Re: [Add] fixing coffee shop brokenness with DoH

[Joseph Lorenzo Hall <[e-mail]>]

On Wed, Jul 24, 2019 at 9:05 AM Vittorio Bertola <
[e-mail]> wrote:

>
> Il 24 luglio 2019 12:19 Joseph Lorenzo Hall <[e-mail]> ha scritto:
>
>
>
>
> On Tue, Jul 23, 2019 at 22:26 Tommy Jensen <Jensen.Thomas=
> 40microsoft.com@dmarc..ietf.org <[e-mail]>> wrote:
>
> > Are people selling DNS logs to ad tech companies? Is that the ecosystem
> being disrupted?
>
> Given how many valid points have been brought up in the last few weeks
> about the drawbacks of centralized app-configured DNS, I don’t think the
> glib tone is constructive.
>
>
> Tone aside, to some users, centralization is a benefit in that they don't
> have a bunch of unknown privacy policies applying to the resolution of the
> names they need. For example, the privacy policy of 1.1.1.1 is pretty
> amazing from the perspective of data retention, secondary uses, etc. (e.g.,
> I know my resolutions will be removed from their logs within 24 hours).
>
> This may seem small but it seems to be lost in the centralization/choice
> discussion.
>
> What you seem to want above, however, is not made possible by
> centralization, but by user choice, i.e. the user being able to tell all
> the applications to use a specific resolver that has a privacy policy they
> like. Centralization might make your choice easier, since you have less
> privacy policies to compare, but might also make it impossible for you to
> find one that you actually like - the fewer they are, the easier it is for
> them to form a cartel and impose conditions that are only good for them.
>
>
These are good points... in the case I'm talking about it's definitely
having user choice, having understandable privacy policies (to people like
me, not end-users necessarily), and having usable ways of turning this on
(e.g., the 1.1.1.1 app from Cloudflare or the Intra app from Google for
older Android to use DoT).


> (I will also note that all this focus on privacy policies is a U.S. bias -
> in Europe, all resolvers have a pretty restrictive basic privacy policy
> which is mandated by the requirements of the GDPR, though of course there
> still are differences that deserve giving users a choice.)
>

So true... We're actively working on generic data protection laws in the
USA, wish us luck! best, Joe