Re: [Doh] [EXTERNAL] Re: New: draft-livingood-doh-implementation-risks-issues

["Livingood, Jason" <[e-mail]>]

On 3/9/19, 1:29 PM, "Stephane Bortzmeyer" <[e-mail]> wrote:

    >> Network operators, ranging from ISPs to enterprises, schools, and
    >> others work hard to provide outstanding DNS and network performance,
    
    > Nice but clearly false. One of the reasons why many users switch to
    public DNS resolvers is because many local networks and ISP do a lousy
    job (specially in some parts of the world). Not to mention those who
    simply announce 8.8.8.8 trough DHCP...

[JL] It is my experience as an operator that it is indeed *not* false, else I'd not have written it nor would many ISPs with similar concerns not agreed with the statement. The key perhaps is that I didn't say *all* of course - but it sure seems like we're nit picking here. I don't disagree that in some parts of the world and in some networks that DNS operations could be improved. But I certainly think you can concede generally speaking that networks (of all types) strive to maximize performance & reliability, and this usually includes good DNS services. 

   > > the current Centralized DoH implementation model does not appear to
   > > make it possible for these operators to continue to play a value
   > > added role in the delivery of network services
    
    > Some people may consider that this is not something we want from the
    ISPs. "value added" is often the code word for violations of network
    neutrality.

[JL] It is not what is intended in the document but your perspective on that issue is noted.

   > If you care only about bytes, video
    providers will always win. But other metrics could be used: is a video
    of a cute kitten more important than a PDF document which is a
    multi-million dollars contract?

   > > The Dyn attack provides a vivid illustration of how DNS
   > > infrastructure vulnerabilities - and DNS space concentration - can
   > > wreak havoc on the stability of the Internet."
    
   > Is it really relevant, since it was an attack on authoritative DNS
    servers? Having lot of local resolvers would not have changed its
    consequences.

[JL] Yes, it suggests that when a provider handles rather a lot of a particular protocol that an outage or attack on that provider can have a significant impact. The quoted paper uses it as an example of the larger issue. 

   > > DNS blocklists, which are one of the primary and most effective ways
   > > to protect a network and its users against malware, phishing, spam,
   > > DDoS attacks, etc.
    
    > Can you explain how a blocklist on the DNS resolver protects against
    spam and dDoS?

[JL] Quite a lot of spam and DDoS traffic emanates from botted hosts. To the extent that you can prevent malware infection, detect and remediate infection, or detect and/or interrupt command & control traffic then you can have an impact on spam and DDoS. 

  >  > Loss of Parental Controls or other Content Controls
    
   > The draft seems to assume that lying DNS resolvers are a good thing
    (politically and technically) but I don't think there is an IETF
    consensus here.

[JL] I totally understand the 'lying resolver' perspective. But we need to be realistic about how technology is ultimately used. Many people have young children and may want to filter what content they have access to at home. And schools for young children may similarly want to block certain content from school. Or want to ensure their devices aren't talking to well-known malware C&C servers, etc.

Anyway - thanks for your review and sharing your thoughts!

Jason