Re: [Resolverless-dns] Paper on Resolver-less DNS

[Erik Sy <[e-mail]>]

On 8/16/19 22:30, Paul Vixie wrote:
> On Friday, 16 August 2019 20:25:39 UTC Erik Sy wrote:
>> ...
>>> does this mean an fbcdn.net link occuring inside a facebook.com object
>>> would require a real DNS lookup, and that any fbcdn.net DNS data
>>> included
>>> in the facebook.com link would be ignored by a correctly implemented
>>> browser?
>>>
>> Let's assume, the user visits the website facebook.com. This website
>> requires the resource https://fbcdn.net/file1. Furthermore, the
>> connection with facebook.com pushes a DNS record for fbcdn.net to the
>> client. Now, the client can use the provided DNS record to retrieve
>> https://fbcdn.net/file1. However, if the server authentication with
>> fbcdn.net fails, this requires the client to evaluate a fallback DNS
>> lookup.
> quite aside from my concerns about the lack of monitoring and control
> by the local network operator (who may have DNS policies which no
> standard ought to ignore or bypass), this seems wrong on the face of it.
Can you please explain your concern and why you think that a limitation
to a same-origin policy is required?
> can you limit it to same-origin policy? web publishers wishing to take
> advantage of whatever benefits "resolverless dns" would offer them,
> can easily rename their linked objects to fit a same-origin policy
> similar to the one used for cookie coverage.
>
>> Expanding this scenario, we can assume file1 requires to retrieve
>> https://a.com/file2 and the connection with fbcdn.net also pushes the
>> corresponding DNS record for a.com. Now, the browser can use the DNS
>> record for a.com to retrieve file2 because these connection occur within
>> the context of the same website assuming a successful server
>> authentication.
>>
>> ...
> thank you for clarifying that; i redouble my earlier (above) ask that
> this NOT be done.
>