Subject: Re: [dnsext] DNSEXT charter and treating DNS names as "the same"

From: "Jiankang YAO" <[email-masked]>
Date: Wed, 11 Aug 2010 13:57:09 +0800

current process is the icann idn fast track.

other icann idn processes such as gtld idn tld are waiting for dnssext's technology solution.  

if chairs or wg said that we can do provision and we do not need a technology, Don't shun away from our responsibility, please.

----- Original Message ----- 
From: "Jiankang YAO" <[email-masked]>
To: "John R. Levine" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Wednesday, August 11, 2010 1:40 PM
Subject: Re: [dnsext] DNSEXT charter and treating DNS names as "the same"

> provision is the policy based, not the technology based.
> 
> it is not a long term solution; it is a short solution.
> 
> long term solution needs the technology solution  such as bname.
> 
> 
> ----- Original Message ----- 
> From: "John R. Levine" <[email-masked]>
> To: "Jiankang YAO" <[email-masked]>
> Cc: <[email-masked]>; <[email-masked]>
> Sent: Wednesday, August 11, 2010 1:20 PM
> Subject: Re: [dnsext] DNSEXT charter and treating DNS names as "the same"
> 
> 
>>> I have been involving in the icann idn process for many years.
>>>
>>> if provisioning works, icann would have used provising.
>> 
>> Hmmn.  I see that CNNIC says in section 5 of their implementation plan for 
>> the IDN ccTLDs that they're making traditional and simplified Chinese 
>> domain names equivalent.  If they're not doing that by provisioning, what 
>> are they're doing instead?
>> 
>> http://www.cnnic.cn/html/Dir/2010/06/12/5852.htm
>> 
>> R's,
>> John

---

From: "Jeffrey A. Williams" <[email-masked]>
Date: Mon, 30 Aug 2010 12:53:56 -0500 (GMT-05:00)

Phillip and all,

  Percisely and nicely done! 

  Unfortunately what you discribe/outline will not set
well with ICANN.  Some may/will find that attitude
inconsequencial as exceptance of other name spaces
will wait or market for the market to come to them,
as IPv9 for instance and by design, indicates.

  Wheather or not ICANN chooses to recognize such
may influence the burgioning marketplace to retreat
and some to seek other DNS hack alternitives that
are both safe and inclusive but not directly associated
with the present legacy name space in any way.

