Re: [Add] meeting hum: should the IETF take up this work?

[Michael Sinatra <[e-mail]>]

On 7/23/19 3:09 PM, Rob Sayre wrote:
> Hi,
> 
> The IETF shouldn't take up work in reaction to non-technical (aka 
> "policy") concerns about imminent deployment of an approved RFC. In this 
> case, it's DoH (https://tools.ietf.org/html/rfc8484).
> 
> Mozilla's presentation accurately stated that DNS is no longer an 
> effective control surface. It can't be, given that HTTPS is ubiquitous, 
> and one can use it to tunnel any protocol.

1. A primary motivation, according to previous discussions on this and 
other mailing lists, for DoH is predicated on the *significant 
effectiveness* of DNS filtering by oppressive governments.

2. A number of us have pointed out that DNS filtering is commonly used, 
also quite effectively, by good guys, and that using DoH by default can 
create noticeable collateral damage.

3. You have stated that DNS filter was never that effective, which then 
calls into question the primary motivation for DoH.  See #1.

Such an argument--that DNS filtering works for bad uses but doesn't work 
for good uses--uncannily mirrors the argument for weakening encryption: 
Terrorists won't be able to use encryption, but law-abiding citizens can 
still rest assured that online banking and e-commerce will be *just as 
secure* as it was before encryption protocols were watered down with 
backdoors.

Neither argument holds much water.

michael