Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

[Rob Sayre <[e-mail]>]

On Tue, Jul 16, 2019 at 11:49 AM Rob Sayre <[e-mail]> wrote:

>
>
> On Tue, Jul 16, 2019 at 10:22 AM Eric Rescorla <[e-mail]> wrote:
>
>>
>>
>> On Tue, Jul 16, 2019 at 9:10 AM Rob Sayre <[e-mail]> wrote:
>>
>>> In any case, BCP 188 covers the issue we're describing quite well.
>>>
>>> "The same techniques to achieve [Pervasive Monitoring] can be used
>>> regardless of motivation.  Thus, we cannot defend against the most
>>> nefarious actors while allowing monitoring by other actors no matter how
>>> benevolent some might consider them to be, since the actions required of
>>> the attacker are indistinguishable from other attacks."
>>>
>>> Pervasive Monitoring Is an Attack
>>> https://tools.ietf.org/html/rfc7258
>>>
>>
>> I'm quite familiar with this BCP but given it's emphasis on passive
>> monitoring and the associated interest in opportunistic security (RFC 7435)
>> I don't see any conflict here.
>>
>
> I think the conflict is that the BCP states that the perceived benevolence
> of an application (parental controls, malware blockers, etc) doesn't
> matter, but that seems to be the case being made here.
>
> Aside from that seemingly obvious conflict, it doesn't seem like DNS-based
> solutions would really work very well for these benevolent applications.
> It's sort of like using a coffee cup as an umbrella--it will catch some
> rain, yes.
>

Oh, also, RFC 7435 is Informational, while RFC 7258 is a BCP. BCPs are the
documents that describe what the IETF is supposed to be doing, right?

thanks,
Rob


>
> thanks,
> Rob
>
>
>
>>
>> -Ekr
>>
>>
>>
>>>
>>> thanks,
>>> Rob
>>>
>>>