Re: [DNSOP] DNSOP Call for Adoption - draft-west-let-localhost-be-localhost

Ted Lemon <mellon@fugue.com> Fri, 08 September 2017 12:07 UTC

Return-Path: <mellon@fugue.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD6191321B6 for <dnsop@ietfa.amsl.com>; Fri, 8 Sep 2017 05:07:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J698UVI89M1J for <dnsop@ietfa.amsl.com>; Fri, 8 Sep 2017 05:07:32 -0700 (PDT)
Received: from mail-pg0-x22e.google.com (mail-pg0-x22e.google.com [IPv6:2607:f8b0:400e:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 46CA81321AA for <dnsop@ietf.org>; Fri, 8 Sep 2017 05:07:31 -0700 (PDT)
Received: by mail-pg0-x22e.google.com with SMTP id d8so4545528pgt.4 for <dnsop@ietf.org>; Fri, 08 Sep 2017 05:07:31 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=40MzPbNa53NQfz9inCE+rxMj/HnOnT4VooVweL9hWZw=; b=REPC/MufO34Pno017WhDJvauqzk2NgViV9mCwKNvZ0paqBGNmoPAJM1DhmlbkBkQdg cNw3GWIO1wfUc5KGdGb8E0B/bzWx4pZ6zlggPgfU3vP5cOctZxJJI4ypyO/vmaZvlZof ubSSU0gD/ER5fUaZkSPPjTI4gYHHWiwgjSdS8UngodAkA0uLQyPyLYmnFYnBux2uAnBg o/d1NnjYvRRzchtFQ7YFwwjPdCPbw9pM4k3ON/WBekCuZpzOOMMb2k8PLOhakzilAjIj iPRmyEmH91mo/2gqoPb6R3HLeHqjJA0hn49GR83oerPddliWDVb3/1u7xOEYplvahHEg cF0g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=40MzPbNa53NQfz9inCE+rxMj/HnOnT4VooVweL9hWZw=; b=Kmc8NviJdJjlVZQzNTYmN0r+dXYpTXOB9yX8nz1anVvgLDIjYdFFeT2QwR4F3BJSCD 9wBl+UK+ZxPCY1zgJ6MinTJi5rhnsPV4odHk32Ka24KdMEPd1CBGV2O93sp8PlZXPJtj i91oTMZ0bWEUfvFZRjzvfaS8ukTE3dF89Cp5EhWZ0sIeI+Jxtatk/f9MelzEl40lWeQK ANN8QAE2kbbNPDedFiymXfRQq+1e5kMfNfn48dte2IaBdmW8A0NVwCIDnlsAfZGZ0CAH e3nmYRE9PB5XT6qrzHAvpP9Kls2he0K+ioI2UiMKEJtEtCGHDm3MxlWBuEdw6I+z7xFs aH3g==
X-Gm-Message-State: AHPjjUi17dg3dOGDXLw1abrL/jVubJrA5POTTtEBetNjmGW7TnJWIpmf 6ufIjpzv45mfu6Yoccv+z53Son/PZkLX
X-Google-Smtp-Source: ADKCNb6L3FcHa3x1XxaV0Cxa4tFbpdeASo6Dk4nGW/N06Jw+9Ty6q8lrra3uP0ENEceee+qlYUeDX32cvDX6U83I764=
X-Received: by 10.98.150.151 with SMTP id s23mr2963531pfk.149.1504872451143; Fri, 08 Sep 2017 05:07:31 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.100.152.98 with HTTP; Fri, 8 Sep 2017 05:07:30 -0700 (PDT)
Received: by 10.100.152.98 with HTTP; Fri, 8 Sep 2017 05:07:30 -0700 (PDT)
In-Reply-To: <20170908022747.C8F0D84A363E@rock.dv.isc.org>
References: <CADyWQ+EZQY9i5-4Ce-NZykwC+sS6iY868Wg0crW6KAZTGQxFQg@mail.gmail.com> <24CD1C88-58C5-4D6C-9F00-E3A2CD8C657C@fugue.com> <CADyWQ+Ex23QVef3AegWB4Jgd-sjG-G4z7XmXL9guN8PeWtsssw@mail.gmail.com> <93C3A47F-07C4-443F-AB87-B5C29F6B6774@fugue.com> <CAHw9_iKBDY9hNThOY3GDeG7BbCkc8Ncy1T=rjpcQ=h5qdB7=UQ@mail.gmail.com> <20170907041659.ED0BB8482BFF@rock.dv.isc.org> <CAPt1N1kXeF0zj_VHuv00taZ+39hR6Nw19uZ5rdxJr3aUeS5RvQ@mail.gmail.com> <20170907045934.C194B848328B@rock.dv.isc.org> <BFAECDAF-8F4B-4C8D-AB7E-1615BD54EF93@fugue.com> <20170908000559.DDBD7849CFAC@rock.dv.isc.org> <CAPt1N1kKNRU+mF-JVti_CKS25+7g5BFH8Yko53-VKgZqVreZuQ@mail.gmail.com> <20170908022747.C8F0D84A363E@rock.dv.isc.org>
From: Ted Lemon <mellon@fugue.com>
Date: Fri, 8 Sep 2017 08:07:30 -0400
Message-ID: <CAPt1N1nFs0G2huEaEszAXkYfVwJEhZ+uynRcCrR=zukjjh28Aw@mail.gmail.com>
To: Mark Andrews <marka@isc.org>
Cc: Warren Kumari <warren@kumari.net>, dnsop WG <dnsop@ietf.org>, Tim Wicinski <tjw.ietf@gmail.com>
Content-Type: multipart/alternative; boundary="94eb2c0dfca6e212330558ac6ba2"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/EjPee_7xMjPoj3Tz4lbvutGPNuM>
Subject: Re: [DNSOP] DNSOP Call for Adoption - draft-west-let-localhost-be-localhost
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 08 Sep 2017 12:07:36 -0000

Do you know of protocols that use SRV to localhost in practice?

Anyway, this is like the question of whether to trust IP addresses when
using rsh. Remember rsh?  There's a reason we don't use it anymore, even
though it was definitely useful.

Localhost over DNS is analogous.

On Sep 7, 2017 10:28 PM, "Mark Andrews" <marka@isc.org> wrote:

>
> In message <CAPt1N1kKNRU+mF-JVti_CKS25+7g5BFH8Yko53-VKgZqVreZuQ@mail.
> gmail.com>
> , Ted Lemon writes:
> > The discussion had covered the failure mode problem. There is substantial
> > agreement that it's better for a stub that issues a query for localhost
> to
> > fail than to succeed. You seem to disagree.
>
> There are lots of people that don't want to deal with ICANN politics
> and that is clouding their technical judgements.
>
> > You haven't stated a reason for disagreeing—instead you've vigorously
> > asserted that this is true. It's fine for you to do this, but if you were
> > to get your way, that would be exactly the bad outcome I want to avoid.
>
> So you want to break EVERY protocol that uses SRV to localhost.  I
> stated clearly that there is stuff that you can do with DNS that
> you can't do with /etc/hosts, NIS, etc.  One shouldn't have to
> itemise everything that will be broken because full functionality
> is not being provided.
>
> > So if there really is a problem here, it would be good for you to make it
> > clear. Your stated desire to preserve flexibility makes sense to me, but
> it
> > doesn't contradict the reason already given for *not *providing that
> > flexibility.
> >
> > Is there some *other* reason why this is important to you, or is that it?
> >
> > On Sep 7, 2017 8:06 PM, "Mark Andrews" <marka@isc.org> wrote:
> >
> > >
> > > In message <BFAECDAF-8F4B-4C8D-AB7E-1615BD54EF93@fugue.com>om>, Ted Lemon
> > > writes:
> > > >
> > > > On Sep 7, 2017, at 12:59 AM, Mark Andrews <marka@isc.org> wrote:
> > > > > I shouldn't BE FORCED to hard code special LOCALHOST rules into DNS
> > > > > tools.  Lookups should "just work" like they did before the root
> > > > > zone was signed.
> > > >
> > > > Because...?
> > >
> > > Because there are things you can do with localhost as a DNS zone
> > > that you can't do with /etc/hosts, NIS, etc. as they are limited
> > > to addresses only.
> > >
> > > Localhost should work just like home.arpa.  The tools we use shouldn't
> > > need special knowledge.  Special knowledge means EVERYTHING needs
> > > to be tested to see if it works with localhost as well and regular
> > > names.  That testing will get missed.  If it doesn't get missed it
> > > costs more money.  Workarounds for different behavior increases the
> > > probability of bugs being introduced as there will be seperate code
> > > paths.
> > >
> > > If I want to add a local trust anchor for localhost I will then
> > > need additional code to disable the workaround for the fact the
> > > root doesn't have a insecure delegation.
> > >
> > > Mark
> > > --
> > > Mark Andrews, ISC
> > > 1 Seymour St., Dundas Valley, NSW 2117, Australia
> > > PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
> > >
> >
> > --94eb2c05f4ca9dd1520558a42ee2
> > Content-Type: text/html; charset="UTF-8"
> > Content-Transfer-Encoding: quoted-printable
> >
> > <div dir=3D"auto">The discussion had covered the failure mode problem.
> Ther=
