Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator

["Ralf Weber" <[e-mail]>]

Moin!

On 15 Mar 2019, at 19:36, Ted Hardie wrote:
> As was pointed out in many groups, trusting the local infrastructure is
> extremely problematic in nomadic cases as the local infrastructure can
> often be infected, ill-maintained. or hostile by design.  Given the
> extremely high percentage of users who are now on the Internet by mobile
> devices which roam and opportunistically use WiFi, ignoring this reality
> would not make sense.  So we rely on configuration of end devices and
> applications, with the belief that the user has some choice there in both
> how the end device is configured and in what applications are supported.
> That's a trade-off, and not a simple one to make, both because it is very
> difficult for end users to make that assessment and because there's a high
> reliance on sensible defaults.  But that choice is an engineering
> trade-off, not an act of war against you or any other network operator.
You can not get on a network with at least trusting some of its
infrastructure, be it SLAAC or DHCP (which BTW both carry information
for DNS resolving). The question is where you draw the line and IMHO
DNS or name resolution is a basic network function and not an application
setting.

> If the user configures your DNS service they get it, and their trust in
> your operations to provide appropriate answers is thereby matched to your
> desire to see the requests.
Yes and this capability existed in operating systems for some time and
was used by some people. It didn’t cause any concern as if a network for
some reason didn’t want to allow user to use external resolving (which is
the case in pretty much every enterprise network) they could simply block
it. This is not so easy with DoH.

> For a very large number of enterprise
> networks, the result is that devices are permitted on the network only when
> under some form of device management, with the proxies, configuration,  and
> limitations that implies.  To protect itself, the enterprise insists on a
> prior relationship with known terms, instantiated by the configuration of
> device management.  There are lighter forms of configuration that do the
> same thing to lesser degrees, but they each presume that a trusted edge
> network operator has a relationship to the users that can effect
> configuration.
This never was fully true and with more and more bring your on device
requiring this will get harder, so network providers (ISP, enterprises,
my home network ;-) have to have tools to apply their network rules,
or if people don’t want to play by the rules block them.

So long
-Ralf
—--
Ralf Weber