注册局政策如何成为浏览器代码：.APP、合同与 HSTS 预载链

摘要

• ICANN 管申请、争用和合同；IANA 链管委派；注册局与注册商管注册政策；浏览器维护者决定客户端是否预载 HSTS。
• 准确机制是浏览器在加载前把适用 HTTP 地址升级为 HTTPS，随后才解析 DNS 并验证服务器证书，并非证书先于 DNS。

分析

.APP 先经历政府预警、申请修改和评估，再通过十二方拍卖解决争用。Charleston Road Registry 签署协议并完成根区委派后，注册局可以通过与注册商的规则传递安全政策。HSTS 预载则位于另一权力层：浏览器发布的软件识别 .app 父域规则，在网络请求前把 HTTP 改写为 HTTPS。DNS 通常在改写后解析，服务器在建立安全连接时出示证书。因而用户体验依赖注册局政策与客户端代码共同执行。ICANN 合规能处理合同义务，注册局能处理注册商违约，注册人能修复 DNS 与证书，浏览器团队能修改预载；任何一路救济都止于自身边界。

来源

• http://service.app/path`
• https://blog.google/innovation-and-ai/technology/developers-tools/introducing-app-more-secure-home-apps-web/
• https://cabforum.org/working-groups/server/baseline-requirements/requirements/
• https://chromium.googlesource.com/chromium/src.git/%2B/63.0.3239.118/net/http/transport_security_state_static.json
• https://datatracker.ietf.org/doc/html/rfc6797
• https://gac.icann.org/work-products/public/app-au-33325-2012-11-20.pdf
• https://gtldresult.icann.org/applicationstatus/applicationchangehistory/1343
• https://gtldresult.icann.org/applicationstatus/applicationdetails/1343
• https://gtldresult.icann.org/applicationstatus/stringcontentionstatus%3Adownloadauctionreport/39
• https://hstspreload.org/
• https://itp.cdn.icann.org/en/files/registry-agreements/app/app-agmt-html-14may15-en.htm
• https://newgtlds.icann.org/en/program-status/application-results/ie-1-1138-33325-en.pdf
• https://portal.icann.org/servlet/servlet.FileDownload?file=00P6100000NjL8nEAF
• https://security.googleblog.com/2017/09/broadening-hsts-to-secure-more-of-web.html
• https://services.google.com/fh/files/misc/crr-rra-app-form.pdf
• https://www.chromium.org/hsts/
• https://www.iana.org/domains/root/db/app.html
• https://www.iana.org/reports/c.2.9.2.d/20150629-app
• https://www.icann.org/en/news/correspondence/falvey-to-willett-06apr13-en
• https://www.icann.org/en/registry-agreements/details/app
• https://www.registry.google/policies/registration/app/