From nobody Wed Jul 3 09:25:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADBCD1202A1 for ; Wed, 3 Jul 2019 09:25:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 10DPruCwzPvh for ; Wed, 3 Jul 2019 09:25:09 -0700 (PDT) Received: from mail.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CBAA012028C for ; Wed, 3 Jul 2019 09:25:09 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 3 Jul 2019 09:25:08 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.004; Wed, 3 Jul 2019 09:25:07 -0700 From: Paul Hoffman To: "add@ietf.org" Thread-Topic: Pre-meeting discussion? Thread-Index: AQHVMbvgvQElUs1nUUu27ijS23SUmw== Date: Wed, 3 Jul 2019 16:25:06 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="utf-8" Content-ID: <1770DBD735E5D640934FB9A3F2A9BA31@pexch112.icann.org> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: [Add] Pre-meeting discussion? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jul 2019 16:25:12 -0000 SW4gdGhlIGhvcGVzIG9mIG1ha2luZyBvdXIgZmFjZS10by1mYWNlIHRpbWUgbW9yZSB1c2VmdWws IEkgcXVvdGUgZnJvbSB0aGUgQm9GIGRlc2NyaXB0aW9uIGF0IDxodHRwczovL3RyYWMudG9vbHMu aWV0Zi5vcmcvYm9mL3RyYWMvd2lraT4uDQoNCj09PT09DQoNCkFzIGRlcGxveW1lbnQgb2YgbmV3 IEROUyB0cmFuc3BvcnRzIHN1Y2ggYXMgRE5TIG92ZXIgSFRUUFMgKERvSCkgYW5kIEROUyBvdmVy IFRMUyAoRG9UKSBwcm9ncmVzc2VzIGFuZCBtb3JlIGtpbmRzIG9mIGFwcGxpY2F0aW9ucyBkbyB0 aGVpciBvd24gRE5TIHJlc29sdXRpb24sIHRoZXJlIGlzIGluY3JlYXNpbmcgaW50ZXJlc3QgaW4g b3BlcmF0aW9uYWwgaW1wbGljYXRpb25zIGFuZCBpZGVudGlmeWluZyBwb3RlbnRpYWwgZnVydGhl ciB3b3JrIHRoYXQgd291bGQgYmVuZWZpdCBETlMgb3BlcmF0aW9ucyBhbmQgYXJjaGl0ZWN0dXJl IGFjcm9zcyBhIHZhcmlldHkgb2YgbmV0d29yayBlbnZpcm9ubWVudHMuIFRoaXMgQk9GIHdpbGwg c2VlayB0byBpZGVudGlmeSByZWxhdGVkIHdvcmsgaXRlbXMgd2hlcmUgZnVydGhlciBwcm90b2Nv bCBzdGFuZGFyZGl6YXRpb24sIGJlc3QgcHJhY3RpY2VzLCBvciBndWlkYW5jZSBjb3VsZCBiZSB1 c2VmdWxseSBkb2N1bWVudGVkIHZpYSB0aGUgSUVURiBjb25zZW5zdXMgcHJvY2Vzcy4NCg0KQWdl bmRhCQkNCuKAoiBBZ2VuZGEgYmFzaGluZyAoNSBtaW5zKQ0K4oCiIEN1cnJlbnQgZmFjdHVhbCBz dGF0ZSwgZXhwZWN0ZWQgdHJlbmRzIGFuZCBjb25jZXJucyByZWxhdGVkIHRvIGFwcGxpY2F0aW9u cyBkb2luZyBETlMgcmVzb2x1dGlvbiwgYW5kIGFyZWFzIHdoZXJlIHdlIGFsbCBoYXZlIGNvbW1v biBpbnRlcmVzdCBpbiBmaWd1cmluZyBzdHVmZiBvdXQuICgyMCBtaW5zKSANCuKAoiBQb3RlbnRp YWwgYXJlYXMgZm9yIGZ1dHVyZSBwcm90b2NvbCB3b3JrLCBiZXN0IHByYWN0aWNlcywgb3IgZ3Vp ZGFuY2U6DQoJ4oCiIFNlcnZlciBkaXNjb3ZlcnkgKDE1IG1pbnMpDQoJ4oCiIEV4cHJlc3Npb24g b2YgcmVzb2x2ZXIgcG9saWN5ICgxNSBtaW5zKQ0KCeKAoiBTdXBwb3J0aW5nIHNwbGl0LWhvcml6 b24gKDE1IG1pbnMpDQrigKIgRGlzY3Vzc2lvbiAoMTUgbWlucykNCgnigKIgT3ZlcmxhcCB3aXRo IGV4aXN0aW5nIGNoYXJ0ZXJlZCB3b3JrIGluIERQUklWRSwgRE9ILCBhbmQgRE5TT1ANCgnigKIg RXhwcmVzc2lvbnMgb2YgaW50ZXJlc3QgaW4gd29ya2luZyBvbiBzcGVjaWZpYyB3b3JrIGl0ZW1z DQoNCj09PT09DQoNClRoZXJlIGFyZSBhIGxvdCBvZiBpbnRlcmVzdGluZyB0b3BpY3MgdGhlcmUu Li4NCg0KLS1QYXVsIEhvZmZtYW4= From nobody Wed Jul 3 12:41:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72D78120447 for ; Wed, 3 Jul 2019 12:41:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GdKJu3M4oE3U for ; Wed, 3 Jul 2019 12:41:20 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [213.121.35.75]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89C7F12046C for ; Wed, 3 Jul 2019 12:41:19 -0700 (PDT) Received: from tpw09926dag08e.domain1.systemhost.net (10.9.202.35) by BWP09926080.bt.com (10.36.82.111) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Wed, 3 Jul 2019 20:41:16 +0100 Received: from tpw09926dag14h.domain1.systemhost.net (10.9.212.38) by tpw09926dag08e.domain1.systemhost.net (10.9.202.35) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 3 Jul 2019 20:41:16 +0100 Received: from bwp09926081.bt.com (10.36.82.112) by tpw09926dag14h.domain1.systemhost.net (10.9.212.38) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Wed, 3 Jul 2019 20:41:16 +0100 Received: from GBR01-CWL-obe.outbound.protection.outlook.com (104.47.20.52) by smtpe1.intersmtp.com (10.36.82.112) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Wed, 3 Jul 2019 20:41:14 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/h19FXtqgSRJ0ZF5k+6GMqHWJ8PX7kzc+3XAmR9csZk=; b=eVK47PUXZuHS6D7I5b3NXCewzsoSoPWMwT4YkXkLgqhHY9wJdCKpzFeLk2lG9uATy8EuYN5dH3Dlcss2tXwo4gmIHJHL8K9bc4XHOJKC49BtqeVlFX11d0pyX39bwI9bMDow4guSldr2ecaA582Pul+Vf0u5U4EalGDqKdo7WHY= Received: from LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM (20.176.157.213) by LO2P123MB2560.GBRP123.PROD.OUTLOOK.COM (20.176.157.211) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2032.20; Wed, 3 Jul 2019 19:41:15 +0000 Received: from LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM ([fe80::45ad:5e82:d9e6:9d43]) by LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM ([fe80::45ad:5e82:d9e6:9d43%5]) with mapi id 15.20.2032.019; Wed, 3 Jul 2019 19:41:15 +0000 From: To: Thread-Topic: Thoughts on a DoH (and DoT) BCP? Thread-Index: AdUx1uEEFvBhHUWqSHedXSRbiDMGgg== Date: Wed, 3 Jul 2019 19:41:15 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.fidler@bt.com; x-originating-ip: [193.113.48.9] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 917e9bc9-8f53-4452-ed4a-08d6ffee6945 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P123MB2560; x-ms-traffictypediagnostic: LO2P123MB2560: x-microsoft-antispam-prvs: x-antispam-2: 1 x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 00872B689F x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(376002)(39860400002)(396003)(136003)(346002)(366004)(199004)(189003)(6116002)(3846002)(7696005)(790700001)(68736007)(186003)(26005)(5640700003)(25786009)(99286004)(54896002)(6306002)(6436002)(14454004)(2351001)(33656002)(256004)(53936002)(66066001)(102836004)(14444005)(5660300002)(66476007)(66556008)(236005)(6506007)(55016002)(9686003)(86362001)(66946007)(2501003)(73956011)(316002)(486006)(6916009)(66574012)(64756008)(74316002)(76116006)(8936002)(8676002)(66446008)(52536014)(71190400001)(71200400001)(478600001)(81166006)(2906002)(476003)(1730700003)(81156014)(7736002); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P123MB2560; H:LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: bt.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 8ppq4bEY9SD5R+wT8CyReeyOH30KO1tE5K4zNsfmqMygEJ7h+CPZfbbxVO9h4r3TYtb6WoLZxaFIIMdn3xqBP7wNbAkRFUHwIfTUGzw6w1dV14yxCaziohof9a6cog7CZjGkU0TIVTkrrjF/Os25tPxX53+zT2DhJac6/h75eh8roGzlG5We9QWwuAWCRKjZpbvg8Pbge8N3Z5ssdJ13buthQdcnLYW3/HlJGE065FXXO7VHuxYofVNy5X0ac8z6SJ4cxaICJOnsZac4LVqpVSTm7vlc4nqcpD/auOjFC295GqLlht0leAcF0HhRSab85VDuf6pIJGFbvAWs4XDjOhThtHW/ssrYfejlbbRfxHGCYzpJ+ucanyqwRZZyRhQCH7wTFOs7oQi9/CbzIVVLRD9IW5gGU7rL20n290TcYCs= Content-Type: multipart/alternative; boundary="_000_LO2P123MB2462DEB5330C313055D62CC396FB0LO2P123MB2462GBRP_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 917e9bc9-8f53-4452-ed4a-08d6ffee6945 X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Jul 2019 19:41:15.2084 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a7f35688-9c00-4d5e-ba41-29f146377ab0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.fidler@bt.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB2560 X-NAI-Spam-Flag: NO X-NAI-Spam-Level: X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0.7 X-NAI-Spam-Report: 5 Rules triggered * 0.6 -- TS_MSG_REP_20 * 0.1 -- THREAD_INDX_INVALD_VAL * 0 -- EDT_SDHA_ADR_FRG * 0 -- EDT_SDHA_DMN_FRG * 0 -- RV6582 X-NAI-Spam-Version: 2.2.0.9309 : core <6582> : inlines <7115> : streams <1826306> : uri <2863411> X-OriginatorOrg: bt.com Archived-At: Subject: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jul 2019 19:41:23 -0000 --_000_LO2P123MB2462DEB5330C313055D62CC396FB0LO2P123MB2462GBRP_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable There are many challenges facing enterprise and internet service provider /= operator networks that intend to deploy and operate DoH (and DoT) resolver= services. The IETF should consider developing a BCP which documents these = concerns and provide appropriate guidance. Some of these issues include: - server performance & measurement considerations - network performance, capacity and resilience planning - impact on existing infrastructure: load balancers, captive porta= ls, NAT, proxies and on-net content caches/CDNs - CPE provisioning - first connection set-up - CPE DoH proxy and certificate options - Interactions between applications and OS/Kernel DNS settings - providing DoH and DoT services in split DNS environments - authentication requirements for DoH and DoT resolvers - management of TLS sessions at DNS query rates - ticket duration,= restarts, etc. - minimising TLS overheads for DoT and DoH traffic - protection of application-specific DoH and DoT resolver configur= ation I'd be willing to work on a BCP on this topic. Is anyone else? What other k= ey issues should be considered? Andy Fidler andrew.fidler@bt.com This email contains information from BT that might be privileged or confide= ntial. And it's only meant for the person above. If that's not you, we're s= orry - we must have sent it to you by mistake. Please email us to let us kn= ow, and don't copy or forward it to anyone else. Thanks. We monitor our email systems and may record all our emails. British Telecommunications plc R/O : 81 Newgate Street, London EC1A 7AJ Registered in England: No 1800000 --_000_LO2P123MB2462DEB5330C313055D62CC396FB0LO2P123MB2462GBRP_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

