Re: [Add] Not a good BoF meeting

[Vladimír Čunát <[e-mail]>]

On 7/24/19 8:16 PM, Thomas Peterson wrote:
> On 24/07/2019 17:56, Stephane Bortzmeyer wrote:
>> * discovery of local DoH resolvers (in my opinion, a flawed idea from
>> the
>> start: if you trust the local network, you don't need DoH, if you
>> don't, you won't trust its DoH announces anyway), 
>
> As the author of a draft (draft-peterson-doh-dhcp[0]) that provides
> discovery of DoH resolvers, I disagree as "trusting the network" is
> more complicated when there may be many operators and users in a given
> network, any of whom could be a threat. To me it is a positive if
> operators can provide secure means of DNS resolution within their
> network, and clients can choose to use them or not.

I'm fairly sure this has been mentioned a few times, but let me repeat
it: if you don't (fully) trust the network, how can you bootstrap your
trust? (e.g. over insecure DHCP)  You may get some certificate name or
key pin, but if you can't first "secure" the channel over which you
obtain those, I don't think you get much more real security.  With some
additional "approval" from the user perhaps, but that would again run
into the same informed-consent issues - and the attacker could e.g. be
running a service with just a tiny "typo" in the domain name.

>> On 24 Jul 2019, at 17:56, Stephane Bortzmeyer <[e-mail]> wrote:
>>
>> I suggest that this list does not do anything useful at this time.
> Plenty of others have a different PoV.


I agree that the ADD "group" is still struggling with finding a
"charter", basically, and I'm afraid I can't see much forward progress
(e.g. since the previous IETF) or satisfaction of a larger fraction of
the participants so far.

Much of the struggle seems about *who gets the control* over DNS or even
other traffic (by default), which might be really hard to get a true
consensus about, and... even if IETF manages to publish a position that
some parties should relinquish (part of) this control, I'm a bit
skeptical whether that act itself would have a significant impact.  In
this case it doesn't even seem viable to technically enforce that apps
don't tunnel information somewhere (without drastic measures like MITM
everything).  It's surely worth trying to discuss this and work towards
some compromise to diminish the arms-race, but how to progress the
discussion forward?

--Vladimir