Re: [apps-discuss] "finding registered domains"

[Andrew Sullivan <[e-mail]>]

Brad,

Thanks for your comments.  Some more questions inline below.

On Tue, Mar 12, 2013 at 02:23:18PM +0000, Hill, Brad wrote:

>  2) I prefer the names-only version.  I think the protocol / port issue is an unnecessary complication.

Everyone seems to think that, and I'm relieved, so if there's another
draft I'll remove that.

>  3) I think if this is going to live in the DNS, it should respect
>  the structure of, and say things about, the DNS, rather than
>  describing a distinct and arbitrary overlay topology of
>  administrative trust relationships.   

Just to be careful here, no matter _what_ we do, we are describing an
arbitrary overlay topology of administrative trust relationships.
That is necessarily true, because the relationships that currently
exist in the DNS are DNS-topological only.  People are _used_ to the
idea that names are related to one another in particular ways, and as
a cultural fact that is mostly true; but in the not very distant past,
it wasn't, and there's reason to suppose it might not obtain in the
near future.

>   i) highly dynamic data that downstream consumers of a cached data set (web  browsers) are not prepared to handle
>   ii) a very large amount of data that downstream consumers of a cached data set are not prepared to handle

This issue had, I have to confess, never even occurred to me.  You're
quite right, however, that the design of the mechanism tends to
encourage a default position of "don't trust, no need to look up," but
the design of the cross-tree declaration will tend to encourage a
large number of queries that are not broadly applicable and that will
therefore not be very good cache candidates.  For practical purposes,
therefore, I'd be tempted to say that, in any SOPA record, the owner
name must be related to the name in the RDATA as either an ancestor or
a descendent (with the root label still being the special case of "not
here"; of course, every name is related to the root label).

> 4) I am also concerned with mixing the state of siblings as to
> whether they share an administrative relationship with the parent or
> not.  Whether the depth in the DNS hierarchy is a "real" thing or
> not, it has been treated as such and been a part of the web security
> model for almost 20 years.  The "walk towards the root until you
> find a boundary, and all siblings are equal" procedures apply not
> just for setting cookies, but to core JavaScript and therefore the
> Same Origin Policy through a feature known as "domain lowering".

I take very seriously the argument that there is an existing and
widely-deployed model.  I note, however, that the widely-deployed
model is about to be thrown out anyway, regardless of how we feel
about it.  For a significant number of the new TLDs are so-called
".brand" TLDs, and I'm pretty sure that the operators of .megacorp are
going to want to be able to set shared cookies in www.megacorp and
product1.megacorp and so on.  

It seems to me, however, that we might need a way to make this sort of
behaviour the default.  The wildcard trick was intended to make that
easy, but I'm not perfectly sure it will.

Best,

A

-- 
Andrew Sullivan
[e-mail]