There are many challenges facing enterprise and i= nternet service provider / operator networks that intend to deploy and oper= ate DoH (and DoT) resolver services. The IETF should consider developing a = BCP which documents these concerns and provide appropriate guidance. Some of these issues include:=

-       = ;   server performance & measurement considerations=

-       = ;   network performance, capacity and resilience planni= ng

-       = ;   impact on existing infrastructure: load balancers, = captive portals, NAT, proxies and on-net content caches/CDNs

-       = ;   CPE provisioning - first connection set-up

-       = ;   CPE DoH proxy and certificate options

-       = ;   Interactions between applications and OS/Kernel DNS= settings

-       = ;   providing DoH and DoT services in split DNS environ= ments

-       = ;   authentication requirements for DoH and DoT resolve= rs

-       = ;   management of TLS sessions at DNS query rates - tic= ket duration, restarts, etc.

-       = ;   minimising TLS overheads for DoT and DoH traffic

-       = ;   protection of application-specific DoH and DoT reso= lver configuration

 

I’d be willing to work on a BCP on this top= ic. Is anyone else? What other key issues should be considered?<= /p>

 

Andy Fidler

andrew.fidle= r@bt.com

This em= ail contains information from BT that might be privileged or confidential. = And it's only meant for the person above. If that's not you, we're sor= ry - we must have sent it to you by mistake. Please email us to let us know, and don't copy or forward it to anyone els= e. Thanks.

We monitor our email systems and may reco= rd all our emails.
British Telecommunications plc
R/O : 81 Newgate Street, London EC1A 7AJ
Registered in England: No 1800000

 

