Re: [mif] [dnsext] [DNSOP] 2nd Last Call for MIF DNS server selection document

[Matthew Pounsett <[e-mail]>]

On 2011/10/22, at 15:21, Keith Moore wrote:

> 
> On Oct 22, 2011, at 2:42 PM, Doug Barton wrote:
> 
>> 1. I think we're all in agreement that dot-terminated names (e.g.,
>> example.) should not be subject to search lists. I personally don't have
>> any problems with any document mentioning that this is the expected
>> behavior.
> 
> agree.  however there are standard protocols for which a trailing dot in a domain name is a syntax error.

Any protocol that makes a standard FQDN a syntax error is itself in error.  Not to say that these don't exist, but if people are writing protocols that can't deal with a properly formatted FQDN they need to stop.  Now.

> Strongly disagree.  That would leave users without a protocol-independent way of unambiguously specifying "this is a fully-qualified domain name".
> 
> The practice of applying search lists to names with "."s in them needs to die.

I can't agree with this statement.  As others have said, the practice of using a search list to allow 'ssh foo.bar' to reach 'foo.bar.example.com' isn't going anywhere, and there are a lot of people that make extensive use of the convenience.  Ask any security professional about how easy it is to compete with convenient access.

I think we need to accept that this practice is here to stay, and figure out how to deal with it on those terms.