Subject: Re: [DNSOP] Last Call: <draft-ietf-dnsop-sutld-ps-05.txt> (Special-Use Domain Names Problem Statement) to Informational RFC

From: Bob Harold <[email-masked]>
Date: Fri, 9 Jun 2017 11:25:24 -0400

On Tue, Jun 6, 2017 at 4:17 PM, The IESG <[email-masked]> wrote:

>
> The IESG has received a request from the Domain Name System Operations WG
> (dnsop) to consider the following document: - 'Special-Use Domain Names
> Problem Statement'
>   <draft-ietf-dnsop-sutld-ps-05.txt> as Informational RFC
>
> The IESG plans to make a decision in the next few weeks, and solicits final
> comments on this action. Please send substantive comments to the
> [email-masked] mailing lists by 2017-06-20. Exceptionally, comments may be
> sent to [email-masked] instead. In either case, please retain the
> beginning of
> the Subject line to allow automated sorting.
>
> Abstract
>
>
>    The Special-Use Domain Names IANA registry policy defined in RFC 6761
>    has been shown through experience to present unanticipated
>    challenges.  This memo presents a list, intended to be comprehensive,
>    of the problems that have been identified.  In addition it reviews
>    the history of Domain Names and summarizes current IETF publications
>    and some publications from other organizations relating to Special-
>    Use Domain Names.
>
>
>
>
> The file can be obtained via
> https://datatracker.ietf.org/doc/draft-ietf-dnsop-sutld-ps/
>
> IESG discussion can be tracked via
> https://datatracker.ietf.org/doc/draft-ietf-dnsop-sutld-ps/ballot/
>
>
> No IPR declarations have been submitted directly on this I-D.

 Minor nit:

4.1.2.  Special-Use Domain Names

Last part of the last sentence:"they can only use the mDNS protocol be used
for resolving that Domain Name."
Looks like "be used" is redundant and should be removed.

-- 
Bob Harold

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 12 Jun 2017 15:52:00 +0200

On Tue, Jun 06, 2017 at 01:17:55PM -0700,
 The IESG <[email-masked]> wrote 
 a message of 42 lines which said:

> The IESG has received a request from the Domain Name System
> Operations WG (dnsop) to consider the following document: -
> 'Special-Use Domain Names Problem Statement'

For an issue which is quite contentious and sensitive, I think there
are some points in the document that deserve a change.

Biggest point: the IESG decided to freeze the RFC 6761 process
<https://www.ietf.org/blog/2015/09/onion/> I regret this decision (RFC
6761 is still in force, it has not been deprecated or updated) and,
unfortunately, registration of new Special-Use Domain Names is now
impossible (pending an action on RFC 6761 that will probably never
come). So, de facto, a regular process has been shut down, leaving the
IETF without a possibility to register these domain names.

Now, on the draft:

* Section 3 says "No formal coordination process exists between the
IETF and ICANN" This is not true, there is a formal liaison
<https://www.ietf.org/liaison/managers.html> and it is even mentioned
laster, in section 4.1.4. This issue was mentioned during the WGLC
<https://mailarchive.ietf.org/arch/msg/dnsop/OWt8DkBJ_JpIITF-R2YpwEhiwFs>

* Section 3 says "Use of the registry is inconsistent -- some
Special-Use Domain Name RFCs specify registry entries, some don't;
some specify delegation, some don't." There is no inconsistency
here. RFC 6761 says (in its section 5) that the reservation of a
Special-Use Domain Name is free to choose the rules regarding
resolution, as long as they are properly explained.

* Section 4.2.2 says "the fact of its unilateral use by The Tor
Project without following the RFC 6761 process" The onion TLD was in
use in Tor since 2004, nine years before the publication of RFC
6761. It is grossly unfair to reproach not following an unpublished
RFC. It was mentioned a long time ago
<https://mailarchive.ietf.org/arch/msg/dnsop/nr4ECaVw6PT09o2xdM3jrKllHBI>

* Section 4.2.3 says "But it shares the problem that such names cannot
be assumed either to be unique or to be functional in all contexts for
all Internet-connected hosts." Unfortunately, because of the wide use
of censorship through lying DNS resolvers, this problem is now part of
our daily life. It would be nice if a name had the same global
signification, but it is no longer true.

---

From: Ted Lemon <[email-masked]>
Date: Mon, 12 Jun 2017 10:42:30 -0400

> IETF without a possibility to register these domain names.