--_000_LO2P123MB2462DEB5330C313055D62CC396FB0LO2P123MB2462GBRP_-- From nobody Wed Jul 3 13:47:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99A611200DB for ; Wed, 3 Jul 2019 13:47:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MPLjZLu2HrAf for ; Wed, 3 Jul 2019 13:47:12 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5ED51200C7 for ; Wed, 3 Jul 2019 13:47:11 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id BF3A2BE7B; Wed, 3 Jul 2019 21:47:09 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fytpE0G3EoYS; Wed, 3 Jul 2019 21:47:08 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 22904BE79; Wed, 3 Jul 2019 21:47:08 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1562186828; bh=M+0bjIchOI7zrlDSrXQ492TxiLcRXeOBducZwSwOMek=; h=Subject:To:References:From:Date:In-Reply-To:From; b=zsu88pYzis1tAAbu61oRTlDO2O9RuEmB99Pogm6KMk6qlQnwD0btECmMvDp7wxrSo KqRqXdsr+KmeMmGrs9zihjsOpHzGFzvUvisEmIjphq4oY5gXqTgUvZcu7pv6vIkWC3 YtG7CJCAyzqntE6C2GFXuPA1dsXxJd/b+6kn2cJw= To: andrew.fidler@bt.com, add@ietf.org References: From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <04438640-16bf-3f73-4048-e5a10c34bfb5@cs.tcd.ie> Date: Wed, 3 Jul 2019 21:47:07 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="QB9hhwpmtvgMvw8bXVyjeegwZfVosOvSb" Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jul 2019 20:47:15 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --QB9hhwpmtvgMvw8bXVyjeegwZfVosOvSb Content-Type: multipart/mixed; boundary="4fyRPSwhAdnTKmKxnWVQz7NlGFP1IT6TY"; protected-headers="v1" From: Stephen Farrell To: andrew.fidler@bt.com, add@ietf.org Message-ID: <04438640-16bf-3f73-4048-e5a10c34bfb5@cs.tcd.ie> Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? References: In-Reply-To: --4fyRPSwhAdnTKmKxnWVQz7NlGFP1IT6TY Content-Type: multipart/mixed; boundary="------------BB10F98572435B226C481897" Content-Language: en-GB This is a multi-part message in MIME format. --------------BB10F98572435B226C481897 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 03/07/2019 20:41, andrew.fidler@bt.com wrote: > There are many challenges facing enterprise and internet service > provider / operator networks that intend to deploy and operate DoH > (and DoT) resolver services. The IETF should consider developing a > BCP which documents these concerns and provide appropriate guidance. I think there are definitely things to figure out such as those you list below and maybe more. I figure the upcoming BoF would be a real success if we could identify a subset of those on which both people who like, and people who dislike, DoH/DoT wanted to work. E.g split horizon seems to me to be an area where we have common interests in figuring something out regardless of one's opinions of DoH/DoT or ADD more generally. FWIW, I (not very confidently;-) suspect it may be that breaking the putative work into such chunks and prioritising those where we guess progress can be made in the IETF may be more effective than trying to develop one BCP to cover all the issues. Some of the issues don't really seem to me to be such that we could get to rough consensus in the near-term - but maybe a bit of working on easier stuff, together with however things outside the IETF evolve, could change that over not too much time. Cheers, S. > Some of these issues include: >=20 > - server performance & measurement considerations >=20 > - network performance, capacity and resilience planning >=20 > - impact on existing infrastructure: load balancers, captive > portals, NAT, proxies and on-net content caches/CDNs >=20 > - CPE provisioning - first connection set-up >=20 > - CPE DoH proxy and certificate options >=20 > - Interactions between applications and OS/Kernel DNS > settings >=20 > - providing DoH and DoT services in split DNS environments >=20 > - authentication requirements for DoH and DoT resolvers >=20 > - management of TLS sessions at DNS query rates - ticket > duration, restarts, etc. >=20 > - minimising TLS overheads for DoT and DoH traffic >=20 > - protection of application-specific DoH and DoT resolver > configuration >=20 >=20 >=20 > I'd be willing to work on a BCP on this topic. Is anyone else? What > other key issues should be considered? >=20 > Andy Fidler andrew.fidler@bt.com >=20 > This email contains information from BT that might be privileged or > confidential. And it's only meant for the person above. If that's not > you, we're sorry - we must have sent it to you by mistake. Please > email us to let us know, and don't copy or forward it to anyone else. > Thanks. We monitor our email systems and may record all our emails.=20 > British Telecommunications plc R/O : 81 Newgate Street, London EC1A > 7AJ Registered in England: No 1800000 >=20 >=20 >=20 --------------BB10F98572435B226C481897 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------BB10F98572435B226C481897-- --4fyRPSwhAdnTKmKxnWVQz7NlGFP1IT6TY-- --QB9hhwpmtvgMvw8bXVyjeegwZfVosOvSb Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0dFEsACgkQWrL68XsX K+r3jxAAkxZzKrfDVtqGL+iEq3GLCf8XcHYV9aw1zqvnnj96R/N4LUFjMkKPn7yU h7A7miF4qxb0CcOh4RxTy0vOV3SPvMVH9je9cjqbaFszw3Nd61NW2I4oM39NoaY9 AwR7PWvlw/Z6cLTSO8nJOmirUpXYWoe4fp4sU2AENz5QTvHNkwdYw0o6l5yTgnMp +SOjo2zfsozJ1TU+LO3AHd4VjdsOZg97qlquNdugPOodIE3sTOBN9gxB9h0rlnPB PLrwjJTz5Bccfw+ovHELButvQlG+xdCwVmNkp/L6STP4vFNrwSz3NYi9cEd/H0cV OnoSmOH6+dWI9Vg6SevxXXCGhwbMphy1I7t/mjG0Ra1XFIb6i/SldpWHwz2jgbme 21h/NDuu+5l+vZ4PYBAGTFb5MrF3DGRJgoUA5syYOQEnTqISJ1GlGnjujmN0lkXK v9cv1cKfzJbZvw2/qLQBDtUcMI5AKJ63R3RUE7Ghk2x15Pf4FcSxd4G7KlwNI9nr c9kbgEcV3z7COyTrAt/N080C4LNgaR+t316AeXw3Bz+YceGEFDDjH8wkoJiSuTN0 zgJGocQiYzo+U6solWl6b7VykAQPNpv0s1QRCelCO1XZsEnSGubJO5P6CaC/I2o/ lpu1qdqh6TV6I3T2nwDuZHBX5oW08o7lv+Eizbvvsir+7MGs9NY= =eWAj -----END PGP SIGNATURE----- --QB9hhwpmtvgMvw8bXVyjeegwZfVosOvSb-- From nobody Thu Jul 4 07:29:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D30771200EB for ; Thu, 4 Jul 2019 07:29:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=innovationslab-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Ay-YumM4U7M for ; Thu, 4 Jul 2019 07:29:20 -0700 (PDT) Received: from mail-qt1-x829.google.com (mail-qt1-x829.google.com [IPv6:2607:f8b0:4864:20::829]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8F3A12007A for ; Thu, 4 Jul 2019 07:29:19 -0700 (PDT) Received: by mail-qt1-x829.google.com with SMTP id z4so4696820qtc.3 for ; Thu, 04 Jul 2019 