Re: [Add] meeting hum: should the IETF take up this work?

[Stephane Bortzmeyer <[e-mail]>]

On Tue, Jul 23, 2019 at 10:46:05PM +0000,
 STARK, BARBARA H <[e-mail]> wrote 
 a message of 183 lines which said:

> But I don’t think they have the operational experience/knowledge to
> fully understand what might happen in various access networks
> (especially mobile networks)

It is not just a matter of experience and knowledge. People (and
organisations) also have opinions and practical interests. Those in
power do not want to relinquish this power, those who have access to
data do not want to lose that access, etc. Framing the issue as "those
who know" vs. "the ignorants" is not the right way to go, IMHO.

> if they started defaulting all their application users to DNS
> servers outside the local (ISP, enterprise, university, etc.)
> network.

The IETF is certainy welcome to discuss that trend (although, as I
noted in a recent message
<https://mailarchive.ietf.org/arch/msg/add/yqQV8KAmVKaJG2YussbSlJOdB7E>,
it has nothing to do with "Applications Doing DNS") but with some
modesty: we design protocols, we can provide advices on how to use it,
but people can make deployment choices of their own. Using the access
network DNS resolver was never an IETF standard (or was it? Any
references?)

> The IETF is a place where we can and must have this discussion, so
> all parties can participate in understanding and mitigating the
> potential harm.

As I said above, people have different opinions. Some call "harm" what
some others call "privacy". Some people want to modify DNS requests
and responses, some does not want their requests and responses to be
modified. No amount of IETF discussion will solve this fundamental
tussle.

> I’m also trying to understand why there seems to be resistance to
> providing ISPs with advice on deploying DoH.

I'm tempted to say that I don't see the point for an access network to
deploy DoH. If the network is safe, DoH is not really necessary
(paranoid may use DoT, since the access network can ensure that port
853 is clear). If it is not, for instance because the resolver
modifies the answers, then users will want to bypass it, anyway.

My guess is that DoH operators will be different from access network
operators.