Re: [Resolverless-dns] [DNSOP] On today's resolverless DNS meeting

Redirected from {dnsop,doh}@ietf.org, so the whole message is
appended, something I am normally loathe to do.

The part I'm focused on is this:

> The webpage can tell the browser to fetch the img resource from
> anyplace it wants to - it can very well specify an IP address
> instead of the hostname - the webpage controls it.

You're right that this can be done, and has been sometimes in the past.

It only works in simple cases, though, which means it would fail an
awful lot on the modern Internet if that resource is hosted on a
machine which needs Host:/SNI to work correctly.

Go ahead and try it with whatever you've got open in your browser now.
I just did it with https to facebook.com, google.com, and
en.wikipedia.org, and got NET::ERR_CERT_COMMON_NAME_INVALID or
NET::ERR_CERT_AUTHORITY_INVALID.  Plain http to vhosted sites also has
problems with identifying the correct objects.

Yes you can come up with more ways to make it work, but they're gross
too, surely more so than being able to have trustworthy name to
address mappings.

Mukund Sivaraman writes:
> Hi all
> 
> It seemed that the objective (or an objective) of what is desired is for
> a webpage to have an <img src=""> and also push an address record for
> the hostname in the src URL.
> 
> We talked about DNSSEC and certificate signing and such. If the host
> serving this webpage to the browser has control over the webpage's
> content (e.g., the contents of that src attribute), and the webpage's
> contents are already authenticated by TLS, then why does an address
> record have to be separately authenticated?
> 
> Why can't the webpage contain the addresses of the hostname in the URL,
> in another attribute of that element? Does it have to be separately
> signed via DNSSEC and certificates? The webpage can tell the browser to
> fetch the img resource from anyplace it wants to - it can very well
> specify an IP address instead of the hostname - the webpage controls
> it. Why can't it, for *that* element, provide the target address in an
> attribute without any additional signatures, given that the webpage's
> content itself is authenticated via TLS?
> 
> 		Mukund
> 
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop