Re: [Add] meeting hum: should the IETF take up this work?

[Adam Roach <[e-mail]>]

On 7/25/19 03:57, Neil Cook wrote:
> But let’s say I decide to run my own non-public DoH  resolver on my 
> network at home. Firefox won’t have it on their list of TRRs, and if 
> as you suggest, the discovery drafts are pointless and so don’t 
> proceed, no application will ever find out about it, unless I 
> configure it manually on every single application and computer in my 
> house (not even mentioning those IoT devices that I can’t configure).
>
> It is also possible that we end up with a large number of public DoH 
> resolvers which mine your personal data for profit. Given the current 
> business model of the internet that is entirely possible.


Since you mention Firefox's TRR list and then mention data mining (with 
an implied connection), I'd like to point out yet again that one of the 
key criteria for appearing on that list is an agreement to treat 
resolution data according to a strict set of privacy-protecting 
provisions. You can see, for example, Cloudflare's associated privacy 
policy at 
https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/

I'm going to pre-reply to a frequent response that the lack of direct 
contractual relationship between users and Cloudflare is problematic. 
Even if you don't trust Mozilla's contractual agreement with Cloudflare 
to provide protection here, I would think that FTC v. Facebook (2019) 
[1] should serve as a pretty vivid illustration of what happens when a 
US company operates outside its published privacy policy.

/a

____
[1] 
https://www.ftc.gov/news-events/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions