Subject: Re: Thinking differently about the site local problem (was: RE: site local addresses (was Re: Fw: Welcome to the InterNAT...))

From: Keith Moore <[email-masked]>
Date: Wed, 2 Apr 2003 18:10:48 -0500

> The lack of IPv6 literal address support in the version of wininet.dll
> that shipped with Windows XP was for reasons of engineering
> expediency, 

in other words, MS deliberately shipped a broken product.

> I do, however, also remember a discussion on one of the IPv6 mailing
> lists about this, and it seemed that there were several members of the
> IPv6 community at large who thought it was great that we weren't
> currently supporting them.  Apparently there are those who think
> hard-coding IP addresses (of any version) in URLs is a bad idea.

yes, there are those who think that it's desirable to force all apps to
suffer the delays and unreliability of DNS every time a connection is
established. they are deluded.

Keith

---

From: "Brian Zill" <[email-masked]>
Date: Wed, 2 Apr 2003 10:00:52 -0800

Hi Jeroen,

The lack of IPv6 literal address support in the version of wininet.dll
that shipped with Windows XP was for reasons of engineering expediency,
and not any political policy decision.  To the best of my knowledge,
Microsoft hasn't said one way or another as to whether or not we plan to
support IPv6 literal addresses in URLs in future releases.

Perhaps this is the discussion you are remembering.

--Brian

> -----Original Message-----
> From: Jeroen Massar [mailto:[email-masked]] 
> Sent: Wednesday, 02 April, 2003 07:19
> To: 'Spencer Dawkins'; [email-masked]
> Cc: IPv6 Feedback Alias
> Subject: RE: Thinking differently about the site local 
> problem (was: RE: site local addresses (was Re: Fw: Welcome 
> to the InterNAT...)) 
> 
> 
> Spencer Dawkins wrote:
> 
> > Hi, Jeroen,
> > 
> > Are you talking about ftp://ftp.rfc-editor.org/in-notes/rfc2732.txt 
> > (PS)?
> > 
> > My quick read of this RFC is that it says "don't use IPv6 literals 
> > without enclosing them in brackets", as in
> > 
> >       host          = hostname | IPv4address | IPv6reference
> >       ipv6reference = "[" IPv6address "]"
> > 
> > But that's not quite the same thing you said: "never use 
> IPv6 IP's in 
> > URL's".
> > 
> > If you're talking about another reference, could you provide it? A 
> > quick RFC search for "IPv6 URL" turned up only this RFC...
> 
> Yes, though I can't seem to google up any references. Except 
> for: 
> http://www.microsoft.com/windowsxp/pro/techinfo/administration
/ipv6/defa
ult.asp

"Q: How can I force IPv6 connections using my Web browser?" <SNIP> "For
applications other than Internet Explorer: Connect using a literal IPv6
address. URLs that use the format for literal IPv6 addresses described
in RFC 2732, "Format for Literal IPv6 Addresses in URLs," are not
supported by the version of Internet Explorer provided with Windows XP."

There was some discussion about this deprecation as the Techpreviews
(Win2k/NT4) did support literal url's. The XP version and up though
won't support it to overcome one major 'problem': website 'designers'
embedding IP's inside websites to 'speed things up' (go figure). And
there where a number of other reasons for deciding so. Unfortunatly I
can't find the messages which where sent to a mailinglist about this
discussion which also contained why they decided this. Note that
wininet.dll doesn't support it that's why IE doesn't either...

MS CC'd, they can best explain the rationale behind it.

Greets,
 Jeroen

PS: Is 'google' already an official english verb? :)

---

From: "Fredrik Nyman" <[email-masked]>
Date: Thu, 3 Apr 2003 12:50:44 +0200

> in other words, MS deliberately shipped a broken product.

Oh, look, release notes, known issue statements, bugtracker entries...

Seems like everybody is deliberately shipping broken products...

-- 
Fredrik Nyman
PacketFront Sweden AB
http://www.packetfront.com/

---

From: Keith Moore <[email-masked]>
Date: Thu, 3 Apr 2003 09:46:58 -0500

> Seems like everybody is deliberately shipping broken products...

Yeah, I was chastised in private mail for shooting the messenger, and
appropriately so.

It is a bit difficult for me to understand how support for address literals
could be considered such a low priority that it could be omitted from a
shipping product.  Recently when I wrote an app that used v6 and urls, the
first routine I wrote was one that would take either an address literal
or a DNS name, plus a port number, and return a properly filled-in sockaddr
structure  (no, getaddrinfo by itself isn't sufficient), and the second 
one I wrote was one that would parse a URL and extract either a DNS name or
address literal from that.  Writing both routines, and the test cases, and
testing the routines on several different platforms took about 2 hours.