> > e is substantial agreement that it&#39;s better for a stub that issues a
> qu=
> > ery for localhost to fail than to succeed. You seem to disagree.<div
> dir=3D=
> > "auto"><br></div><div dir=3D"auto">You haven&#39;t stated a reason for
> disa=
> > greeing=E2=80=94instead you&#39;ve vigorously asserted that this is
> true. I=
> > t&#39;s fine for you to do this, but if you were to get your way, that
> woul=
> > d be exactly the bad outcome I want to avoid.=C2=A0</div><div
> dir=3D"auto">=
> > <br></div><div dir=3D"auto">So if there really is a problem here, it
> would =
> > be good for you to make it clear. Your stated desire to preserve
> flexibilit=
> > y makes sense to me, but it doesn&#39;t contradict the reason already
> given=
> >  for <i>not </i>providing that flexibility.=C2=A0</div><div
> dir=3D"auto"><b=
> > r></div><div dir=3D"auto">Is there some <i>other</i> reason why this is
> imp=
> > ortant to you, or is that it?</div></div><div
> class=3D"gmail_extra"><br><di=
> > v class=3D"gmail_quote">On Sep 7, 2017 8:06 PM, &quot;Mark Andrews&quot;
> &l=
> > t;<a href=3D"mailto:marka@isc.org">marka@isc.org</a>&gt; wrote:<br
> type=3D"=
> > attribution"><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0
> .8ex;b=
> > order-left:1px #ccc solid;padding-left:1ex"><br>
> > In message &lt;<a href=3D"mailto:BFAECDAF-8F4B-
> 4C8D-AB7E-1615BD54EF93@fugue=
> > .com">BFAECDAF-8F4B-4C8D-AB7E-<wbr>1615BD54EF93@fugue.com</a>&gt;fugue.com</a>&gt;, Ted
> Lemo=
> > n writes:<br>
> > &gt;<br>
> > &gt; On Sep 7, 2017, at 12:59 AM, Mark Andrews &lt;<a href=3D"mailto:
> marka@=
> > isc.org">marka@isc.org</a>&gt; wrote:<br>
> > &gt; &gt; I shouldn&#39;t BE FORCED to hard code special LOCALHOST rules
> in=
> > to DNS<br>
> > &gt; &gt; tools.=C2=A0 Lookups should &quot;just work&quot; like they
> did b=
> > efore the root<br>
> > &gt; &gt; zone was signed.<br>
> > &gt;<br>
> > &gt; Because...?<br>
> > <br>
> > Because there are things you can do with localhost as a DNS zone<br>
> > that you can&#39;t do with /etc/hosts, NIS, etc. as they are limited<br>
> > to addresses only.<br>
> > <br>
> > Localhost should work just like home.arpa.=C2=A0 The tools we use
> shouldn&#=
> > 39;t<br>
> > need special knowledge.=C2=A0 Special knowledge means EVERYTHING
> needs<br>
> > to be tested to see if it works with localhost as well and regular<br>
> > names.=C2=A0 That testing will get missed.=C2=A0 If it doesn&#39;t get
> miss=
> > ed it<br>
> > costs more money.=C2=A0 Workarounds for different behavior increases
> the<br=
> > >
> > probability of bugs being introduced as there will be seperate code<br>
> > paths.<br>
> > <br>
> > If I want to add a local trust anchor for localhost I will then<br>
> > need additional code to disable the workaround for the fact the<br>
> > root doesn&#39;t have a insecure delegation.<br>
> > <br>
> > Mark<br>
> > --<br>
> > Mark Andrews, ISC<br>
> > 1 Seymour St., Dundas Valley, NSW 2117, Australia<br>
> > PHONE: <a href=3D"tel:%2B61%202%209871%204742"
> value=3D"+61298714742">+61 2=
> >  9871 4742</a>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0
> =C2=
> > =A0INTERNET: <a href=3D"mailto:marka@isc.org">marka@isc.org</a><br>
> > </blockquote></div></div>
> >
> > --94eb2c05f4ca9dd1520558a42ee2--
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
>