GNUnet: IETF getting cold feet about P2P Names?

There have been hundreds of messages to the IETF DNSOP WG mailing list recently about adding a number of domain names to the Special-Use Domain Names registry established by RFC 6761. This registry was initially created so that Apple's use of the ".local" TLD for Multicast DNS could be legitimated.

The author of this blog post is presumably GNUnet developer Christian Grothoff, who wrote a "P2P Names" Internet-Draft that would add ".gnu", ".zkey", ".onion", ".exit", and ".i2p" to the Special-Use Domain Names registry. This draft has languished for years but interest has recently picked up due to, for instance, the rollout of the ICANN New gTLD Program. Having a TLD on the Special-Use registry would prevent it from being delegated by ICANN in the root zone, possibly in a future new gTLD round. The RFC adding an entry to the Special-Use registry can also make recommendations to DNS software developers to generate "immediate negative responses", as is done for some zones like "10.in-addr.arpa". This could reduce the privacy impact of accidental "DNS leaks" for protocols like Tor if widely deployed.

Meanwhile, Facebook launched the Facebook-over-Tor project using the URL https://facebookcorewwwi.onion/, and they did so with a browser verifiable SSL certificate from a CA(!). Those kinds of certificates are currently issued under an "internal names loophole" that will expire later this year, unless ".onion" is added to the Special-Use registry. Alec Muffett of Facebook and Jacob Appelbaum of the Tor Project put forward a separate Internet-Draft adding just ".onion" to the Special-Use registry. This draft gained consensus, first as draft-appelbaum-dnsop-onion-tld, then as draft-ietf-dnsop-onion-tld after it was adopted by the DNSOP working group. It will most likely be published soon and thus cause ".onion" to be added to the Special-Use registry, before the CA/B Forum deadline. For further details about Facebook's involvement, see this DNSOP WG mailing list post from Alec Muffett.

Long-time IETF participant Ted Lemon described a probable reason that the original Grothoff draft with its bundle of five different Special-Use registrations failed to gain consensus:

The problem with draft-grothoff-- is not that the strings it proposes to standardize are unrelated. Whether they are related or not is immaterial. The problem is that there is more than one such string, and consensus depends on the least popular string listed. By separating out .onion, we give ourselves a better chance of actually getting consensus in the short term.

It could be that proponents for some of the other strings in draft-grothoff-- would prefer that onion not be separated out in hopes that this will make it more likely that the other strings mentioned in draft-grothoff-- can ride on the coattails of .onion, which seems like a shoe-in. However, anyone who thinks this has minimal experience with DNSOP. Such a belief would be overly optimistic. In fact, if there is anything that elicits strong objection, it will hold up the whole draft, no matter how much consensus there may be on the more popular names. This is precisely because we operate on the basis of rough consensus, not on the basis of popularity. So tacking something less popular onto something popular does not get the less popular thing support: it robs support from the more popular thing.

The four other proposals besides ".onion" were subsequently split out into separate drafts: draft-grothoff-iesg-special-use-p2p-i2p, draft-grothoff-iesg-special-use-p2p-gns, draft-grothoff-iesg-special-use-p2p-exit, and draft-grothoff-iesg-special-use-p2p-bit.

The proximate cause for the GNUnet blog post about the IETF "getting cold feet" appears to be comments Andrew Sullivan made at the microphone at the IETF-93 DNSOP WG meeting, which were recorded in the minutes as:

    Andrew Sullivan: Some of these are attacks on the way that the DNS works
        ...and thus a bad idea
        If you don't use the domain name space rules, you don't get a name
        Don't ask the IETF to help you compete with the DNS business model

In the first place, the point I was trying to make in the "business model" remark is just this: some of the drafts trying to register special-use names that Christian Grothoff talked about hive out of the DNS uses of names that create a resolution system only in some special network context. So, just as local. marks something as to be looked up only with mDNS, onion. and exit. both mark something as to be looked up only under onion routing (or maybe, depending on your view, only using Tor). But others of these proposals, such as bit., mark out a name space and associated protocol that competes with the DNS. It is a fully parallel name resolution universe, applicable to absolutely any network application. My point was that the second class of these basically puts us in the position of approving a special-use registration that is effectively an attack on someone else's business model (ICANN's and that of the various registries and registrars). I believe that draws the IETF into a political battle for which it is unprepared, and that's really why I object to these registrations.

Yes, but there's always the risk that, soon after you have decided to use .quux as your internal TLD, ICANN will sell the official .quux TLD to someone. Next, public web sites like www.coolest-site-ever.quux will pop up, and users at your site would really like to use them but can't get at them.