07:29:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=innovationslab-net.20150623.gappssmtp.com; s=20150623; h=subject:to:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to; bh=RvRAVIRvlM2o8RqSRBORxkuebNugQBotZ6wy3E/n7jU=; b=BQuaP8JC38dn9NTFHBqzUTslV9qjIw86KcTHGXoHWj8gBEDb6GOLp4J7OW63oIJ3/I JTj3MTz4YR/eQciP8pKYOPh0pXA5iX+DV9TE3mEv5MhHaqXDWGCOJaSmwKFsbzIo3WKN VqcjHNV6pR8VcDDXZpfvzZ2F+X5b2f1LT6DPwi/PZ5WULN329AfDHpttRUsBKbidQbYD vmpyHlfnoO0lnoSy0EC3UqcLgRXsYW2SZxodfjcK8j2MmmLlX8zFo7xJTzwXFjM2rc2A bBy7ElZjS1D0bhTSVUDxSILBokbBMmZcgNscNMuJL5Ce9bo0UzUxTyc3FI3zLnfix9l8 wZxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=RvRAVIRvlM2o8RqSRBORxkuebNugQBotZ6wy3E/n7jU=; b=iAA6b0WVL+aG14Ja0qvmqfCdzlwyBt6IJL4Z2drVg2MZrUr5j+Y5SPVOOQjo8R1JB+ rTsv/KK3qKeGxiB5N58Kgya4YID+GB9cGHwICyL8C7TvamvMIId5nUdc6/PrkAHPdWpL te0RqpHvSy1J40JWZjlvQxF9VhublJRBxzNmmOFnjH4UpDnPPwd7pBSFplFLHXMU9KGc K9SCMhB2U5M4kZcVEe1m6HNITE+foFsa4vxqQ2l84zTerLLJrTIpaJDBQ3r/9dRrLLB/ xkuP2egD1emOORKCm6lExAP/g+vpzikHoVYZToTab3mSF0XdYyklxU/mQUPV0TGFMNzN 5xbQ== X-Gm-Message-State: APjAAAXrX99p+avUBeX/Smpo944gTHNO9Y5x55loIDyCSVTApPA0ABKP M72CRTnxcCWasmcsP23gp2UErCMcwUU= X-Google-Smtp-Source: APXvYqzD8CBAU/ojUf0UO7/2YBXvEEZzYdap6XyTNzfbGb6P7yWBbOkZZGdMcN/T540aY9bMUqUdXw== X-Received: by 2002:a0c:ad76:: with SMTP id v51mr38082095qvc.232.1562250558619; Thu, 04 Jul 2019 07:29:18 -0700 (PDT) Received: from LakeHartwell.local ([2601:154:c001:f99e:9409:2fe8:da3a:7a0a]) by smtp.gmail.com with ESMTPSA id v7sm2415050qto.91.2019.07.04.07.29.17 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 04 Jul 2019 07:29:17 -0700 (PDT) To: add@ietf.org References: From: Brian Haberman Openpgp: preference=signencrypt Autocrypt: addr=brian@innovationslab.net; keydata= mQINBFm5KgYBEACs2icafejrG19L5DRNFq8Q2O+K+LRxjR4qAElZDnXFXNA2ipFWPeT0J2wa KJ+h9UdfhDm8DzULB553CYm+Q3XF1N56TglkIRMZYc7mYXZEr3x7e4fmX4kD4qMjBLG8cL26 rEe3Q0qaiMGY69/4o5coVMT0qmHjgCH1tkG+L2Y8MKr1gFxS18eO8MVoWe1yDKuyxFSElHGB 3mZn4gcqeCaemPGG3CiVNlp4KnijpNcSgvseXbkQEA4IXEsIvUL8MIwOTXg9Gh5cbtisZpuf +4B0LNMUSqWlqyKd9M3KCMj+dW4vsFytc00Z+GyQ+ArOR9GwTdAwJ5qqVODTvbjKqOR1zolJ 1JxLUtSiv7Lx5x2OrCexPYXkzlTkjG9Imtg2XNh55R/JKMC3KU1NQL3nS9tJXeoRWNgWSZrG MsrbeejbqLVb9LblXNpgLciJ96XHMvYAXX7p4LAwivzSRrVg46vErYIAV6EvDvwVENWW8JCU 0vX5iTGfkEwU4KxCa7WAmmD8yiNspHP1J0uk93Sta5K0PuTi7b+EZlCjdrqOEWLGPv6qXlIu FwLLcCaDs3XdVvwgNM+UFRxFH1aOVQQKCiCOCcNlwgYG1u4ZbD2T6hd/d2tOAKu/MNnQVF7d Cfi2BtSjzglLcY61e37zqTM04BgU+LniZ7V99yneM6DM2UzgkwARAQABtClCcmlhbiBIYWJl cm1hbiA8YnJpYW5AaW5ub3ZhdGlvbnNsYWIubmV0PokCQAQTAQoAKgIbAwUJB4YfgAULCQgH AwUVCgkICwUWAgMBAAIeAQIXgAUCWbkqSAIZAQAKCRBo1jycU9GLYQixD/9UX0uiAvbJ+4dK z3Ne3kUdDK0Lk73RGfFgE/ezsc9I6ED82h+arC8pAoDnBWgzTxugZdbexek983bgMq02XFsG pJf7hudeKnB8UmtjTc0j1UUgi129FYyBmINS2Lz1gpEOygFfbeOGLJK5qZJwD3I3O6yN8SUZ uwahXXd1aEB+d1eGhNqxkjQ+L7vdfTlN662GWog3ROMwUbrg0+QAbn/Vlp2iIYO6VERUZ9Yr GfFJX9b9LKa6AHxzAaqFIix1h2wBiIacpIBGU/4+3+wL5zkCbGSRzoIHW8srllj7ehgwwfNx QevibuZWJ4XpHpIxrtsmBO7ERFk8pN7oiQ9M3b2Cg9OBD5vgxyMCHEKIblWyKz8GLtz5357L ORU1EBWB8BoJPBHz3u7bZE+jH9+w5PpI087Ae78KCDkTNj7o2wbkRoYLmLpMo8DOwAumyy5R 2DuRu0cn5Rw5pFjlJkyfM0Wf80Ml/SINrUORWeqSbsHSX8i+Y0Oyt5JNo9NFbgN0Gn/Qo364 I8cLgbvUAyFHwhnmbHB+QXFCGAy73NOQ+g2fCRPeSbihhYa34ugfmd4oa6W2w805ixzM7iGr P+wDB1dhA7eHKVmoo9Kxvm9VzU+2homYGEROd/H6n0BMvWtp1oFh/JvEgZN6dVLg3p+XX5Zj Ggy568bIY4P5kP7pAxh017kCDQRZuSoGARAAtCWxW1cRne/iGbFuibvB8d3upcbCB7oz4LWk LSE20Db2ymn04ici9V+wBSWX57me5jQdwMi/gzVVZcupbzWTg5Yhv7Qt7CKORJLEKo6nULbb 4aEpdOXD9s7wwx+foFjzjtDOH/JYoB+OEe2oW39VmK6EsIx7ClsLf6+cih5yApZHtmV+2M3J YSxD2kCUE619ITFLAkMf203ap5vJ6DDaaKnVoNhF9qV7jlJEceGqHTBG4KkBX/zNCehMIfhr ViY/B2IWAHeuZ99lnCPx2mehGGa4XLjQauUkY9KB7dOq/ODyt+7SL0dfWrOVf3BnU3C308b4 9YdId8KI4dJ30nfXn6ifTK9STZHZE+Mt1sIVmtEguqMXEk/axZmT14x194c7ZPmU/uCQTE3U y1NFs4Yof50WF1ze0CyN2ycmqx11mHjP5+L23TqcdIWmJG+EtdHUAFpu42kbB0fML3Oc/cEU SmWK3WpF5YPljLM2gyh3RXjuiBnaGoJaKTOj5zXQ2G2l3/ijbn9FbqmFup+R352dxUyakXEP xNe3HdyjfyUcy/RJNeZz/lgUIhkxWQjOOU1RIN41RtCKcF9tJjMwgQvI51QmPvf90/6ab3I/ vwEpjlRb4AbuWfPWe89J+Z3TG97V9sntlMcQ6MGiPLbyFpiXIf2150e6FxZdJtipVwY2d/kA EQEAAYkCJQQYAQoADwUCWbkqBgIbDAUJB4YfgAAKCRBo1jycU9GLYfy0EACYrxb4nWtOnIu0 N7rXXo/0ZjaBTyUhJ6hzy2D7rt3vv/qj2ui+N21ui/yMDS928za/XRfP25qN9A1puioHqN4l SAsxwCC3mT9GJXVXVgivg3MeciqBXoOdnk1hUkP1CTKL3qZ9pSuw8bPlNE7+b1xF7Oce37YH +QRVmBXbGwTxtDTCZ9Js0/IpiUtg9QCfmryB1r/fD0TFb8b9aCBuVeKocWSuX9UXRt7zRGM8 BJwOLvdLdGvV8us1imlBKFLai4L8CPgihuc/s7ZB0r3pgW697hXScWhGHF3OUWbPFVkNyivM xtDcq+9ZlUMrxFbwUEABi8NFwvzwn+YJQqlrPiF4xxsScYpnIlfWEuP6Vpp6Z/u5x+1MNyZb oxNWWaevMVeo3tdRV9F6/YFqucw4JQ9HqlCKQ62sW9+e5SSlxGNlV4j9cchG6a4fAZqxL+pS ks+KitK3ap/R4RUG+nbjLlhCwGJIti8lxvdYAoPqjtwEUmMJv4dIl0/2h1495cwBIi7XeRKZ Rx38TV3G3LCx0J8dFhkyTG5TxUZQFgHjznkIX7bzeSQX72MxT0b/tc38yM71WpAgAY+MlHCT FQRKqIQsH/4MFir+g/oV2uPNGwmg0QEOnv9zZ79JJ/nBmuXC2RwUVTtZgtiZXhaP0afvR0eg WPEzptIZZCSmtBOOYkfsAw== Message-ID: <2ab90a6a-dd40-b7a0-b380-4dcbd657c89c@innovationslab.net> Date: Thu, 4 Jul 2019 10:29:15 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="l2KUDlOKJSgL4vFWHvqAHU4swENrJ3bsX" Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jul 2019 14:29:22 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --l2KUDlOKJSgL4vFWHvqAHU4swENrJ3bsX Content-Type: multipart/mixed; boundary="15nDjEtRZqgfyu4VV9Kyr5dsssA42VfOT"; protected-headers="v1" From: Brian Haberman To: add@ietf.org Message-ID: <2ab90a6a-dd40-b7a0-b380-4dcbd657c89c@innovationslab.net> Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? References: In-Reply-To: --15nDjEtRZqgfyu4VV9Kyr5dsssA42VfOT Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 7/3/19 3:41 PM, andrew.fidler@bt.com wrote: > There are many challenges facing enterprise and internet service provid= er / operator networks that intend to deploy and operate DoH (and DoT) re= solver services. The IETF should consider developing a BCP which document= s these concerns and provide appropriate guidance. Some of these issues i= nclude: Please remember that there is already an operationally-focused BCP draft for DoT. https://datatracker.ietf.org/doc/draft-ietf-dprive-bcp-op/ Regards, Brian --15nDjEtRZqgfyu4VV9Kyr5dsssA42VfOT-- --l2KUDlOKJSgL4vFWHvqAHU4swENrJ3bsX Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEUZk246qFfyoMW2DGaNY8nFPRi2EFAl0eDTsACgkQaNY8nFPR i2G9iBAAlQ58z7rmHXczbHeB84nzcRh7AqJ7VAZ8wV62sUCdFopLznyAT0o/RhkN llCiH4Anu2VAyJDxwvM1HcJLgxZhXb8jFIrDHTibbdJIhgxrUzn2mF6R8ebTUV/c q2Dm6Px1E9NAYwHK4QOspY9SVmgf3h9D1iaGDh8s3pMXslgt9uSrRD63AkT/6GKn PLTeIXhQysdTJQn2ST7rvpPhbWJxMBMLI9F0EdIBtkATO5qN4yKFNl5lMGHclpKB /T4p8NuoZg8D9XQcUAzos7ur39g3tvjeepi0/V6aXwC9ZPhlN69BusKjbmWBzyNP +IyF4iFwzGlP0pj34CrXIBbk1uyUB2ORtCpzDa/aRP0OFUO3R78b7EzvGday1fxj WxxpmNtShXiQtxF8zEAv4ibKO6WGtvHQTA9lvU4ZsIlKvTs3NkgTpStofDATMF9Z 2UlUc/TfkyeWvQUdFE9i4HwepUW3MLZgC6Iw+Xf1ZSLQeGNSSTSiDPpc7MdnLH/x