Minutes for DBOUND at IETF-89
minutes-89-dbound-1

Dbound BOF, IETF 89, London, UK

Co-chairs: Marc Blanchet and Olaf Kolkman

Mailing list: dbound@ietf.org

------------------------

1530

1. Use Cases for the Public Suffix List, Gervase Markham

Dave Crocker: I suggest alternate wording, like, "transition in administrative
authority".

Marc Blanchet: What is the impact of new TLDs coming on line that are not yet
in the list?

Gervase Markham: Algorithm has fallback: Unrecognized TLDs are treated as trust
boundaries. We asked ICANN for automatic notification of new TLDs. The PSL is
updated monthly.

Marc Blanchet: Yesterday I checked, and the root zone has published three new
TLDs which are not in the PSL.

John Levine: How often is the PSL downloaded?

Gervase Markham: Don't have exact numbers for that. It's millions per day.

Erik Nygren: What if a given name needs different handling for different use
cases, e.g., TLS boundaries, vs. Cookie boundaries.

Gervase Markham: The ICANN/PRIVATE split is the only support for different use
cases.

Franck Martin: The algorithm is incomplete.
There are cases where the PSL algorithm returns "I don't know".

Gervase Markham: We hare happy to see this replaced by something better.

Peter Koch: What is registration policy? Who can add or remove names?
What are the consequences of false positives and false negatives?

Gervase Markham: We try to check that the person sending the email seems
legitimate.

Murray Kucherawy: What is the turnaround time?

Gervase Markham: Weeks rather than months

Olaf Kolkman: Are there use cases you've encountered for which the PSL is not
adequate?

Gervase Markham: It works well for us. In the future that may depend on how
much communication we get about the new TLDs and how they are structured.

------------------------

1550

2. draft-pettersen-subtld-structure, Yngve Pettersen

There were no questions from the IETF attendees in the room.

------------------------

1600

3. draft-sullivan-domain-policy-authority, Andrew Sullivan

Alexander Mayrhofer: My name is Peter Koch.
(Illustrating a point about verifying identity and authority.)

Andrew Sullivan: Relationships have to be expressed mutually by both sides

Yngve Pettersen: What about Google appspot where they own www
but everything else is delegated?

Andrew Sullivan: That is supported

Dave Crocker: I'm not understanding. Why not use an "underscore" name
beneath the zone in question?

Andrew Sullivan: Because the semantics of such names are very unclear.

Phillip Hallam-Baker: Trying to fix this to make cookies work sensibly
is like trying to nail things to Jello. We should fix cookies.

Andrew Sullivan: The error is trying to make administrative inferences based on
naming structure.

Phillip Hallam-Baker: When I do a DNS query to the root servers, it
reveals the whole domain name I'm looking for.

Andrew Sullivan: We'd have to redesign DNS to fix that.

Phillip Hallam-Baker: No, just change the recursive servers.

Andrew Sullivan: That's redesigning DNS.

Ed Lewis (via Jabber): This reminds me of the problem we had in setting up
the "who can sign" issue in DNSSEC.  I.e., why the RRSIG has a signer name
in it instead of automatically assuming the zone it is in AND why today we
only allow the zone to sign it.

Dan York: Have you thought of changing the name of the SOPA record?

Andrew Sullivan: This is a US-only and temporary problem.

Gervase Markham: If you relax the "same tree" restriction, how many more
queries would you have to do?

Andrew Sullivan: We expect these queries to be used to pre-prepare a list.

Mark Nottingham: Who is spidering the DNS to make this work?

Andrew Sullivan: (Knowingly hand-waving) The web browser, or it's a system
service.

Olaf Kolkman: I'm seeing a lot of non-verbal skepticism

Mark Nottingham: I'd like to hear a browser maker comment on this

Yopav Nir: What happens when DNS records are filtered?

Andrew Sullivan: This is a starting point on a path towards something better

Yopav Nir: What happens when DNS SOPA records are blocked forever?

Andrew Sullivan: There's no reason to believe that would happen.
DNAME is in successful use today.
Browsers with access to non-broken DNS will get superior functionality.
Browsers with broken DNS won't.

------------------------

1620

4. draft-levine-orgboundary, John Levine

There were no questions from the IETF attendees in the room.

------------------------

1630

5. Discussion on next steps

Dave Crocker: There's been discussion of principles, but not specific details.
We need specific details in order to make engineering decisions.
The problem statement needs to be expanded and deepened.

Andrew Sullivan: How many people read and understood John Levine's proposal?

Gervase Markham: The solution may suffer a "success failure" -- if it
works well, lots more people will start using it, which will increase the
amount of traffic and the dataset size.

On mobile devices, storing large datasets locally is not desirable,
nor is generating additional network queries.

Alexander Mayrhofer: I'm trying to understand what the IETF task is here.
The PSL maintenance effort seems to be minimal, which is surprising for
something that's so important to browsers.
We should document what is wrong with the current process first.

Yngve Pettersen: This information could be put in HTTP headers instead of DNS.

Phillip Hallam-Baker: I'd like to see a small focussed feature set.

Olaf Kolkman: What features would you like?

Phillip Hallam-Baker: Blocking certificates issued for *.com.

Jeff Hodges: There are multiple different "Public Suffix Lists" maintained
by different organizations.

Olaf Kolkman: Are you saying that authority to publish such information
should be under the control of the entity that's authoritative for the
domain name?

Peter Koch: Maybe we're trying to solve the wrong problem here.
If Public Suffix List is the answer, what is the question?
Perhaps it's just provisioning optimizations in disguise.
Whose cooperation is required to make this work?
I would like to see a clearer problem stetement.

Mark Nottingham: Why make a distributed system?
Why not keep the list centralized, as it is now?

Wendy Seltzer: How does this relate to the web security model?

Joe Hildebrand: There are three parts to this:
1 Where does the data come from?
2 How is the data transmitted?
3 How do we verify the authority of the data?

Dave Crocker: Question of independence has come up.
Is a child independent of parent? Is a parent independent of child?
Must they collaborate? What is necessary? What is prohibited?

Olaf Kolkman: Who will volunteer to help with this work?

Please send mail to the chairs.

Olaf Kolkman: Are the Area Directors satisifed?

Barry: This is not a WG-forming BoF. It's up to you guys to decide how to
proceed.