I've been following this thread, and I'm well aware of the massive amounts
of NXDOMAIN stuff. I don't know enough about this specific issue.
But there are things which happen in Browser Land which would lead me to
naively conclude the people making browsers don't understand DNS. Two
recent (actually ongoing) examples:
1) Firefox still (years now, although I haven't filed a bug) doesn't
understand that it's perfectly ok to have a trailing dot on an FQDN;
and it serves a purpose. (It's not supposed to be included in the TLS
Host: header though.)
2) In spite of implementing their own DNS resolvers, browsers seem unable
to block domains cloaked by CNAMEs (the third party trackers accessing
first party cookies trope, RPZ works just fine for some odd reason).
On Wed, 27 Nov 2019, Petr Špaček wrote:
[...]
“Coincidence? I think NOT!”
https://youtu.be/MDpuTqBI0RM?t=53
FYI there is also an issue about this in their tracker:
https://bugs.chromium.org/p/chromium/issues/detail?id=946450#c1
As I understand it these are unadorned labels, unit of one. Two
parts to this.
What's Chrome's point with this? They've trained monkeys that URLs are for
Boomers, just type a search string in there. Wild guess here, it goes
something like this:
User types an undotted hostname on their network. Chrome searches and
returns a bunch of shopping and social media sites. Ok, that makes monkeys
upset. Well, we'll go off the reservation (we really hate doing this) and
see if our operating environment resolves it before searching. Oh drat!
The operating environment is doing a search! Some monkeys are upset either
way. Prod Mgr: They're interfering with our search! They don't understand
the one true way! Dev: I think we should agressively probe the operating
environment with garbage, the best defense is a good offense. Prod Mgr:
Let's call it a "friendly" probe and I'm good with it.
Fine, you may not like my personalizations, but is that it? I don't
believe these people are idiots with no knowledge of DNS operation.
To riff off of an old South Park episode, there seems to be a lot of smug
in the air. It's not just one thing. It's a pattern of engineering around
the DNS. Poorly.
Since I don't use Chrome, could somebody please type a local hostname (one
label) with a trailing dot into the thing and see what happens? Nothing
good, I'm sure. Those who know the purpose of the trailing dot will know
that this should outright fail to resolve (probably sends a request to the
root for the label as a TLD).
Since they're already engineering around the DNS and the trailing dot has
been a casualty for some time, would it be unthinkable for them to
repurpose it as a declarative: this label needs to be sent to the
operating environment resolver (without the dot). Search lists...
everybody hates search lists.
Let me put it to you this way: which do you hate more, search lists or
unary labels hitting the roots?
Shouldn't what happens be that they spew their probe at the operating
environment resolver, it appends things from the search list and tries
those?
If there's a shared engineering problem here, isn't it that when these
fail, the resolver tries the naked label? Or tries it first, but in any
case, tries it.
Isn't the proliferation of "valid" TLDs contributing to this embarrassment
of riches by making approaches such as selectively whitelisting TLDs so
increasingly impractical as to obviate consideration?
Should local resolvers reject attempts to resolve single labels as TLDs
unless RD=0?
I apologize, none of this is fully baked, but the debate doesn't seem to
be encompassing the entirety of the system.
--
Fred Morris
_______________________________________________
dns-operations mailing list
dns-operations@lists.dns-oarc.net
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