O5pXpqdFFa3JVykE2qwlE2V1YdHNE3fMBjnTDC8bY4YP8sz0iX+qGEKQDy9zIb6e 0SncId0Dp6M59UrY0kkkb48cTSQtOyGvGpqr+10cbtsbZC6So/kX9f97Qp1tKfYf SP/Y+DqcCUVKzXwXyoH4XNdru7C3iw/B+5Apt9genXamQeqtpdI= =1OPf -----END PGP SIGNATURE----- --l2KUDlOKJSgL4vFWHvqAHU4swENrJ3bsX-- From nobody Fri Jul 5 03:07:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B70211200B5 for ; Fri, 5 Jul 2019 03:07:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5GS4uMuq2MPp for ; Fri, 5 Jul 2019 03:07:07 -0700 (PDT) Received: from smtp96.iad3a.emailsrvr.com (smtp96.iad3a.emailsrvr.com [173.203.187.96]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D80B412009C for ; Fri, 5 Jul 2019 03:07:06 -0700 (PDT) X-Auth-ID: bgreene@senki.org Received: by smtp29.relay.iad3a.emailsrvr.com (Authenticated sender: bgreene-AT-senki.org) with ESMTPSA id 4E2712223E; Fri, 5 Jul 2019 06:07:05 -0400 (EDT) X-Sender-Id: bgreene@senki.org Received: from [10.0.1.57] (75-139-7-163.dhcp.kgpt.tn.charter.com [75.139.7.163]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384) by 0.0.0.0:587 (trex/5.7.12); Fri, 05 Jul 2019 06:07:05 -0400 From: Barry Greene Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_F9896F51-62F7-4931-BB7F-15929B9A65DE"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 5 Jul 2019 05:07:03 -0500 In-Reply-To: <2ab90a6a-dd40-b7a0-b380-4dcbd657c89c@innovationslab.net> Cc: add@ietf.org To: Brian Haberman References: <2ab90a6a-dd40-b7a0-b380-4dcbd657c89c@innovationslab.net> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Jul 2019 10:07:09 -0000 --Apple-Mail=_F9896F51-62F7-4931-BB7F-15929B9A65DE Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii The issues that Andrew is bring up would take that dprive-bcp draft in a = totally different direction. Is this want you want? Would the authors be = open to the change? > On Jul 4, 2019, at 9:29 AM, Brian Haberman = wrote: >=20 > Signed PGP part >=20 >=20 > On 7/3/19 3:41 PM, andrew.fidler@bt.com wrote: >> There are many challenges facing enterprise and internet service = provider / operator networks that intend to deploy and operate DoH (and = DoT) resolver services. The IETF should consider developing a BCP which = documents these concerns and provide appropriate guidance. Some of these = issues include: >=20 > Please remember that there is already an operationally-focused BCP = draft > for DoT. >=20 > https://datatracker.ietf.org/doc/draft-ietf-dprive-bcp-op/ >=20 > Regards, > Brian >=20 >=20 >=20 --Apple-Mail=_F9896F51-62F7-4931-BB7F-15929B9A65DE Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEdoGA/YBcwd1ud+j1VW6TcBa/RfMFAl0fIUcACgkQVW6TcBa/ RfOF4wf+KRzMCTSI7/1uCPAzQrzPPcNcNU4l1mqwQuC8M6uEBUXVlwff2ngJe4VV iQqa9bJHQZGlqyAQnUUXN6oVX42tE37v7iOYTvZNV7GYeGRoGnWixRMwZEfUi5vr ZaklUoe0jQCXAhZ1Ao5SviZBZ90i2H5BwF3C5I+IhFDlqvMZy/gVq+wJemIGLWL1 6fOiBJbDAHO3IHqX6PH0+yGQ69PjFR/x0V7ryXZATDXUImwMwMvkb3IHJCgBEcPg KGR9DQ6AZXpcun3gp+HDGmsdjjwT6R/a7qatRhhBGlBU5vGdxVzf2k37lRgR4g4Z PYW10CEcNUOqbKW5mDjMMi6kL+dy1A== =LNQG -----END PGP SIGNATURE----- --Apple-Mail=_F9896F51-62F7-4931-BB7F-15929B9A65DE-- From david.huberman@icann.org Sun Jul 7 07:44:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7209A120048 for ; Sun, 7 Jul 2019 07:44:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mk7Fk4gY8h_U for ; Sun, 7 Jul 2019 07:44:40 -0700 (PDT) Received: from mail.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C6E2C12001E for ; Sun, 7 Jul 2019 07:44:40 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Sun, 7 Jul 2019 07:44:39 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Sun, 7 Jul 2019 07:44:39 -0700 From: David Huberman To: "add@ietf.org" Thread-Topic: List of ADD? Thread-Index: AQHVNNKAJc6U0ATzMkCfusPJub/9lg== Date: Sun, 7 Jul 2019 14:44:38 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.47.236] Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha256; boundary="B_3645341078_812472056" MIME-Version: 1.0 Archived-At: Subject: [Add] List of ADD? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jul 2019 14:45:28 -0000 --B_3645341078_812472056 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Hello, I was giving a presentation this past week on "What's Going on in the World= of DNS?" to=20 an audience of network operators and government technical policy makers. O= ne of the=20 questions I got from the audience was about current implementations of ADD.= Other=20 than Firefox and Chrome, I wasn't able to point the questioner to any other= applications=20 publicly doing RFC 8484 DoH; there is also some malware using the non-stand= ard=20 Google API for DNS-over-HTTPS. Have any applications or OSes publicly committed to DoT? Does anyone know o= f any other=20 application makers publicly talking about ADD that they could please share = here on-list?=EF=BB=BF Thank you! David David Huberman Senior Technical Engagement Specialist Office of the CTO ICANN M: +1-571-342-2267 E: david.huberman@icann.org =EF=BB=BF=EF=BB=BF --B_3645341078_812472056 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIH8wYJKoZIhvcNAQcCoIIH5DCCB+ACAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0B BwGgggWoMIIFpDCCBIygAwIBAgIQCCCjezVuaqyieF/3cJVtpTANBgkqhkiG9w0BAQsFADBl MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGln aWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcx MjEzMDAwMDAwWhcNMjAxMjEyMTIwMDAwWjCBwTELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNh bGlmb3JuaWExFDASBgNVBAcTC0xvcyBBbmdlbGVzMTwwOgYDVQQKEzNJbnRlcm5ldCBDb3Jw b3JhdGlvbiBmb3IgQXNzaWduZWQgTmFtZXMgYW5kIE51bWJlcnMxIDAeBgNVBAMTF0Rhdmlk IEh1YmVybWFuIDIwMTcxMjExMScwJQYJKoZIhvcNAQkBFhhkYXZpZC5odWJlcm1hbkBpY2Fu bi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDdg9FuWh3v/L2kclVo95d6 WvPm7FTZ1brAC//JJ3Q6b7eUi4YGBIN+A3J6GDyybewuhYGb6lpMsx5/kKZk61g0OFFqI4vV IYI3hz8FYE1RFFs2t9i8f0ZaXp1N/fzhXUwX2yiTwP3ACJbfq8gtWFDd6fmj5+gs3h2ttkuC W6y9KYNzdDklvKmHWjKug14jZo9ONcuk7FpTnhvTk55GXVWm+4tFL04SMFxDeTq588zthhee tZpKyVzQsRWXrHUZjyz2dmrSXTzaNg0wS3mQZ0aSNQ2I0xidEZwSlQ98how3WD8CzNsdgPwH 7FzFu1hIz5DhiCLv/kU2wjGwvu6oxuxpAgMBAAGjggHxMIIB7TAfBgNVHSMEGDAWgBTnAiOA AE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUlYQthwDehLcR6dDPAXFRD3H/ASswDAYDVR0T AQH/BAIwADAjBgNVHREEHDAagRhkYXZpZC5odWJlcm1hbkBpY2Fubi5vcmcwDgYDVR0PAQH/ BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDBDBgNVHSAEPDA6MDgGCmCG SAGG/WwEAQIwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCB iAYDVR0fBIGAMH4wPaA7oDmGN2h0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNI