Subject: Re: IAB Statement on Dotless Domains

From: [email-masked] (Noel Chiappa)
Date: Sat, 13 Jul 2013 11:27:47 -0400 (EDT)

> From: "Livingood, Jason" <[email-masked]>

    > FWIW, I think for most larger companies with multi-billion dollar
    > revenues streams it is less about the up-front fees to apply &
    > operationalize a gTLD than the long term business potential.

I guess I'm missing something. How exactly is having a gTLD going to bring in
the Big Bucks? Do people actually type addresses into the address bars on
their browsers any more, or do they just type what they're looking for into
the search bar?

	Noel

---

From: Arturo Servin <[email-masked]>
Date: Sat, 13 Jul 2013 12:38:41 -0300

> their browsers any more, or do they just type what they're looking for into
    Not even using a search bar anymore. Some browsers do a search
whilst you are writing the hostname that you want to access. So for
facebook I just normally type "fac", twitter "twi" and it autocompletes.
For Google and wikipedia I do not even try to go to their web page. For
a search (google) I just type what I am looking for and that is all, for
wikipedia I do the same and 95% of the times the first search result is
the link to them.

Regards,
as

---

From: "John Levine" <[email-masked]>
Date: 13 Jul 2013 16:28:53 -0000

>their browsers any more, or do they just type what they're looking for into

Let's just say you're not allowed to ask that question, any more than
you can ask a fundamentalist Christian how he knows he's going to
heaven.

You are definitely not allowed to look at the history of .AERO,
.TRAVEL, .JOBS, .ASIA, .MUSEUM, .COOP, .MOBI, .TEL or .PRO.

---

From: John C Klensin <[email-masked]>
Date: Sat, 13 Jul 2013 12:52:04 -0400

--On Saturday, July 13, 2013 16:28 +0000 John Levine
<[email-masked]> wrote:

>> I guess I'm missing something. How exactly is having a gTLD
>> going to bring in the Big Bucks? Do people actually type
>> addresses into the address bars on their browsers any more,
>> or do they just type what they're looking for into the search
>> bar?
> 
> Let's just say you're not allowed to ask that question, any
> more than you can ask a fundamentalist Christian how he knows
> he's going to heaven.

Noel asked at least two different questions.  One is not
supposed to ask either of them, whether your analogy is
appropriate or not.  (And see my note from yesterday.)
 
> .TRAVEL, .JOBS, .ASIA, .MUSEUM, .COOP, .MOBI, .TEL or .PRO.

One could quibble about that list -- I'd think about deleting
one or two that actually met the rather narrow expectations for
them and maybe add a few others that didn't.  But, yes, the
track record of big profits from selling names out of new gTLDs,
especially if "defensive registrations" are excluded, has been
abysmal.

As far as I know, the only completely successful business model
for post-2001 new gTLDs that were not intended as a service for
a restricted community has involved an extreme form of the
"encourage defensive registrations" model, so extreme that
others have described it as "extortion".

   john

---

From: Hector Santos <[email-masked]>
Date: Sat, 13 Jul 2013 12:58:31 -0400

> their browsers any more, or do they just type what they're looking for into

Define people.  The layman will not type the protocol (http://),  and 
the auto-suggestion technology is so advanced, you will get multiple 
different sets of results that may or may not include the DNS solution 
as the first part of the result.

Try typing out my domain, winserver.com. First timers will not get the 
WINSERVER.COM web site, but Microsoft's WIN SERVER 201x and/or WINDOWS 
SERVER web sites first.

Overall, while I believe winserver and winserver.com are technically 
different as with winserver.net, winserver.org, etc, I think it would be 
unfair if a dotless WINSERVER dns entry was prevailing over my 
winserver.com domain.   Perhaps an I-D describing a BCP for searching 
orders will help, if not already, available.  If Dotless domains are to 
be inter-networking ready as it already in used for intra-networking 
operations, then perhaps it should be a FALLBACK answer to the .com, 
.net, org lookup.

