Re: [arch-d] consolidation draft ( was New Version Notification for draft-nottingham-avoiding-internet-centralization-01.txt)

[Watson Ladd <[e-mail]>]

On Mon, Jan 10, 2022 at 10:33 PM Eliot Lear <[e-mail]> wrote:
>
> Watson,
>
> Full disclosure- my name is on the draft, but it is a draft, and it
> needs work.  In this regard, I think you have jumped the gun in your
> review.  Please see below.
>
> On 11.01.22 05:43, Watson Ladd wrote:
> > On Mon, Jan 10, 2022 at 8:27 AM Dominique Lazanski
> > <[e-mail]> wrote:
> >> Also, Mark and I have a slightly updated take on our draft here:
> >>
> >> https://datatracker.ietf.org/doc/draft-lazanski-consolidation/
> > This draft makes a number of misleading and poorly substantiated
> > statements about DoH that easily could have been corrected by checking
> > against the published RFC. Given that several of the authors were
> > vocal participants in the rather ugly and extended debate about DoH, I
> > expect better. A sampling
> >
> > - "This change in the look up process is forcing the technology to
> > develop in a way which has narrowed the ability for companies and
> > small industries to do DNS look ups without updating out of date
> > hardware and software, therefore disenfranchising developing countries
> > and smaller companies without  big budgets."
> >
> > The  addition of a protocol does not narrow the ability to use the
> > older protocol. You would have to show revolvers turning off 53 in
> > favor of DoH. That hasn't happened.
>
> I don't think you have to show that resolvers are turning off port 53,
> but rather simply that the query traffic has shifted from port 53.
> Certainly that has, to some extent or another, happened.

That's not what the sentence says: it says that ability to do DNS
lookups (not serve queries) via port 53 has been reduced. A shift in
traffic doesn't mean anything to the traffic that remains.

<snip>
> I think the fundamental risk here is concentration of resolver
> providers.  What would happen to load if a Big Cloud Provider Who Offers
> DoH Today had a systemic failure (we have certainly seen such things)?
> This can of course be remediated by having a large and diverse selection
> of providers to spread load, so that no one provider can cause an
> excessive load shift.

Why does DoH make this worse than DNS? 8.8.8.8 works just fine over
53, and you have the same concentration issue. I think this a more
general thing than with DNS and should be a risk of concentration:
failures might remove substantial capacity.
Yes, AWS-East-1, I'm looking at you.

>
> By the way, your own statement is baseless.  That is, if you are going
> to correct someone, please be so kind as to at least cite some sources,
> since you claim they are readily available.  Not that the draft
> shouldn't support its own claims, of course.

I retract that, there aren't very clear contradictions. I'll link some
sources that complicate the picture
https://w3techs.com/technologies/overview/proxy shows that the most
common reverse proxy is none. Only 20% of sites use Cloudflare.
Unfortuately it doesn't seem to have historical data, but Netcraft
does, but alas only for server, and they had 10% for Cloudflare
recently https://news.netcraft.com/archives/2021/11/23/november-2021-web-server-survey.html.
These are substantial percentages!

The problem is that these measurements only look at sites, not
traffic. And traffic is highly skewed, with many large sites running
their own CDN, and many CDNs only competing for high traffic sites or
in particular niches. I don't really know what the market looks like:
a handful of competitors as it says in the draft is too few.  Probably
the best way is to try to pull it out from IX records, but off-nets
complicate it. It's not an easy number to get.

My recommendation would be to focus on sites, as it's more observable
and substantiated. And there's a more interesting dynamic: DDoS
attacks make it difficult to run small networks, filtering services
and CDN make it easier to run websites, but at the cost of having a
substantial impact for the rest of the world if it goes down and a lot
of sites impacted.

The other technical point is about CDN geolocation being disrupted by
DoH. This doesn't actually happen: the CDNs that do rely on geographic
IP assigment see some degradation even without /24 propagated, but
it's not big as the destination of the DoH resolver is close
networkwise to the query. No different from what happens with Do53,
and the same solutions like explicit client indication work. Useless
is way overstating it.

>
> > Unless there is a workable discovery protocol, and the people calling
> > for it should be the ones to propose it, I don't think we should hold
> > off on real privacy improvements for real users as a result. I think
> > there are real problems to think about in this space, but making this
> > a referendum on the biggest privacy improvement for real users since
> > Firesheep is not going to help have that conversation.
>
> Where is anyone being held back?

Nobody is, because the IETF process hasn't stopped ODOH and DOH
because people want discovery. That doesn't stop people from arguing
otherwise. Your draft argues that we need more review of protocols
then the already ponderously slow IETF consensus process, focused on
the claimed operational problems, that protocol design has economic
implications we need to review, etc. These seem like extremely
difficult things to actually get to solid conclusions on.

>
> >
> >> It seems that there is common ground among all three and also some big differences. However, its clear to me that there are technical, economic and policy related issues that are intertwined and need to be discussed further. The unintended consequences of legislation in, say, Russia (for example) is based in consolidation taking place on US platforms. These can’t be ignored.
> > I'm not aware of any large consequences of laws in Russia caused by US
> > consolidation. That definitely doesn't mean there haven't been any,
> > but it might be useful to point to examples.
>
> Indeed examples are good.  By the way, The Verge had an article about
> the Swiss Army doing its own version of IM because of risks associated
> with WhatsApp being a US company.  Yes, there are a number of
> entertaining aspects to that bit of information; and I'm confident the
> Verge doesn't have the story quite right.  But at least enjoy the
> entertainment as it comes.
>
> Eliot



-- 
Astra mortemque praestare gradatim