Re: [Resolverless-dns] Paper on Resolver-less DNS

[Paul Vixie <[e-mail]>]

On Friday, 16 August 2019 20:25:39 UTC Erik Sy wrote:
> ...
> > does this mean an fbcdn.net link occuring inside a facebook.com object
> > would require a real DNS lookup, and that any fbcdn.net DNS data included
> > in the facebook.com link would be ignored by a correctly implemented
> > browser?
> > 
> Let's assume, the user visits the website facebook.com. This website
> requires the resource https://fbcdn.net/file1. Furthermore, the
> connection with facebook.com pushes a DNS record for fbcdn.net to the
> client. Now, the client can use the provided DNS record to retrieve
> https://fbcdn.net/file1. However, if the server authentication with
> fbcdn.net fails, this requires the client to evaluate a fallback DNS lookup.

quite aside from my concerns about the lack of monitoring and control by the 
local network operator (who may have DNS policies which no standard ought to 
ignore or bypass), this seems wrong on the face of it. can you limit it to 
same-origin policy? web publishers wishing to take advantage of whatever 
benefits "resolverless dns" would offer them, can easily rename their linked 
objects to fit a same-origin policy similar to the one used for cookie 
coverage.

> Expanding this scenario, we can assume file1 requires to retrieve
> https://a.com/file2 and the connection with fbcdn.net also pushes the
> corresponding DNS record for a.com. Now, the browser can use the DNS
> record for a.com to retrieve file2 because these connection occur within
> the context of the same website assuming a successful server authentication.
> 
> ...

thank you for clarifying that; i redouble my earlier (above) ask that this NOT 
be done.

-- 
Paul