The point of publishing this document is to get a step closer to fixing this problem.

> <https://mailarchive.ietf.org/arch/msg/dnsop/OWt8DkBJ_JpIITF-R2YpwEhiwFs>

What is meant here is not that the IETF and ICANN don't communicate, but rather that the IETF doesn't have a formal process for saying to ICANN, specifically, "don't use this name."   It's all informal.   It is done through the liaison, it's true, but there's no set of instructions to follow which, having been followed, we can point to and say "we followed the process."

We could replace the first sentence as follows: "Although the IETF and ICANN do have a liaison relationship through which special-use allocations can be discussed, there exists no formal process for coordinating these allocations."

Would that work?

> resolution, as long as they are properly explained.

The point here is not that every name should be treated the same, but that every RFC that does a 6761 allocation should specify how/whether the name is delegated every 6761 allocation should be added to the special-use names registry.

How about the following change:

   o  Use of the registry is inconsistent -- some Special-Use Domain
      Name RFCs specifically add registry entries, some don't; some specify
      how and whether special-use name delegations should be done, 
      some don't.

> <https://mailarchive.ietf.org/arch/msg/dnsop/nr4ECaVw6PT09o2xdM3jrKllHBI>

This was not intended as a reproach, but I see why you read it that way.   How about this:

      The situation was somewhat forced, both by the fact of its
      unilateral use by The Tor Project before the RFC 6761
      process became available,

> signification, but it is no longer true.

Andrew McConachie brought up the same issue.   Unfortunately I think this is out of scope for this document, but several people have expressed interest in formally documenting this issue—I think Andrew Sullivan expressed a similar sentiment at the mic in Chicago.   You might want to discuss this with them and see if there's work to do.

---

From: Job Snijders <[email-masked]>
Date: Mon, 12 Jun 2017 17:00:34 +0200

> <https://mailarchive.ietf.org/arch/msg/dnsop/nr4ECaVw6PT09o2xdM3jrKllHBI>

----

OLD:
   The situation was somewhat forced, both by the fact of its unilateral
   use by The Tor Project without following the RFC 6761 process, and
   because a deadline had been set by the CA/Browser Forum
   [SDO-CABF-INT] after which all .onion PKI certificates would expire
   and no new certificates would be issued, unless the .onion
   Special-Use Top-Level Domain Name were to be recognized by the IETF.

NEW:
   The situation was somewhat forced, both by the fact that use of the
   .onion domain name by the Tor Project predates the process described
   in RFC 6761 by 9 years, and because a deadline [CABF-DEADLINE] had
   been set by the CA/Browser Forum [CABF] after which all PKI
   certificates for internal names would expire and no new certificates
   would be issued. At the time .onion was considered an internal name.
   IETF recognition of the .onion as a Special-Use Top-Level Domain Name
   facilitated the development of a certificate issuance process
   specific to .onion domain names [CABF-BALLOT144]. 

[CABF-DEADLINE] should link to https://www.digicert.com/internal-names.htm
[CABF] should link to https://cabforum.org/
[CABF-BALLOT144] should link to https://cabforum.org/2015/02/18/ballot-144-validation-rules-dot-onion-names/

----

I wasn't there, but reading ballot-144, some cabforum mails, and 
https://blog.torproject.org/blog/landmark-hidden-services-onion-names-reserved-ietf
it appears to me that all parties involved were actively trying to fix a
long standing broken situation.

Kind regards,

Job

---

From: Ted Lemon <[email-masked]>
Date: Mon, 12 Jun 2017 11:12:59 -0400

> [CABF-BALLOT144] should link to https://cabforum.org/2015/02/18/ballot-144-validation-rules-dot-onion-names/

Thanks, I think this is better text.

> long standing broken situation.

Yes, that's what it looked like to me as well.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 12 Jun 2017 17:15:08 +0200

On Mon, Jun 12, 2017 at 11:12:59AM -0400,
 Ted Lemon <[email-masked]> wrote 

> Thanks, I think this is better text.

Me too (no longer talks of "unilateral" use)

---

From: Ted Lemon <[email-masked]>
Date: Mon, 12 Jun 2017 11:17:22 -0400

> Me too (no longer talks of "unilateral" use)

"unilateral" isn't a criticism.   It's what happened.   There's a reason that it happened.   I don't think we should minimize that.   I disagree with the idea that was advanced by some folks in dnsop during the .onion discussion that the unilateral use of the name was bad.   It was common practice at the time.