Subject: [DNSOP] comments on draft-ietf-dnsop-qname-minimisation

From: "Rose, Scott" <[email-masked]>
Date: Thu, 30 Oct 2014 15:46:01 +0000

Read over the new DNSOP-titled version and have a couple of minor comments.  

Section 3 - 1st paragraph:
I am not a lawyer, but have had to deal with them on occasion.  qname minimization may or may not reduce legal responsibilities.  Just because you can't do something doesn't always absolve you from trying :)

4th paragraph: I'd suggest dropping the word "illegal"  It's a loaded term and may not be true depending on the jurisdiction. 

last paragraph:
Their is also a (small) performance hit for DANE aware applications where the owner name often has multiple labels.  Might want to mention it as well.  One way to reduce the time would be to not do minimization for certain qtypes (like TLSA, OPENPGPKEY, etc.).  It doesn't gain much since the cache would have the authoritative server in it already, so it would reduce one query that would (possibly) hit an empty non-terminal per type. 

I guess this means I sign on as a reviewer,
Scott

===================================
Scott Rose
NIST
[email-masked]
+1 301-975-8439
Google Voice: +1 571-249-3671
http://www.dnsops.gov/
===================================

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 31 Oct 2014 12:30:54 +0100

On Thu, Oct 30, 2014 at 03:46:01PM +0000,
 Rose, Scott <[email-masked]> wrote 
 a message of 27 lines which said:

> I am not a lawyer, but have had to deal with them on occasion.
> qname minimization may or may not reduce legal responsibilities.  

Right. IANAL too, so text changed for something milder ("it may
decrease their legal responsability" which is true in Europe).

> 4th paragraph: I'd suggest dropping the word "illegal"  It's a
> loaded term and may not be true depending on the jurisdiction. 

Ed Lewis did a similar remark. The idea is to have one short word for
"something which is a violation of the RFC". Any idea for a better
word, less legally loaded?

> Their is also a (small) performance hit for DANE aware applications
> where the owner name often has multiple labels.  Might want to
> mention it as well.  One way to reduce the time would be to not do
> minimization for certain qtypes (like TLSA, OPENPGPKEY, etc.). 

First, we should remember (it is not crystal-clear in the current
draft) that qname m12n is an unilateral change (it does not change the
protocol) so resolver implementers may do it in slightly different
ways. That being said, not doing minimisation for some qtypes seem to
be an overoptimisation, not worth the complexity. Also, OPENPGPKEY is
a bad example because it is a case where there is PII even after the
second label so Qname m12n is *more* important for this type.

---

From: Dave Lawrence <[email-masked]>
Date: Fri, 31 Oct 2014 10:20:31 -0400

> word, less legally loaded?

Non-conformant.

> That being said, not doing minimisation for some qtypes seem to be
> an overoptimisation, not worth the complexity. Also, OPENPGPKEY is a
> bad example because it is a case where there is PII even after the

On a barely related note, qname min helps with the logical progression
of the DNSSEC chain when a signed subdomain of a signed domain is
hosted on the same machine.  With longest match rules a full qname
means the resolver has to infer that there's a missing link it needs
to go back and ask about.

---

From: Edward Lewis <[email-masked]>
Date: Fri, 31 Oct 2014 11:11:59 -0400

Yes, but…

> to go back and ask about.

WIth long-lived keys (TTL wise) the recipient may already have a copy of the keys validating the signature that arrives.

(In the dark ages we included the KEY set in each answer before we realized that it was overkill to do so.  Yes, the “KEY” set - I said it was in the dark ages.)

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 31 Oct 2014 08:55:03 -0700

> word, less legally loaded?

Nonstandard or noncompliant.

--Paul Hoffman

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 31 Oct 2014 17:03:34 +0100

On Fri, Oct 31, 2014 at 08:55:03AM -0700,
 Paul Hoffman <[email-masked]> wrote 

> Nonstandard or noncompliant.

OK, we just have to fix RFC 6274, 6120, 5646, 5246 and dozens of other
RFC which all use "illegal" like the draft.

---

From: Edward Lewis <[email-masked]>
Date: Fri, 31 Oct 2014 12:17:31 -0400

> RFC which all use "illegal" like the draft.

I’d support non-standard.

(As far as the other RFCs: "If all the other kids are jumping from the bridge, would you too?")

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 31 Oct 2014 09:18:26 -0700

> RFC which all use "illegal" like the draft.

Or, you can just choose to use a better term than they did.

--Paul Hoffman

---

From: Dave Lawrence <[email-masked]>
Date: Fri, 31 Oct 2014 12:21:38 -0400

> RFC which all use "illegal" like the draft.

No, we don't.  They are not normative, and do not proscribe the use of
language that is less potentially ambiguous.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 31 Oct 2014 17:28:40 +0100

On Fri, Oct 31, 2014 at 12:17:31PM -0400,
 Edward Lewis <[email-masked]> wrote 

> I’d support non-standard.

Not me. I may be wrong in logic or in english but to me, "non
standard" means "there is no existing standard about this behaviour -
either pro or con - so I can do what I want". Here, we talk about
something that is "against the rules laid out by the standard".

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 31 Oct 2014 13:03:57 -0400

> something that is "against the rules laid out by the standard".

"Nonconforming", then.  I have to agree that "illegal" is wrong.
There are no DNS cops, despite what many people would like.

