[dbound] DBOUND and paths forward

"Murray S. Kucherawy" <superuser@gmail.com> Tue, 24 May 2016 00:54 UTC

MIME-Version: 1.0
Date: Mon, 23 May 2016 17:54:16 -0700
Message-ID: <CAL0qLwbeWRLd8tF045xYn00FLH3Dm1u=DR3-Gjb7oot+GYEr6Q@mail.gmail.com>
From: "Murray S. Kucherawy" <superuser@gmail.com>
To: "dbound@ietf.org" <dbound@ietf.org>
Content-Type: multipart/alternative; boundary="94eb2c03381018c88c05338bff04"
Archived-At: <http://mailarchive.ietf.org/arch/msg/dbound/uL5vpEhp0p7B4c3ZLZIx-zE4J1s>
Subject: [dbound] DBOUND and paths forward
Precedence: list

Colleagues,

At IETF 95, the DBOUND co-chairs met informally with the authors of the
documents we've had under consideration for some time.  Predictably, the
topic was about if, or how, we move forward from here.  Rest assured that
no decisions were made, as those must be made by the working group in an
approved way (e.g., this list).  However, we do have some results to share
with the group, and gauge where consensus is on our next steps.

We believe we are entrenched in a battle to solve two problems
simultaneously.  Our charter compels us to try our best to do this, and
we've put admirable amounts of thought into it.  Ultimately, however, if
such a grand unified solution does exist that the community will adopt, its
time has apparently not yet come.

This leaves us with a couple of choices.  We can produce independent
solutions for our various use cases -- the two primary ones being the one
driven by the email community that wants a way to do policy lookups without
the perceived problems of the maintenance of the Public Suffix List, and
the web security one having to do with which cookies apply to which sites.
We can choose to work on only a subset of these.  Or we can admit defeat
and dissolve the working group, having sadly accomplished nothing.

The small pseudo design team observed that it appears as though there is
actually only one community likely to implement our solutions in the short
term, and that is the email community.  We perceive it to be unlikely that
a solution produced by this working group for the web security issue would
be adopted in short order by any of the browser producers.  They simply
have not expressed a desire to contribute and adopt, or even concur that
there's a serious problem that needs to be solved.  In contrast, the email
community (in particular the DMARC folks) will apparently be thrilled to
adapt their specifications and implementations to the output of this
working group, even experimentally, out of their concerns regarding the
upkeep of the PSL and its impact on their ability to provide timely, safe
service.

With that in mind, your co-chairs propose that we abandon any grand unified
theory of domain boundary evaluation and focus only on this email use
case.  If there is a change of heart from other communities, or some
unifying idea does appear, we can re-evaluate our options at that time.
However, in the interests of being productive toward our original goals, we
propose to assume that is not the case and will not be in the near future.

So, what say you all?

-Pete & Murray, your DBOUND co-chairs

Re: [dbound] DBOUND and paths forward Andrew Sullivan
Re: [dbound] DBOUND and paths forward Gervase Markham
Re: [dbound] DBOUND and paths forward Hodges, Jeff
[dbound] DBOUND and paths forward Murray S. Kucherawy
Re: [dbound] DBOUND and paths forward John Levine
Re: [dbound] DBOUND and paths forward HANSEN, TONY L
Re: [dbound] DBOUND and paths forward Kurt Andersen
Re: [dbound] DBOUND and paths forward Paul Hoffman
Re: [dbound] DBOUND and paths forward Jiankang Yao
Re: [dbound] DBOUND and paths forward Casey Deccio
Re: [dbound] DBOUND and paths forward Murray S. Kucherawy