Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

[Michael Sinatra <[e-mail]>]

On 7/16/19 10:25 AM, Jim Reid wrote:
> 
> 
>> On 16 Jul 2019, at 17:33, Michael Sinatra <[e-mail]> wrote:
>>
>> Unless we find ways of making DoH compatible with institutional controls, the banhammer will come down and we will end up in an arguably worse spot (think proxy decryption of all HTTPS, banning of certain browsers, blocking of well-known services, etc.).  Personally, I don't want that to happen, but I fear it will if we don't make DoH more flexible by default.
> 
> Obligatory nit-picking:
> 
> What you're actually talking about here is one deployment/application of DoH, not the protocol itself. The basic protocol is fine (pretty much). It's how the protocol gets used that can create problems. DoH doesn't have to or need to become "compatible with institutional controls". It's the applications and services which use DoH might have to do that.
> 
> FWIW, I agree with what you say if "DoH" was replaced with "DoH deployment".
Yes, everything I am talking about in this thread is as you say--my 
intent was "DoH deployment" even though I only said "DoH."  Thanks for 
the opportunity to clarify.

The one disagreement I have with DoH as a protocol is that it 
essentially obfuscates the DNS resolution process, from a network 
perspective.  But that's not under discussion here (and it's basically 
water under the bridge anyway).

michael