IETF Logo Mail Archive

Re: [Doh] panel discussion on DoH/DoC

Vittorio Bertola <vittorio.bertola@open-xchange.com> Mon, 11 February 2019 13:21 UTC

Return-Path: <vittorio.bertola@open-xchange.com>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA6C9130E8F for <doh@ietfa.amsl.com>; Mon, 11 Feb 2019 05:21:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Level:
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lOyq05N6N7q8 for <doh@ietfa.amsl.com>; Mon, 11 Feb 2019 05:21:00 -0800 (PST)
Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8FFCE12D4EA for <doh@ietf.org>; Mon, 11 Feb 2019 05:21:00 -0800 (PST)
Received: from open-xchange.com (unknown [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 586126A23E; Mon, 11 Feb 2019 14:20:54 +0100 (CET)
Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 4B2B13C20A4; Mon, 11 Feb 2019 14:20:54 +0100 (CET)
Date: Mon, 11 Feb 2019 14:20:53 +0100
From: Vittorio Bertola <vittorio.bertola@open-xchange.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, Eric Rescorla <ekr@rtfm.com>, Andrew Sullivan <ajs@anvilwalrusden.com>
Cc: DoH WG <doh@ietf.org>
Message-ID: <2108215800.1884.1549891254241@appsuite.open-xchange.com>
In-Reply-To: <d122cbe2-3ea4-71cb-b4fb-9f90c7aef7d6@cs.tcd.ie>
References: <20190207105106.GB1772@server.ds9a.nl> <C7C3BAF7-4BD4-4EE2-B3F2-1F8B49222980@fugue.com> <20190207130313.7g7hf4swaopnr75e@nic.fr> <FD7BFAFF-88B9-49BF-A652-3649ADCD53F9@fugue.com> <637C85D5-EACC-4C39-A220-753AC83FD78A@rfc1035.com> <35CBC108-69C9-4EB9-AACE-EEB39F802456@fugue.com> <1503183837.15474.1549549260349@appsuite.open-xchange.com> <97216205-8415-42F6-BF24-5FFB589FC887@rfc1035.com> <CABtrr-UfwtgmO80A9en0-4tyPKqRRdvwR3BVEQQv+ykrNt-=mg@mail.gmail.com> <f9a06c5d-7af2-46b1-5929-490c22c602bb@time-travellers.org> <CABtrr-WNfQ16FQWmtZFUoCDc1R3rua8zw8FCAr2JBNx4cLyaAA@mail.gmail.com> <1549842687.561412.1655109464.1F2DA0B4@webmail.messagingengine.com> <168d9e46ec8.278b.55b9c0b96417b0a70c4dcaded0d2e1c6@anvilwalrusden.com> <CABcZeBOXevwJne3uY0kMFk0b_w0Hx0e9qsHmBK61JdPd2hruBw@mail.gmail.com> <d122cbe2-3ea4-71cb-b4fb-9f90c7aef7d6@cs.tcd.ie>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Priority: 3
Importance: Medium
X-Mailer: Open-Xchange Mailer v7.10.1-Rev7
X-Originating-Client: open-xchange-appsuite
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/gFdrWa6iS4fY_C5ptEUdMtF_iEA>
Subject: Re: [Doh] panel discussion on DoH/DoC
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 11 Feb 2019 13:21:02 -0000

> Il 11 febbraio 2019 alle 12.40 Stephen Farrell <stephen.farrell@cs.tcd.ie> ha scritto:
> 
> 
> Hiya,
> On 11/02/2019 00:16, Eric Rescorla wrote:
>> The general idea would be to have a list of DoH servers (operators, not machines) and then to randomly select one for each client. We haven't decided to do this, so also haven't decided on how we'd implement it :)
>
> I agree that picking one like that is no worse and likely better than round robin or similar, when considering how the DoH servers can affectthe browser user's privacy in "normal" scenarios. I'd guess that the censorship scenario might call for something else though, esp if the selected DoH server becomes unresponsive. Be interested if you've thoughts on that. (Not sure myself what browser behaviours might be best in such failure cases.)

Sooner or later, this will have to be addressed as a much broader architectural issue: the original assumption that all DNS resolvers give the same reply to all DNS queries everywhere to everyone, so it doesn't really matter which one you use, has been false for quite some time already, due to several use cases of which only a small minority pertains to censorship. Should we get back to the original principle - as a centralized/randomized DoH server set would possibly imply - or should we find ways to make localized DNS policies exist and work well?

Ciao,
-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com
Office @ Via Treviso 12, 10144 Torino, Italy

v2.27.6 | Report a Bug | By Email | System Status