Re: Devilish: Forget about DNS

On Mon, Feb 09, 2004 at 03:06:40PM -0500, Yakov Shafranovich wrote:
> 
> Because identity #1 can be  successfully verified using DNS. Case in 
> point - lets take a look at the XMPP protocol, section 14.3 
> (http://www.ietf.org/internet-drafts/draft-ietf-xmpp-core-22.txt):
> 
> "  Client-to-server communications MUST NOT proceed until the DNS
>    hostname asserted by the server has been resolved.  Such resolutions
>    SHOULD first attempt to resolve the hostname using an [SRV] Service
>    of "xmpp-client" and Proto of "tcp", resulting in resource records
>    such as "_xmpp-client._tcp.example.com." (the use of the string
>    "xmpp-client" for the service identifier is consistent with the IANA
>    registration).  If the SRV lookup fails, the fallback is a normal
>    IPv4/IPv6 address record resolution to determine the IP address,
>    using the "xmpp-client" port of 5222 registered with the IANA.
> "


Sorry Yakov, but you confused a few things here. The SRV record
here is something like the MX record, because this is Jabber. 
As far as I can remember, it works like this: 

When I, [email protected] wish to chat with you,
[email protected], I do login into my own Jabber server of 
danisch.de and send a call to the server of solidmatrix.com, informing
it that [email protected] wishes to chat with you.

Then your server is fetching the SRV record for danisch.de in order to 
find my server, and is giving it a callback.


This is very different from what we do here:

- It's a notification-callback scheme. We don't want to have this
  for e-mail, do we? If we did so, we'd go into a very differnt 
  transport: When I send you an e-mail, your MTA would have to 
  fetch the MX records for danisch.de and then contact them to 
  pick up the message waiting for you. Callback is a nice 
  verification method, but in the early days of ASRG it was
  exhaustively discussed that we do not want to have this.

- It's based on the assumption that there are no more than 1-2
  servers with static IP addresses for a domain involved, and 
  that they all listen for the protocol.  This precondition does not
  apply to e-mail. 


So my HTTP proposal applies to your #1 identities as well.

regards
Hadmut