Subject: Re: [DNSOP] abandoning ANAME and standardizing CNAME at apex

From: Mark Andrews <[email-masked]>
Date: Wed, 19 Sep 2018 07:24:25 +1000

> On 19 Sep 2018, at 6:02 am, JW <[email-masked]> wrote:
> 
> 
> -------- Original message --------
> From: Mark Andrews <[email-masked]>
> 
> > I would also expect a relatively large client population using SRV records
> > given the rate Firefox and Chrome browsers are upgraded.  SRV lookups
> > work for lots ofother protocols.  SRV records also make it through
> > firewalls and IDS today.
> >
> 
> Hi Mark,
> 
> I agree SRV is the obvious choice for a greenfield protocol but there is HTTP code sprinkled /everywhere/.  I can't imagine all those forgotten scripts, lonely IOT devices, and troubleshooting guides are going to be as easy to solve as updating chrome and firefox.

Actually it really is.  Think about the names that are served by CDN’s, the other data
at those names and the clients that are making those lookups.  Those names with other
data are the ones that need to me moved to using SRV.  The rest of the HTTP lookups
can continue to use A and AAAA lookup in perpetuity if they want.  Sure we want to
upgrade the rest over time but it is mostly browsers that are doing these lookups
where there is the other data issues.

As for scripts, you upgrade the tools those scripts use: curl(libcurl), wget, fetch
for SH. File::Fetch for perl.  Similar for the other scripting languages. Very few
applications actually make socket calls directly for http. 

Mark

> Whatever the solution, I feel it should be as transparent to the client as possible.  CNAME would fit this bill but the negative impact is largely unknown.
> 
> Perhaps defining a set of default protocols for SRV where it could simulate a CNAME-like response if https/http SRV records are found?
> 
> /John
> 
> >
> > -- 
> > Mark Andrews, ISC
> > 1 Seymour St., Dundas Valley, 
> > NSW 2117, Australia
> > PHONE: +61 2 9871 4742              
> > INTERNET: [email-masked]
> 

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: [email-masked]

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 19 Sep 2018 09:26:26 +0200

On Wed, Sep 19, 2018 at 07:24:25AM +1000,
 Mark Andrews <[email-masked]> wrote 
 a message of 38 lines which said:

> As for scripts, you upgrade the tools those scripts use:
> curl(libcurl), wget, fetch for SH. File::Fetch for perl.  Similar
> for the other scripting languages. Very few applications actually
> make socket calls directly for http.

I hope it is true but I'm not so sure. Any hard data somewhere? My
purely anecdotal evidence is that I've seen "applications actually
make socket calls directly for http", one reason probably being it is
widely teached in schools.

HTTP/2 is a good thing here since it is much harder to do it yourself,
so people will rely on libraries :-)

---

From: Mark Andrews <[email-masked]>
Date: Wed, 19 Sep 2018 17:47:10 +1000

> On 19 Sep 2018, at 5:26 pm, Stephane Bortzmeyer <[email-masked]> wrote:
> 

And the number of such applications that connect to names that are served by
CDN and are also at zone apexes such that CNAME doesn’t work is ~0%.  Such
applications need to be upgraded.

I’m sure CDN’s could give Agent string counts for sites where they are
doing DNS hacks for apex names so we could see actual data.  It will be in
their logs.  I’m sure there are employees of such companies reading this.