Re: [dbound] Related Domains By DNS (RDBD) Draft

[Stephen Farrell <[e-mail]>]

Hi Sam,

On 14/03/2019 20:13, Samuel Weiler wrote:
> 
>> We added some text on that in -01, in the intro. See the top
>> of page 3. Wasn't that clear enough?
> 
> No, it is not.  Those are pretty broad use cases.  

Broad != not-clear though:-) But fair enough.

> I want to see them
> more specifically defined.  e.g.  "correlate the ownership of websites
> in different languages" is still pretty broad.  WHO do you want to do
> the correlation?  (Which pieces of code?)  Is this for statistics and
> analysis (only) 

Yes, it is for that. But saying "only" seems wrong - if people are
minded to publish this information then it can be used by anyone who
finds it, however they want.

For example, I might write some survey code that changes how it
counts based on this. But I can't describe that code as it'd
depend on what survey I'm actually doing.

>- e.g. so the Alexa list reflects the aggregate of
> correlated sites?  Or do you want client code doing something?  

See above.

> Do you
> want cookies shared? 

No. I would prefer to stay away from that, for now at least.

If/when RDBD RRs get published then browsers can think about whether
they'd like to use that information is as far as I'd go there - since
I do not make a browser, I don't see any point in trying to tell those
who do that they ought use this now. If they decided they did want to
use RDBD, then they could register a new rdbd-tag value if that was
what they wanted - at least I think that'd be a sensible thing to do.
And any text about the semantics of RDBD RRs using that rdbd-tag
value can be written then, by whomever understands that particular
use-case in full detail.

> Credentials?  

No. Same as above.

We say this in the draft:

"
   It is not a goal of this specification to provide a high-level of
   assurance that two domains are definitely related, nor to provide
   fine-grained detail about the kind of relationship that may exist
   between domains.
"

I'd be fine to strengthen that and saying something stronger if that
helped, e.g. maybe to say that rdbd-tag==0 RRs are not designed to
be used for cookies or for cross-domain authentication.

> I realize that this could touch many
> parts of the stack.
> 
> Put another way, if you're right that:
> 
>> ... part of the reason DBOUND failed was an
>> attempt to be all things to all parties. I think repeating
>> such an attempt with RDBD would lead to the same failure.
> 
> Then the use case(s) needs to be very clear.

Not sure I agree there. Use-case clarify or the lack thereof
does not imply one is or is not trying to be all things to all
parties. I do agree that clear text about use-cases is better
of course. But so is terse text.

Cheers,
S.