--
HLS

---

From: Yoav Nir <[email-masked]>
Date: Sat, 13 Jul 2013 18:20:18 +0000

On Jul 13, 2013, at 7:58 PM, Hector Santos <[email-masked]> wrote:
> 
> Try typing out my domain, winserver.com. First timers will not get the WINSERVER.COM web site, but Microsoft's WIN SERVER 201x and/or WINDOWS SERVER web sites first.

I did as you suggested earlier, and typed "winserver", but not into Google's search bar. I typed it into the address bar of Safari. Like Chrome, the address bar and search bar are the same. I got these suggestions, sorted by category:

  Google Search
     winserver
     win server 2012
     win server 2008
     win server 2003
     win server 2013
  Search Suggestions
     Santronic's Wildcat! Interactive Net Server (WINSE...     winserver.com
     WinServer - Home                                          winserver.codeplex.com
     Wildcat! Open Site                                        opensite.winserver.com

So finding your site is not that difficult for first-timers. But regardless, the people who type in addresses or DNS names in full are rare and far between.

---

From: Hector Santos <[email-masked]>
Date: Sun, 14 Jul 2013 09:34:38 -0400

> So finding your site is not that difficult for first-timers. But regardless, the people who type in addresses or DNS names in full are rare and far between.

Agreed. Just to see again, I tried it on my wife's new computer with 
Chrome and it showed:

     Windows Server on aws.amazon.com
     Windows Server 2012 at microsoft.com
     www.winserver.com

Am I off-base to suggest that the IETF can address this "dotless" domain 
searching confusion with a INFO or BCP suggesting software *should* 
consider DNS solution first over non-DNS solutions?

It raises a fairness question as the method of communications becoming 
closer to obsolete from the user's standpoint, i.e. no protocol is 
necessary to type (hence via the browser, HTTP is the default protocol).

I am now wondering what if we tried to add a dotless winserver zone into 
our DNS.  Will the software even allow it?

--
HLS

---

From: Yoav Nir <[email-masked]>
Date: Sun, 14 Jul 2013 13:53:01 +0000

On Jul 14, 2013, at 4:34 PM, Hector Santos <[email-masked]> wrote:

> Agreed. Just to see again, I tried it on my wife's new computer with Chrome and it showed:
> 
> Am I off-base to suggest that the IETF can address this "dotless" domain searching confusion with a INFO or BCP suggesting software *should* consider DNS solution first over non-DNS solutions?

SM is way ahead of you :-) :
http://tools.ietf.org/html/draft-moonesamy-dotless-domains-00

> 
> It raises a fairness question as the method of communications becoming closer to obsolete from the user's standpoint, i.e. no protocol is necessary to type (hence via the browser, HTTP is the default protocol).
> 
> I am now wondering what if we tried to add a dotless winserver zone into our DNS.  Will the software even allow it?
> 
> --
> HLS

---

From: Hector Santos <[email-masked]>
Date: Sun, 14 Jul 2013 11:03:50 -0400

> http://tools.ietf.org/html/draft-moonesamy-dotless-domains-00

Good show SM.

I have a very popular 5-6 years old resource web page related to using 
jQuery-based Auto-Suggestion methods with source.  It uses a DOMAIN 
query for an example for the auto-suggestion.   You can see how easy it 
is to just use an NON-DNS database solution.   A DNS-solution would have 
a higher overhead with this full duplex concept.

http://beta.winserver.com/public/test/MultiSuggestTest.wct

Whats funny, is that as I type Winserver here, it also pulls the dotless 
domain.   This data source was a collection of "Bad domains" as rejected 
and collected by our SMTP server!  So at some point, a dotless winserver 
was used and rejected by our SMTP server.

This illustrates a good part of the issue, from how SMTP currently 
behaves and also from the user standpoint, the searching may pull the 
dotless domain first.