Admittedly I'm a bit biased.  I've measured the percentage of email delivery
failures due to various reasons and discovered that DNS misconfiguration was
high on the list (MTA miscnfiguration was also high). I've also attempted to
measure the amount of delay caused by DNS lookups.  So I understand better
than most why it's important - for both diagnostic and performance reasons -
to support address literals.  

That and I suspect there's a philosophical difference in writing APIs.  I
believe in thinking hard about what an API needs to do before writing it, so
that the API once implemented will be able to be used for a wide set of
purposes.  That and I try hard to only have to implement the API once, because
the overhead in context switching my brain back to the API when I need to add
functionality to it is almost certainly larger that the effort required to
completely implement the API the first time.  If it's too difficult to
implement it completely, there's probably something wrong with the design.  I
do understand and use stubbing, but I regard that as a technique to be used
for quick prototypes that are going to be discarded anyway.  I also understand
the notion of biasing the testing toward the most frequently-used features on
the assumption that such testing will uncover the most common bugs.  But there
are important features that are not frequently used, and there are bugs that
are important to fix even though they are in seldom-used code.  Features used
for diagnostics, and security bugs are good examples of these.

Then there's the problem that when a 800-pound gorilla ships code, that
code largely defines expectations for what will and will not work in practice
- often moreso than the standards themselves.  So if MS ships code that
doesn't support address literals, then nobody will attempt to use address
literals unless they can detect that the client isn't using MS code.  For this
and other reasons, I believe that 800-pound gorillas have a greater
responsibility than their competitors to ship code that works properly.

OTOH, servers that take the trouble to recognize that the client isn't a
MS client can provide their clients with significantly better response time by
giving those clients address literals in internal references (either in HTTP
referrals or in HTML).

---

From: John Stracke <[email-masked]>
Date: Thu, 03 Apr 2003 10:42:40 -0500

Keith Moore wrote:

>- often moreso than the standards themselves.
>  
>
Strange as I feel defending Microsoft, I actually think it's commendable 
that they implemented IPv6 at all; it's not as if there's a lot of 
market demand for it yet.  From that viewpoint, it's not surprising that 
they gave IPv6 address literals a low priority.

(Personally, I would've implemented address literals *first*, so that, 
if I ran into a bug, I could isolate whether it was in DNS lookup or 
not.  Would've saved time in the long run, since debugging takes longer 
than coding.)

-- 
/============================================================\
|John Stracke      [email-masked]                     |
|Principal Engineer|http://www.centive.com                   |
|Centive           |My opinions are my own.                  |
|============================================================|
|"God does not play games with His loyal servants." "Whoo-ee,|
|where have you *been*?" --_Good Omens_                      |
\============================================================/

---

From: Keith Moore <[email-masked]>
Date: Thu, 3 Apr 2003 11:54:18 -0500

> >Then there's the problem that when a 800-pound gorilla ships code,
> >that code largely defines expectations for what will and will not
> >work in practice- often moreso than the standards themselves.
> >  
> >
> Strange as I feel defending Microsoft, I actually think it's
> commendable that they implemented IPv6 at all; it's not as if there's
> a lot of market demand for it yet. 

I'm certainly glad that they've done so; however most of their
competitors are shipping v6 also, and some have been doing so for
considerably longer than MS.  About the only major vendor that isn't
shipping v6 seems to be Palm (shame on them!).

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 03 Apr 2003 12:34:10 -0500

>shipping v6 seems to be Palm (shame on them!). 
Keith, I can't get upset about Microsoft declining to ship 
poorly-tested code.  Given how many security holes are due to buggy, 
poorly-tested programs, I applaud anyone who takes that seriously.

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com (2nd edition of "Firewalls" book)

---

From: Eric Rosen <[email-masked]>
Date: Thu, 03 Apr 2003 15:41:04 -0500

Steve> I  can't get upset  about Microsoft  declining to  ship poorly-tested
Steve> code.  Given how many security  holes are due to buggy, poorly-tested
Steve> programs, I applaud anyone who takes that seriously. 

Well, suppose they were to ship IPv6 without IPsec, on the grounds that they
didn't have the testing resources  for IPsec.  Would you still be applauding
them?  Or would you be questioning whether they have their priorities right? 

Features always fall off due to the inability to allocate sufficient testing
resources,  but a vendor  does have  some choice  over which  features those
are.