On 9/9/26 13:45, Ben Schwartz wrote:
This proposal is technically very precise, which I appreciate, but I find the semantics puzzling. What does it mean for a domain name to carry a "protected wetland area" record? What does it mean for a domain name to indicate a "supply voltage"?
This is all stuff in DIEM. Essentially, a DIEM "digital emblem" record-bundle is bound to an "issuer" (the party that controls the domain that names it) and and "asset" (the thing named). A "validator" validates the DNSSEC signature on the records to determine whether the emblem was actually issued by the issuer, and uses the information in the record-bundle and their expertise and current practices to determine whether the emblem is actually associated with the thing they're looking at.
The point here is to not reinvent anything. Proprietary scanners are starting to pile up, implementing different proprietary digitalization schemes for different emblems, and that's not sustainable. Everybody's in agreement that we need a standard, and we're now four years into consensus that the first (and probably only) underlying mechanism for looking these named entities up is the DNS. Since you'd have to start with a DNS lookup anyway, and it doesn't really make sense to then force people to do a second lookup when the first one is sufficient to carry the necessary data.
Then the question is whether to reinvent the standards that all these folks already use, which are mostly ISO and UNECE standards, or to try to find a way to cram each and every one of them into a different kind of TXT record... Simply passing the ISO and UNECE standards through unmolested is the least work for everybody, and keeps the IETF from stepping on other people's toes by inventing a brand new way to say "the thing this record describes should weigh 45kg +/-2kg".
So, that's DIEM in a nutshell. We've already been through the phase of people showing up and telling emblem-digitalizers that they shouldn't want to have a standard, or that it should all be invented from scratch, or that emblems are stupid, or whatever. For folks who want to relitigate that, DIEM is the place rather than DNSOP, I think.
So, specifically, a "protected wetland area" is an area which is required to be marked by the Ramsar Convention (https://www.ramsar.org).
The "dangerous forces" marking of a power plant required under Article 56 of the Additional Protocol I to the Geneva Conventions (https://ihl-databases.icrc.org/en/customary-ihl/v2/rule42) would quite conceivably include a voltage, and for all I know, there are other treaties that require markings (which, yes, are going to get digitalized, whether in a standards-based way or not) which might reasonably carry a voltage indication.
It seems to me that these registries are intended to apply to many subjects, including physical objects and organizations, but the examples shown do not look like assertions that can sensibly be made about domain names.
The assertions aren't being made about domain names (I mean, there are people who want to do that, but they want to attach, for instance, a Red Cross to icrc.org) the domain names identify the thing about which the assertion is being made. The domain name is just a unique name in a hierarchical structure, which can be looked up over the Internet. The name gets attached to a thing, and then people look up the domain name, use the DNSSEC signature to validate it, and once they know it to be a valid record, they read and perhaps act upon the data they find within the record.
Just like hearing that the web site of Bank of America is "bofa.com", looking up "bofa.com" in the DNS, checking whether the DNSSEC signature is valid, then looking at the left-hand-side to see what the MX record points to, so you can act on that and send them a piece of email. It's not conceptually different than that.
My personal preference would be to invite these standards bodies to define a registry of assertions about domain names, which we can then import as a new RR type of this kind.
Can you explain what that would look like, and who the consumer for it would be?
Are we speaking about the name itself, or some other entity linked to that name?
As I said, there are people who want to attach emblems to domain names, yes, but that's probably a very very small portion of the total. Just like there are people who do DNS lookups to find out whether a domain name exists, without any intention of acting upon what they find. But the vast majority of DNS lookups are by parties who hope to act upon what they find in the left-hand-side of the result, if the DNSSEC validates.
Does the UNECE/ISO record describe the other entities indicated by other records on the same name?
Yes. The record bundle is the set of records which exist at the same label in the DNS hierarchy. If one is using DIEM, the set of records which exist at one label are all associated with one asset, or with one class of assets which can be described as a set. Just like there may be multiple NS records at a label, or multiple AAAA records, if they can all be used interchangeably because they have the same result. There are more complicated cases, where an emblem is split across a zone cut because a portion of the record is public, and a portion is split-horizon / selective disclosure. But again, that's not any different than any other use of the DNS.
Or is it describing the owner of the zone?
No, not directly. As with any other use of the DNS, the validator is assumed to have an out-of-band mechanism for knowing whether Bank of America is bofa.com or b0fa.cm. DIEM is about standardization of the digitalization mechanism for presenting the emblems which label assets, rather than describing the issuers (the owner of the zone)... However that might wind up being a distinction without a point, if the asset is the intellectual property which is the name of the owner. But that's not really a problem
Whatever direction we go, I would also like to see confirmation (perhaps via liaison statements) that UNECE and ISO have consensus in favor of this approach.
Patrik is an IETF-ISO liaison.But the point of the mechanism is to _avoid_ opening pandora's boxes of reinvention. The IETF operates on a consensus model, but most standards bodies don't. So holding a non-consensus standards body to an IETF standard of consensus doesn't make sense. They've published their standards, their standards are in use. The only point here is to be able to allow two consenting adults to communicate something about one of those standards without having to invent a new way of doing so.
We don't say that people can't have a web site about tires if the international standards organization which specifies tire standards doesn't approve HTTP. We're about communications, not about regulating content or what people are allowed to say over the communication channels we standardize.
-Bill
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
