Re: [Doh] Mozilla's plans re: DoH

On 27. 03. 19 17:56, Eric Rescorla wrote:
> 
> 
> On Wed, Mar 27, 2019 at 9:32 AM Tony Finch <dot@dotat.at
> <mailto:dot@dotat.at>> wrote:
> 
>     Eric Rescorla <ekr@rtfm.com <mailto:ekr@rtfm.com>> wrote:
>     >
>     >     4. At any time, the user will have the option to select a
>     >     different resolver out of the list, specify their own resolver, or
>     >     disable DoH entirely.
> 
>     Will Firefox inform its users whether the local resolver supports DoT or
>     DoH?
> 
> 
> We don't currently expect to do so. As noted above, we don't think
> secure transport to the local resolver is sufficient to ensure the
> privacy and security guarantees we are trying to provide.
> 
> 
> 
>     > However, there are two more restricted cases in which we do think some
>     > network control of the resolver is reasonable.
> 
>     What about allowing Firefox users to access private / internal domain
>     names?
> 
> 
> If a name doesn't resolve with DoH, we fall back to the system resolver.
> This doesn't work properly when the same name is available on the public
> DNS but pointing to a different location. As I alluded to in my email,
> we're still working out how to deal with this split horizon scenario>
> -Ekr

IANAL, nevertheless I will say Beware of
https://patents.google.com/patent/US20160197898A1

BTW This patent is very likely to soon become property of IBM as part of
Red Hat acquisition. I'm not sure what is going to happen with Red Hat's
patent promise.

Petr Špaček  @  CZ.NIC

> 
> 
>     Tony.
>     -- 
>     f.anthony.n.finch  <dot@dotat.at <mailto:dot@dotat.at>> 
>     http://dotat.at/
>     each generation is responsible for the fate of our planet
> 
> 
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh