Dbound BOF, IETF 89, London, UK Co-chairs: Marc Blanchet and Olaf Kolkman Mailing list: dbound@ietf.org ------------------------ 1530 1. Use Cases for the Public Suffix List, Gervase Markham Dave Crocker: I suggest alternate wording, like, "transition in administrative authority". Marc Blanchet: What is the impact of new TLDs coming on line that are not yet in the list? Gervase Markham: Algorithm has fallback: Unrecognized TLDs are treated as trust boundaries. We asked ICANN for automatic notification of new TLDs. The PSL is updated monthly. Marc Blanchet: Yesterday I checked, and the root zone has published three new TLDs which are not in the PSL. John Levine: How often is the PSL downloaded? Gervase Markham: Don't have exact numbers for that. It's millions per day. Erik Nygren: What if a given name needs different handling for different use cases, e.g., TLS boundaries, vs. Cookie boundaries. Gervase Markham: The ICANN/PRIVATE split is the only support for different use cases. Franck Martin: The algorithm is incomplete. There are cases where the PSL algorithm returns "I don't know". Gervase Markham: We hare happy to see this replaced by something better. Peter Koch: What is registration policy? Who can add or remove names? What are the consequences of false positives and false negatives? Gervase Markham: We try to check that the person sending the email seems legitimate. Murray Kucherawy: What is the turnaround time? Gervase Markham: Weeks rather than months Olaf Kolkman: Are there use cases you've encountered for which the PSL is not adequate? Gervase Markham: It works well for us. In the future that may depend on how much communication we get about the new TLDs and how they are structured. ------------------------ 1550 2. draft-pettersen-subtld-structure, Yngve Pettersen There were no questions from the IETF attendees in the room. ------------------------ 1600 3. draft-sullivan-domain-policy-authority, Andrew Sullivan Alexander Mayrhofer: My name is Peter Koch. (Illustrating a point about verifying identity and authority.) Andrew Sullivan: Relationships have to be expressed mutually by both sides Yngve Pettersen: What about Google appspot where they own www but everything else is delegated? Andrew Sullivan: That is supported Dave Crocker: I'm not understanding. Why not use an "underscore" name beneath the zone in question? Andrew Sullivan: Because the semantics of such names are very unclear. Phillip Hallam-Baker: Trying to fix this to make cookies work sensibly is like trying to nail things to Jello. We should fix cookies. Andrew Sullivan: The error is trying to make administrative inferences based on naming structure. Phillip Hallam-Baker: When I do a DNS query to the root servers, it reveals the whole domain name I'm looking for. Andrew Sullivan: We'd have to redesign DNS to fix that. Phillip Hallam-Baker: No, just change the recursive servers. Andrew Sullivan: That's redesigning DNS. Ed Lewis (via Jabber): This reminds me of the problem we had in setting up the "who can sign" issue in DNSSEC. I.e., why the RRSIG has a signer name in it instead of automatically assuming the zone it is in AND why today we only allow the zone to sign it. Dan York: Have you thought of changing the name of the SOPA record? Andrew Sullivan: This is a US-only and temporary problem. Gervase Markham: If you relax the "same tree" restriction, how many more queries would you have to do? Andrew Sullivan: We expect these queries to be used to pre-prepare a list. Mark Nottingham: Who is spidering the DNS to make this work? Andrew Sullivan: (Knowingly hand-waving) The web browser, or it's a system service. Olaf Kolkman: I'm seeing a lot of non-verbal skepticism Mark Nottingham: I'd like to hear a browser maker comment on this Yopav Nir: What happens when DNS records are filtered? Andrew Sullivan: This is a starting point on a path towards something better Yopav Nir: What happens when DNS SOPA records are blocked forever? Andrew Sullivan: There's no reason to believe that would happen. DNAME is in successful use today. Browsers with access to non-broken DNS will get superior functionality. Browsers with broken DNS won't. ------------------------ 1620 4. draft-levine-orgboundary, John Levine There were no questions from the IETF attendees in the room. ------------------------ 1630 5. Discussion on next steps Dave Crocker: There's been discussion of principles, but not specific details. We need specific details in order to make engineering decisions. The problem statement needs to be expanded and deepened. Andrew Sullivan: How many people read and understood John Levine's proposal? Gervase Markham: The solution may suffer a "success failure" -- if it works well, lots more people will start using it, which will increase the amount of traffic and the dataset size. On mobile devices, storing large datasets locally is not desirable, nor is generating additional network queries. Alexander Mayrhofer: I'm trying to understand what the IETF task is here. The PSL maintenance effort seems to be minimal, which is surprising for something that's so important to browsers. We should document what is wrong with the current process first. Yngve Pettersen: This information could be put in HTTP headers instead of DNS. Phillip Hallam-Baker: I'd like to see a small focussed feature set. Olaf Kolkman: What features would you like? Phillip Hallam-Baker: Blocking certificates issued for *.com. Jeff Hodges: There are multiple different "Public Suffix Lists" maintained by different organizations. Olaf Kolkman: Are you saying that authority to publish such information should be under the control of the entity that's authoritative for the domain name? Peter Koch: Maybe we're trying to solve the wrong problem here. If Public Suffix List is the answer, what is the question? Perhaps it's just provisioning optimizations in disguise. Whose cooperation is required to make this work? I would like to see a clearer problem stetement. Mark Nottingham: Why make a distributed system? Why not keep the list centralized, as it is now? Wendy Seltzer: How does this relate to the web security model? Joe Hildebrand: There are three parts to this: 1 Where does the data come from? 2 How is the data transmitted? 3 How do we verify the authority of the data? Dave Crocker: Question of independence has come up. Is a child independent of parent? Is a parent independent of child? Must they collaborate? What is necessary? What is prohibited? Olaf Kolkman: Who will volunteer to help with this work? Please send mail to the chairs. Olaf Kolkman: Are the Area Directors satisifed? Barry: This is not a WG-forming BoF. It's up to you guys to decide how to proceed.