QTJBc3N1cmVkSURDQS1nMi5jcmwwPaA7oDmGN2h0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydFNIQTJBc3N1cmVkSURDQS1nMi5jcmwweQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUF BzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYWNl cnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDQS5jcnQwDQYJKoZIhvcN AQELBQADggEBAM0aLHYCdcGnWNf1xBSx9x353WzHbJ2XIiV3cMC9XxwhJDuEWRC+RIOmEgTl LKL0qPpSy/9HexawAJSWwJhrGVH1hAV3qYgijeeX7MkNezaLN0PdDd32TJZikU0V4LhMkfFQ 160BFWEB2o9zP4o5nB7fBiLhFqkzJ3pfqamZXlkhQNqZ7QVXgb8j/1hCjLB7/D3c+G/Vzhwb oqLsY0JazQS6bUWMhkTB4o+LIzNoHtP/8CfHlvoH6cU6clvFSIquOEdnqi4md/GTz56ApG0w cFi2NY+tGhbzwVXxGQXNh/sjn3uBYNcfHokuC2gC0C5HxzKTiBKWu6rpr9nelcgF55AxggIP MIICCwIBATB5MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNV BAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJ RCBDQQIQCCCjezVuaqyieF/3cJVtpTANBglghkgBZQMEAgEFAKBpMC8GCSqGSIb3DQEJBDEi BCCCQygms5R+3ADb8sZnRVNCWyS8IkatItjqtNJcLGL21DAYBgkqhkiG9w0BCQMxCwYJKoZI hvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xOTA3MDcxNDQ0MzhaMA0GCSqGSIb3DQEBAQUABIIB AEkar6JAadapBKfyXGNj3RSxwNV5WKnrnCpzebNscOHBPBkaDAt4/1+eeEAp6R4mzfF6V5mS vMZuZHbLAP05O5MP5RzIwmKrSfIZ2fRY20zN7mfsPN1OgXT7U1J62J6svHBkdJAS5fHtWxJA ukOwVcokVPeiDSaDEKxWg9STABdlXlHYxWveioWpuEAubITGFMkZvSjkBmD93MaEvQiMEXMa O26dF9j+otYJQXqT56USVg2AT7WBxFfhu0igaaS7F9BvKYqtvK1RPizp6SPsvnUt3AN6calw JvJbMxkfSg9eb/mpnEN/y4F6eJCi2FsnTCNXt2AlJN1dBnRRCMRuZhs= --B_3645341078_812472056-- From nobody Sun Jul 7 08:06:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EF07120281 for ; Sun, 7 Jul 2019 08:06:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N7eO_48a23Fr for ; Sun, 7 Jul 2019 08:06:26 -0700 (PDT) Received: from mail-qk1-x733.google.com (mail-qk1-x733.google.com [IPv6:2607:f8b0:4864:20::733]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C23CB1202B4 for ; Sun, 7 Jul 2019 08:06:26 -0700 (PDT) Received: by mail-qk1-x733.google.com with SMTP id r6so11422646qkc.0 for ; Sun, 07 Jul 2019 08:06:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=iwY6pj5hvJych6YyHxAbQp19w874O8+EVZy6G60dOmc=; b=Mi0v9JgqPMmVcqAUF5k25TfPNWTZrAV8qUvxaJYeqNF5NQ4NRKoi7IFfI9km5iC7JD Pea32m/YtFYIuVK/wkf1q5nyf7bLeM1H6Ti6NVMmISzDotopbMSVB8YjsXxZmXW4s/m6 IE4HoZ73TcApu6p0KC6CoNOXzvj9y5NSwr5Qg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=iwY6pj5hvJych6YyHxAbQp19w874O8+EVZy6G60dOmc=; b=ZonnRDZ4ix1MbVMUtNCNfDEQI7NrscpfGUqdbgb38OnNcMWjLSHHWrKswj6Rpb3/4i dbq98i6mHE0tDiGx7fq0Se3XJZeQbu+0ZLgwT9GW/GQWUp0H/tnjWyxK8CKw5CoWgWd3 nwicyJyhiKXD3yLMYNBskDG7GqujYNz7Eqo2ihqlzbLZEHBFDQZqRpmlMbam753/Hrtn +JEbAMwF19uXP2OBJi6LFci3mRGq6OHj8haM+0OjK08dT4GK5mTem6Ld3RSM9Y1ILI1k 7mK0RWDPG2Oj2IkWnFd61kPkctfNfVY6U3cuR8Sjiql+zoHwZt9XfZ5jxOdn53ABht8o ftwA== X-Gm-Message-State: APjAAAUquxWqQiL91quryhgUPW4nCweH19E3FxTDu30cgMhmBx6z/Ea9 SDD1R0/5MNQAMQv0IPU2hXM8zH9uIC+gkvNp X-Google-Smtp-Source: APXvYqyabhWQCO3CJwMya2YvTtsHk1+AJjiiAWxp/M8I+r9M0EaHD+X8HZNV/aoLNqwod4QbVqiWeg== X-Received: by 2002:a37:ac14:: with SMTP id e20mr10757998qkm.243.1562511985675; Sun, 07 Jul 2019 08:06:25 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id a67sm5085955qkg.131.2019.07.07.08.06.23 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 07 Jul 2019 08:06:23 -0700 (PDT) From: Joe Abley Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_3A516816-0D0C-4473-A3FE-FB081C785A42"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Sun, 7 Jul 2019 11:06:22 -0400 In-Reply-To: Cc: "add@ietf.org" To: David Huberman References: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] List of ADD? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jul 2019 15:06:39 -0000 --Apple-Mail=_3A516816-0D0C-4473-A3FE-FB081C785A42 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi David, On 7 Jul 2019, at 10:44, David Huberman = wrote: > I was giving a presentation this past week on "What's Going on in the = World of DNS?" to > an audience of network operators and government technical policy = makers. One of the > questions I got from the audience was about current implementations of = ADD. Other > than Firefox and Chrome, I wasn't able to point the questioner to any = other applications > publicly doing RFC 8484 DoH; there is also some malware using the = non-standard > Google API for DNS-over-HTTPS. >=20 > Have any applications or OSes publicly committed to DoT? Does anyone = know of any other > application makers publicly talking about ADD that they could please = share here on-list?=EF=BB=BF Do you want to answer the question of what applications are doing DNS, = or to the questions of what applications are doing DNS with specific = transports? Both are interesting, I think, but usefully separate. Netflix apps and chrome key devices are examples of applications that = are doing DNS that people have mentioned to me, recently. I don't know = what transport they are using (I don't use either and haven't had a = chance to look myself). There are several applications that do DoT specifically for the purpose = of allowing the user to select particular transports; Sinodun's stubby = is an easy example. But that doesn't seem like what you're looking for. Joe --Apple-Mail=_3A516816-0D0C-4473-A3FE-FB081C785A42 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXSIKbgAKCRA0jwy9hlI6 LI8kAJ98KuQcqpupJLaJL3afluOlzJ3STgCeK99M22icQ5sjSIgyJXkK3xyvExY= =rgrk -----END PGP SIGNATURE----- --Apple-Mail=_3A516816-0D0C-4473-A3FE-FB081C785A42-- From nobody Sun Jul 7 08:11:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B1AE1202FF for ; Sun, 7 Jul 2019 08:11:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gRIXrEYg3l9v for ; Sun, 7 Jul 2019 08:11:32 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8D4101202A1 for ; Sun, 7 Jul 2019 08:11:32 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id 16E9C1A0F46 for ; Sun, 7 Jul 2019 08:11:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1562512292; bh=gIGVo48F0WoF+aT5nQmo53xy5BVmbcmaPS/oc8aaUhw=; h=To:References:From:Subject:Date:In-Reply-To:From; b=gogd2FxTHFILZYi/pBBCqdD3D0vNxtkJhGMB2HQMnXSax02U7tVB8RdiYHJqXjMVv Vn2Ic52EY99pWcMK3lNw9u1Rb8WaeNdWFOuAgGBlw6s/CpU18pPRJUaK/GLN3ymrSu ns6uX++LeIKAdMFToDfBEd3V0kXc4HqojNQby+wg= X-Riseup-User-ID: E3E5E51BD97E251590EB0447E0FEC8ABA739ABCAFFFBAB223AAC759B730D0598 Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id DD01D12056F for ; Sun, 7 Jul 2019 08:11:27 -0700 (PDT) To: add@ietf.org References: From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: <3438d49e-5daf-2c0e-a9c1-f38314ebdbee@riseup.net> Date: Sun, 07 Jul 2019 15:11:00 +0000 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="SDW2OTeHEgM2bOZUqfyVAButm1bHJDsGW" Archived-At: Subject: Re: [Add] List of ADD? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jul 2019 15:11:45 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --SDW2OTeHEgM2bOZUqfyVAButm1bHJDsGW Content-Type: multipart/mixed; boundary="A2fBGHb7T5xVm8Yitw1CIQGzp4Bvub8Pf"; protected-headers="v1" From: nusenu To: add@ietf.org Message-ID: <3438d49e-5daf-2c0e-a9c1-f38314ebdbee@riseup.net> Subject: Re: [Add] List of ADD? References: In-Reply-To: --A2fBGHb7T5xVm8Yitw1CIQGzp4Bvub8Pf Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable David Huberman: > I was giving a presentation this past week on "What's Going on in the > World of DNS?" to an audience of network operators and government > technical policy makers. One of the questions I got from the > audience was about current implementations of ADD. Other than > Firefox and Chrome, I wasn't able to point the questioner to any > other applications publicly doing RFC 8484 DoH; You might find these two pages of use: https://github.com/curl/curl/wiki/DNS-over-HTTPS#supported-in-browsers-an= d-clients https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Implementation+Status dnscrypt-proxy also implementing DoH, has multiple frontend applications = but are also probably not "applications" in the sense of "ADD". https://dnscrypt.info/implementations =20 > Have any applications or OSes publicly committed to DoT?=20 Android 9 has DoT support. systemd has a first version of DoT without the strict profile, but Android and systemd are not really "applications" in the sense of ADD= I guess. --=20 https://twitter.com/nusenu_ --A2fBGHb7T5xVm8Yitw1CIQGzp4Bvub8Pf-- --SDW2OTeHEgM2bOZUqfyVAButm1bHJDsGW Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAl0iC5cACgkQrWE4wkXN Qn4g6g//Vy/C5qXkAwRgblAiz0oCjIeHGmxZaHOOEXqpUM2R0Qz4IQss5vW73ile im80JTJ1JwiuWh97ATe8MEz2XQDf+3mxVZ9rmW/m2FM3EhmPSqSIO+01Xvl0J8xD udt5GN+OXV4fFjy/rVDR36Gtkfbzzbns4EXntyMCr9QafJDlUH+1hg72bYYeMnmR lFqkl/5c4X/pCxJSnk7iyTt58KwQ4CiRwmS/PqL1D9bo6L7G7f89nyuuTLNX3+Hi KkELG6RYAuJaBh1TBJvU38MXaZGsKyq7M68lF+0L4YzAmVBx6tDJj2XulDFTGnh6 ehwPKn+CxMp1H20xS3iLHjRyLohxECZWy+3ccEC2KCDwgt1t7DEpF3FpZWWDes5z UYaxz21eDpbU+a6IVwCz7wvsNgAsCYhobW47Au4M4qMnUJIdA4Kp50rRqKPg6UrS TN7T+BckOuQkxgRb0cjjJD1Psg4/p3055wIyYiXBSx8GOtyadOFl25COLytSyZ6/ SHOXBK13vhaPSMfyjqIlhlG0Rq3KKjPw/NxJScZsCy1bMY0UQ0KnJ6wsJ4NAwvAq LipVW2W3eumaEjjfQNKJXRRvuJBoB7rGGLBpmYmezybXeUT51bF2ri/f+uy9fzlb fqwlSjaBMyCmqFIhsz/BOsLDrFzss8qKk8vPktfjfNMY4I2KRa0= =7m5N -----END PGP SIGNATURE----- --SDW2OTeHEgM2bOZUqfyVAButm1bHJDsGW-- From nobody Sun Jul 7 14:36:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15BA512017C for ; Sun, 7 Jul 2019 14:35:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c2HFiWB1rWxf for ; Sun, 7 Jul 2019 14:35:49 -0700 (PDT) Received: from mail.hardakers.net (mail.hardakers.net [168.150.192.181]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED8221200F5 for ; Sun, 7 Jul 2019 14:35:48 -0700 (PDT) Received: from localhost (unknown [10.0.0.3]) by mail.hardakers.net (Postfix) with ESMTPA id 039C5234EC; Sun, 7 Jul 2019 14:35:47 -0700 (PDT) From: Wes Hardaker To: David Huberman Cc: "add\@ietf.org" References: Date: Sun, 07 Jul 2019 14:35:46 -0700 In-Reply-To: (David Huberman's message of "Sun, 7 Jul 2019 14:44:38 +0000") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [Add] List of ADD? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jul 2019 21:36:03 -0000 David Huberman writes: > there is also some malware using the non-standard Google API for > DNS-over-HTTPS. They've started using real DOH too, at least based on: https://www.zdnet.com/article/first-ever-malware-strain-spotted-abusing-new-doh-dns-over-https-protocol/ (which even references RFC8484) -- Wes Hardaker USC/ISI From nobody Sun Jul 7 14:52:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 20F311200BA for ; Sun, 7 Jul 2019 14:52:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bSfei4uqhFdz for ; Sun, 7 Jul 2019 14:52:05 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 886931200B7 for ; Sun, 7 Jul 2019 14:52:05 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id 20A8C1A0279 for ; Sun, 7 Jul 2019 14:52:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1562536325; bh=P8TZmlioz5cpD6m3vdJiyAp4BPbpIy3ljj5A7JsyxBE=; h=Subject:To:References:From:Date:In-Reply-To:From; b=K9wCJ7lfHymjv8xBjEZqCjAco3JgXOlAxbworTBTH+dD6fad9DP9S7XAp5m1Eoufz sy8BfU/9++xh2S3TWOJIxhddZv2sT+55YCBSGfFxWZ1YLMUHt6SUPyYFBOsz4cFvZk USzNUqvTndM0VU+fEcF3KFsCpulbatP8nS+2jizs= X-Riseup-User-ID: 31B870C6DCC5978DA3C15EAC16037A945B816207BF6007C687060DBDDE1C17C7 Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id 4B043120760 for ; Sun, 7 Jul 2019 14:52:03 -0700 (PDT) To: add@ietf.org References: From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: <0e955d7a-324a-043c-f7b5-f19278f45f09@riseup.net> Date: Sun, 07 Jul 2019 21:51:00 +0000 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="treq4HU5Id1If59Tqi3rfYyX7ZvRR4CRZ" Archived-At: Subject: Re: [Add] List of ADD? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jul 2019 21:52:08 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --treq4HU5Id1If59Tqi3rfYyX7ZvRR4CRZ Content-Type: multipart/mixed; boundary="MmODx4XEGsholbYqoYmMgXc4N0KR8PswR"; protected-headers="v1" From: nusenu To: add@ietf.org Message-ID: <0e955d7a-324a-043c-f7b5-f19278f45f09@riseup.net> Subject: Re: [Add] List of ADD? References: In-Reply-To: --MmODx4XEGsholbYqoYmMgXc4N0KR8PswR Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Wes Hardaker: > David Huberman writes: >=20 >> there is also some malware using the non-standard Google API for >> DNS-over-HTTPS. >=20 > They've started using real DOH too, at least based on: >=20 > https://www.zdnet.com/article/first-ever-malware-strain-spotted-abusing= -new-doh-dns-over-https-protocol/ >=20 > (which even references RFC8484) It doesn't really matter that much but people pointed out that this specific malware did not speak DoH as in RFC8484 https://twitter.com/bagder/status/1146740062127886338 --=20 https://twitter.com/nusenu_ --MmODx4XEGsholbYqoYmMgXc4N0KR8PswR-- --treq4HU5Id1If59Tqi3rfYyX7ZvRR4CRZ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAl0iaYAACgkQrWE4wkXN Qn4AVA//R85HP11HWb7KkIx1FoU9e+V/YmlW0AwdCCQv9sLDLSe8PMHxFox6XYLP Xv6KoxkzQ8GnUkAee32igNayP0rdmIe7dCtU7o4f58nMfkEFPd/mNx6aQXjhTwT2 9qQHjqtmr5xhtZvgg4uK0ekuJp2MfRPTgYOTGXNCyGVMeF8i5m8glewXhsU2SfSV O8QbZfFZceV3gfkRG6dmq8NeMRFbPN84oNlOVY1yqtOKBA9+NNh9f87IT4mpmtJq IJqB0jSWzWRjtUq1H6KL5gnHi/qQIA9/3JEkx3UsW5C/xz5CWvCKbYFuncbEACxf