Re: [Doh] Seeking input on draft-03

[Justin Henck <[e-mail]>]

I can still see a lot of use cases for allowing discovery with just the
origin, and think it's an important feature to allow both performance
enhancements and drive user adoption:

   - Without the need for additional standards, a client on an HTTP/2
   connection could discover a DNS resolver on that origin and use it for all
   queries related to content on that origin
   - If the certificate frame is adopted, a client could make DNS queries
   to all open connections, to see if they host an origin (preventing
   round-robin DNS from messing up multiplexing)
   - People can configure a bootstrapping-free DNS server with fewer
   variables (IP + origin)
   - People can survey DNS servers, even if the dns endpoint itself is
   access-restricted. This would allow us to track adoption, and though it
   could be used to block servers it could also be used to find ones returning
   non-canonical results.

It may be that .well-known/dns metadata would solve many of these purposes
by being optional, or by only being required to point to at least one
instance; that would account for the desire to host multiple resolvers.

On Fri, Feb 9, 2018 at 4:24 AM Stephen Farrell <[e-mail]>
wrote:

>
> Thanks Patrick,
>
> On 08/02/18 20:24, Patrick McManus wrote:
> > WRT the removal of .wk:
> >
> > * its previous presence had never been meant as a discovery mechanism of
> > the form "I know a hostname, therefore I know the URL". origin is a
> > security primitive for http, but its not an addressing primitive for http
> > services such as a DoH endpoint.. indeed the DoH server might sensibly
> wish
> > to offer multiple URIs on the same host (in the same way some free dns
>
> Fair point.
>
> > providers make a variety of resolution policies available with different
> IP
> > addresses).  The configuration primitive for a DoH server is the URI -
> not
> > origin.
> >
> > * I had originally included .wk as a bit of future proofing for a use
> case
> > not part of the DoH charter (not to enable it, but being sure not to
> > preclude it at a later time). I have been convinced that .wk is not
> > necessary for that - and so it was removed from the draft. I regret that
> > these two things were confused by readers of <= -02 due to my own
> > composition skills (or lack thereof).
> >
> > As to Stephen's query - this was both discussed f2f in singapore and
> > https://github.com/dohwg/draft-ietf-doh-dns-over-https/issues/24 . Of
>
> I read that and it's overall convincing enough for me.
>
> I do also wonder about the point raised there about doing surveys of
> doh deployments - as one poster (willscott) said though, I'm not sure
> if I think enabling that is a good thing or not. (The downside being
> that censors discover deployments too.) I'd not argue that's reason
> enough to retain well-known in the draft.
>
> Cheers,
> S.
>
> > course there hasn't been consensus declared on the issue - the editors
> are
> > just trying to make the newer drafts as closely aligned with the group's
> > discussion as we can manage as part of the proces> -P
> >
> >
> > On Thu, Feb 8, 2018 at 2:56 PM, Stephen Farrell <
> [e-mail]>
> > wrote:
> >
> >>
> >>
> >> On 08/02/18 18:05, Ben Schwartz wrote:
> >>>
> >>> One important difference is that draft-03 no longer proposes a
> >>> ".well-known" entry.  In draft-02 and prior, clients could check for
> the
> >>> presence of a DOH service at the default path, given only the domain
> name
> >>> of a server.  In draft-03, there is no default path, so clients must be
> >>> configured with the full URL of the DOH endpoint.
> >>
> >> Apologies if I'm forgetting a thread where this was discussed,
> >> but what's the reason for dropping .well-known? (If there is a
> >> thread, a pointer to that is a sufficient answer.)
> >>
> >> Thanks,
> >> S.
> >>
> >> --
> >> PGP key change time for me.
> >> New-ID 7B172BEA; old-ID 805F8DA2 expires Jan 24 2018.
> >> NewWithOld sigs in keyservers.
> >> Sorry if that mucks something up;-)
> >>
> >> _______________________________________________
> >> Doh mailing list
> >> [e-mail]
> >> https://www.ietf.org/mailman/listinfo/doh
> >>
> >>
> >
>
> --
> PGP key change time for me.
> New-ID 7B172BEA; old-ID 805F8DA2 expires Jan 24 2018.
> NewWithOld sigs in keyservers.
> Sorry if that mucks something up;-)
> _______________________________________________
> Doh mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/doh
>