Re: [dbound] BoF request for IETF 115 (fwd)

[John R Levine <[e-mail]>]

-----Original Message-----
From: John R Levine <[e-mail]>
Date: Thursday, December 22, 2022 at 14:51

     Vixie: ... ability to (as an example) let google.com set a cookie which would be sent to gmail.com. I agree that it's a hard problem. If someone wants to work on that problem in the IETF, I have yet to see evidence of that interest. The coalition of the willing that I hope we can isolate for this WG is narrowly just the thing Tim quoted out of the earlier charter:

         Tim: What appears to be needed is a mechanism to determine policy realm
         boundaries in the DNS.  That is, given two domain names, one needs to
         be able to answer whether the first and the second are either within
         the same policy realm or have policy realms that are related in some
         way.

     John: The hard bit is to do it in a way that people are willing to use.  If
     domain owners are willing to put a few records in the DNS and domain users
     are willing to do a DNS lookup or two each time they're checking a
     boundary, then my thing or Casey's should work.

> If by "it" you mean my example (google.com can set-cookie for gmail.com) ...

No.

> If by "it" you mean putting PSL-like stuff into the DNS per your (John's) 2016 draft, then I do not expect some people (like browser makers) to be "willing to use it" unless it gets aggregated.

So far we agree.

     ... If you want to be able to
     prefetch everything, they won't.

> So, I could disagree. Any decent passive DNS database can "prefetch everything" ...

Aw, come on

> even if there is no linkage in the DNS tying related records together. This is routinely done for SPF and DMARC now.

That is not anything like the SPF or DMARC used by the mail systems I know.  They do regular DNS lookups using
well defined DNS names found in the messages they're checking.

> However, none of that matters, so I won't disagree on that basis. Instead I will say that not everyone wants to prefetch everything, and the requirement to do so is one of the problems with the PSL today.

I really don't understand what point you're making here.  If you need to 
be able to prefetch stuff, you need to be able to prefetch all the records 
that apply to some DNS subtree and I am reasonably sure that is not 
feasible with the wildcard hacks that Casey and I have proposed.

R's,
John