Re: [Doh] ..I don't get it (the hate)

On Tue, 26 Mar 2019 at 12:31, Joe Abley <jabley@hopcount.ca> wrote:

> On Mar 26, 2019, at 12:15, George Michaelson <ggm@algebras.org> wrote:
>
> > This is (surely) between me, the browser vendor, and the website? Why
> > does the ISP have any say in this?
>
> The ISP (or equivalent actor) has the opportunity to have a say today.
> Some deployment models would take this opportunity away.
>
> I don't believe the concern is for sophisticated users who can make
> informed choices. I can use a tor browser right now that also defeats
> the ISP's opportunity to participate in the resolution process. That's
> not controversial.
>
> The contentious aspect is, I think, the potential for a majority of
> end-users who are not sophisticated and hence are unable to make
> informed decisions to have this behaviour changed for them.
>

And in a similar vein, unsophisticated end users who might change this
configuration deliberately, and then still expect their ISP to help them
out when they've got a problem.

I think the biggest enterprise concern is more around the balance between
users' privacy in one context (e.g. protecting dissidents) and user privacy
and security in other contexts (e.g. data exfiltration by malware).  I'm
concerned, and I believe others are as well, that while we're making gains
in the former, the loss in the latter may outweigh those gains by quite a
lot.  The malware on a user's system that is now able to reach its C&C
because its DNS queries cannot be blocked doesn't just put the user of that
computer at risk, but all the other users on that network as well.  And
there, again, it's a question of scale.  While it's possible for malware to
set up similar resolution systems today, if they do it stands out in ways
that can be detected and mitigated.  If they're hiding in the forest of all
the standard web browser traffic, that becomes a much more complex (and
therefore expensive) problem.

>
> It's not the existence of the mechanism, it's the potential scale of
> the deployment.
>
>
> Joe
>
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh
>