,  I have  
to agree that the over-use of the term "critical infrastructure" is  
not always helpful.

It has become a bit of a buzzword and whether we like it or not does  
rings all sorts of bells that often distract from any of the real  
engineering issues.

I agree with calling a rabbit a rabbit but first be really sure that  
it really is a rabbit. Before using the term "critical Internet  
infrastucture" my only
advice is that we really sit and think about the criticality of that  
infrastructure to the Internet (Capital I).

As a protocol and the related implementations DNS is one of the  
important factors in how we decide to move packets. So is BGP, HTTP,  
SIP and every other
protocol that people use on a regular basis to conduct business.

I prefer Olaf's wording. I would probably state it as important  
rather than essential but I suspect that is just a matter of  
perspective.

John L. Crain

On Jul 11, 2007, at 5:20 AM, Olaf M. Kolkman wrote:

> and having seen the first blog entries that put their own spin on  
> the language I suggest to rephrase the first paragraph a tiny bit:
>
>
> In that way the text talks about what we, as a group, are working  
> on: a protocol and not the infrastructure. It probably doesnt fully

---

From: Edward Lewis <[email-masked]>
Date: Wed, 11 Jul 2007 09:44:06 -0400

At 14:20 +0200 7/11/07, Olaf M. Kolkman wrote:

>>  The DNS protocol is an essential component of the Internet architecture.
>>  It has a large installed base and repertoire of protocol specifications.
>>  the standards track, while defending against further extensions of the DNS

I'll throw yet another spanner - I'd just lop off the claims of DNS' 
importance and spread as this is an IETF WG charter not promotional 
for consulting services.  If the reader doesn't know about the DNS, 
the charter isn't important to them.

A phrase above "the Internet" is misused.  DNS is deployed in many 
networks besides the public Internet.  If you need to stress 
"essential" and want to keep the opening sentence, remove the last 
"the".

"Defending against"..."questionable value."  How about "while 
thoroughly reviewing further proposed extensions"?  A little less 
"leading the witness."
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Think glocally.  Act confused.

---

From: Ólafur Guðmundsson /DNSEXT chair <[email-masked]>
Date: Wed, 11 Jul 2007 10:44:31 -0400

thanks,

At 04:01 09/07/2007, you wrote:
>Olafur,
>
>--On 07 July 2007 18:20 -0400 "Ólafur 
>Guðmundsson /DNSEXT co-chair" <[email-masked]> wrote:
>
>Nits only:
>
>>The DNSEXT WG group

applied.

>    somehow be treated qualitatively differently]

This was intentional and is strongly implies that new work is
second class citizen until added to the charter :-) see below.

>C. I think that should be "The DNSEXT WG's scope"

applied,

>"new", as it then covers current proposals too.

This paragraph is about the hurdle that NEW work needs to pass
i.e updated charter, while the old work (i.e. existing RFC's)
can be done without charter changes.
For example clarifying Dynamic update in a way that may make it
behave slightly differently than the current RFC specifies but
complies with current implementations can be done w/o charter change.

>>though may do so if deemed necessary for resolution of a specific issue

applied

>>of RR templates as they are posted.

Thank you for your constructive comments,

         Olafur

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 11 Jul 2007 10:51:19 -0400

> >The DNS protocol is an essential component of the Internet  

Speaking as a failed philosopher, the word "essential" bugs me there.
Do we really think we can't have the Internet without there being a
DNS?  You could alter this to be

      The DNS protocol is a fundamental component of the Internet
      architecture, and is relied upon by large numbers of network
      applications.

The idea of the second clause there is to emphasise the importance of
the DNS to the things that use the network, rather than some intrinsic
importance of DNS itself.  It's probably just my twitchy reaction to
the word "essential", though.  I don't have a strong feeling about
it.  I like the rest of the altered text. 

> a protocol and not the infrastructure. 

I like that emphasis in particular.

A

-- 
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
jabber: [email-masked]                 +1 416 646 3304 x4110

---

From: Alex Bligh <[email-masked]>
Date: Wed, 11 Jul 2007 15:53:30 +0100

Olafur,

> second class citizen until added to the charter :-) see below.

