Re: [Doh] [EXTERNAL] Re: DoH

["Winfield, Alister" <[e-mail]>]

Top posting on purpose ….

I’ve tried to respond twice to this and I think third time I might get closer to my thinking…

The DoH solution (note not necessarily protocol) is missing at least two key elements which together would have reduced the immediate panic in the implementation. Not to say there aren’t other things that need work just the really problematic issues could be contained or deferred.

The current active work on discovery and somehow defining a trust and privacy mechanism surrounding TRR’s.

With trusted lists of TRR’s you’d then be able to use the output of a fundamentally insecure discovery method. If that ‘trust and privacy’ were to be selectable say by choice of provider. You get the option to allow the local network policy / or not. You can chose to allow trusted coffee shops but others may be not in your list because they do things that ‘you’ don’t like. Parents can chose to trust only those DNS providers that give strong parental controls. Whatever group you are in many things would be less controversial. Oh, it’s not easy but at least we wouldn’t be in the current position where it is almost certain that a sudden change will occur to a keystone of the Internet.

Worst case example is that given the billions of queries per second we are talking about here and the localisation of content delivery it impacts, many terrabytes per second of traffic could / would rapidly migrate to less-optimal CDN’s. The distribution of this might well break networks, sadly there is no research that can reliably work out the full impact. Small trials really don’t help because we already handle small percentages of non-local DNS use. It’s the unknown of what happens if 80% of the users in a single software update change to a non-local DNS provider (especially if it’s one that doesn’t forward granular enough EDNS client-subnet data because ‘privacy’).

I admit that last paragraph may be FUD, but in this case the risk to the stability of the Internet is potentially at stake so largest possible ‘we’ owe everyone a little time exposing the potential issues in detail with any mitigations if they exist. Preparing those who will be impacted for change and then somehow containing the initial  change so if it really does cause hard to contain issues we have a small enough problem its solvable in reasonable timeframes. Anyone who has done operations will tell you that big changes that happen fast are the nightmare you fight hardest to avoid.

One more thing I’ll repeat others warning.. beware unintended consequences this must not end in a fight between networks, or governments and DoH providers. If this goes wrong and corporates and other players decide this is a step too far because of the impacts we all know the outcome could be very messy and I for one would rather work to get a less painful and most likely less privacy impactful result.

NB: Don’t bite I do like the protocol and I agree that there are some that need it to exist.

--
Alister Winfield

From: Doh <[e-mail]> on behalf of Adam Roach <[e-mail]>
Date: Thursday, 28 March 2019 at 19:12
To: "[e-mail]" <[e-mail]>, "[e-mail]" <[e-mail]>, "[e-mail]" <[e-mail]>
Cc: "[e-mail]" <[e-mail]>, "[e-mail]" <[e-mail]>
Subject: [EXTERNAL] Re: [Doh] DoH

On 3/28/19 18:35, [e-mail]<mailto:[e-mail]> wrote:

  *   For the types of home networks you mention, which generally lack professional and dedicated network administrators, DoH does not inherently represent any significant change to the decade-old status quo resulting from publicly-available DNS.

I disagree, there is a fundamental change here.  If / when browsers enable DoH by default...



Yes, and this pertains to product decisions rather than the DoH protocol itself. I tried to make this point in the third paragraph of my response. I apologize if that point was insufficiently clear.
/a
--------------------------------------------------------------------
This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by sending them to [e-mail] as attachments. Thank you
--------------------------------------------------------------------

Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD