Re: [Add] [EXT] Re: meeting hum: should the IETF take up this work?

["Ralf Weber" <[e-mail]>]

Moin!

On 1 Aug 2019, at 19:59, Jacques Latour wrote:

> From the department of this-could-be-a-bad-idea and the department of 
> omg-this-goes-against-everything-we’re-trying-do, but here it goes: 
> a DoH operator should have a policy to blacklist IP address as 
> requested by the network operator, since we can’t effectively block 
> DoH at the edge of the enterprise network, an enterprise network 
> should have the ability to request the well behaved DoH recursive 
> operators to block requests coming from their network IP address.  
> Perhaps have some sort of trusted clearing house of IP addresses that 
> the well behaved DoH recursive operators should blacklist from. 
> Enterprises can block non well behaving DoH recursive operators.
Interesting idea. I think that in addition to discovery mechanism for 
DoH servers we need some best practices rules for DoH server operators 
so that white hat operators of DoH servers don’t interfere with 
enterprise security and maybe a blacklist for those who use DoH for 
exfiltration. While the idea of the operators blocking requests from 
known enterprises is technically interesting I don’t think it fits 
into enterprise security requirements, as they want the packets not to 
leave their perimeter. So running DoH servers on know addresses (that 
some providers like Google already said they would do) and let the 
enterprise block them outbound might be the better way.

So long
-Ralf
—--
Ralf Weber