Subject: [weirds] bootstrap requirements

From: Marc Blanchet <[email-masked]>
Date: Thu, 4 Jul 2013 13:22:46 -0400

Hello,
 to help foster and converge the discussion on the bootstrap solution, I started a list of differentiating requirements for bootstrapping. I then asked John Levine, Andy Newton, Arturo Servin and Ernie Dainow to provide comments. This list below is the result of this discussion. All bad ideas are mine, all good ideas are theirs.

This is NOT the list of requirements. It is a list of possible requirements that would help compare various solutions and to (hopefully) help to converge. 

I intend to present during Berlin meeting compare the various solutions by using that list.  

Regards, Marc.

======
Weirds Bootstrapping

Possible functional requirements:
1) require use of https on every request
2) specify per registry which of http/https is to be used by clients
3) provide delegation below the tld
4) same solution for both names and numbers
5) don't route all traffic through one point of attack (which is not the same as one point of failure)
6) base URL may have a prepended path (i.e. http://domain/my/own/path/query)
7) if DNS is used, only terminating DNS RR can be used (i.e. no CNAME, SRV, NAPTR

Possible design choices:
20) does the client have a cache of "servers" to start with?
21) if a cache, how/when does it refresh the data?

---

From: Carlos Martinez-Cagnazzo <[email-masked]>
Date: Thu, 4 Jul 2013 16:39:52 -0300

When discussing bootstrapping and related topics (redirects) some of us
bring up some perceived constraints and we use them to force the discussion
in one direction or another.

I believe that it would be great to add to the presentation and for the WG
to review certain hypothesis that have been brought forward a few times. I
also believe we should openly discuss them and note whether we feel they
are actual constraints or limitations or not.

Here is my list, yours may vary. Feel free to add.

- the 'lazy client programmer' hypothesis, take #1: Clients mostly won't
bootstrap regardless of the proposed method and will hit the first RDAP
server that comes to their mind with a hammer.

- the 'lazy client programmer', take #1, soft version: Clients will
bootstrap if we provide a simple enough mechanism

- the 'lazy client programmer' take #2: Clients won't cache anything and
will bootstrap over and over again and will repeat queries over and over
again even when queried for the same object multiple times

- the need for supporting Javascript-only clients: Should we consider this
a hard constraint on bootstrapping or can we accept that JS-only clients
may use the help of a friendly server ?

Having these matters settled will, IMO, be helpful for framing future
discussions. I was actually thinking on creating a SurveyMonkey for them :)

Looking forward to Berlin!

~Carlos

On Thu, Jul 4, 2013 at 2:22 PM, Marc Blanchet <[email-masked]>wrote:

> Hello,
>  to help foster and converge the discussion on the bootstrap solution, I
> started a list of differentiating requirements for bootstrapping. I then
> asked John Levine, Andy Newton, Arturo Servin and Ernie Dainow to provide
> comments. This list below is the result of this discussion. All bad ideas
> are mine, all good ideas are theirs.
>
> This is NOT the list of requirements. It is a list of possible
> requirements that would help compare various solutions and to (hopefully)
> help to converge.
>
> _______________________________________________
> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/weirds
>
>

-- 
--
=========================
Carlos M. Martinez-Cagnazzo
http://cagnazzo.name
=========================

---

From: Andy Newton <[email-masked]>
Date: Tue, 16 Jul 2013 13:37:24 +0000

From: Marc Blanchet <[email-masked]<mailto:[email-masked]>>
Date: Thursday, July 4, 2013 1:22 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [weirds] bootstrap requirements

Possible design choices:

I have one additional one: Does not require us to open up previously settled technical decisions.

-andy

---

From: "Carlos M. martinez" <[email-masked]>
Date: Tue, 16 Jul 2013 09:42:10 -0400

> settled technical decisions.

+1, that's why I think we should settle the 'hypothesis on client
behaviour' questions once and for all, so they don't keep creeping up
every time we discuss bootstrapping.

~CM.

---

From: Marc Blanchet <[email-masked]>
Date: Tue, 16 Jul 2013 09:56:12 -0400

Le 2013-07-16 à 09:37, Andy Newton <[email-masked]> a écrit :

> From: Marc Blanchet <[email-masked]>
> To: "[email-masked]" <[email-masked]>

would you mind stating them?  (I haven't seen a real concensus call on any of them and I've seen different opinions on all of them)

Marc.