-----Original Message-----
>From: Phillip Hallam-Baker <[email-masked]>
>Sent: Aug 30, 2010 11:01 AM
>To: Alex Bligh <[email-masked]>
>Cc: Jiankang YAO <[email-masked]>, Stephane Bortzmeyer <[email-masked]>, [email-masked]
>Subject: Re: [dnsext] Re: DNSEXT charter and treating DNS names as "the same"
>
>The only reason I can see to reject the provisioning method is that
>the provisioning may not work across zones of authority.
>
>So for example, let us imagine that I want to synchronize
>hallambaker.com with hallambaker.co.uk. If I registered the .co.uk
>version I would be able to program my DNS configurator to create the
>same records in each domain.
>
>The same infrastructure tells my Web server to map
>www.hallambaker.co.uk to www.hallambaker.com through an internal
>redirect.
>
>I get precisely the effect desired with no need to change any of the
>DNS infrastructure. The only (minor) downside being that this may not
>work identically if I decide to make radical changes to my DN
>configuration and end up with records that are out of sync. But this
>is not really a major difference to what happens with a single zone,
>cutovers take time to propagate, that is the way the Web is.
>
>
>Now imagine that .co.uk decide that they want to synchronize *.co.uk
>and *.co.gb.
>
>So now I start to see traffic from www.hallam.co.gb. My Web server has
>no idea that this should be redirected to hallam.com and no way to
>find out.
>
>
>The only way that I can see to make an XNAME type scheme work would be
>as follows:
>
>1) CANONICALIZE
>
>I don't care if you want the two trees to be peers. That type of
>system simply does not work reliably in my view. If you want multiple
>naming to work then you have to pick one set of names that is
>canonical and map all the equivalents to those forms.
>
>If you can't pick one set of names then do like they are doing with
>IPv9 and map everything to numbers which is probably where IDNs will
>end up in any case because there isn't a single keyboard on the planet
>that can type every UNICODE code point direct without the user
>learning a coding scheme and there never will be (I don't think
>handwriting recognition is likely to work much better either). On the
>other hand, every telephone handset in the world has decimal Arabic
>numerals and can call every other telephone handset in the world.
>
>
>2) ZNAME pointer to describe the forward reference.
>
>This contains the following fields
>
>* Canonical domain
>* Alias link
>
>The canonical domain has a ZNAME link pointing to itself and the first
>alias in the list. The first alias points to the second and so on.
>
>co.uk   ZNAME co.uk co.gb
>co.gb   ZNAME co.uk co.unitedkingdom
>co.unitedkingdom ZNAME co.uk co.uk
>
>
>This is the bare minimum of information required to make the scheme
>work. And it is somewhat flawed since we would ideally want to have
>all these records signed using the .co.uk ZSK and this is not
>something that DNSSEC really supports/enforces.
>
>Better would be the following
>
>co.uk                                                ZPTR co.gb
>co.gb._ZNAME.co.uk                      ZPTR co.unitedkingdom
>co.unitedkingdom._ZNAME.co.uk   ZPTR
>
>co.gb   ZNAME co.uk
>co.unitedkingdom ZNAME co.uk
>
>
>OK so we have removed all arbitrary limits from the scheme, what does
>that buy us over the DYM record which is an advisory pointer as
>follows:
>
>co.gb   DYM co.uk
>co.unitedkingdom DYM co.uk
>
>The only difference between ZNAME and DYM is that with DYM there are
>no processing rules defined in the DNS system.
>
>So processing for ZNAME would be:
>
>Client looks up www.hallambaker.co.uk, gets A record returned for
>www.hallambaker.com.
>All clients automatically support ZNAME because the processing rules
>are in the DNS system
>
>If their DNS resolver supports ZNAME - user gets to see site.
>Otherwise - user gets 'site not found' page from web client
>
>If Server supports ZNAME lookup - user gets to see site.
>If Server does not support ZNAME - user gets 'site not found' page
>from web server
>
>
>Processing for DYM on the other hand would be
>
>Client looks up www.hallambaker.co.uk, gets A record returned for
>www.hallambaker.com.
>
>If client supports DYM - user gets directed to the right site
>Otherwise user does not get directed to the right site.
>
>No other part of the infrastructure needs to provide support.
>
>
>The dependence on the resolver is particularly difficult from a user
>experience perspective. Changing their means of accessing the net will
>cause sites that were reachable to suddenly become unreachable for
>unknown reasons.
>
>
>
>On Mon, Aug 30, 2010 at 5:45 AM, Alex Bligh <[email-masked]> wrote:
>>
>>
>> --On 30 August 2010 17:20:57 +0800 Jiankang YAO <[email-masked]> wrote:
>>
>>>> Unless you claim that *every* IDN TLD require synchronization of
>>>> content (something that not everyone will agree with) *and* that this
>>>> synchronization requires a non-provisioning method to be done,
>>>> something that you often repeat but which is not true.
>>>
>>> I can not prove that every IDN TLD need it.
>>> but some IDN TLD and second level IDN domain names need it.
>>
>> *Why* do these TLDs need XNAME as opposed to the provisioning method?
>>
>> Let us assume the provisioning method means synchronized entries move
>> together between registrants etc. The only thing XNAME gives you beyond the
>> provisioning method AFAICS is ensuring the tree below the delegation point
>> is also synchronized, which is (in some circumstances) disadvantageous in
>> making the applications perform similarly (as demonstrated several times).
>> So what is the /advantage/ of XNAME over provisioning, given its trivial
>> to demonstrate provisioning is capable of doing the same thing and is
>> more flexible when 'the same thing' is sometimes wrong?
>>
>> --
>> Alex Bligh
>>
>>
>
>
>
>-- 
>Website: http://hallambaker.com/
>

Regards,
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827