Re: [apps-discuss] "finding registered domains"

On Wed, Mar 13, 2013 at 10:43 AM, John Levine <johnl@taugh.com> wrote:
>>I am still not very clear about what the problem is and what the possilbe solution is.
>>
>> Could you kindly summarize it in one or two sentences ?
>
> I agree that use cases would help a lot.  The ones I'm aware of are:

+1

The presentation of the information in DNS terms is trivial. The whole
problem is knowing what information to present and why.

> * Web cookies: limit how high up the DNS tree a site can promote its cookies.

Also prevent cookie sharing across subtrees, especially to reduce
cross site contamination issues when some parts of a tree are
outsourced.

HTTP is not the only protocol with cookies. There are application
level cookies as well. Rule 81 applies here and probably provides
grounds for a corollary.

So if I outsource management of my shopping cart to a payment
processor and my Web site to a cheap hosting service I probably don't
want cookies set on one to be visible on the other.

My view is that anything more complex than defining a domain subtree
as a distinct administrative region from all others is going to be too
complex to implement securely.

> * DMARC and other mail authentication: find policy documents for a
> domain given one of its subdomains
>
> * SSL/TLS certificates: prevent certificate issue for names at or above public
> delegation points

Actually VeriSign would be perfectly entitled to obtain an SSL
certificate off a public root for .com

What would be *BAD* would be *.com

The use made of the public suffix list is rather more however. If
someone is applying for a.b.c.d.e.f.g.h.i.example.com it probably does
not have an email server on it. It might even be an appliance that
does not have SMTP capability. Sending an email to check ownership of
the domain is not going to work. The email would have to go to
admin@example.com.

Regardless of what the DNS mythology claims, the DNS administrator of
example.com has complete control over the subtree beneath it. That is
how the DNS is designed. If the owner of a.b.c.d.e.f.g.h.i.example.com
wants independence from example.com they have only one route and that
is to buy a domain of their own.

So while there are other applications where you might want to treat
different parts of the subtree as independent administrative domains
(ai.mit.edu might not want to share cookies with lcs.mit.edu) that is
not the case for CAs.

> * Variants: state that two parallel names are under the same management (has
> issues different from the previous three)

That would be an interesting and useful problem but I really don't
want to commit to going down that rathole. That looks to me like
something that might suggest that we need to think about an extensible
approach.

> R's,
> John
> _______________________________________________
> apps-discuss mailing list
> apps-discuss@ietf.org
> https://www.ietf.org/mailman/listinfo/apps-discuss

-- 
Website: http://hallambaker.com/