Re: [dbound] DBOUND and paths forward

[Gervase Markham <[e-mail]>]

Hi everyone,

I'm super-late to this thread, and it may be that I'm too late entirely,
but nevertheless:

On 24/05/16 01:54, Murray S. Kucherawy wrote:
> The small pseudo design team observed that it appears as though there is
> actually only one community likely to implement our solutions in the
> short term, and that is the email community.  We perceive it to be
> unlikely that a solution produced by this working group for the web
> security issue would be adopted in short order by any of the browser
> producers.  They simply have not expressed a desire to contribute and
> adopt, or even concur that there's a serious problem that needs to be
> solved.

I don't think that's true. There's not an _acute_ problem that needs to
be solved, but it is a reasonably serious one. The current mechanisms of
both maintaining the PSL and also of shipping and querying it may not be
able to scale indefinitely. The current list contains about 8,500
entries, but we had a (technically invalid, but only because the wrong
person applied) request to add another 85,000 entries last week.

>From a personal perspective, my lack of willingness to contribute has
been about my assessment of my own abilities and (lack of) understanding
of the technical space in which the fix lives, not a lack of interest in
seeing an outcome.

> With that in mind, your co-chairs propose that we abandon any grand
> unified theory of domain boundary evaluation and focus only on this
> email use case.  If there is a change of heart from other communities,
> or some unifying idea does appear, we can re-evaluate our options at
> that time.  However, in the interests of being productive toward our
> original goals, we propose to assume that is not the case and will not
> be in the near future.

It was lack of time to read this list, not lack of desire to see a
positive outcome, which led to me not fully appreciating the import of
this direction change when it was originally posted.

While the PSL "works" for browsers now, it will not work forever. In a
browser context, the use cases are pretty clear and if only that case
were considered (rather than the "grand unified theory"), I'm sure there
are a number of possible technical solutions which would work to give
domain owners direct control over their boundary-setting.

This group seems like the correct collection of people who could solve
this problem by proposing changes to the Internet infrastructure, and
I'm very sad that the current plan is not to solve it. :-| I suspect
that if it's not solved formally, it'll end up being solved informally
using some half-assed definition on a wiki page somewhere of the correct
magic TXT records you need to add to your DNS so that someone's crawler
will notice your boundaries and automatically update some copies of some
PSL-like thing somewhere.

Gerv