Re: [dnsoverhttp] Fwd: New Version Notification for draft-hoffman-dns-over-https-00.txt

[Martin Thomson <[e-mail]>]

On 4 May 2017 at 13:15, Patrick McManus <[e-mail]> wrote:
> A new version of I-D, draft-hoffman-dns-over-https-00.txt

A few nits only; I need to think more about how this fits into the
ecosystem.  I am warming to the notion that you have flexibility in
representation format, that's a key advantage of using HTTP.  You have
neatly punted on the hard parts of that by choosing the dumb option to
document, which means that you can bootstrap effectively.

The query string uses one of the worst encodings known to man.  Did
you do any analysis here?  Is base64url bad for some reason.  For
instance, I would believe that it increases the length of the string
in the aggregate if you told me.

You should use a parameter name for the query string so that you at
least have the chance to automatically discover a service and make
requests in other forms using the query string without sniffing or
other such horrors (conneg works fine for the POST variant, but you
are pushing those uses to a method that isn't a great fit).  What you
have consumes the entire usable space in the query string, so it would
be hard to get in edgewise with an alternative query form.

Do you really need to encode the ID?  I realize that might be
construed as opening the floodgates, but it is going to make caching
that much more fragmented.  Can you not just trim it off?

Section 7 seems a little repetitive.  I don't think that you have much
of a case on security grounds to require h2, but the last paragraph
seems quite convincing.