Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

[Stephen Farrell <[e-mail]>]

Hiya,

On 17/07/2019 16:38, Neil Cook wrote:
> So I use DNS filtering in my own house (along with millions of other
> people as already stated on this thread), provided by my network
> operator (but it doesn’t have to be - I used to use OpenDNS for
> example, and I have the capability to run my own resolver if I so
> desired). I have malware filtering as well as parental controls
> enabled. I am the de-facto network administrator in my house,  but I
> don’t have the tools or software that enterprises use so I won’t
> benefit from the work being done to help enterprises control this. I
> also have other people coming into my house and using my network, and
> I also like to control what they can access when they are in my home.
> All of this works very well for me today. It doesn’t work for me when
> applications/endpoints start deciding that my network is an attacker
> because it does filtering, and bypassing that filtering "in the
> interest of end-users".
I don't question your right to do as you do, but as an (I hope)
equally valid single data point, I don't do the above and would
be fine if visitors to my home network used DoH with an external
service without being under my control. Going further, were I to
enforce my DNS policy choices on visitors to my home network
without explaining those, (which is mostly impractical), I would
consider myself to be potentially attacking visitors to my home,
which is IMO inhospitable.

There are multiple valid conflicting setups here and the issue I
think is that the application doing DNS can't detect which are in
play, so the application developer has to try pick a safe default
I guess. Not an easy task.

S.