Re: [dbound] DBOUND - updated use cases?

[Jothan Frakes <[e-mail]>]

> Sort of ironically with all of the stuff about DMARC using the PSL, we
> are mostly done updating the DMARC spec and the largest change is that
> it doesn't use the PSL any more.


Sounds like a potentially good evolution.

My response here hopefully won't be taken as me guarding PSL turf.

Curious to walk through this with you.  Assuming this proceeds, I would
anticipate there would be a gradual upgrade that happens.

What is the anticipated transition span of legacy/I-D version, and how
would conflicting configurations between them behave?

At what point can I update the PSL Wiki to reflect that DMARC no longer
needs entries?

Since DMARC puts policy records in
> the DNS anyway, we added a flag to the policy record saying roughly
> "this is a boundary" and it now does a limited tree walk looking for
> the records.*
>

If the tree walk vs security blocking  issue is solved, this might be a
good thing for carving off DMARC from PSL


> At this point I believe the major uses of the PSL are in browsers, the
> original cookie application, CORS, address bar heuristics to guess
> whether a string is a hostname, and for CAs to tell whether a wildcard
> certificate is OK.
>

Probably should be luring in W3C WHAT-WG participants to this dialog
related to browser stuff, as DBOUND will absolutely require their adoption
if PSL replacement is objective.

There's far more than browsers/ca and minimizing PSL use cases to that may
introduce some fracturing, as various dependancies carve off their
dependancy on the PSL which DNS-based solutions may or may not be the magic
solve for.

It is important as evolution away from PSL may happen, that we may need to
acknowledge that a one-stop location with a central truth (akin to the
wisdom of ICANN's ICP-3 principle) that PSL currently furnishes.

There is a growing list of programming libs that try to be smart about
Universal Acceptance stuff like linkification via the PSL, such as form
input bozofiltration  -  and a lot of unknown, proprietary or opaque use
cases that.

There is a list I am compiling for M3AAWG presentation.


> * - before anyone says that won't work, I left out some details. See
> the I-D


Can you share URL so I don't have to hunt?

The DNS walk part was the hole in the boat last go.