Re: [Add] Proposed charter and BoF request for IETF 106

Hi Alissa,

Thank you for sharing that text. A light edit to your contribution might
say:

"Network operators have historically mis-used DNS for a variety of
purposes..."

The "mis-" prefix was obviously added by me. But should the IETF take those
use cases seriously? I think all the shady traffic is on the "dark web"
now, anyway.

thanks,
Rob

On Wed, Oct 9, 2019 at 9:52 PM Alissa Cooper <alissa@cooperw.in> wrote:

> Hi Rob,
>
> When the IESG was discussing this, I wrote up the text below. The
> structure and some of the text made it into the version Barry shared.
>
> —
>
> Application Behavior Considering DNS (ABCD)
>
> DNS over TLS (DoT) [RFC 7858], DNS over DTLS [RFC8094], and DNS over HTTPS
> (DoH) [RFC 8484] provide confidentiality and tamper-resistance to thwart
> on-path attacks against DNS queries flowing between clients and recursive
> resolvers. Along with the deployment of these new transports, various
> application providers have been exploring having the application configure
> its own DNS services rather than using DNS services configured by the
> network operator. (The working group considers a network operator to
> include Internet service providers, enterprises, and any businesses that
> provide network access.) Together, these developments may represent a set
> of shifts depending on how the new protocols are deployed: from cleartext
> to encrypted transports, from use of unique port numbers for DNS resolution
> to ports that support significant other traffic (e.g., HTTPS), and from
> network operator control of DNS configuration to control by clients,
> third-party resolvers, or others.
>
> This potential set of shifts raises many questions given the long history
> and current status of DNS operational practices. Network operators have
> historically used DNS services for a variety of purposes beyond simple
> query resolution: to mitigate network and security threats, to enforce
> enterprise policy, to provide parental controls and other filters, and to
> comply with relevant laws and regulations, among others. To the extent that
> the presence of encrypted DNS transports or changes in DNS configuration
> control or both create barriers to achieving the objectives that underlie
> these practices, this working group is the venue within the IETF to work on
> engineering and operational solutions.
>
> This working group is focused on specifying protocols, guidance, and best
> practices to support the smooth operation of encrypted DNS transports
> across diverse networks with potentially diverse and changing arrangements
> concerning where the control of DNS service configuration is located.
> Specific initial areas of focus include but are not limited to:
>
> - Resolver discovery and selection
> - Expression of resolver policy
> - Support for split-horizon DNS environments
> - Mechanisms to facilitate testing of new configurations
>
> This working group will coordinate with the DNSOP (OPS Area) and DPRIVE
> (INT Area) working groups, and all last-call announcements (including
> Working Group Last Calls issued by the chairs) will be copied to all three
> working groups to ensure thorough and careful review.  The working group
> will also coordinate with the Security Area, and will be assigned a
> security advisor.
>
> —
>
> Best,
> Alissa
>
>
> On Oct 9, 2019, at 3:51 PM, Rob Sayre <sayrer@gmail.com> wrote:
>
>
>
> On Wed, Oct 9, 2019 at 8:48 PM Joe Abley <jabley@hopcount.ca> wrote:
>
>> Hi Rob,
>>
>> On 9 Oct 2019, at 09:40, Rob Sayre <sayrer@gmail.com> wrote:
>>
>> >> So if it helps, consider "the IESG" as the charter proposal writers
>> >> and "5 or 6 ADs" as the BoF proponents.
>> >
>> > It does not help. Could those "5 or 6 ADs" put their names on the
>> proposal?
>>
>> Can you explain why this is important?
>>
>> I don't mean to imply it's not; I'm just trying to understand your
>> question.
>>
>
> You ask a totally fair question.
>
> I think the charter is misguided and wrote that "a proposal that no one
> will put their name on doesn’t even deserve an argument."
>
> So, I just asked (again) whether someone would put their name on it.
>
> thanks,
> Rob
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>
>
>