Re: [Add] What to do in this potential working group

[Alec Muffett <[e-mail]>]

On Wed, 21 Aug 2019, 19:17 David Conrad, <[e-mail]> wrote:

> Further, you cannot ensure to the end user that the “trusted” resolver
> operator has not tampered with the data, be it due to court order, internal
> attack, software bugs, etc.
>

But you can assure that it is a response from the resolver which you chose
(contracted?) to deal with,  rather than some happenstance resolver.

This latter is a major dent in the typical broad DNS threat model, one
which is glibly underplayed by those who would demand some theoretical and
upcoming "perfection" of trust - eg: DNSSEC - when a "better than extant"
option is already available and ready to be adopted by appropriate clients,
in the form of DoH.

To play with metaphor: Seatbelts won't protect you if your car's petrol
tank explodes or if a meteor lands on it; but that's not an argument to
deride seatbelts. One could attempt to make the argument "we won't need
seatbelts when we have a car which is proof against meteorite strike!" -
but I for one shall still wear them, and where they are not available - for
instance on a bicycle - then I shall not.

Equally: I shall (as available) use DoH, Do53, and perhaps even DoT on
occasion, and I shall look down scornfully upon anyone who suggests that
there is only one true DNS resolution transport.

And I will lobby for DoH as "better than extant, where available" — and not
hold my breath for bolt-ons like DNSSEC.

-a