--
HLS

---

From: S Moonesamy <[email-masked]>
Date: Sun, 14 Jul 2013 22:05:17 -0700

>http://tools.ietf.org/html/draft-moonesamy-dotless-domains-00

That memo discusses about the case of the dotless domains in terms of 
the technical standards.  Comments are welcome.

At 13:11 13-07-2013, Ofer Inbar wrote:
>What this brings to mind is that we used to have implicit DNS domain
>search in the early days of DNS.  When edu.com accidentally hijacked
>a huge chunk of the Internet, most of the net very quickly got rid of
>implicit search, and we got the explicit DNS search feature that many
>people are discussing now.

Yes.

>If some new TLD gets used in a dotless fashion in a way that truly
>does cause major trouble, I expect we'll see sites all over the net
>quickly deploying DNS resolvers that discard A, AAAA, or MX records
>at the top level, to protect their users.

There is already deployed code to do that.

At 20:14 14-07-2013, Doug Barton wrote:
>It is unarguably true that as things currently stand there will be 
>"problems" with dotless domains. How widespread, and how serious 
>those problems become is yet to be seen.

I haven't seen anyone in the IETF arguing that sufficient market 
demand overrides comments about problems that will appear.

>So either this is a good idea that will gain traction, and therefore 
>appropriate software support; or it is a bad idea that will go away 
>on its own. Either way, making a fuss

It is up to those who decide to decide whether dotless domains is a 
good idea that will gain traction or a bad idea that will go away on it own.

At 20:25 14-07-2013, Dave Crocker wrote:
>In contrast, assertions about "market demand" ensuring that 
>"software folks... will make them work" rests on a fuzzy concept of 
>market forces -- for example, the market of users isn't likely to be 
>issuing a formal or informal 'demand' about any of this, and a model 
>of altering installed-base behavior that has, I believe, has no 
>historical precedent.

Yes.

>It is, in fact, possible that Marshall Rose was wrong and that for 
>some things, there is no possible thrust sufficient to make pigs 
>fly, or at least not without killing an extraordinary number of other pigs.

:-)

Regards,
S. Moonesamy

---

From: Doug Barton <[email-masked]>
Date: Mon, 15 Jul 2013 22:38:52 -0700

> the technical standards.  Comments are welcome.

Interesting, but pardon my being blunt, it does not seem to cover any 
new ground. You did say one useful thing:

IETF specifications usually provide guidance to ensure interoperability. 
  Whether dotless domains are harmful or not is a policy matter.

>> people are discussing now.

Can you (or Ofer) define how you're using the terms "explicit" and 
"implicit" in terms of DNS search, and what their relevance is to the 
topic of dotless domains? And no, I'm not being snarky, I think part of 
the problem here is a fundamental misunderstanding of how the vast 
majority of hosts are configured currently.

> There is already deployed code to do that.

True, for better or worse. :)  BIND's implementation also starts off 
with a reasonable default list of delegation-only domains, and allows 
you to customize the list.

... which is an excellent example of market forces influencing software 
development.

>> "problems" with dotless domains. How widespread, and how serious those
>> problems become is yet to be seen.
>
> I haven't seen anyone in the IETF arguing that sufficient market demand
> overrides comments about problems that will appear.

I haven't seen anyone in the IETF arguing that the moon is made of green 
cheese either. What does your comment have to do with anything? Sorry 
(again) to be blunt, but the IETF pounding the "this thing is bad!" drum 
is not a particularly effective tool. [1]

We have to be realistic about how and where our influence is relevant, 
and more importantly how and where it is not. Detailing the technical 
problems with the proposal is relevant IETF work, but that job has 
already been done more thoroughly by my esteemed former colleagues on 
the SSAC.

>> appropriate software support; or it is a bad idea that will go away on
>> its own. Either way, making a fuss
>
> It is up to those who decide to decide whether dotless domains is a good
> idea that will gain traction or a bad idea that will go away on it own.

You vastly overestimate your own importance in the grand scheme of 
things. Don't worry, it's a common human problem. :)  Rather than 
repeating my point for the third time, see what I wrote just above.