A

-- 
Andrew Sullivan
[email-masked]

---

From: Warren Kumari <[email-masked]>
Date: Fri, 31 Oct 2014 16:20:14 -0400

On Friday, October 31, 2014, Andrew Sullivan <[email-masked]> wrote:

> "Nonconforming", then.

Nonconformant or noncompliant ((as previously suggested) does not comply
with the standard)

> I have to agree that "illegal" is wrong.
Oh, I thought that was Mark... :-)

And I'd happily volunteer if we form a larger force - "he carries a badge,
and a copy of Wireshark -- he's Warren, a member of the elite DNS branch of
the Protocol Police. Sworn to uphold EDNS compliance and seek out broken
delegations wherever they may be..."

W

> A
>
> --
> Andrew Sullivan
> [email-masked] <javascript:;>
>
> _______________________________________________
> DNSOP mailing list
> [email-masked] <javascript:;>
> https://www.ietf.org/mailman/listinfo/dnsop
>

-- 
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf

---

From: Mark Andrews <[email-masked]>
Date: Sat, 01 Nov 2014 08:15:15 +1100

As for protocol police, we need them.  Deploying anything new is
getting to be extremely difficult given the levels of non compliance
with existing RFC.  Protocols only work when both side are following
the protocol.

As Tim hasn't sent out a updated agenda I will draw your attention
to:

http://tools.ietf.org/html/draft-andrews-dns-no-response-issue-04

http://users.isc.org/~marka/ts.html

http://users.isc.org/~marka/alexa-report.html
http://users.isc.org/~marka/au-report.html
http://users.isc.org/~marka/bottom-report.html
http://users.isc.org/~marka/gov-report.html
http://users.isc.org/~marka/tld-report.html

Which covers EDNS compliance which I will be discussing at HI.

Getting rid of broken software on authoritative servers is something
we can achieve.

Mark

In message <[email-masked]>, Warren Kumari writes:
> --===============2813703441700708651==
> Content-Type: multipart/alternative; boundary=047d7ba9751882c1e50506bdb90a
> 
> --047d7ba9751882c1e50506bdb90a
> Content-Type: text/plain; charset=UTF-8
> 
> --047d7ba9751882c1e50506bdb90a
> Content-Type: text/html; charset=UTF-8
> Content-Transfer-Encoding: quoted-printable
> 
> <br><br>On Friday, October 31, 2014, Andrew Sullivan &lt;<a href=3D"mailto:=
> [email-masked]">[email-masked]</a>&gt; wrote:<br><blockquot=
> e class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc sol=
> id;padding-left:1ex">On Fri, Oct 31, 2014 at 05:28:40PM +0100, Stephane Bor=
> tzmeyer wrote:<br>
> &gt; something that is &quot;against the rules laid out by the standard&quo=
> t;.<br>
> <br>
> &quot;Nonconforming&quot;, then.=C2=A0=C2=A0</blockquote><blockquote class=
> =3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
> ing-left:1ex"></blockquote><div><br></div><div>Nonconformant=C2=A0or noncom=
> pliant ((as previously suggested)=C2=A0does not comply with the standard)=
> =C2=A0</div><div><br></div><div>=C2=A0</div><blockquote class=3D"gmail_quot=
> e" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">=
> I have to agree that &quot;illegal&quot; is wrong.<br>
> There are no DNS cops, despite what many people would like.<br>
> <br></blockquote><div><br></div><div>Oh, I thought=C2=A0that was=C2=A0Mark.=
> ..<span></span> :-)</div><div><br></div><div>And I&#39;d happily volunteer =
> if we form a larger force - &quot;he carries a badge, and a copy of Wiresha=
> rk -- he&#39;s Warren, a member of the elite DNS branch of the Protocol Pol=
> ice. Sworn to uphold EDNS compliance and seek out broken delegations wherev=
> er they may be...&quot;</div><div><br></div><div>W</div><div><br></div><div=
> ><br></div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"marg=
> in:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
> A<br>
> <br>
> --<br>
> Andrew Sullivan<br>
> <a href=3D"javascript:;" onclick=3D"_e(event, &#39;cvml&#39;, &#39;ajs@anvi=
> lwalrusden.com&#39;)">[email-masked]</a><br>
> <br>
> _______________________________________________<br>
> DNSOP mailing list<br>
> <a href=3D"javascript:;" onclick=3D"_e(event, &#39;cvml&#39;, &#39;DNSOP@ie=
> tf.org&#39;)">[email-masked]</a><br>
> <a href=3D"https://www.ietf.org/mailman/listinfo/dnsop" target=3D"_blank">h=
> ttps://www.ietf.org/mailman/listinfo/dnsop</a><br>
> </blockquote><br><br>-- <br>I don&#39;t think the execution is relevant whe=
> n it was obviously a bad idea in the first place.<br>This is like putting r=
> abid weasels in your pants, and later expressing regret at having chosen th=
> ose particular rabid weasels and that pair of pants.<br>=C2=A0 =C2=A0---maf=
> <br>
> 
> --047d7ba9751882c1e50506bdb90a--
> 
> 
> --===============2813703441700708651==
> Content-Type: text/plain; charset="us-ascii"
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> Content-Disposition: inline
> 
> [email-masked]
> --===============2813703441700708651==--
> 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]