IETF Logo Mail Archive

Re: [DNSOP] Draft for dynamic discovery of secure resolvers

Joe Abley <jabley@hopcount.ca> Mon, 20 August 2018 15:41 UTC

Return-Path: <jabley@hopcount.ca>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73D25130FF0 for <dnsop@ietfa.amsl.com>; Mon, 20 Aug 2018 08:41:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bnxeNh8Zz5uI for <dnsop@ietfa.amsl.com>; Mon, 20 Aug 2018 08:41:22 -0700 (PDT)
Received: from mail-pg1-x530.google.com (mail-pg1-x530.google.com [IPv6:2607:f8b0:4864:20::530]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC7D5130FEB for <dnsop@ietf.org>; Mon, 20 Aug 2018 08:41:21 -0700 (PDT)
Received: by mail-pg1-x530.google.com with SMTP id h8-v6so518827pgs.4 for <dnsop@ietf.org>; Mon, 20 Aug 2018 08:41:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=08W6rf24Icu/P+ixIA9bBAOfby0qYdpeXy6fUxvs1WQ=; b=DWmCQt/mTR53mqt2PnrcB0uCneP8OelFE7MBvSHDWDHzvJRM6CEsoOwxumbbizT3vk QIeU2VDXakc3ozSaqfDEDHneBgTyfZ2SBxvG/bpA54bOyt7UPls8Vt4dfxYobmKKlVUS 7yYZJkYAjjc6YqJ4SJoB+RBUnz2lMpVWHW+94=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=08W6rf24Icu/P+ixIA9bBAOfby0qYdpeXy6fUxvs1WQ=; b=ZKatJ08mFb5dS9wJsMk5kvapVCbrfEZ3oi/OYsmpwG4nKnQXdTFIzHxZ38EtdxK7Ph rpvn9FgxCgEdrfxYni5QAsf4JM+KxL5RD6T1Re+7U9knCLmWEmyYh/WIPVK+lCbFElve PHv1x7JwwjS4XTMCgFdi45tq9BRZThgovPY5kwtk2EbH+hh2tRcFvACZPbLL79z2vV6R TnKQDlPFSuErCP0wGnKYbi/TuORiBIHoQBT+gK81jrVxSYF+GKJPtm+ETWJRiXDMV0Sl iu0A044yJiIS951lAVO7Xn62LBiRAoKTiFeOlJ4NUba5JQHegYDjNN8D9of1ZMEg2U9m y4hQ==
X-Gm-Message-State: AOUpUlHGTHi5e9nGtjprVui9C3S4fpepHs7v8y8J5NXW8hwJrxADNvqD JR0z/CdMRAbWdMf6s+ZG3Qntnu+RFjI=
X-Google-Smtp-Source: AA+uWPwCqV5SGO3YRgLIb/tHtKcgQZx7T3/HuY0+GQ6le/QAnSjYVGeCM85dYXFDTu4hvdQuTgjjvQ==
X-Received: by 2002:a63:67c3:: with SMTP id b186-v6mr43815470pgc.5.1534779681190; Mon, 20 Aug 2018 08:41:21 -0700 (PDT)
Received: from ?IPv6:2607:f2c0:101:3:e510:137d:bc64:7f84? (node-131dv6bwhmk66vyt8k.ipv6.teksavvy.com. [2607:f2c0:101:3:e510:137d:bc64:7f84]) by smtp.gmail.com with ESMTPSA id 143-v6sm18189118pfy.156.2018.08.20.08.41.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 20 Aug 2018 08:41:19 -0700 (PDT)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (1.0)
From: Joe Abley <jabley@hopcount.ca>
X-Mailer: iPad Mail (15G77)
In-Reply-To: <1313743534.13562.1534765718802@appsuite.open-xchange.com>
Date: Mon, 20 Aug 2018 11:41:16 -0400
Cc: Doug Barton <dougb@dougbarton.us>, dnsop@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <9AFE57A7-1D27-4F86-9013-E3C63E63C582@hopcount.ca>
References: <CAC=TB13mUH2SDxFb4c3rOz0-Z6PE_r9i84_xK=dmLxiVr45+tA@mail.gmail.com> <CAPt1N1=-792WkQmbTigPdqOh0dONykYycG0hheOecoQa4ai=Hw@mail.gmail.com> <CAC=TB11tG4o0dkavXGb20=DGBCrmVoRP60bpzsvq5=Q0zFjhDg@mail.gmail.com> <CAPt1N1kj7Y0dPLeDk=PMqQEpAd-Mvds6VLT8XUC1BYOfdyUbJA@mail.gmail.com> <CAC=TB125M81nwiCTNr8Vbee+Z7Fh_3L+6EdZ8evXVzP-2ji4fg@mail.gmail.com> <CAPt1N1n9hDUZQ-Ltvs73T20=fpG-FR_j-t4m0kMapDiv2Us1kw@mail.gmail.com> <5B78BFB9.40103@redbarn.org> <47508D79-0D49-4F31-9BA6-6DC80C38F1DE@cable.comcast.com> <ad1f6dff-ebcc-97a9-6f4b-1ed683827cc7@dougbarton.us> <1313743534.13562.1534765718802@appsuite.open-xchange.com>
To: Vittorio Bertola <vittorio.bertola@open-xchange.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/2BXJ2y_ScvEqVoTiHOzcqHgHDA8>
Subject: Re: [DNSOP] Draft for dynamic discovery of secure resolvers
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 20 Aug 2018 15:41:31 -0000

On Aug 20, 2018, at 07:48, Vittorio Bertola <vittorio.bertola@open-xchange.com> wrote:

>> Il 19 agosto 2018 alle 19.02 Doug Barton <dougb@dougbarton.us> ha scritto:
>> And Jason, you missed a threat model, which is users who want to bypass their ISP's resolver.
> 
> I think that there should be a lot more attention to this "use case" in this discussion. It seems to me that the designers of DoH have in their minds a romantic picture of the dissident in some authoritarian country trying to escape censorship and save her own life, so that being able to bypass the local ISP, obviously run by evil government cronies, would be a good thing. 
> 
> However, in most of the world, the reality is that the biggest motivation for people to try bypassing the ISP's resolver is to access illegal Web content that has been filtered out at the DNS level, such as unauthorized gambling websites, illegal pornography, "free" football live streams (which are usually full of malware), etc. - not to mention bots trying to contact their command and control server without incurring into RPZ-based filtering.

These are the same use-case, just viewed with different bias.


Joe

v2.23.0 | Report a Bug | By Email