Subject: OASIS and new RR types

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 8 Aug 2006 19:30:19 +0200

Page 32 of the following document:
http://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf

shows that the DNS community has not yet fully succeed in convincing the
rest of the IT-world that it is easy and natural to register new RR types.

BTW, is not the listed method a bit cumbersome since you apparently
must enumerate *all* NAPTR records of a certain domain?

It *still* seems that "typed labels" and TXT records would be potentially
faster and not impose limitations on other uses of TXT records or DNS
itself.  In a nutshell:

1. Requester wants meta-data belonging to a name-space like "urn:oasis:something".

2. Provider insert such data as (using a sample rewrite scheme):
$ORIGIN example.com
urn_0oasis_0something  TXT  "the stuff"

2. Requester queries for TXT records with label "urn_0oasis_0something.example.com"

This should not clash with other uses and you should only get back the relevant TXT records.

It may be a kludge, but IMHO a relatively moderate such.

Anders

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Fri, 11 Aug 2006 13:33:54 +1000

> [ Moderators note: Post was moderated, either because it was posted by
>    a non-subscriber, or because it was over 20K.  
>    With the massive amount of spam, it is easy to miss and therefore 
>    delete relevant posts by non-subscribers. 
>    Please fix your subscription addresses. ]
> 
> I find this whole thing with getting RRs allocated a bit confusing.
> 
> Would creating a form on IANA's website make this less of an issue?   
> Or would that make things worse?

	I don't think it will change a thing.  Too many keep spreading
	FUD and being Microsoft apologists.

	If Microsoft's DNS API can't handle new types then Microsoft
	needs to fix the API.  The 20 year old libresolv API can
	handle arbitary types.  There was no excuse for Microsoft
	writing a API that can't handle unknown types.

	If a firewall can't handle a unknown type then the firewall
	is broken.  You get the firewall fixed or you replace the
	firewall with one from a vendor that knows how to handle
	DNS.

	It's not the ease of getting a type anymore.  It is easy
	to get new types.  A couple of pages like RFC 4431 is all
	that is required.

	Mark

> Thanks,
> -drc
> 
> On Aug 8, 2006, at 10:30 AM, Anders Rundgren wrote:
> 
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 10 Aug 2006 20:53:51 -0700

Rather than rubbing peoples nose in anything I would rather put 100% of my effort in that regard behind persuading the Redmond club that it would be a good idea to support DNSSEC in their next server release.

Given that the time between server releases is about six years and the feature list on the last one closed some time in 2001 it is hardly suprising that features such as support for unknown RRs that have not had a measurable degree of evangelism effort behind them have not been more widely adopted.

If the world does not listen to you, you can either conclude that they are fools or that you have not spoken well enough.

From: Mark Andrews

---

From: Mark Andrews <[email-masked]>
Date: Fri, 11 Aug 2006 14:13:24 +1000

> Rather than rubbing peoples nose in anything I would rather put 100% of my ef
> fort in that regard behind persuading the Redmond club that it would be a goo
> d idea to support DNSSEC in their next server release.
> 
> Given that the time between server releases is about six years and the featur
> e list on the last one closed some time in 2001 it is hardly suprising that f
> eatures such as support for unknown RRs that have not had a measurable degree
>  of evangelism effort behind them have not been more widely adopted.

	RFC 1034 and RFC 1035 basically say you should expect unknown
	RR types.  It shouldn't have required evangelism in 2001.
	Any decent engineer would have seen that unknown was basically
	opaque data.  This was made abandently clear in RFC 2535 (1999)
	as we had to work out how to sign future records.  The use of
	compression pointers (the one sticking point in 1034/1035) in
	rdata had ceased years earlier.

	Sorry. There is was excuse.
 
> If the world does not listen to you, you can either conclude that they are fo
> ols or that you have not spoken well enough.
> 
> 
> From: Mark Andrews
>

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 10 Aug 2006 22:03:27 -0700

You still suffer from thinking that the world has some form of obligation to follow the proposals of this committee without any effort on the member's part to convince them that this is the case.

Much later than 1999 members of this group were still making statements such as 'if it is not possible to deploy DNSSEC in dot com then the problem is that dot com is to big and we should reduce it in size'. Small wonder it was ignored at the time. 

Until SPF appeared there was no mainstream proposal to add records to the DNS to support a feature that was not principaly an extension of the DNS itself.

Regardless of what should have happened it did not. There is plenty that this WG should have done in the past that it didn't.

The IETF produces several hundred RFCs each year. Most require several man years for a serious implementation. Most will be utterly ignored by everyone apart from their authors. The job is not done until there is a deployment constituency.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> Sent: Friday, August 11, 2006 12:13 AM
> To: Hallam-Baker, Phillip
> Cc: David Conrad; Anders Rundgren; [email-masked]
> Subject: Re: OASIS and new RR types 
> 
> 
> > Rather than rubbing peoples nose in anything I would rather 
> put 100% 
> > of my ef fort in that regard behind persuading the Redmond 
> club that 
> > it would be a goo d idea to support DNSSEC in their next 
> server release.
> > 
> > Given that the time between server releases is about six 
> years and the 
> > featur e list on the last one closed some time in 2001 it is hardly 
> > suprising that f eatures such as support for unknown RRs 
> that have not 
> > had a measurable degree  of evangelism effort behind them 
> have not been more widely adopted.
> 
> > If the world does not listen to you, you can either 
> conclude that they 
> > are fo ols or that you have not spoken well enough.
> > 
> > 
> > From: Mark Andrews
> >

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 13 Aug 2006 19:27:52 -0700

All proposals that came from the DNS community.

MX arguably did not but if you look back to the pre-history of DNS you will find that DNS grew largely out of the demands of SMTP.

> From: Danny Mayer [mailto:[email-masked]] 
> Sent: Sunday, August 13, 2006 5:36 PM
> Cc: [email-masked]; David Conrad; Anders Rundgren; 
> [email-masked]
> Hallam-Baker, Phillip wrote:
> > Until SPF appeared there was no mainstream proposal to add 
> records to 
> > the DNS to support a feature that was not principaly an 
> extension of 
> > the DNS itself.
> > 
> 
> You mean apart from MX, SRV, and NAPTR?
> 
> Danny
> 
>