Re: Services and top-level DNS names (was: Re: Update of RFC 2606

[Mark Andrews <[e-mail]>]

> >> As someone else pointed out, there are currently about two dozen TLDs with
> >> A or MX records at the apex.  Some of them have been like that for many
> >> years, and as best I can tell, the Internet has not thereby collapsed.
> >
> > 	How many label our hosts with two letter domain names?
> 
> Beats me, but since there are several hundred TLDs, it seems to me that 
> the chances are pretty low that everyone in the world has managed to avoid 
> using them as host names.
> 
> > 	Do you have any evidence that they have not caused problems?
> 
> Hey, you're the one claiming that there's a global disaster in progress of 
> which nobody seems to be aware.  If there's evidence, tell us about it.
> 
> >        I suspect that other sites that used the names just put up
> >        with the pain of renamimg hosts along with the resultant
> >        risk of email being misdirected.
> 
> Perhaps you could start by asking people at ai.mit.edu how long their mail 
> has been unusable.

	The problem is that user@ai is not globally unique. 

	MIT users will have problems talk to user@ai when "ai" means
	Anguilla.  The is a current security issue.

	If / when MIT stop using ai.mit.edu, "user@ai" will not longer
	mean [e-mail].  This will mean that any configuration file
	that has "user@ai" will now, suddenly, get a different meaning.
	This is a latent security issue.

> Look, we all know there's an unlimited number of ways one can screw up 
mail and web configuration.  If you put an underscore in the name of a web 
> server, as often as not it sort of works even though it's flatly forbidden 
> by RFCs.  Or if you put an @ or % character in the local part of your 
> e-mail address, it'll fail all over the place even though the RFCs say 
> that's fine.

	I don't condone those actions.

	If I see someone using underscore in a hostname I tell them
	that they have made a error.

	As for the % hack.  That should only be processed by the
	machines handling the domain to the right of the @ sign.
	If I saw a machine mishandling it I would complain to the
	owner of the broken machine.

	Similarly if "foo@bar"@domain failed I'd complain to owner
	of the machine that is broken.
 
> Why is this particular configuration issue so uniquely awful that the IETF 
> and ICANN need to tie themselves up in knots about it?  ICANN has plenty 
> of real problems on its plate, like registrars who steal people's names 
> and won't give them back.  This isn't one of them.

	This is worse.

	The owner of a domain name that has been stolen can go to
	the courts to get it back.  The have a remedy path outside
	of ICANN.

	This is a fundemental attack on the communication infrastruction
	of the Internet which is predicated on there being globally
	unique names.  It needs to be nipped in the bud before it
	gets too bad.

	Mark

> Regards,
> John Levine, [e-mail], Primary Perpetrator of "The Internet for Dummies
> ",
> Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor
> "More Wiener schnitzel, please", said Tom, revealingly.
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]
_______________________________________________
Ietf mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/ietf