Re: [Add] meeting hum: should the IETF take up this work?

[Valentin Gosu <[e-mail]>]

On Sun, Jul 28, 2019, 04:50 Vittorio Bertola <vittorio.bertola=
[e-mail]> wrote:

>
> Il 27 luglio 2019 17:55 Eric Rescorla <[e-mail]> ha scritto:
>
>
>
>
> On Sat, Jul 27, 2019 at 7:52 AM Michael Richardson < [e-mail]>
> wrote:
>
> If the extension said what the privacy was, rather than just that Mozilla
> had
> vetted it, then perhaps there could be other levels of privacy.
>
>
> It's not quite clear to me what you have in mind here, but one thing I
> would like to emphasize is that the Mozilla TRR program is more than just a
> self-assertion about privacy policy, in that we actively manage the list,
> rather than just trusting people's self-assertions. If people were
> interested in some other set of privacy policies, then it's not clear to me
> who would be responsible for running such a program.
>
> I understand your viewpoint, but from the opposite one - the resolver
> operator's one - having to apply for membership to multiple lists of
> trusted resolvers, possibly with different or even contrasting
> requirements, just to be usable on any browser and any application, looks
> like a nightmare. Also, this would definitely be a push towards a smaller
> number of bigger and more centralized resolver operators, as smaller
> operators would have a harder time managing multiple accreditations.
>
> So there would be merit in thinking of a joint industry program to
> evaluate and accredit resolvers, which could even foresee different levels
> of accreditation or different policies, so that applications could still
> pick different requirements, but at least the resolver could apply once
> and, if meeting all the requirements, be validated for all clients. All in
> all, it would not be too different from the CA machinery.
>
> But your point on who would run it, and "is there actually anyone willing
> to work on this?", is also valid; and also, even the simplest resolver
> certification program would still be more restrictive, and thus more prone
> to centralization, than the current situation in which
>


people can just deploy a DNS resolver without having to ask for permission
> and it becomes immediately available to everyone.
>

It seems to me that for both DNS resolvers and DoH servers people still
need to go through the trouble of pointing their systems to it.

You can easily set up your DoH server, and share it with your friends...
Who then need to configure their browsers/stub resolvers to use it.

The question is which DoH servers are trustworthy enough to be a default -
which is where Mozilla's policies become important.

The problem with centralization also exists today with the bigger DNS
resolvers... I suspect quad8, quad1 and quad9 get the majority of traffic
(from people who switched the default DNS service, or ISPs that forward
such traffic) - which makes sense since they provide a globally available
reliable service.


> --
>
> Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
> [e-mail]
> Office @ Via Treviso 12, 10144 Torino, Italy
>
> --
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add
>