Re: [apps-discuss] "finding registered domains"

[Andrew Sullivan <[e-mail]>]

On Wed, Mar 13, 2013 at 06:56:47PM +0000, Hill, Brad wrote:
> 
> admin of a given label has control of descendant labels.  The
> hierarchy of control is more than just implied.
> 

This hierarchy is a straight artifact of the hierarchical name space.  So
yes, but once you've performed delegation you can't control what
happens on the other side of the zone cut (except by removing the
delegation).  Or, of course, maybe you can: maybe you're the same
organization.  This is sort of the point of what we're trying to do:
there's no way to read that distinction from the DNS today.
 
> algorithm and basic model otherwise remains totally intact.  In
> contrast, changes differentiate domain lowering properties among
> siblings at the same depth are a much more substantial change to how
> the Web security model works and increases the complexity of the
> algorithms and implementations, the mental model for users, and the
> complexity and size of the data needed to support that model.

Well, yes, but people are doing this anyway, with really lousy
security now.  So it feels to me like we need to support it, even if
we put in a deployment note making observations about what the
experience might be particularly during early deployment.  And after
all, it is entirely possible to support the present model of operation
in the approach I've outlined.

A

-- 
Andrew Sullivan
[e-mail]