Re: [Doh] [Ext] Re: Use cases and URLs

[Paul Hoffman <[e-mail]>]

On Mar 7, 2018, at 5:11 PM, Patrick McManus <[e-mail]> wrote:
>> Yes, exactly. If someone tells you that your bank runs this secure DNS server, that’s verbal, not copy and paste.
> 
> I don't agree with this.
> 
> Its logically an argument for not even using hostnames.

That is an absurd reach. If I already interact with my bank through my browser, I know its hostname. I call my bank "Bank of America", not "bofa.com", but I know the latter is its hostname.

> The minimal information in your example is your bank - so just assume www.BANK.com.

See above. In the edge case that I hear that my bank runs this secure DNS server but I don't know my bank's hostname, I am out of luck with DOH. That's fine.

> But even if you argue hostname is the goldilocks of granularity, the DNS resolver market has already shown that its not rich enough. note that quad-9 offers both 9.9.9.9 and 9.9.9.10 and that 10 is not simply a secondary for .9 but its a different service with different policies and different results.. but because the configuration scheme of traditional DNS is so coarse they needed to burn IPv4 addresses just to convey configuration information.

OS configuration for DNS service has always been based on IP addresses because using a domain name to identify a server causes a pretty obvious chicken-and-egg problem. How is that relevant for DOH, which is based on URLs that already have a hostname in them?

> Your suggestion uplevels that from 1 address to 1 hostname but the fundamental problem remains.

Which fundamental problem? My proposal allows for differentiated service in the JSON response.

> Lastly, we want this work to be consistent with the BCP56bis work which explicitly talks about Initial URLs in 4.4.1. It says arbitrary URLs should be used unless they are not practical.

And this proposal fully supports that notion. No one has to go through discovery to use the DNS API server.

> I would say if there were no configuration at all we could talk about whether or not they were impractical, but in the cases that are in scope we're definitely talking about configuration.

Correct. This proposal is to make configuration easier. Are you objecting to making configuration easier, or to the notion that the DNS API server URL should be discoverable, or ...?

--Paul Hoffman