Subject: [weirds] I-D Action: draft-ietf-weirds-redirects-01.txt

From: [email-masked]
Date: Sun, 24 Feb 2013 19:42:04 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Web Extensible Internet Registration Data Service Working Group of the IETF.

	Title           : Redirection Service for Registration Data Access Protocol
	Author(s)       : Carlos M. Martinez
                          Arturo L. Servin
                          Linlin Zhou
                          Dario Gomez
                          Gerardo Rada
	Filename        : draft-ietf-weirds-redirects-01.txt
	Pages           : 11
	Date            : 2013-02-24

Abstract:
   The traditional WHOIS protocol has several important shortcomings,
   and over the past few years several approaches to a better
   Registration Data Access Protocol (RDAP) have been discussed and
   proposed.

   Among these shortcomings, different registries operate different
   WHOIS services.  For users this implies that several WHOIS queries to
   different registries may be necessary in order to obtain data for a
   given resource.

   This document describes a redirection service for RESTful WHOIS
   queries.  This service allows users to query a single WHOIS service
   and be redirected to the authoritative registry.

   The solution implemented proposed here applies to Regional Internet
   Registries(RIRs) and Domain Name Registries(DNRs).

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-weirds-redirects

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-weirds-redirects-01

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-weirds-redirects-01

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Arturo Servin <[email-masked]>
Date: Mon, 25 Feb 2013 11:53:22 +0800

Changes from lastest version:

	The original version was a description of the LACNIC's prototype
redirection service. For the version 00 of the draft we didn't changed
anything. For this version we added a new author and we changed the
document to describe a redirection service for WEIRDS (or we have tried to).

	We also we would like to hear some feedback about how you want a
redirection service:

	1) Just doing a staless http redirection
	2) Doing statefull http redirection to avoid loops (considering that
the user agent may be bad implemented and incapable of break a loop)
	3) Something in between as we are proposing with the trade-offs that we
describe.

@to the chairs

	Do you consider that we should discuss this at the Orlando session?

Thanks!
as

On 25/02/2013 11:42, [email-masked] wrote:
> _______________________________________________
> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/weirds
>

---

From: "John Levine" <[email-masked]>
Date: 25 Feb 2013 20:11:58 -0000

>the user agent may be bad implemented and incapable of break a loop)

Has this been a problem in practice?  HTTP has had redirects for 20
years.  I'd think that redirect loops would be a solved problem at
that level.

-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: Arturo Servin <[email-masked]>
Date: Thu, 28 Feb 2013 14:58:44 +0800

No and yes. It has not been a problem but some people commented that it
would be good to inspect some mechanisms to protect weirds servers
against bad programed clients.

	We are happy to follow the WG desires, we could forget about any
mechanism, we could look for another one, etc.

Regards,
as

---

From: "Carlos M. Martinez" <[email-masked]>
Date: Thu, 28 Feb 2013 12:18:51 -0200

IMO, some 'lightweight' redirect warning embedded in the protocol would
be a good addition. I'm specifically thinking about scenarios where very
simplistic clients are used (curl/wget scripted with bash or some quick
n'dirty javascript concoctions)

This would not be a protection against a determined attacker, but would
rather serve as a useful warning/protection for/against the fat-finger
crowd.

But, again as Arturo mentions, we are willing to submit to the WG's
desires :D

Cheers

~CArlos

---

From: "John R Levine" <[email-masked]>
Date: 28 Feb 2013 10:39:32 -0500

> n'dirty javascript concoctions)

curl and wget recognize and break redirect loops.  Javascript depends on 
the browser in which it's running, but they all break redirect loops, too. 
It's very simple: after some large fixed number of redirects, like 20, 
they declare failure and stop.

Really, this sounds like a solution in search of a problem.  It's hard for 
me to imagine a plausible scenario in which someone would be doing WEIRDS 
lookups, and the underlying HTTP fetch tool wouldn't already deal with 
redirect loops.

Also, I can tell you from long experience dealing with similar indirection 
loops that server side loop breaking doesn't work.  No matter how clever 
you are, someone will do something that resets the loop count, or that the 
server doesn't recognize as a loop, and you end up breaking it in the 
client anyway.  Just take it out, please.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
"I dropped the toothpaste", said Tom, crestfallenly.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 28 Feb 2013 14:01:50 -0800

For what it's worth, this is also how sendmail does email loop detection.
Specifically, beyond a fixed (but configurable) number of Received fields,
the mail is assumed to be looping, so it bounces.

-MSK, participatin'

On Thu, Feb 28, 2013 at 7:39 AM, John R Levine <[email-masked]> wrote:

> It's very simple: after some large fixed number of redirects, like 20, they
> declare failure and stop.
>
> ______________________________**_________________
> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/weirds<https://www.ietf.org/mailman/listinfo/weirds>
>

---

From: "John R Levine" <[email-masked]>
Date: 28 Feb 2013 17:18:45 -0500

On Thu, 28 Feb 2013, Murray S. Kucherawy wrote:
> Specifically, beyond a fixed (but configurable) number of Received 
> fields, the mail is assumed to be looping, so it bounces.

I should hope so.  See RFC 5321 section 6.3 which is the same as RFC 2821 
sec 6.2.

Again, this is a solved problem.

R's,
John

---

From: SM <[email-masked]>
Date: Thu, 28 Feb 2013 14:41:55 -0800

At 07:39 28-02-2013, John R Levine wrote:
>curl and wget recognize and break redirect loops.  Javascript 
>depends on the browser in which it's running, but they all break 
>redirect loops, too. It's very simple: after some large fixed number 
>of redirects, like 20, they declare failure and stop.

If I understood the above correctly it is about having the client 
(browser, etc.) perform loop detection instead of doing it on the server side.

Regards,
-sm

---

From: "John R Levine" <[email-masked]>
Date: 28 Feb 2013 17:48:37 -0500

> If I understood the above correctly it is about having the client (browser, 
> etc.) perform loop detection instead of doing it on the server side.

Correct.  My point is that all likely clients already do loop breaking at 
the http level, so there's no point in trying to do it again.

Regards,