Re: [Doh] [Ext] Re: Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh

[Paul Hoffman <[e-mail]>]

On Jan 29, 2019, at 6:48 AM, Stephane Bortzmeyer <[e-mail]> wrote:
> In the current draft, I have a big concern about the idea of an
> application (for instance the Web browser) having a specific DNS
> resolver (section 5 of draft -07), different from the rest of the
> applications on the same machine.

If you have this concern, you need to bring it up with the browser vendors, not with this WG. I have been informally told that both Firefox and Chrome have them (but I have not checked).

> It will be a nightmare to debug DNS
> issues with such a setup. We cannot prevent people for doing bad
> choices like this one but we should not condone it in a RFC.

You first have to have the discussion of whether or not this is a bad choice. There will likely be differing opinions. That is, I suspect that the browser vendors didn't spend the time and effort to put them in just for fun: they felt a need. I totally understand that this will cause debugging to be more difficult, but that is true for a lot of things added in modern browsers.

> IMHO, the
> correct setup is a shared DoH client, running on the local machine
> (stubby, systemd-resolve, etc) or on the CPE.

...and yet there is no indication that such a thing exists today, nor is planned by any of the OS vendors.

(Side note: given how crappy CPE software is consistently shown to be, I am horrified that you suggest to put anything there in the same message where you talk about "nightmare to debug".)

> [This is a purely technical issue, different for the more political
> one raised by Bert Hubert.]

It has the same effect, however. If a user is smart enough to have an opinion like "I trust my {browser|OS} vendor more than my {OS|browser} vendor", some will pick one and some will pick the other.

--Paul Hoffman