Thanks. I understand the point, but it is (again perhaps deliberately) a
little subtle for those stumbling across the wording the first time,
especially for the hard of understanding (such as myself). If the subtlety
itself is not deliberate, you might perhaps want to make it a little more
explicit. This is not a big point.

Alex

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 11 Jul 2007 10:55:17 -0400

> I would like to see a statement of purpose rather than just a claim of authority.

Perhaps I don't understand exactly what you're aiming at here, but
doesn't, "The DNSEXT WG group will actively advance DNS
protocol-related RFCs on the standards track, while defending against
further extensions of the DNS that are of questionable value," entail
the purposes?  That is, to advance protocol-reated RFCs and defend
against questionable extensions?

A

---

From: Mark Andrews <[email-masked]>
Date: Thu, 12 Jul 2007 08:40:27 +1000

>       architecture, and is relied upon by large numbers of network

	Sounds reasonable.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Florian Weimer <[email-masked]>
Date: Thu, 12 Jul 2007 09:54:37 +0200

* Ólafur Guðmundsson:

> The DNSEXT WG group will actively advance DNS protocol-related RFCs
> on the standards track, while defending against further extensions
> of the DNS that are of questionable value.

This should read "while preventing further DNS protocol changes and
enhancements targeted to the standards track", if this is the
consensus.

At least I've got a hard part interpreting this sentence in the
proposed charter in any other way:

> to this charter.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 13 Jul 2007 07:29:26 -0700

I would strongly agree with Edward here, the phrase 'defending against' is likely to lead to protracted argument of a kind that is not at all productive.

It makes it sound very much as if the group intends to filibuster anything that's NIH. That is not a good plan.

The way to deal with the protection issue is to create a clearly defined interface between the DNS and applications that rely on it that is 1) infrastructure friendly even in cases of incompetent code, 2) does not require changes to the infrastructure to support new applications, 3) can be operated by IANA for at least a decade after DNSEXT has closed.
 
Encapsulation is a good thing, we should encapsulate the DNS.

As you might guess I do not like DNS tree walking algorithms. As written the charter suggests that the group should sit ready to pounce on any tree walking proposals and learn the proposers not to. That approach is only viable as long as the bad ideas are proposed in the IETF, the worst ideas are likely to come from outside the IETF altogether. Bad ideas from other sources have just as much bad effect.

We need an interface for the application designers that guides them in the right direction:

* Do use the DNS as the naming infrastructure, do not invent your own (XRI, UDDI, etc. etc.)
* Do use DNS service records for discovery (not privileged URLs which break the Web architecture)
* Do put small quantities of application data in the DNS directly (up to 32 bits of ergodicity)
* Do not put large quantities (500+ bytes) of application data in the DNS directly, use a URI instead.
* Do take account of the fact that the DNS has internal caching and that records have relatively long expiry times.
* Do not walk the DNS, use the wildcard mechanism

Then we get the .NET and Java communities to coat this set of best practices with a set of APIs that keep the incompetents from causing damage.

The reason for XPTR is that it allows us to provide a mechanism that is robust and unlikely to fail even if the application designer does not bother to register their code points.

In other words, do not write a charter saying 'defend the DNS against bad ideas', that is going to fail. Instead state that the group is going to add safety guards and rubber bumpers to the infrastructure so that the unintended damage is as unlikely as we can achieve.

> [mailto:[email-masked]] On Behalf Of Edward Lewis
> Sent: Wednesday, July 11, 2007 9:44 AM
> Cc: [email-masked]
> Subject: Re: Revised draft charter for DNSEXT
> 
> importance and spread as this is an IETF WG charter not 
> promotional for consulting services.  If the reader doesn't 
> know about the DNS, the charter isn't important to them.
> 
> A phrase above "the Internet" is misused.  DNS is deployed in 
> many networks besides the public Internet.  If you need to 
> stress "essential" and want to keep the opening sentence, 
> remove the last "the".
> 
> thoroughly reviewing further proposed extensions"?  A little 
> less "leading the witness."
> --

---

From: Suzanne Woolf <[email-masked]>
Date: Wed, 11 Jul 2007 14:59:32 +0000

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

> thoroughly reviewing further proposed extensions"?  A little less 

I support this language, on the grounds that the more dry, precise,
and technically oriented we can make this, the better off we will
be. The WG charter doesn't need to flag how important the work is--
the people involved enough in the work to read WG charters already
know.

