IETF Logo Mail Archive

Re: [DNSOP] I-D Action: draft-ietf-dnsop-structured-dns-error-07.txt

"Gianpaolo Angelo Scalone, Vodafone" <Gianpaolo-Angelo.Scalone@vodafone.com> Thu, 09 November 2023 09:08 UTC

Return-Path: <Gianpaolo-Angelo.Scalone@vodafone.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 48395C151063 for <dnsop@ietfa.amsl.com>; Thu, 9 Nov 2023 01:08:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.107
X-Spam-Level:
X-Spam-Status: No, score=-7.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=vodafone.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EcnseXan6vPQ for <dnsop@ietfa.amsl.com>; Thu, 9 Nov 2023 01:08:16 -0800 (PST)
Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05lp2105.outbound.protection.outlook.com [104.47.18.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F3DAC14CE51 for <dnsop@ietf.org>; Thu, 9 Nov 2023 01:08:15 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=CEfYXcfTHnXnSO1BG/nWFOTIDAba8kkWigKAUy5nWZIh2hsdztgWI8HP/irYo+Y+P414uBUhMBjD9elj2+RSZIAaErtcTS7o9UduQzQEHBdCtXaR5EWGBoXb8VZDgaEekFrZdbkoJQS2w/Fh/S2VMnO8rf7dcRBLEl1reyIaBU+IJUAGSk3SP8X0UxrhfymSvDFy7JzpG1bLnXIopzC4wJKwTuvs6+mO5+V0cMfQZZuFVKAjDuwbFNPE+FOLYjnsIS96d1wAstBd0+Nk/ofF/u3md02r9zaT57YmnhdrTfvmJgN7//1AtRmqVPOEyPwVSYccSXqRFBtcISA5SM6QoA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=MN0WSvfo1fhSek0G4zeyCpriq2/pv9B/SluFrC1Sedg=; b=ex7LsmDMCHOG9qUnVlORYfm0unzNlW12oaR+nlXUEFah05Pgl+15dO1EVuJ+Bv/+6iwWArckXqmt55HC/02i4i3CPqR6UoPXE5zdOJr0wjLxmpkleOeLg98uY9nVNnNx5XCXTc1iMeT5MReGcDMiXmGv44MziTbk7vnLh141t+NuWNhDFjNMxFK/KRN8CpQcvWkZ9oyZR7dPAzmU2KuU5MIzJlwW+KFycjMM0uuUZOgdFhHcyNkVDi+bQ2iEhYttLc9crtWtnqwgXn5sqvL7/fyAWtM61+y3frfd6tnFq7vSGsimNnoqR4C43GX8Ypj0WiFA7JxirVZkmXjx2J52Fg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=vodafone.com; dmarc=pass action=none header.from=vodafone.com; dkim=pass header.d=vodafone.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vodafone.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MN0WSvfo1fhSek0G4zeyCpriq2/pv9B/SluFrC1Sedg=; b=KvP9AqkYPyq4lMdq34ZZXSks/j+/1jW6qawL8hE5wierqOYoeww2BMD4X4fA4wEHT5blKJtXMK0aRd71sd0EK3K8uS9V1p0n/AQO+z2v0f+b4NdiOvVke7YLlAPNoM9FH0fyn/whEJfO3sysU29xfHys6fTnP4mxr9A0fm/ZGhgAlHZihUGX6woE/rId5fvvHG5kjR2hgwnAsPqjzMcX2odIIhMmdzc7xVzRdMoPkcyrfUMIwEJ49dnz8V8CETLcOMAosmImREAmgjp5j48kwHCyptHGdcH5Ynt7KYHPPlaJbchdXCG5m+kNK5sfd+jw2OAD8TJ+tedbKQyv5X7lyw==
Received: from DB9PR05MB8473.eurprd05.prod.outlook.com (2603:10a6:10:29c::24) by DB3PR05MB10018.eurprd05.prod.outlook.com (2603:10a6:10:436::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6954.28; Thu, 9 Nov 2023 09:08:09 +0000
Received: from DB9PR05MB8473.eurprd05.prod.outlook.com ([fe80::ef1d:10fa:6240:c992]) by DB9PR05MB8473.eurprd05.prod.outlook.com ([fe80::ef1d:10fa:6240:c992%3]) with mapi id 15.20.6977.018; Thu, 9 Nov 2023 09:08:08 +0000
From: "Gianpaolo Angelo Scalone, Vodafone" <Gianpaolo-Angelo.Scalone@vodafone.com>
To: "dnsop@ietf.org" <dnsop@ietf.org>
Thread-Topic: Re: [DNSOP] I-D Action: draft-ietf-dnsop-structured-dns-error-07.txt
Thread-Index: AdoS6i3t/HAhjImSTKqIUjL3G/PMVA==
Date: Thu, 09 Nov 2023 09:08:08 +0000
Message-ID: <DB9PR05MB8473EE94D86348FF1E8207EAA3AFA@DB9PR05MB8473.eurprd05.prod.outlook.com>
Accept-Language: it-IT, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Enabled=true; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_SetDate=2023-11-09T09:06:37Z; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Method=Standard; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Name=0359f705-2ba0-454b-9cfc-6ce5bcaac040; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_SiteId=68283f3b-8487-4c86-adb3-a5228f18b893; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_ActionId=9acd6dae-4546-4047-b193-b346b890c1c0; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_ContentBits=2
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=vodafone.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: DB9PR05MB8473:EE_|DB3PR05MB10018:EE_
x-ms-office365-filtering-correlation-id: a677b42e-5951-4600-a7cd-08dbe1036465
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: i/dCstm1ua0Yex3iv+re+FjNRShvPKXJrJOKbW9IujghYUzJ4vUvRQEl5i+H+6FOpIokQDraFrYq3JFzgbSCDMYRr0fcXUk7ebZY06h9mTTD4QZxuJRBQDzJC1Z7WaL54jecZC2oYoIddJx2AIPp/ufOPPRbz7IPNr+0R29P/w/wH1wENCwFXdixMs0Ue1DlCq1y/Lmr1cvOnzz+CAWX6dIlokTzc0MDlnpj6B9CMli0d7ymlCcY/M4UTPGNAIDeVlBNS4BKLLyapOvIR1ynPaeTSSEA37DWD4+BkQb9+owwvgU1vpEPZHwB0dR9xLN2YKnmABg+pVgRYGj3mpv0CNDAA7gPyBDYCxjwaknWdHdC2XDpJs7sqvtaMt9R3feTqirYou1jgbc7g4C8WgkihHEaqll22nJrjj/+0lm1eeOKmlRZAz48FJ6LjveQLxYVxrOctM0kYzil5gHldwhokuloLSZr+Fa4ipWAnfWUB9oiUnHBbhseHq7FIDBiM7l7pzyagKsf6K1BphT5NxD2+bAzHHm788VZxElduRN1gul5+XWzIUsYOFmOOACHkIxz05POMDY8Ej1knbSxjnZUeZ0KS/nPg95CmO+zp9pwugRtw6C92Dj7fitaAoq/wj8k
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB9PR05MB8473.eurprd05.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230031)(39860400002)(366004)(396003)(136003)(376002)(346002)(230922051799003)(64100799003)(451199024)(186009)(1800799009)(52536014)(55016003)(7696005)(66574015)(26005)(9686003)(6506007)(41300700001)(82960400001)(38100700002)(33656002)(83380400001)(122000001)(86362001)(8676002)(9326002)(5660300002)(2906002)(8936002)(71200400001)(38070700009)(66446008)(66946007)(66476007)(76116006)(66556008)(316002)(64756008)(478600001)(6916009); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: q0v1JlNx6xALdWFKV5mvMvs12qrSbTq3KztR5cgDOxfGM9Uamyl6nUAt5Og4VTa5X/Yqhr1Rud43CUPP1w01v3cNHWIDmuZ4K8f/QmjOVrpVg//OjQXkZM+vHpBNykLa8wNWgQ0PJ7F2uxggt5Pc4fYmAYtjTUhfm2glisPXBHdS1z02PMBOi9Xqp1tiNhqF/UAYywqZAu27Mw2AZ6wSjtgP9DLEaVsCZpd2A9svEP708+Lellp7cCC38Dkwwm/mJv7cXgm1xSd81TzxbIbVf0q0WWy6tTu30eC28Hp1rfXfNFXk5AcYa6oKke1F7YkjGMP2M7cDrYnTaCcScQCwT2wcDySxwwxDffE+Jd7VMomhY/7ADjgpfOAk+Ah5Jdyc7ZkVfrlTbcLJMpD0b/BJlNFw6FsNY6vFOIowSVrgIbYjF4kETK8RpEI+FsDA+LTqzBAEOZoHhk99qqnASr9Nl/8kZu8FfKLMamyqbGaHoKfDW8WAhT6ZOdQ7CXPq++/x0ubOD4mzlT9JnD+qkSyM5idqA2zRhBa3hOwFzkOUF4BROpRDEOkrpv693AyRTKMNv3GnwuOAD3spXTtIKqlX3qUNtvZwpwgG0dilN9XWPdaOyrjrJx8jpsgTQS1qsJDSSgAV8JLEOfdzqWvVqAW5WmpNs8LTpQ41icqcnqfFqt8BooJBlaAqF22mbfvVq1azgFQy+9mI36BUubJPpjFhwrAogUaPq6eXaHyIp/GGw0R6K7V/V1CoRaXBe0u6ne4LBSrbMMvyjXwBgRTSw9A5UgZNt2PW/B+iV0h8A6LH91mIsgjlUCgJWQ90X06JjUZ9qtu/9KMxMsFLZVw5o/8p79ZiNnxxlYCvps5bYOesycd6bZtosPLAnifmxL3Nu5uf2DtPytd4J8TmJKh5aximAeAtuzlCMUiRV3MwY9p0lqZ1sRFZl5V5ZWrg6yEu/CHBJAT205t40CLGwyaHURB/MSgJ6Qsnc8vKsgmjUMzCoVcAsJICbEnXs1P5TLcUMO3nhUATinO/xJROjwEuZ+V8oI0/ydCbMYFB0K/8tEW49O8xFkb361OBOuEH8gy4bwx8mn7YBNqmUtm4WspiAVENWdroBqnIh2X4HELD0ncWw7LagCsFfqEZLjmpmz1FCBtgDFcWVQuRvIiXAeKNkOxtk3MoZ6bFbfOXyajf3PyjyuPV8C0ttCGYu6l1P5jbWbCOY8cn3ln1rtZxDbGENpS06G3BPSJeyJlhWw2UW8dgi/YO2QRJTPpTjOK8fkcqg7x92goNgMfh8kIF0D/4VIkz1YhF1QIv6FIbEDYgQkrWjaJ7yTsjBFBdwL46jIn60WpMdLbiEP42Cx5sqMr/I+l5xtUXtwZuCZFJ6ALDCKj70hCaxgf610FnFgYJ9e9iBYbp0hf8OWNUjiEkJWGv7Yi5rRkdtzbHZNfVLjjP4PiIS+F8AzWm6AfQRSQBulGAxpVg+elVLGbD6Vjl+UFLxHC1vTGA510JJ5V3Ow89fq0GR3ZxoEE/KnTXxxTs5VXOypQTfpZf9EQVzqu4oW5P34n8MbwPG1hcMFJHOG0cJdYfHU8ffmTSSvIAy0eSyNCNHM+FaYMv11dYQJ1OJrDORS9vLK1ojPVbBGIA2h3Syi/6qew=
Content-Type: multipart/alternative; boundary="_000_DB9PR05MB8473EE94D86348FF1E8207EAA3AFADB9PR05MB8473eurp_"
MIME-Version: 1.0
X-OriginatorOrg: vodafone.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DB9PR05MB8473.eurprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a677b42e-5951-4600-a7cd-08dbe1036465
X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Nov 2023 09:08:08.8053 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 68283f3b-8487-4c86-adb3-a5228f18b893
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: XZe2uD4R+GoQVHl5etWdwUWc+59PVkBG/Xq0Po67AWc/Lx9KMdT1y97W+7qUYx1UjZtI3JXyI1GC1SWyvs1h163zJ4K4CCYJ6WRjXbv581Rc4Vzz4qyOSjYRRk/lkCaL
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB3PR05MB10018
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/f4bQP_sq7mx0Q0-O7OeJ_a_KSWQ>
Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-structured-dns-error-07.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 09 Nov 2023 09:08:21 -0000

