Re: [DNSOP] Last Call: <draft-ietf-dnsop-onion-tld-00.txt> (The .onion Special-Use Domain Name) to Proposed Standard

[Andrew Sullivan <[e-mail]>]

On Mon, Aug 10, 2015 at 07:25:23PM +0000, Alec Muffett wrote:
> 
> Some Googling suggests that the http:// scheme is defined in RFC 2616, which - to summarise - again does not mandate DNS.
> 

I'm by no means an expert on the scheme, but I think following the
references means that 2616 does in fact inherit certain DNS
limitations, because RFC 2616 refers normatively to RFC 2396, which
says this:

host          = hostname | IPv4address
hostname      = *( domainlabel "." ) toplabel [ "." ]
[…]
   Hostnames take the form described in Section 3 of [RFC1034] and
   Section 2.1 of [RFC1123]: a sequence of domain labels separated by
   ".", each domain label starting and ending with an alphanumeric
   character and possibly also containing "-" characters.  The rightmost
   domain label of a fully qualified domain name will never start with a
   digit, thus syntactically distinguishing domain names from IPv4
   addresses, and may be followed by a single "." if it is necessary to
   distinguish between the complete domain name and any local domain.

That gets us right back to the limitations in 1034 and 1123, alas.
RFC 3986, which obsoletes 2396, makes this only marginally better
because it seems to use the presence of dots as a hint that the DNS is
what's in use (though it does not in fact mandate that and suggests
that the rules are OS dependent).  It moreover says "URI producers
should use names that conform to the DNS syntax, even when use of DNS
is not immediately apparent, and should limit these names to no more
than 255 characters in length."  That's hardly encouraging.

I don't know how any implementation actually works in this respect,
but the "does not mandate DNS", while strictly true, doesn't make the
argument work quite as well as one wants.  Experience suggests that
expectations of the old-fashioned Preferred Syntax from STD13 is all
over the place.  Presumably, that's why people keep picking things
that sure look like domain names as identifiers; but we don't get to
have the advantages without all the built-in costs.

A

-- 
Andrew Sullivan
[e-mail]