Re: [Doh] A question of trust (was Re: Draft -09 and WGLC #2)

[Patrick McManus <[e-mail]>]

I appreciate the comments.

On Wed, May 30, 2018 at 11:59 AM, Mateusz Jończyk <[e-mail]> wrote:

The server selection text that ended up merged is a little different than
what you quoted (partly because we had a similar reaction when rereading)

"A DNS API client MUST NOT use a different URI simply because it was
discovered outside of the client's configuration, or because a server
offers an unsolicited response that appears to be a valid answer to a DNS
query."

the key and clear part there is "a different URI".


> I think the previous wording in the "Security considerations" section was
> much
> better:
>         A client MUST NOT use arbitrary DNS API servers.
>         Instead, a client MUST only use DNS
>         API servers specified using mechanisms such as explicit
> configuration.
>
>
While I normally favor concise (and do like your text), the feedback has
been to err on the side of being more explanatory especially in justifying
use of MUST NOT - so editorially I think what we have is the right thing to
do and I think you did make it better by reconciling it more tightly with
the server selection section.



> It only required a rewording of the section "Selection of DNS API server"
> to
> match it.
>
> ------------------
>
> By the way, we should clarify the section "Server push". I propose it to
> read so:
>
>         A DNS API client MUST ignore pushed DNS API requests (see
> {{RFC7540}}
>         Section 8.2) whose pushed request URI is not one that the client
>         would have directed the same query to if the client had initiated
> the
>         request.
>
> (which is a modification of the text proposed in
>         https://github.com/dohwg/draft-ietf-doh-dns-over-https/pull/185
> and suits the comments there).
>
>
Basically, my response is that this is the same as the security
considerations reasoning. Its helpful to explain a little bit of rationale
and highlight how this differs between push and pull..