---

From: Andy Newton <[email-masked]>
Date: Tue, 16 Jul 2013 14:20:12 +0000

From: Marc Blanchet <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, July 16, 2013 9:56 AM
To: Andrew Newton <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [weirds] bootstrap requirements

This WG hasn't been operating under formal consensus calls for technical issues. I think this is easily covered under the "we all know it when we see it" measurement. Otherwise we get to open the XML vs. JSON debate, the HTTP RESTful vs DNS debate etc… Most of our drafts have been getting decent review on their revisions. If an item has been in a draft for sometime, especially after having had some discussion on the list, and has not changed, then it has been previously settled.

-andy

---

From: Marc Blanchet <[email-masked]>
Date: Tue, 16 Jul 2013 11:16:06 -0400

Le 2013-07-16 à 10:20, Andy Newton <[email-masked]> a écrit :

> To: Andrew Newton <[email-masked]>
> Cc: "[email-masked]" <[email-masked]>

all fine. but it would really help (me at least) if you would be more precise on "previously settled technical decisions" when you are referring to bootstrap requirements/draft/discussion. 

Marc.

---

From: Andy Newton <[email-masked]>
Date: Tue, 16 Jul 2013 16:50:53 +0000

Date: Tuesday, July 16, 2013 11:16 AM

Le 2013-07-16 à 10:20, Andy Newton <[email-masked]<mailto:[email-masked]>> a écrit :

In the context of the current disagreement on bootstrapping, the matter of allowing servers to have a base path in the URL has been in the rdap-query draft for some time and was discussed on this list (though briefly). The desire to remove this flexibility is surfacing now because the CNAME bootstrap approach cannot accommodate it.

I'd also like to point out one more bootstrap nice-to-have. The bootstrap method should be flexible enough to accommodate federated authentication, such as a ticket server. That is, if ICANN or some authority wanted to stand up a ticket server that allowed LEAs differentiated access, it would be nice if the bootstrap method made that as seamless as possible. I hope that makes sense.

-andy

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 16 Jul 2013 10:01:44 -0700

On Tue, Jul 16, 2013 at 9:50 AM, Andy Newton <[email-masked]> wrote:

>  In the context of the current disagreement on bootstrapping, the matter
> of allowing servers to have a base path in the URL has been in the
> rdap-query draft for some time and was discussed on this list (though
> briefly). The desire to remove this flexibility is surfacing now because
> the CNAME bootstrap approach cannot accommodate it.
>
>
Just to be clear, the working group is allowed to change its mind.  If we
collectively decide A, but then someone points out something we hadn't
considered and consensus swings to B, that's perfectly acceptable.

Put another way: Given some previous decision and some new information, I
think it's just fine for the WG to consider whether the previous decision
stands up to the new information.  Consensus might change or it might not,
but that re-evaluation is a reasonable use of (some) working group time.
On the other hand, if that new information doesn't really change or add to
the premises on which the decision was reached, we need to keep moving.

-MSK, co-chairin'

---

From: Gavin Brown <[email-masked]>
Date: Tue, 16 Jul 2013 18:57:48 +0100

On 16 Jul 2013, at 18:01, "Murray S. Kucherawy" <[email-masked]> wrote:

> Just to be clear, the working group is allowed to change its mind.  If we collectively decide A, but then someone points out something we hadn't considered and consensus swings to B, that's perfectly acceptable.

My mind has changed on this. Allowing a base path is less useful to me than a scalable bootstrap.

It's not like anyone's going to run an RDAP service on GeoCities.

G.

-- 
Gavin Brown
Chief Technology Officer
CentralNic Ltd
Innovative Registry Services for ccTLD and gTLD registries
https://www.centralnic.com/

CentralNic Ltd is a company registered in England and Wales with company
number 4985780. Registered Offices: 35-39 Moorgate, London, EC2R 6AR.

---

From: Andy Newton <[email-masked]>
Date: Tue, 16 Jul 2013 18:26:51 +0000

On 7/16/13 1:57 PM, "Gavin Brown" <[email-masked]> wrote:

>> Just to be clear, the working group is allowed to change its mind.  If
>>we collectively decide A, but then someone points out something we
>>hadn't considered and consensus swings to B, that's perfectly acceptable.
>

I agree with this. However, the approach upon which this is being
reconsidered isn't arguably more scalable for our needs and is arguably
more complex and less flexible.

-andy