Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

[Eric Rescorla <[e-mail]>]

On Tue, Jul 16, 2019 at 11:55 AM Rob Sayre <[e-mail]> wrote:

>
>
> On Tue, Jul 16, 2019 at 11:49 AM Rob Sayre <[e-mail]> wrote:
>
>>
>>
>> On Tue, Jul 16, 2019 at 10:22 AM Eric Rescorla <[e-mail]> wrote:
>>
>>>
>>>
>>> On Tue, Jul 16, 2019 at 9:10 AM Rob Sayre <[e-mail]> wrote:
>>>
>>>> In any case, BCP 188 covers the issue we're describing quite well.
>>>>
>>>> "The same techniques to achieve [Pervasive Monitoring] can be used
>>>> regardless of motivation.  Thus, we cannot defend against the most
>>>> nefarious actors while allowing monitoring by other actors no matter how
>>>> benevolent some might consider them to be, since the actions required of
>>>> the attacker are indistinguishable from other attacks."
>>>>
>>>> Pervasive Monitoring Is an Attack
>>>> https://tools.ietf.org/html/rfc7258
>>>>
>>>
>>> I'm quite familiar with this BCP but given it's emphasis on passive
>>> monitoring and the associated interest in opportunistic security (RFC 7435)
>>> I don't see any conflict here.
>>>
>>
>> I think the conflict is that the BCP states that the perceived
>> benevolence of an application (parental controls, malware blockers, etc)
>> doesn't matter, but that seems to be the case being made here.
>>
>> Aside from that seemingly obvious conflict, it doesn't seem like
>> DNS-based solutions would really work very well for these benevolent
>> applications. It's sort of like using a coffee cup as an umbrella--it will
>> catch some rain, yes.
>>
>
> Oh, also, RFC 7435 is Informational, while RFC 7258 is a BCP. BCPs are the
> documents that describe what the IETF is supposed to be doing, right?
>

Well, sort of. But in this case, 7435 is a Consensus document, it just
doesn't have normative force. Thus, I think it's reasonably strong evidence
that opportunistic security isn't inconsistent with 7258. IIRC Stephen
Farrell was AD at the time, so perhaps he'd be willing to offer his
perspective.

-Ekr


> thanks,
> Rob
>
>
>>
>> thanks,
>> Rob
>>
>>
>>
>>>
>>> -Ekr
>>>
>>>
>>>
>>>>
>>>> thanks,
>>>> Rob
>>>>
>>>>