Re: [dbound] On (not) moving forward

[Andrew Sullivan <[e-mail]>]

On Fri, Mar 25, 2016 at 09:27:00PM -0400, Marc Blanchet wrote:
> in-DNS a good solution, does it have the problem of finally not being
> implemented/deployed because of a new RR?

The difference between RDAP and SOPA has to do with the incentives for
deployment.  (The RDAP case could in fact have been solved by SRV, if
you ask me, but it was quite clear that the WG didn't want to do it.)

The SOPA draft defines the default case as, "Nobody is in the same
policy realm as me."  For a large number of sites, this is
exactly the right answer.

The SOPA draft says you can make the explicit claim, "Nobody is in the
same policy realm as me."  That has certain advantages, such as
caching and so on, which means that it's the right answer for public
suffixes.  Since they're the people who have the greatest potential to
deploy new RRs, there's a positive effect.

The SOPA draft gives you a way to make more significant statements
about others being in the same policy realm.  There is a barrier to
new RRs here, but there are mitigating factors: (1) the sites that
want this sort of functionality are more sophisticated, so they are
the more likely to be able to deploy new RRs; (2) the lookup story
doesn't need to be perfect for consumer-end hosts, because of the plan
to fall back to browser-distributed files as well (which now get the
benefit of automatic crowdsourced maintenance); (3) an important part
of this story is the CA checking when issuing certs, which benefits
from the new RR even if consumer-end hosts.

Finally, I do, very much, think that things like SOPA would be way
easier to deploy if we did something like John's RRTYPE
pattern-classification stuff.  That has kind of gone nowhere, but
partly because the demand is stanched by the constant refrain that new
RRs are impossible to deploy.  I'd be prepared to update the SOPA
draft with a normative dependency on draft-levine-dnsextlang-07 if we
think it would help.

Best regards,

A

-- 
Andrew Sullivan
[e-mail]