---

From: Kevin Darcy <[email-masked]>
Date: Sat, 14 Jul 2007 01:37:32 -0400

Edward Lewis wrote:
> for consulting services. If the reader doesn't know about the DNS, the 
> charter isn't important to them.
>
Very true. In contexts where it is necessary to identify DNS'es 
importance and/or criticality and/or its rightful place in the 
constellation of Internet protocols/architectures, I still maintain that 
we should call a spade a spade. But none of that is necessary in a 
charter, so let's stay off the bureaucrats' and lawyers' radars by 
leaving it out completely.

- Kevin

---

From: Dean Anderson <[email-masked]>
Date: Sun, 15 Jul 2007 15:54:39 -0400 (EDT)

> Stephane is right and you are wrong Kevin.

No, Kevin is right. For good reasons, below

> national security people, etc. 

As well it should.

> If the IETF uses this phrase, the politicians and bureaucrats will
> quote it in other fora. But in a very different way: they'll use it to
> pursue their political objectives. 

You mean objectives like truth and honesty in engineering "critical
internet infrastructure"?  That's not politics. Bridge builders and
skycraper builders can't be bullshit artists. Likewise, DNS architects
have to be honest engineers whose work is based on solid science.  The
term "critical internet infrastructure" lets people know where bs should
stop, and solid science should begin.

> That will mean more work and hassle for the engineers who have to
> engage with the lawyers and government types who turn up at the likes
> of ICANN, IGF and WSIS meetings.

As well it should.  They represent stakeholders with genuine interests.

> For instance, to reassure certain governments that their "critical
> Internet infrastructure"  isn't under the control of the US
> government.

As well it should.  They also represent stakeholders with genuine 
interests.

> those arguments to those bureaucrats Kevin, I suggest you back off.  

Bullshit and terminology changes don't alter any of these problems.  
Once they figure out what your new codewords are, they'll find you out,
anyway. And they'll call you dishonest for trying to duck your
responsibilities for honestly describing the impact of your work with
deceptive terminology. You plainly understand the impact of your change
of terms and you identified exactly the forseeable certain consequences
of your terminology change above.  Your intention is to deceive people
who might be interested in "critical internet infrastructure".

> employers! -- who do this thankless but vital work so that folk like  

Of course, some of the "engineers", have not done the "thankless vital
work", but have promulgated unsound ideas for their personal gain. That
isn't Kevin's interest, or in the public interest.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Kevin Darcy <[email-masked]>
Date: Mon, 16 Jul 2007 23:17:14 -0400

Dean,
This discussion needs to happen eventually, but I don't think it needs 
to happen in the context of framing language for a WG Charter. A WG 
Charter explains WHY the WG exists, and HOW the WG intends to 
enhance/extend/fix the protocol to which it is devoted. The Charter does 
*not* need to explain WHAT the protocol is, or what its relative 
importance is perceived to be in the grand scheme of things.

So please, leave my name out of this. I'm fully in accord with just 
dropping the controversial language from the Charter. I don't think it 
suffers in the slightest from the omission. We can have the larger 
discussion at some other time and/or in some other context.

- Kevin

---

From: Dean Anderson <[email-masked]>
Date: Tue, 17 Jul 2007 16:27:48 -0400 (EDT)

Kevin: Ok. So when do you think this discussion should happen? On each
draft? The most relevant thing you said before is that we should call a
spade a spade. We should not try to dodge oversight by deceptive terms,
or by deceptive practices.  Dishonesty just brings more tedious
oversight, because then one (__evenyone__) has to prove their honesty
and integrity, in addition to proving their proposal is needed,
necessary, and safe.

I look forward to the proposed language for the charter.