Subject: Re: Text (Re: Proposed updates for domain-based drafts)

From: Nicolas Williams <[email-masked]>
Date: Tue, 5 Sep 2006 08:24:43 -0500

On Tue, Sep 05, 2006 at 12:39:10PM +0100, Alexey Melnikov wrote:
> Nicolas Williams wrote:
> >+   For the purposes of domain-based names a "domain" is defined by the
> >+   applications that use domain-based names.  An application protocol
> >+   might use a simple DNS domainname, such as "example.com" for naming,
> >+   while another it might use the DNS domainname of the SRV RRs it
> >+   queries (e.g., "_tcp._foo.example.com"), and yet another may use
> >+   something that does not resemble a DNS domainname.  Application
> >+   protocol specifications that provide for use of domain-based service
> >+   names MUST define the domain-portion of their domain-based names.
> > 
> >
> I like the suggested changes, except for the last sentence quoted above. 
> Here you are trying to put requirements on application protocols, which 
> is probably Ok. But you are effectively declaring all existing 
> application layer protocols non compliant with this MUST. Was this the 
> intent?

Not at all -- existing apps don't know how to use domain-based names, so
they will require updating anyways.  This is a requirement only for
applications that wish to support the use of domain-based names.

Nico
--

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 05 Sep 2006 15:00:23 -0400

On Tuesday, September 05, 2006 08:24:43 AM -0500 Nicolas Williams 
<[email-masked]> wrote:

>> > +   might use a simple DNS domainname, such as "example.com" for
>> > naming, +   while another it might use the DNS domainname of the SRV
>> > RRs it +   queries (e.g., "_tcp._foo.example.com"), and yet another
>> > may use +   something that does not resemble a DNS domainname.
>> > Application +   protocol specifications that provide for use of
>> > domain-based service +   names MUST define the domain-portion of their
>> > domain-based names.
>> >
>> >

Right.  Just as an application which uses host-based service names needs to 
specify a service name, and application which uses domain-based names needs 
to specify both a service name and how to derive the "domain" component.

-- Jeff

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 5 Sep 2006 15:02:49 -0500

> applications that wish to support the use of domain-based names.

Also, if your concern is about DIGEST-MD5 applications that use
serv-name then worry not: these drafts are specifically for GSS-API
applications, and clearly no SASL/GS1 applications have used
domain-based names in the past.

OT:  Now, about DIGEST-MD5's support for domain-based naming...  Are
there SASL applications that use this?  Does Cyrus SASL implement this?
Any other implementations?  Please answer off-list, or at least off the
KITTEN list, as this would be off-topic there.