Re: [dbound] [DNSOP] Over on the dbound list: draft-dcrocker-dns-perimeter-00

[Dave Crocker <[e-mail]>]

On 4/4/2019 9:57 AM, Bob Harold wrote:
>     And my having to write this response makes me suspect there's some
>     benefit in adding an end-begin shorthand to the specification, to
>     reduce
>     the verbosity and permit a single record to declares Perimeters both
>     above and below the node.  It's purpose would be for Perimeter
>     hierarchy
>     have a one-name level, such as your example (and I suspect would be a
>     common use.)
> 
> Agreed.

OK.

Since adding constructs makes a spec and its implementation more 
complicated,(*) I'll ask the group whether the simplicity of having just 
'begin' and 'end' for marking Perimeters -- at the expense of the 
verbosity of extra records -- is preferred or whether adding a third 
choice, as a contraction, such as "endbegin", is preferred so there 
would be only one record.

(For completeness:  The 'part' construct doesn't define a Perimeter, so 
it doesn't come into this issue.)



>     Cool.  Subset of branches.
> 
>       > a.example.
>       > b.a.example.
>       > c.a.example.
>       > d.a.example.
>       > ...
>       > z.a.example.
>         \
>          ._perim TXT begin <schema>
> 
>     would clearly work.
> 
>     If there were a need to instead have a.example make the declaration, I
>     don't see an obvious answer.
> 
> 
> This is my concern.
> 
>     My first thought is for the Scheme to have a sub-notation, to indicate
>     that the presence of the Perimeter is not for all branches, such as by
>     having it list the children links it applies to.  But that's not
>     feeling
>     terribly satisfactory.
> 
> 
> Not great, but probably required.  Could the RFC include a note about 
> this possible issue?

Sure.  But I'll also ask for suggestions to see whether we can have 
Perimeter handle this sufficiently to satisfy folk.

I'm taking the open question as:

      How should DNS Perimeter Overlay provide for a parent node to 
specify that a subordinate Perimeter applies only to a subset of its 
subordinate links?

It might help to move this from the abstract to the concrete if we 
develop a few real-world examples we'd like to cover.  I don't have any 
to suggest but hope others do.


d/

(*) I tend to think of additions as having disproportionate effects, 
best treated as exponential.  So adding even one item to a small list of 
features is worth worrying about.

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net