Re: [Doh] [Ext] Are we missing an architecture? (was Re: DNS Camel thoughts: TC and message size)

[Mukund Sivaraman <[e-mail]>]

Hi Patrick

On Wed, Jun 13, 2018 at 02:59:01PM -0700, Patrick McManus wrote:
> > DoH is not even an RFC yet and there has been an announcement from
> > Mozilla that by default all its DNS queries will be sent to Cloudflare
> > via DoH, and this is the default behavior that's all within the Firefox
> > application. Is anybody else concerned about the Firefox DoH
> > announcement?
> >
> >
> You are overstating the announcement greatly. We're running some fairly
> small experiments to see how this works. It has gotten a bit more publicity
> than something at this scale normally does because its important to let
> impacted users know how their data flow is changing - that's all. I hope it
> makes for a better protocol.
> 
> This is part of the process of data driven decision making. sometimes known
> as running  code - and it makes for successful protocols when the IETF does
> it right. I'm happy to say that open standards are an important part of our
> mission and we're confident that we won't accidentally create defacto
> standards from Internet Drafts - that's something we think carefully about
> and have done well managing with HTTP and TLS over the last few years (of
> which we have shipped dozes on draft versions to much bigger populations in
> service of creating the final consensus product) and I'm confident we'll be
> fine aligning with the final DoH as well.
> 
> on the other hand, as I've told the HTTP WG on many occasions: this forum
> is for open standards, its not the room I make product specific decisions
> in (nor would I expect other participants to negotiate their product
> decisions with me).

The questions aren't about Firefox explaining its decision or its usage
of protocol. The questions are about DoH enabling this, what its purpose
is. Until this announcement, I used to view DoH as a way to make DNS
service available where existing secure stub->resolver protocols such as
DNS over TLS and dnscrypt don't work. It seems DoH may be used as the
means to bypass traditional DNS completely, where answers are not
obtained via the system configuration of stub. It may be justified (and
surely this is possible using traditional DNS as well), but let's see
some descriptions of how DoH is expected to be used. On re-reading the
charter, it appears someone had thought about all this which isn't
apparent on a naive reading.

It would help participation, get to more consensus if the usage patterns
are better understood.

		Mukund