Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

On Tue, Jul 16, 2019 at 7:22 AM Eric Rescorla <ekr@rtfm.com> wrote:

> Hi Alec,
>
> This is a good question.
>
> As I alluded to in my response to Robert Sayre, DoH has a difficult
> deployment problem. Specifically, whether we like it or not, there are
> some environments in which DNS filtering is in place and the user
> wants it that way (parental [0] or anti-malware filtering are good
> examples of this).
>

Parental controls and malware detection are usually done on the device.

https://www.apple.com/newsroom/2019/04/the-facts-about-parental-control-apps/
https://blog.google/products/chrome/cleaner-safer-web-chrome-cleanup/

>
> In any case, hopefully this clarifies the situation.
>

It does not.

thanks,
Rob

>
>
> On Tue, Jul 16, 2019 at 4:26 AM Alec Muffett <alec.muffett@gmail.com>
> wrote:
>
>> On Tue, 16 Jul 2019, 11:31 Dixon, Hugh, <Hugh.Dixon@sky.uk> wrote:
>>
>>> Hi Alec –
>>>
>>
>> Hi Hugh!
>>
>> Given that this is at its core (just) a protocol for asking (any) DNS
>>> server whether it has a filtering policy, won’t “non-compliant software”
>>> will be the sort of software which does not beacon?
>>>
>>
>> That's kinda the whole point; the problem is that innocent people might
>> try using Firefox to access Twitter from Turkey during a civil rights
>> crackdown, their Firefox-implementing-this-mechanism will give them away as
>> trying to evade Government blocking of Twitter, and they will end up
>> arrested or worse.
>>
>> Not everyone is in a position to welcome or appreciate upstream DNS
>> filtering "for their own good" - for instance, this example from Turkey:
>>
>>
>> https://www.mic..com/articles/85987/turkish-protesters-are-spray-painting-8-8-8-8-and-8-8-4-4-on-walls-here-s-what-it-means
>> <https://www.mic.com/articles/85987/turkish-protesters-are-spray-painting-8-8-8-8-and-8-8-4-4-on-walls-here-s-what-it-means>
>>
>> It would seem regressive of Mozilla's principles to assist someone
>> getting identified & thrown in jail for non-compliance with repressive
>> blocking; not to mention - to repeat - the other obvious possibility is
>> that any IP address which beacons-out a lookup of TBD.arpa will immediately
>> be blackholed / firewalled, again to dissuade people from fact-checking
>> their government's spokespeople.
>>
>> Or, perhaps you would consider this non-compliant-behaviour, worthy of
>> such sanction?
>>
>> - alec
>>
>> --
>> Add mailing list
>> Add@ietf.org
>> https://www.ietf.org/mailman/listinfo/add
>>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>