4 ms·

The public suffix list is an abomination --- a useful, pragmatic, largely successful abomination, but an abomination nevertheless. The PSL centralizes and makes

The public suffix list is an abomination --- a useful, pragmatic, largely successful abomination, but an abomination nevertheless. The PSL centralizes and makes static a database that should be dynamic and distributed. It's a throwback to the bad old pre-DNS internet where everyone would copy around /etc/hosts files and rely on ad hoc human updating to keep host->address mapping up to date. The information in the public suffix list belongs in DNS.

selcuka 5y ago
I guess the problem is there is no clear, technical definition of what a TLD is. There are many weird cases as described on the public suffix page (e.g. edu.au is a TLD unless it is catholic.edu.au, which is a TLD itself). I believe it would be much easier to work with domain names if everyone agreed that all domain names should follow the same convention (e.g. hostname(s) + domain name + TLD type + country suffix) from the beginning.
- chrismorgan 5y ago
  Not just catholic.edu.au, states have their own things, e.g. schools in Victoria are *.vic.edu.au. Universities tend to not be conceptually so local and tied to the state, so they go with *.edu.au. Same deal with government, you’ve got *.gov.au for federal matters and *.{vic, …}.gov.au for states.
_jal 5y ago
That would be potentially dangerous. This is old, but according to their site[1], IE used to use it for "Zone determination" and "ActiveX opt-in list security restriction". If DNS were referenced for these purposes, that's how you get 0wned by accepting DHCP at your local coffee shop. [1] https://publicsuffix.org/learn/ https://publicsuffix.org/learn/
- quotemstr 5y ago
  > that's how you get 0wned by accepting DHCP at your local coffee shop. Code authentication is what certificates are for. What is the precise attack you're describing? "Potentially dangerous" doesn't cut it. In any case, DNSSEC addresses any possible coffee shop attack.
  - tptacek 5y ago
    No, DNSSEC doesn't address any coffee shop attacks. DNSSEC is a server-to-server protocol (or, I guess more fairly, a recursor-to-recursor) protocol. Unless you're running something other than a stub resolver on your machine (if you didn't install something, you're not), all of DNSSEC's security coalesces to a single bit in the header that says "yes, I promise, as your name server, that I actually verified signatures". I hope it's clear that a coffee shop attacker can spoof a DNS record with a single bit set. DNSSEC is full of big problems, which is why it's moribund (virtually none of the most widely-used zones have signed). But the lack of any service model in the "last mile" is probably the biggest. If you're worried about coffee shop attacks, you're looking for DoH, which actually does directly address these attacks, which, unlike cache corruption, actually occur all the time --- which is why browsers are moving to make DoH a default.
    - tryauuum 5y ago
      Looks like you were personally hurt by DNSSEC, care to share some details?
    - quotemstr 5y ago
      Nothing stops you running a recursive resolver on your local machine. DoH is great too (provided you trust the endpoint), but what I really want is a chain of trust extending from the root to the individual DNS record, and DoH by itself doesn't give me that. But DoH sure is great for further centralizing control over internet name resolution in a few hands!
      - tptacek 5y ago
        Nothing stops you from behaving like a DNS server, that's true. But nobody is going to forklift in error-prone new DNS security infrastructure just so a couple hundred Linux nerds (hey, it me) can have a new toy to play with. What's not going to happen is for every phone in the world to run its own recursor, and that's what needs to happen for DNSSEC to work on the last mile. There are lots of problems with DNSSEC, not just this one. But if you want to have a discussion that involves things DNSSEC might help on the Internet, it's best not to start with coffee shop attacks, which are the problem DNSSEC is literally least suited to solve --- in fact, practically designed not to solve. The coffee shop problem --- or, more accurately, the wide-scale equivalent problem of ISPs behaving like malicious coffee shops --- is exactly the problem DoH addresses.
- fomine3 5y ago
  That's why nowadays most web standard uses "origin" rather than "domain".
- foobar33333 5y ago
  DNS over HTTPS has already solved that issue.

selcuka 5y ago

I guess the problem is there is no clear, technical definition of what a TLD is. There are many weird cases as described on the public suffix page (e.g. edu.au is a TLD unless it is catholic.edu.au, which is a TLD itself). I believe it would be much easier to work with domain names if everyone agreed that all domain names should follow the same convention (e.g. hostname(s) + domain name + TLD type + country suffix) from the beginning.

chrismorgan 5y ago
Not just catholic.edu.au, states have their own things, e.g. schools in Victoria are *.vic.edu.au. Universities tend to not be conceptually so local and tied to the state, so they go with *.edu.au. Same deal with government, you’ve got *.gov.au for federal matters and *.{vic, …}.gov.au for states.

_jal 5y ago

That would be potentially dangerous. This is old, but according to their site[1], IE used to use it for "Zone determination" and "ActiveX opt-in list security restriction". If DNS were referenced for these purposes, that's how you get 0wned by accepting DHCP at your local coffee shop. [1] https://publicsuffix.org/learn/ https://publicsuffix.org/learn/

quotemstr 5y ago
> that's how you get 0wned by accepting DHCP at your local coffee shop. Code authentication is what certificates are for. What is the precise attack you're describing? "Potentially dangerous" doesn't cut it. In any case, DNSSEC addresses any possible coffee shop attack.
- tptacek 5y ago
  No, DNSSEC doesn't address any coffee shop attacks. DNSSEC is a server-to-server protocol (or, I guess more fairly, a recursor-to-recursor) protocol. Unless you're running something other than a stub resolver on your machine (if you didn't install something, you're not), all of DNSSEC's security coalesces to a single bit in the header that says "yes, I promise, as your name server, that I actually verified signatures". I hope it's clear that a coffee shop attacker can spoof a DNS record with a single bit set. DNSSEC is full of big problems, which is why it's moribund (virtually none of the most widely-used zones have signed). But the lack of any service model in the "last mile" is probably the biggest. If you're worried about coffee shop attacks, you're looking for DoH, which actually does directly address these attacks, which, unlike cache corruption, actually occur all the time --- which is why browsers are moving to make DoH a default.
  - tryauuum 5y ago
    Looks like you were personally hurt by DNSSEC, care to share some details?
  - quotemstr 5y ago
    Nothing stops you running a recursive resolver on your local machine. DoH is great too (provided you trust the endpoint), but what I really want is a chain of trust extending from the root to the individual DNS record, and DoH by itself doesn't give me that. But DoH sure is great for further centralizing control over internet name resolution in a few hands!
    - tptacek 5y ago
      Nothing stops you from behaving like a DNS server, that's true. But nobody is going to forklift in error-prone new DNS security infrastructure just so a couple hundred Linux nerds (hey, it me) can have a new toy to play with. What's not going to happen is for every phone in the world to run its own recursor, and that's what needs to happen for DNSSEC to work on the last mile. There are lots of problems with DNSSEC, not just this one. But if you want to have a discussion that involves things DNSSEC might help on the Internet, it's best not to start with coffee shop attacks, which are the problem DNSSEC is literally least suited to solve --- in fact, practically designed not to solve. The coffee shop problem --- or, more accurately, the wide-scale equivalent problem of ISPs behaving like malicious coffee shops --- is exactly the problem DoH addresses.
fomine3 5y ago
That's why nowadays most web standard uses "origin" rather than "domain".
foobar33333 5y ago
DNS over HTTPS has already solved that issue.