Re: [Dbound] Request to participate in DBOUND discussions

[Jothan Frakes <[e-mail]>]

Hi Joe-

Due to client obligations making a schedule conflict, I won't be able to
directly attend the upcoming IETF meeting in London to participate in the
BoF.   I will be in Singapore at the upcoming ICANN meeting and wanted to
participate in (or propose if it is not yet in existence) a BoF there.

Is that possible?



> Your wishlist looks like you're assuming a solution that looks a lot like
> a better-managed and better-structured public suffix list.
>
>
​Yeah, I can definitely see that the list looks like that - actually to be
honest, it is that...  Although I went all-out on a starting point to
include many, many things beyond PSL.   ​​Just wanted to get a wishlist
started.  :)

The list is a set of asks or personal requests I have been approached with
over the past 10-12 years related to different elements of domain
boundaries or domain validation.  This has been from LEA, Security, and DNS
providers but also from just general internet tool developers or people
writing simple web-forms or hosting companies.

I don't want us to get stuck to where we can't think big at the time there
is a blank canvas for us to paint, so why not get all the cans of paint
onto the table, and then let the group discussion evolve what we do.  I am
sure some of this would fall away depending upon group wisdom.

I don't want to necessarily prejudice the group's outcome, but rather
identify needs/wants towards a goal of whatever we would potentially draft
being inclusive of as many real world use cases as possible.  I and others
have participated in pre-Idraft dialog or ghostwriting them and seen them
fall into the ether or not get traction.

PSL exists because there really is not anything else.  It formed in a
vacuum to serve an important need.  We might solve some/all/more than these
needs through the dbound group work.

Full disclosure (and selfishly), I'd like to see something out of this
group that is a viable substitute for PSL.  PSL is volunteer-operated and
it is one of those "no good deed goes unpunished" efforts - the
shortcomings are highlighted frequently than the benefits - by the people
it benefits.  I personally have thousands of hours invested in PSL and
participate in it because I immediately recognized how it benefits
developers and the internet community, and operates in the public interest
- if it can keep up.

A decentralized version with authoritative origins would be far better -
getting registries to maintain something like their suffixes for their
zones in something centralized like PSL can take a lot of coordination and
effort in validating the data and the submission.  Similar to DNSSEC there
is no compulsion on authoritative operators to participate, and there is an
educational gap as to what it is (and isn't).  We also have the other side
of the equation in the 'consumers' within the development / application and
other communities who derive use from this resource to consider as well.



> Is the solution space wide enough to consider other options, e.g.
> publication of policy that communicates the same information in the form of
> data in the DNS, published as resource records?
>
>
I sure hope so.  I think DNS may be well suited for this, especially if
there's some means to decentralize things and place authority into the
hands of the appropriate party, such as the registry operator.


> I'm not saying that one is better than the other (or that the right
> solution requires just one approach, versus more than one), but it'd be
> nice to understand the part (if any) different such approaches could play
> as part of a working group discussion rather than as a pre-baked assumption.
>
> [For illustrative purposes only, just to better explain the question
> above, not jumping to implementation assumptions, I mean something like
>
>   (in the root zone)
>   . IN SOA ...
>   . IN PSL whois.iana.org. "http://www.root-servers.org/"
>
>   (in the COM zone)
>   COM. IN SOA ...
>   COM. IN PSL whois.crsnic.net. "http://www.verisigninc.com/"
>
>   (etc)
>
> i.e. RRSets in the DNS at a zone apex that indicates the presence of a
> registry-like administrative boundary, using the scaffolding already
> present in the DNS to do versioning, cryptographic signatures, etc. No
> doubt any real candidate mechanism would be better fleshed out than the
> above, no need to point out the need for extra RDATA, etc, etc.]
>
>
Thanks for the example.  Could be new record type, might be a few.​​  For
example, the boundaries might be different for Cookies than Whois in a
given zone.

In any event, if there was simply a pointer like that, consumers would want
there to be consistency to those resources, so a suggested structure of
file / resources available at the destination of whatever location would be
wise to include in our scope if our work takes us in that direction.

We would the authority chain to be clear, but also want to not prejudice
(nor introduce opportunity to prejudice) sub-domain providers like
Centralnic (EU.COM, UK.COM etc) or other similar providers from being able
to include resources.