Re: [lamps] CAA tree climbing, gurrghhg

There is an interesting difference with this spec. If the spec goes through
IETF process and becomes an RFC and the folk in CABForum vote to do so,
this goes into production as a compliance requirement.

One side effect of that is that there cannot be any loose ends. PSL is a
loose end.

We debated the dbound problem at great length and then decided that it
doesn't matter. There are really only a few TLDs of any consequence and if
they did something silly, we can vote to unsilly as a special case. And
since they know that, it is unlikely folk will be silly.

Yes, VeriSign could put a CAA record in .com but I bet they won't because
even if they go mad and do, we can pass a CABForum rule with a special
exception.

On Fri, Oct 6, 2017 at 6:27 PM, John R Levine <johnl@taugh.com> wrote:

> I see that the current draft says that CAs climb up the tree a label at a
> time all the way to the TLD, looking for a CAA policy record.
>
> I think you will find a great deal of resistance to that design, because
> it runs into the dbound problem. If I register fobar.hockey, I do not want
> the .hockey TLD setting my default certificate policy.
>
> DMARC has a similar problem looking for policy records for mail
> authentication.  If there's no _dmarc record for a particular domain,
> implementations find the related "organizational domain", roughly the
> highest name under the same management, and it looks for a _dmarc record
> for the organizational domain.  Current implementations use the mozilla PSL
> or something similar; if we were able to converge in something in dbound or
> its reincarnation, they'd use that instead.
>
> I cheefully agree that the PSL is awful, but as far as I can tell all of
> the alternatives are worse.
>
> R's,
> John
>
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm
>