Subject: [DNSOP] `localhost` and DNS.

From: Mike West <[email-masked]>
Date: Wed, 15 Nov 2017 15:51:17 +0100

Hey folks!

Skimming through the recording of Monday's meeting
<https://play.conf.meetecho.com/Playout/?session=IETF100-DNSOP-20171113-0930>
(starting
at around 53:56), it sounds to me as though there's at least loose
agreement that signing a response for `localhost` is not what we'd like to
recommend: all the folks who commented explicitly took that position for
similar reasons. The current text in
https://tools.ietf.org/html/draft-ietf-dnsop-let-localhost-be-localhost-01#section-4.2
reflects
this position, and IMO it's what we should run with.

Are there contrary opinions that weren't expressed in the room on Monday?
If not, is there additional work we need to do on the draft before moving
on? I believe the remaining feedback that's been provided on the list has
been addressed in the current -01.

Also, one suggestion made at the mic is that `127.0.0.1` isn't the only
loopback address (with the example of FreeBSD jails). I believe the current
draft accepts that reality by allowing a range of loopback addresses in
https://tools.ietf.org/html/draft-ietf-dnsop-let-localhost-be-localhost-01#section-2.
Are there loopback addresses outside the 127.0.0.0/8 range?

Thanks!

-mike

---

From: Ted Lemon <[email-masked]>
Date: Thu, 16 Nov 2017 05:05:05 +0800

On Nov 15, 2017, at 10:51 PM, Mike West <[email-masked]> wrote:
> Skimming through the recording of Monday's meeting <https://play.conf.meetecho.com/Playout/?session=IETF100-DNSOP-20171113-0930> (starting at around 53:56), it sounds to me as though there's at least loose agreement that signing a response for `localhost` is not what we'd like to recommend: all the folks who commented explicitly took that position for similar reasons. The current text in https://tools.ietf.org/html/draft-ietf-dnsop-let-localhost-be-localhost-01#section-4.2 <https://tools.ietf.org/html/draft-ietf-dnsop-let-localhost-be-localhost-01#section-4.2> reflects this position, and IMO it's what we should run with.

Yes, the current text appears to me to be correct.

---

From: Richard Barnes <[email-masked]>
Date: Thu, 16 Nov 2017 08:01:49 +0800

On Thu, Nov 16, 2017 at 5:05 AM, Ted Lemon <[email-masked]> wrote:

> <https://play.conf.meetecho.com/Playout/?session=IETF100-DNSOP-20171113-0930> (starting
> similar reasons. The current text in https://tools.ietf.org/
> html/draft-ietf-dnsop-let-localhost-be-localhost-01#section-4.2 reflects

+1

>
>
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>
>

---

From: Mike West <[email-masked]>
Date: Mon, 27 Nov 2017 12:54:20 +0100

Post-{IETF,Thanksgiving} ping. Feedback (or further +1's!) would be
appreciated. :)

-mike

On Thu, Nov 16, 2017 at 1:01 AM, Richard Barnes <[email-masked]> wrote:

>> similar reasons. The current text in https://tools.ietf.org/html
>> /draft-ietf-dnsop-let-localhost-be-localhost-01#section-4.2 reflects

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Mon, 27 Nov 2017 10:39:07 -0800

Looks good to me.

On 11/27/2017 03:54 AM, Mike West wrote:
> On Thu, Nov 16, 2017 at 1:01 AM, Richard Barnes <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>
>
>     On Thu, Nov 16, 2017 at 5:05 AM, Ted Lemon <[email-masked]
>     <mailto:[email-masked]>> wrote:
>
>         On Nov 15, 2017, at 10:51 PM, Mike West <[email-masked]
>         <mailto:[email-masked]>> wrote:
>>         at around 53:56), it sounds to me as though there's at least
>>         loose agreement that signing a response for `localhost` is
>>         not what we'd like to recommend: all the folks who commented
>>         explicitly took that position for similar reasons. The
>>         current text
>>         in https://tools.ietf.org/html/draft-ietf-dnsop-let-localhost-be-localhost-01#section-4.2
>>         <https://tools.ietf.org/html/draft-ietf-dnsop-let-localhost-be-localhost-01#section-4.2> reflects
>         [email-masked] <mailto:[email-masked]>
>         <https://www.ietf.org/mailman/listinfo/dnsop>
>
>
>
>
>