Hi,
I still think that a mechanism to reach an HTTPS resource is needed.
Considering the security implications of rendering directly an HTTPS URI,
It could be an additional field, to be used by the client

  *   For out of band connection to retrieve the needed page info from resolvers with high reputation that have agreements with the browser
  *   To connect to an high reputation service (to be created) having the only purpose to host blocking pages on behalf of the various DNS filtering services
     *   This high reputation service would be defined in a separated RFC
     *   Access criteria and content to be defined
     *   Management criteria to be defined

Having such a service would allow to access high reputation information about the eventual blocking reason and provide the end user modern methods to understand the blocking or request an amendment in case of false positives.

The mechanism proposed in draft-ietf-dnsop-structured-dns-error-07.txt is a big improvement respect the existing situation, but still requires some knowledge that common users may not have and so limit the capability to require amendments only to users well educated on the topic.
With a SIP contact or an EMAIL contact the end user should know what to ask very well, with an HTTPS URI a request to amend the blocking could be populated with the relevant information, empowering also less experienced users (here we are sort of providing a pre internet solution to an internet problem).

Many countries request filtering of DNS traffic for CSAM or for Adult Content Filtering reasons, so a good way to avoid false positives would provide the population a better access to internet.

Gianpaolo



C2 General

v2.23.0 | Report a Bug | By Email