Re: [arch-d] IAB statement on "Avoiding Unintended Harm to Internet Infrastructure"

[S Moonesamy <[e-mail]>]

Hello,
At 10:53 PM 12-11-2019, Andrew Campling wrote:
>In the DNS section, it is disheartening to read the IAB stating that 
>"[a DNS resolver] returning the wrong (or no) address breaks the 
>trust that users have in this infrastructure", after having spent 
>months on the ADD list and elsewhere to explain that there are 
>indeed lots of use cases in which users expect, or even actively 
>request, that their resolver applies filters to the responses. In 
>some cases it is actually the opposite - if I acquire a DNS-based 
>service to prevent any accidental connection to malware-infected 
>websites and then I get malware, that's when I lose trust in my DNS 
>resolver; same for parental controls.

The position, in the past, was that it was important to preserve the 
chain of trust instead of allowing someone along the path to change 
the information published in DNS.  There are use cases where the 
changes are done for valid reasons, e.g. the user does not wish to 
download malware.  What are the unintended consequences of supporting 
such cases?

Regards,
S, Moonesamy