Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

[Rob Sayre <[e-mail]>]

On Tue, Jul 16, 2019 at 10:22 AM Eric Rescorla <[e-mail]> wrote:

>
>
> On Tue, Jul 16, 2019 at 9:10 AM Rob Sayre <[e-mail]> wrote:
>
>> In any case, BCP 188 covers the issue we're describing quite well.
>>
>> "The same techniques to achieve [Pervasive Monitoring] can be used
>> regardless of motivation.  Thus, we cannot defend against the most
>> nefarious actors while allowing monitoring by other actors no matter how
>> benevolent some might consider them to be, since the actions required of
>> the attacker are indistinguishable from other attacks."
>>
>> Pervasive Monitoring Is an Attack
>> https://tools.ietf.org/html/rfc7258
>>
>
> I'm quite familiar with this BCP but given it's emphasis on passive
> monitoring and the associated interest in opportunistic security (RFC 7435)
> I don't see any conflict here.
>

I think the conflict is that the BCP states that the perceived benevolence
of an application (parental controls, malware blockers, etc) doesn't
matter, but that seems to be the case being made here.

Aside from that seemingly obvious conflict, it doesn't seem like DNS-based
solutions would really work very well for these benevolent applications.
It's sort of like using a coffee cup as an umbrella--it will catch some
rain, yes.

thanks,
Rob



>
> -Ekr
>
>
>
>>
>> thanks,
>> Rob
>>
>>