Re: [Add] point of deploying DoH in access network (Re: meeting hum: should the IETF take up this work?)

[Ted Lemon <[e-mail]>]

Someone in another thread pointed out that it’s too soon to create a wiki. This discussion is a clear example of why a wiki would be good. 

It’s fairly clear to me that there isn’t a clear understanding of the threat models for which mitigations are being discussed. Clearly describing the threat models we believe exist in a wiki would allow us to evaluate proposed solutions to see if they address these threat models. 

Right now we are discussing mitigations that have already been shown not to address actual threats, but because we aren’t documenting the discussion, that has been forgotten and so we are repeating ourselves. 

Sent from my iPhone

> On Aug 2, 2019, at 7:37 AM, Alec Muffett <[e-mail]> wrote:
> 
>> On Fri, 2 Aug 2019 at 12:18, Robert Mortimer <robm=[e-mail]> wrote:
> 
>>  Just on the javascript in browser making DNS queries, already been done to control a spam campaign.
>> https://www.bleepingcomputer.com/news/security/new-spam-campaign-controlled-by-attackers-via-dns-txt-records/
>> 
>> So the bad guys at least are already doing this. They could of course use other methods etc. etc.
> 
> For anyone else who hasn't been through the archives, this one has already been discussed on this maillist:
> 
>     https://mailarchive.ietf.org/arch/msg/add/6lkOu-0D6OWNfHwnsK7S1NkG6Oo
> 
>     https://mailarchive.ietf.org/arch/msg/add/OoEVkT3IdLnTqhBuE777MKPAlRo
>  
> - alec
> 
> --
> http://dropsafe.crypticide.com/aboutalecm
> -- 
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add