Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

["Dixon, Hugh" <[e-mail]>]

[gah – can’t get mail client to indent-and-mark quoted content properly..  sorry – using bullets … ]

From: Alec Muffett <[e-mail]>
Date: Tuesday, 16 July 2019 at 12:26
To: "Dixon, Hugh" <[e-mail]>
Cc: "[e-mail]" <[e-mail]>
Subject: Re: [EXTERNAL] Re: [Add] draft-grover-add-policy-detection-00

On Tue, 16 Jul 2019, 11:31 Dixon, Hugh, <[e-mail]<mailto:[e-mail]>> wrote:
Hi Alec –
Hi Hugh!

Given that this is at its core (just) a protocol for asking (any) DNS server whether it has a filtering policy, won’t “non-compliant software” will be the sort of software which does not beacon?

·         That's kinda the whole point; the problem is that innocent people might try using Firefox to access Twitter from Turkey during a civil rights crackdown, their Firefox-implementing-this-mechanism will give them away as trying to evade Government blocking of Twitter, and they will end up arrested or worse.
Doesn’t requesting TBD.arpa signal intent-to-comply rather than the other way around?  I don’t quite get the link between “.. their Firefox-implementing-this-mechanism ..” and “..trying to evade .. blocking ..”. At any rate, it’s a draft policy-discovery protocol not an implementation guide, no?


·         Not everyone is in a position to welcome or appreciate upstream DNS filtering "for their own good" - for instance, this example from Turkey:
The proto doesn’t say that – it just drafts a possible mechanism for any DNS resolver to indicate to the caller that there is policy.  Could be for lots of reasons, and users with device/os/app admin intent and rights might well not check it, act on it, not act on it, sometimes act on it/interact with it.



·         It would seem regressive of Mozilla's principles to assist someone getting identified & thrown in jail for non-compliance with repressive blocking; not to mention - to repeat - the other obvious possibility is that any IP address which beacons-out a lookup of TBD.arpa will immediately be blackholed / firewalled, again to dissuade people from fact-checking their government's spokespeople.
I don’t get (see above) why a check for TBD.arpa indicates intent to subvert.  I was thinking [intent to subvert] <=> [not checking TBD.arpa] ..?

H

Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD