Subject: Re: wcard discussions in Minneapolis

From: Robert Elz <[email-masked]>
Date: Fri, 01 Apr 2005 18:58:37 +0700

Date:        Tue, 29 Mar 2005 13:57:25 -0500
    From:        Edward Lewis <[email-masked]>
    Message-ID:  <a06200700be6f5083c205@[10.31.32.83]>

  | How about we document that there are inconsistencies in the 
  | definition of DNS which lead to unclear semantics when asterisk 
  | labels are delegation points or DNAME rewrite points.

I'm going to skip DNAME for a minute, since I don't recall its spec
well enough to comment,

But for NS, I don't understand this at all, nor most of the other comments
on this thread (the ones I've just read, which isn't all of them).

Everyone seems to be assuming that there's something undefined about
"* NS".    Nonsense.    What's there now is perfectly well specified.

It's useless, and a bit bizarre, but undefined it isn't.

Much of the "it is undefined" can be traced back to really meaning
"it isn't defined to do what I think it should do" (which is perfectly
possible, but utterly irrelevant), or "when I skimmed the RFC it wasn't
obvious to me what happens" which is also possible, and is (part of)
what the wildcard clarify doc is supposed to be fixing.

I fully understand that lots of people don't like having it defined as
it is currently, and making it be undefined would be a fine first step
in later being able to supply a definition (different than the current one).
But if that's to happen, everyone needs to be very clear, that what is
happening is a change to the DNS - an explicit and deliberate change, not
just a clarification or fixup of what has been there for decades now.

That might be OK (after all, the WG did decide to change the definition
of "* CNAME" - and recognised it as being an actual change).

Just please, when considering this question, don't start out from
"it is undefined" or "it is ambiguous" or anything else like that,
because it isn't.

What is there now is perfectly well defined, and 100% useless for
anything.   In some sense, all the wcard clarifications doc really
needs to say is that - just make it clear to everyone that "* NS"
isn't going to produce any meaningful result (in the wildcard sense).
Even explaining why that's true probably isn't required.

kre

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Fri, 1 Apr 2005 10:32:11 -0500

>It's useless, and a bit bizarre, but undefined it isn't.

I have to respectively disagree on that.

'* NS' was once well defined, but then two things happened.

1) The arm wrestling over the legitimacy of synthesizing a name that 
you are delegating away.

- As one of my co-bar patrons says, it's not the NS that indicates 
delegation, but the SOA.  I don't agree, I still think it's the 
parent's placement of an NS set.  (The parent is authoritative for 
the existence of the NS, but not the contents.)

- This arm wrestling was purely an academic exercise until:

2) DNSSEC is picky about legitimacy of data.

The problem is that by following rules regarding who's authoritative 
for data and therefore who can sign and following rules for 
synthesizing records, we hit a discontinuity in the domain-zone 
continuum.

...what this situation make me think about is the appearance of RFC 
2136 and the profound impact it has on the definition of DNS even 
though what it is adding is somewhat "window dressing" and is only 
moderately deployed.  (I mean Dynamic Update.)  I.e., DNSSEC and 
Dynamic Update have both uncovered dirtly little incompletenesses in 
the original specifications.  Where once we were confident we knew 
DNS, we are not always so sure.

That's why I am disagreeing.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Achieving total enlightenment has taught me that ignorance is bliss.