Re: [Add] draft-grover-add-policy-detection-00

[Eric Rescorla <[e-mail]>]

On Sun, Jul 14, 2019 at 5:18 PM Rob Sayre <[e-mail]> wrote:

> It's right there in BCP 61:
> "However security must be a MUST IMPLEMENT so that end users will have the
> option of enabling it when the situation calls for it."
>
> It seems like this proposal standardizes automatically disabling security.
> Maybe we could generalize it.
>

Let's take a step back here. First, this document doesn't violate the
section of BCP 61 you are quoting, because that text doesn't require that
security be on by default. Second, there's plenty of precedent for
opportunistic encryption in IETF; see, for instance:
https://tools.ietf.org/rfcmarkup?doc=7435. Of course, this doesn't mean
that this document is necessarily a good idea, but to the best of my
knowledge it's not prohibited by any RFC.

The question of whether it's a good idea is rather more complicated: at a
high level we have a situation where nearly all DNS is unencrypted and sent
to a resolver which is insecurely configured. Some of those resolvers do
policy enforcement and in some of those cases, the user wanted that kind of
policy enforcement, so just switching over to a secure Trusted Recursive
Resolver potentially violates POLA, and it would be nice to be able to
detect those cases and do something [0]. Now, of course, that signal itself
is insecure, so this is pretty far from ideal, but the whole situation is
pretty messy, so it seems worthwhile to explore the space a bit.



> Let's add some domains to the draft that switch HTTPS to HTTP, and switch
> SSH to telnet.
>

This sort of rhetoric doesn't seem particularly helpful.

-Ekr

[0] And this draft doesn't say what "something" is, so, how good an idea
this is partly depends on what that is.


>
> thanks,
> Rob
>
> On Sun, Jul 14, 2019 at 5:12 PM Andy Grover <[e-mail]> wrote:
>
>> I don't follow, in what way?
>>
>> On July 13, 2019 3:48:05 PM PDT, Rob Sayre <[e-mail]> wrote:
>>>
>>> This draft doesn't seem to conform to the requirements laid out in BCP
>>> 61.
>>>
>>> https://tools.ietf.org/html/bcp61
>>>
>>> thanks,
>>> Rob
>>>
>> --
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add
>