Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

["Dixon, Hugh" <[e-mail]>]

Hi Alec –
Given that this is at its core (just) a protocol for asking (any) DNS server whether it has a filtering policy, won’t “non-compliant software” will be the sort of software which does not beacon?  (sort-of detectable but not if it’s essentially optional app behaviour anyway, such that the absence of a beacon isn’t a significant “flag” – certainly not as much of a one as non-existent DNS activity - as it would be if all lookups have gone DoH-to-third-party)?
I think this is just a policy-signalling protocol, to enable users who “want to” to use the preferred policy-implementing resolver (quite possibly using DoH as the transport).  The wording gets a touch confusing in there – I’m sure a next draft would make the distinction clearer.
My comments are not a commentary on the wider effectiveness of the draft proposal by the way, just on the specific example given.

H

From: Add <[e-mail]> on behalf of Alec Muffett <[e-mail]>
Date: Monday, 15 July 2019 at 14:18
To: "[e-mail]" <[e-mail]>
Subject: [EXTERNAL] Re: [Add] draft-grover-add-policy-detection-00

On Mon, 15 Jul 2019 at 14:14, Alec Muffett <[e-mail]<mailto:[e-mail]>> wrote:

* [as I understand it] any cafe owner using PiHole will be able to suppress TBD.arpa resolution, and disable DoH
* [as I understand it] any state telco (Iran, above?) can suppress TBD.arpa resolution, and arrest anyone who attempts to resolve it for using "non-compliant" software
* albeit the desire to protect people with MITM-filters is variously legislated and appears desirable, I cannot see how delivery of such is now compatible with the themes of rfc7258

Alas how often one hits "Send" and then realises what one should have added:

* [as I understand it] any telco, state-sponsored or otherwise, can capture the IP address of any host which beacons/attempts to resolve "TBD.arpa", and then block all traffic to it, or else divert the latter for "special treatment"

That's not really in the spirit of rfc7258, either.

    - alec

--
http://dropsafe.crypticide.com/aboutalecm<https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fdropsafe.crypticide.com%2Faboutalecm&data=02%7C01%7Chugh.dixon%40sky.uk%7C3dc632e5eddf44e1891208d70926f9f2%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C636987935332970513&sdata=304yZx6JcxrylBxUncE%2B6sdPBPWyO7qBA5IBPP8Rt1s%3D&reserved=0>
--------------------------------------------------------------------
This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by sending them to [e-mail] as attachments. Thank you
--------------------------------------------------------------------

Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD