Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

[Vittorio Bertola <[e-mail]>]

Il 17 luglio 2019 17:25 Ted Hardie <[e-mail]> ha scritto:

The IETF was not building these protocols to stop the use of the DNS as a policy enforcement mechanism and it is entirely possible to integrate them into a system which does this by offering the policy enforcing resolver over one of these confidential protocols. 

I agree on the second part of your sentence, but I do not fully agree on the first one. In late 2017, several people - including one author of RFC 8484 and one member of the IAB - went on record saying that DoH was being developed exactly to stop the use of DNS as a policy enforcement mechanism. See for example the "DOH" section in this article:

https://blog.apnic.net/2017/12/12/internet-protocols-changing/" rel="nofollow">https://blog.apnic.net/2017/12/12/internet-protocols-changing/

Of course these were not statements made on behalf of "the IETF", nor they represent the objectives of everyone who took part in the work, yet the fact that the whole organization got DoH standardized so quickly is hard to interpret differently than a sign of support both for the technology and for its explicit purpose above.

Now, arguing over this is not very useful, but I wanted to show that the concerns over the IETF's past approach to this matter have some reasons, even if I concede that most issues derive from deployment choices and not from the standard in itself. But if the people making the deployment choices are the same people that wrote and approved the standard, drawing a line is almost impossible.

Rather than falling back to the state where the endpoint simple accepts that its traffic is visible to all and possibly intercepted, this new work is an effort to make it easier for you to gain the cooperation required.  I hope you can see that this is in both the interest of policy enforcement bodies and the end users.

Yes, and this is why I was actually defending the spirit of the draft against claims that it would just facilitate downgrade attacks. I think this draft is a step forward, and in general Mozilla appear to be much more receptive to the concerns than they were months ago, and this goes to their merit. I see progress in this discussion and I am happy to continue it.

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] 
Office @ Via Treviso 12, 10144 Torino, Italy