Thanks for the explanation. Here's what I understand: * The consumer of these records is expected to learn out of band "$SPEAKER publishes their claims about $ASSET at $DOMAIN". There is no presumption of equality or equivalence between $SPEAKER, $ASSET, and $DOMAIN. (However, $SPEAKER must trust the owner of $DOMAIN, which approaches an equivalence.) * There is no specified in-band identification of $SPEAKER or $ASSET. * There is no implicit connection to any other records on the domain name. If example.com has a UNECE record saying "protected wetland", and a LOC record conveying geographic coordinates, this does not mean that the speaker is claiming that a protected wetland exists at that location. (Perhaps it _could_ be used that way, but this would have to be communicated to the consumer out of band.)
Thoughts on that basis: - The absence of explicit in-band identifiers for $SPEAKER or $ASSET seems like a weakness. For example, if the vendor of some DIEM-labeled equipment sells that brand to a different company, I might care to know which one published the UNECE record that I am relying on. - It seems like it would be wisest not to use a DIEM domain for anything else. That way, it can easily be aliased by CNAME in the future. If that were a rule, it would also help to expand the semantics: any other records on that name are also $SPEAKER talking about $ASSET. - The Descriptor is UTF-8 and intended for human consumption. Does it need to be internationalized? Do we need a language tag? - I can imagine stamping this domain on physical goods as a QR code, but that would need a URI scheme. "diem://" perhaps? --Ben On Wed, Sep 9, 2026 at 3:20 PM Bill Woodcock <[email protected]> wrote: > > On 9/9/26 13:45, Ben Schwartz wrote: > > This proposal is technically very precise, which I appreciate, but I > > find the semantics puzzling. What does it mean for a domain name to > > carry a "protected wetland area" record? What does it mean for a > > domain name to indicate a "supply voltage"? > > This is all stuff in DIEM. Essentially, a DIEM "digital emblem" > record-bundle is bound to an "issuer" (the party that controls the > domain that names it) and and "asset" (the thing named). A "validator" > validates the DNSSEC signature on the records to determine whether the > emblem was actually issued by the issuer, and uses the information in > the record-bundle and their expertise and current practices to determine > whether the emblem is actually associated with the thing they're looking at. > > The point here is to not reinvent anything. Proprietary scanners are > starting to pile up, implementing different proprietary digitalization > schemes for different emblems, and that's not sustainable. Everybody's > in agreement that we need a standard, and we're now four years into > consensus that the first (and probably only) underlying mechanism for > looking these named entities up is the DNS. Since you'd have to start > with a DNS lookup anyway, and it doesn't really make sense to then force > people to do a second lookup when the first one is sufficient to carry > the necessary data. > > Then the question is whether to reinvent the standards that all these > folks already use, which are mostly ISO and UNECE standards, or to try > to find a way to cram each and every one of them into a different kind > of TXT record... Simply passing the ISO and UNECE standards through > unmolested is the least work for everybody, and keeps the IETF from > stepping on other people's toes by inventing a brand new way to say "the > thing this record describes should weigh 45kg +/-2kg". > > So, that's DIEM in a nutshell. We've already been through the phase of > people showing up and telling emblem-digitalizers that they shouldn't > want to have a standard, or that it should all be invented from scratch, > or that emblems are stupid, or whatever. For folks who want to > relitigate that, DIEM is the place rather than DNSOP, I think. > > So, specifically, a "protected wetland area" is an area which is > required to be marked by the Ramsar Convention (https://www.ramsar.org). > > The "dangerous forces" marking of a power plant required under Article > 56 of the Additional Protocol I to the Geneva Conventions > (https://ihl-databases.icrc.org/en/customary-ihl/v2/rule42) would quite > conceivably include a voltage, and for all I know, there are other > treaties that require markings (which, yes, are going to get > digitalized, whether in a standards-based way or not) which might > reasonably carry a voltage indication. > > > It seems to me that these registries are intended to apply to many > > subjects, including physical objects and organizations, but the > > examples shown do not look like assertions that can sensibly be made > > about domain names. > > The assertions aren't being made about domain names (I mean, there are > people who want to do that, but they want to attach, for instance, a Red > Cross to icrc.org) the domain names identify the thing about which the > assertion is being made. The domain name is just a unique name in a > hierarchical structure, which can be looked up over the Internet. The > name gets attached to a thing, and then people look up the domain name, > use the DNSSEC signature to validate it, and once they know it to be a > valid record, they read and perhaps act upon the data they find within > the record. > > Just like hearing that the web site of Bank of America is "bofa.com", > looking up "bofa.com" in the DNS, checking whether the DNSSEC signature > is valid, then looking at the left-hand-side to see what the MX record > points to, so you can act on that and send them a piece of email. It's > not conceptually different than that. > > > My personal preference would be to invite these standards bodies to > > define a registry of assertions about domain names, which we can then > > import as a new RR type of this kind. > > Can you explain what that would look like, and who the consumer for it > would be? > > > Are we speaking about the name itself, or some other entity linked to that > > name? > > As I said, there are people who want to attach emblems to domain names, > yes, but that's probably a very very small portion of the total. Just > like there are people who do DNS lookups to find out whether a domain > name exists, without any intention of acting upon what they find. But > the vast majority of DNS lookups are by parties who hope to act upon > what they find in the left-hand-side of the result, if the DNSSEC > validates. > > > Does the UNECE/ISO record describe the other entities indicated by other > > records on the same name? > > Yes. The record bundle is the set of records which exist at the same > label in the DNS hierarchy. If one is using DIEM, the set of records > which exist at one label are all associated with one asset, or with one > class of assets which can be described as a set. Just like there may be > multiple NS records at a label, or multiple AAAA records, if they can > all be used interchangeably because they have the same result. There > are more complicated cases, where an emblem is split across a zone cut > because a portion of the record is public, and a portion is > split-horizon / selective disclosure. But again, that's not any > different than any other use of the DNS. > > > Or is it describing the owner of the zone? > > No, not directly. As with any other use of the DNS, the validator is > assumed to have an out-of-band mechanism for knowing whether Bank of > America is bofa.com or b0fa.cm. DIEM is about standardization of the > digitalization mechanism for presenting the emblems which label assets, > rather than describing the issuers (the owner of the zone)... However > that might wind up being a distinction without a point, if the asset is > the intellectual property which is the name of the owner. But that's > not really a problem > > > Whatever direction we go, I would also like to see confirmation > > (perhaps via liaison statements) that UNECE and ISO have consensus in > > favor of this approach. > > Patrik is an IETF-ISO liaison. > > But the point of the mechanism is to _avoid_ opening pandora's boxes of > reinvention. The IETF operates on a consensus model, but most standards > bodies don't. So holding a non-consensus standards body to an IETF > standard of consensus doesn't make sense. They've published their > standards, their standards are in use. The only point here is to be > able to allow two consenting adults to communicate something about one > of those standards without having to invent a new way of doing so. > > We don't say that people can't have a web site about tires if the > international standards organization which specifies tire standards > doesn't approve HTTP. We're about communications, not about regulating > content or what people are allowed to say over the communication > channels we standardize. > > -Bill _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
