Re: [Add] "primary control over DNS routing should lie with..."

[Rob Sayre <[e-mail]>]

On Mon, Jul 27, 2020 at 4:24 PM Deen, Glenn (NBCUniversal) <
[e-mail]> wrote:

> -Taking off my chair hat and posting as a contributor –
>
>
>
> Rob,
>
>
>
> The RFC’s you cite (RFC1958, RFC7624) here, and have cited before when the
> discussion of security models has popped up are seemingly being taking out
> of context and are being raised to a higher level of authority that I
> believe the IAB intended them to be.
>
>
If those documents aren't convincing, you could consult RFC 7258 -
Pervasive Monitoring Is an Attack (aka  BCP 188).


>
> Paul makes a very valid point – there are very significant numbers of
> networks in Enterprises, governments, schools, universities, and even homes
> of some highly skilled engineers that will have DoH present on devices,
> operating systems, and applications and will be attempting to do discovery,
> and these networks do have security practices and security systems which
> may interfere with certain discovery approaches – and ADD should be taking
> those things into account the best we can.
>

It is not a valid point. If one owns the devices, then configure them. As
another participant wrote: "From an endpoint's perspective, there is no
authoritative way to distinguish between network administration ('good')
and network attacks ('bad') without some prior knowledge and trust of the
network, such as preinstalled certificate".

thanks,
Rob

>