>> In contrast, assertions about "market demand" ensuring that "software
>> folks... will make them work" rests on a fuzzy concept of market
>> forces -- for example, the market of users isn't likely to be issuing
>> a formal or informal 'demand' about any of this, and a model of
>> altering installed-base behavior that has, I believe, has no
>> historical precedent.
>
> Yes.

I already explained why Dave's perspective is wrong in my previous 
message, which you apparently chose to ignore. Your example of 
delegation-only domains for DNS software further proves my point.

Doug

[1] cf. NAT

---

From: S Moonesamy <[email-masked]>
Date: Tue, 16 Jul 2013 00:15:06 -0700

Hi Doug,
At 22:38 15-07-2013, Doug Barton wrote:
>Interesting, but pardon my being blunt, it does not seem to cover 
>any new ground. You did say one useful thing:
>
>IETF specifications usually provide guidance to ensure 
>interoperability.  Whether dotless domains are harmful or not is a 
>policy matter.

It's a -00 draft.  The above paragraph is one of the two arguments in 
the draft.

>"implicit" in terms of DNS search, and what their relevance is to 
>the topic of dotless domains? And no, I'm not being snarky, I think 
>part of the problem here is a fundamental misunderstanding of how 
>the vast majority of hosts are configured currently.

Speaking for myself, I would say that "explicit" is what the user 
configured and "implicit" is what the is not used-configured.

>I haven't seen anyone in the IETF arguing that the moon is made of 
>green cheese either. What does your comment have to do with 
>anything? Sorry (again) to be blunt, but the IETF pounding the "this 
>thing is bad!" drum is not a particularly effective tool. [1]

I hope that "market forces", whatever that means, is not the main 
argument to dispel problems.

>We have to be realistic about how and where our influence is 
>relevant, and more importantly how and where it is not. Detailing 
>the technical problems with the proposal is relevant IETF work, but 
>that job has already been done more thoroughly by my esteemed former 
>colleagues on the SSAC.

I don't have any influence.  I take no position on the SSAC 
report.  What I did was to read all the IETF specifications 
referenced in the draft and write a draft.  It does not bother me to 
be unrealistic. :-)

>repeating my point for the third time, see what I wrote just above.

I left in the paragraph that was quoted for context.  The text says 
"those who decide".  I don't have anything to do with the decision 
about dotless domains.  As I am not important it is unlikely that I 
might overestimate my importance. :-)  I don't know the grand scheme 
of things and I do not need to know the grand scheme of things.

Regards,
S. Moonesamy

---

From: Ofer Inbar <[email-masked]>
Date: Tue, 16 Jul 2013 11:07:21 -0400

> majority of hosts are configured currently.

You're not being snarky, but that indicates that you seem to have
missed my point, which is not about the technical details of how
domain search got changed after the edu.com disaster.  My point is
not to make a direct parallel between how domain search changed, and
dotless domains, and you seem to be looking at it in that light.

What this brings to mind is that we had a DNS system that was
vulnerable to the addition of something to the DNS that people had
expected nobody would make the mistake of doing, but it happened and
caused damage, and the net reacted by altering how DNS software works
in order to protect against that damage.  At the time, the obvious
defensive change was "don't do implicit domain search".  If dotless
domains cause damage as many people here predict, what I'm saying is
that I think we'll react similarly, and that I guess the defensive
change people will widely deploy is to reject A/AAAA/MX records at
the top level.

You really do not need to drill into the specifics of the change from
implicit to explicit domain search in reaction to edu.com, in this
context.  So it sounds to me like you have something quite different
in mind.  I don't know what you think I was trying to say - it's not
anything I said explicitly, so perhaps you think I was trying to
subtly say something between the lines.  To be clear: I wasn't.
  -- Cos

---

From: John C Klensin <[email-masked]>
Date: Tue, 16 Jul 2013 13:56:25 -0400

--On Tuesday, July 16, 2013 11:07 -0400 Ofer Inbar
<[email-masked]> wrote:

>...
> vulnerable to the addition of something to the DNS that people
> had expected nobody would make the mistake of doing, but it
> happened and caused damage, and the net reacted by altering
> how DNS software works in order to protect against that
> damage.  At the time, the obvious defensive change was "don't
> do implicit domain search".  If dotless domains cause damage
> as many people here predict, what I'm saying is that I think
> we'll react similarly, and that I guess the defensive change
> people will widely deploy is to reject A/AAAA/MX records at
> the top level.

