Re: [TLS] access_administratively_disabled v2

[Stephen Farrell <[e-mail]>]

On 04/01/18 14:22, Eric Rescorla wrote:
> I am not in favor of this change at this time.

Same here.

> 
> I suspect I'm not in favor of the mechanism, but i'm definitely not in
> favor of
> adding a placeholder alert for some mechanism which isn't specified.

I'm fairly sure I'm against attempting to handle captive
portal issues at the TLS layer. Any changes to TLS needed
for captive portals ought really garner consensus within
the capport wg and then be discussed here. (It looks from
the archive of that wg that this topic hasn't even been
raised there despite a few people suggesting that, which
is IMO another reason to reject this proposal now.)

I don't find the more-transparent-censorship argument
offered convincing. If DNS-based censorship is offered as
the motivation (as opposed to or in addition to captive
portals) then I think that'd require chatting with the
dnsop folks, who are already discussing DNS-RPZ. I'd guess,
(but not sure as it's not my fav. idea;-), that might throw
up a requirement that censorship might only be done for a
few minutes while some previously unseen name was checked
out, or a name might be censored for days or weeks, if it's
newly registered and some censor considers that a threat.
IOW, if any changes to TLS are warranted based on DNS-based
censorship, then those are likely more complex than has
been seen in this discussion, and also aren't things where
this list has the right expertise AFAIK.

S.

-- 
PGP key change time for me.
New-ID 7B172BEA; old-ID 805F8DA2 expires Jan 24 2018.
NewWithOld sigs in keyservers.
Sorry if that mucks something up;-)