Subject: Re: [Bundled-domain-names] New Version Notification for draft-yao-bundled-name-problem-statement-01.txt

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 14 Oct 2016 16:43:48 +0200

On Wed, Aug 24, 2016 at 02:11:33PM +0800,
 Jiankang Yao <[email-masked]> wrote 
 a message of 189 lines which said:

> the following is the new version of PS document.

I've just read it and I have three comments.

One is on the possible size of the "bundle". In french, even if you
limit to the accented characters of the french language, a bundle of
all possible variants for a name with three accented characters can be
on the size of the thousand. It can be larger for other scripts. Is it
a requirment that the solution (whatever it is) work with large
bundles? In the minutes of the Berlin Bar BOF, I see "In scope:
Mapping among any finite number of activated domain names \ Out of
scope:  Infinite number of domain names or variants" which does not
help: 37^63 (number of possible LDH labels) is finite but *huge*.

The second is that you do not mention the solution that people use
today, when the names are in different TLDs: rely on a clever
provisioning system. Just automatically generate the config for all
your domain names. (Hello, DevOps.)

The third is about section 4, application issues. The idea of using at
runtime a DNS request to decide which page to serve seem to me very
bad: latency (there is a reason why Apache does not look up PTR by
default), resiliency (what if the DNS is down), debugging (result of
the HTTP request will depend on a third party).

---

From: "John Levine" <[email-masked]>
Date: 14 Oct 2016 16:57:19 -0000

>bundles?

I'd think it has to.  The .CAT TLD bundles accented characters exactly
as you describe.  In languages with variant characters there are
likely to be variant names all over the DNS tree, which means there's
a combinational explosion if you do this in a naive way.

>your domain names. (Hello, DevOps.)

This works sometimes.  Having done some scanning of .ONG and .NGO
which have parallel DNS, it doesn't work as often as it does, even in
what should be a trivally simple setup.  Also see the comment about
combinational explosion above.

>the HTTP request will depend on a third party).

This is my part so I guess I should explain.  Having looked at servers
in .CAT (which used to use dnames and now uses parallel DNS) and in
.NGO/.ONG I have found that in practice very few people configure
their web servers to handle variants correctly.

I'm sure that you and I could come up with a provisioning system to
produce parallel configurations for DNS, Web, and SMTP, install them
into the appropriate application servers, and update them all as
needed.  But you and I are not typical.  More typical is a setup where
DNS, Web, and mail are separate departments or even separate
subcontractors who talk to each other only when it is completely
unavoidable.

So if we want it to work, it has to work without configuring
individual servers, and the only way I can see to do that is to have
the application servers follow a single authority which is the DNS.
We are allowed to be smart about how we do it, so performance needn't
be a problem.  I'd think that when an application server sees a name
it doesn't recognize, it then does a few DNS probes to find the DNAME
or BNAME or CLONE or whatever which tells it about the entire mirrored
subtree and it remembers that subtree for the TTL of the DNS record.
The DNAME that ties together the two versions of the Chinese name of
Taiwan has a TTL of a day, which I think would be typical, so in any
sensible setup, the vast majority of mirrored names would be handled
with cached configurations, rather than new lookups.

This isn't bulletproof, but it seems likely to work a lot more often
than something that requires synchronized server updates to DNS, web,
mail, and other applications.

R's,
John