Two additional observations about this.   Ofer's explanation
about the edu.com example and the resultant ban on heuristic
search is consistent with RFC 1535 and what little I remember of
the history.   However...

* The RFC 1535 defensive change was far more practical in 1993
than it is today, just because of the size of the Internet, the
number of deployed DNS servers and resolvers, and the
difficulties of deploying "required" upgrades.  So the harm
level or likely duration of harm should dotless TLDs be deployed
is greater today or at least less likely to yield quickly to a
defensive change.

* A different example of searching issues caused a good deal of
disruption when it came up (several years earlier than the
EDU.COM. case) and may be relevant to ICANN's current plans and
their likely effects.   In that case, a very large number of
computer science departments in universities all over the world
quite reasonably were delegated domains like
CS.university-name.EDU, often resulting in
host1.CS.university.EDU, host2.CS.university.EDU and email
addresses like [email-masked].  Whether by relying
on the heuristics that RFC 1535 banned or by explicit search,
institutions set up name completion so that a reference from
within that institution to username@CS (or username2@chem or
username3@art -- you get the idea) worked as everyone expected,
yielding [email-masked], etc.   Usually, host1.CS
did too -- this is not just about "dotless" domains.

Then the TLD for Czechoslovakia was delegated under the
then-assigned ISO 3166 code of CS and unpleasant things started
happening.  Users in some institutions couldn't find Czech sites
at all; others had no problems.  In some cases in which search
rather than mere completion was used, some names would be found,
some names wouldn't, and false positives become possible.  If
there is advice for ICANN in this it is that, when DNS searching
scenarios are involved, it is not sufficient to worry about
possible conflicts between proposed new TLDs and existing
private-use pseudo-TLDs (such as "local.")   Instead, conflicts
with existing second or third-level labels (and perhaps ones
even further down the tree) have to be considered if completion
or search configurations involving those labels might give them
the same appearance as a TLD or subdomains of that TLD.

Whether the IAB should have included any of this in its
Statement is, IMO, another matter.  My personal bias is that, if
the IAB starts making Statements about the implications of a
technological choice, they should be comprehensive about the
relevant subject.  That principle would call for discussion, not
only of the email issues that started this thread, but the "CS."
case and many of the other issues that have been mentioned.  On
the other hand, there are arguments against that principle,
especially when a body like ICANN is concerned and there is
reason to believe that any statement more than a paragraph or
two long will be unread by many people in the intended audience.
Personally, I would have preferred it had the IAB been explicit
about what issues they were and were not addressing if they
decided to avoid a comprehensive discussion -- at least then,
people might be debating their choices but not whether they are
exhibiting their ignorance.  But that is just my opinion.

    john

---

From: Mark Andrews <[email-masked]>
Date: Wed, 17 Jul 2013 10:32:27 +1000

> subtly say something between the lines.  To be clear: I wasn't.

It was more than implicit to explicit.  It was also trying domains
with dots "as is" first.  Domains with perids were treated as fully
qualified until proved otherwise.  Unqualified domains were qualified
then tried "as is" if a match was not found.

It is bad to treat domains with periods as partially qualified.
It is bad to treat domains without periods as qualified.

Note it is also more than A, AAAA and MX record at the tld label.
It is also SRV records where they are used with a base name in
a host context.

_http._tcp.tld/SRV is equally bad as tld/A where as
_whois._tcp.tld/SRV would not be a issue as it would point to
the whois service for names that end in .tld.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]