Re: [Add] Trust and control on the Internet (was Re: fixing coffee shop brokenness with DoH)

[Andrew Campling <[e-mail]>]

On Jul 24, 2019, at 4:22 PM, Vittorio Bertola < [e-mail]<mailto:[e-mail]> > wrote:

>  Trust in the Internet infrastructure is a hard problem because the trust relationships are different depending on subjective judgements and preferences. One user might trust the application and distrust the network, while another user might trust the network and distrust the application, and a third user might be uneducated and fail to make any decision or be easily fooled into trusting the wrong people. This last case leads to several parties claiming that they have to make decisions "on behalf of the users for their own good", but then a struggle between the application, the network and the government ensues, on who is actually entitled to do that, and to which extent.

I think we should note that the third category, the “uneducated” user, is by far the largest, at least in the context of understanding matters such as DNS.  In addition, we should also note that, in the context of GDPR in Europe, DNS data is considered to be personal data and it will be possible for significant profiling to be carried out on the basis of this data; this may constrain what decisions can be made and by whom, at least without the knowledge and consent of the user.

>  The other face of this problem is the "control plan" discussion: DoH supporters claim that the DNS is not a proper control plan for the Internet, but then they do not provide alternatives to people that need one; they either say "do that at the endpoints" (which is generally cumbersome for non-technical users and even impossible in several legitimate cases, ranging from adversarial endpoints - e.g. a bot-infected device - to endpoints that won't have the necessary capabilities - e.g. IoT stuff), or "the Internet shall be free, go get lost!". This is likely to result in an "arms race" - if the protocol people do not provide a clear control plan, the operational people will just make one in some way, no matter how disruptive that will be.

It seems reasonable to assert that a control plane is required for operational purposes including, for example, to implement user choices and comply with local legislation.

>  While ADD already has more immediate points that deserve attention, such as the best practices for configuring Do* servers, it would be good if we could also have the architectural discussion above, which is broader and affects the Internet way beyond the DNS, though it comes up when discussing the DNS because that's where trust and control issues have been addressed until now. Perhaps this could be a separate working item or even a separate working group.

I agree that the architectural discussion needs to be had too.



Andrew