dFy6o4of50YWOJQqFPRRSKkXYz3abHh4fi3y+ye1EonrMkwYRDRSLPL8Rcz9BRGr BIQkrP7pE4LqUq9p9ee5Bcbig7xsfrlKq2QuoftzlUXXZPKzZDCBmoJLKnk8bsUf nNm7CStDXpEpTlipFTIIExfo+/200fBCpmgVC1Hqg+POylxRMtfjSA0WQldO6zpl SKR5MNA35KWVQjpGqbaIxjDZcBzVfxlzKBRGy2bHiLzaZMn16AMbyuNAWB1ZDTO0 oUzHeU+Inne6rsxVU1/9Ig7eChPnQHrAc2QeuP7RHDSITdmFcMVpRm7ujwVSNXWb oELo8MHrMtz2Hu/rhIkNpbpY/mh+yd0ol36fyycCyVCrZDcEa5U= =FtUY -----END PGP SIGNATURE----- --treq4HU5Id1If59Tqi3rfYyX7ZvRR4CRZ-- From nobody Sun Jul 7 14:54:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDF8C1200BA for ; Sun, 7 Jul 2019 14:54:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=emu.st Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nz-S2uBYPwne for ; Sun, 7 Jul 2019 14:54:03 -0700 (PDT) Received: from f3.bushwire.net (f3.bushwire.net [203.0.120.11]) by ietfa.amsl.com (Postfix) with ESMTP id 3BBCE120091 for ; Sun, 7 Jul 2019 14:54:03 -0700 (PDT) Received: by f3.bushwire.net (Postfix, from userid 1001) id 759D93B0B8; Mon, 8 Jul 2019 07:54:00 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/simple; d=emu.st; s=2019; t=1562536440; bh=/+uJEM0C8r56ljLuSrfp8B7rqCY=; h=Comments:Received:Date:Message-ID:From:To:Subject:References: MIME-Version:Content-Type:Content-Disposition:In-Reply-To; b=iZlvyfvdCx25SxG4MzfhOsDE/kAaOX9nhPWBj1JvlChSXRXjHoBkBf67zBNN3l6M7 Cq6dmtYsqXwfcTQIu+uAsUkVUGrLLYxIBEkkokGznzIf46yOJ7Dy2q5v2nILIgGRax xCk2e4538uF2anMjTD/9AgTPj6r3nM5M5xUjR9pI=jR9pI= Comments: QMDA 0.3a Received: (qmail 25397 invoked by uid 1001); 7 Jul 2019 21:54:00 -0000 Date: 7 Jul 2019 21:54:00 +0000 Message-ID: <20190707215400.25396.qmail@f3-external.bushwire.net> From: "Mark Delany" To: "add@ietf.org" References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Archived-At: Subject: Re: [Add] List of ADD? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jul 2019 21:54:05 -0000 On 07Jul19, David Huberman allegedly wrote: > Have any applications or OSes publicly committed to DoT? Does anyone know of any other > application makers publicly talking about ADD that they could please share here on-list???? Where you being specific about "applications and OSes" as that seems to be a narrower question than one which might identify growing popularity (or risk by the sounds of your target audience)? For example, did you want to include resolver libraries, resolvers and middle-ware boxes that can use ADD on their upstream side as they effectively "cause" ADD use by many applications? Mark. From nobody Sun Jul 7 14:54:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D3ED1200DF for ; Sun, 7 Jul 2019 14:54:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XyL3bsiRr67c for ; Sun, 7 Jul 2019 14:54:18 -0700 (PDT) Received: from mail.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3972D1200E6 for ; Sun, 7 Jul 2019 14:54:18 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Sun, 7 Jul 2019 14:54:16 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Sun, 7 Jul 2019 14:54:15 -0700 From: Paul Hoffman To: Wes Hardaker CC: "add@ietf.org" Thread-Topic: [Ext] [Add] List of ADD? Thread-Index: AQHVNQ6EacTdr9fnc0KQOhCLgzpdQA== Date: Sun, 7 Jul 2019 21:54:14 +0000 Message-ID: <90703947-B064-4617-AA64-5D82DB85B69F@icann.org> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: <4F65D7EFE095AF4AA204676CE78A4708@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [Ext] List of ADD? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jul 2019 21:54:24 -0000 On Jul 7, 2019, at 2:35 PM, Wes Hardaker wrote: > They've started using real DOH too, at least based on: > https://www.zdnet.com/article/first-ever-malware-strain-spotted-abusing-n= ew-doh-dns-over-https-protocol/ > (which even references RFC8484) Nope. The writer of the article apparently didn't even read the reference t= hat the article gives to the Qihoo 360 analysis; that clearly shows the que= ry and response are using the pre-8484 Google API, not RFC 8484. Again: DNS-over-HTTPS has been possible for long before RFC 8484, and there= are many ways to do it that don't conform to the standard. --Paul Hoffman= From nobody Sun Jul 7 15:14:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5F211200B4 for ; Sun, 7 Jul 2019 15:14:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sMFZC4kdmI0S for ; Sun, 7 Jul 2019 15:14:20 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98AF5120096 for ; Sun, 7 Jul 2019 15:14:20 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 7875024205E6; Sun, 7 Jul 2019 22:14:13 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Sun, 7 Jul 2019 23:14:12 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <6603467C-C179-4D39-BC38-C010788735DD@rfc1035.com> References: To: Wes Hardaker X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] List of ADD? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jul 2019 22:14:22 -0000 > On 7 Jul 2019, at 22:35, Wes Hardaker wrote: >=20 >> there is also some malware using the non-standard Google API for >> DNS-over-HTTPS. >=20 > They've started using real DOH too FWIW a (proof of concept) DoH based exfiltration attack was done at the = end of last year: https://sensepost.com/blog/2018/waiting-for-godoh From nobody Sun Jul 7 15:26:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90814120176 for ; Sun, 7 Jul 2019 15:26:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MTzbUy5AVSiZ for ; Sun, 7 Jul 2019 15:26:19 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id F0E9C1200F5 for ; Sun, 7 Jul 2019 15:26:18 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 16C145F43011; Mon, 8 Jul 2019 00:26:17 +0200 (CEST) Received: from [172.19.152.78] (p54B8A0E0.dip0.t-ipconnect.de [84.184.160.224]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id E36F85F42FC3; Mon, 8 Jul 2019 00:26:11 +0200 (CEST) From: "Ralf Weber" To: "Paul Hoffman" Cc: "Wes Hardaker" , add@ietf.org Date: Mon, 08 Jul 2019 00:26:10 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <0C9B5EF0-655D-4415-AC62-012F851B68EB@fl1ger.de> In-Reply-To: <90703947-B064-4617-AA64-5D82DB85B69F@icann.org> References: <90703947-B064-4617-AA64-5D82DB85B69F@icann.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Add] [Ext] List of ADD? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jul 2019 22:26:31 -0000 Moin! On 7 Jul 2019, at 23:54, Paul Hoffman wrote: > On Jul 7, 2019, at 2:35 PM, Wes Hardaker wrote: >> They've started using real DOH too, at least based on: >> https://www.zdnet.com/article/first-ever-malware-strain-spotted-abusin= g-new-doh-dns-over-https-protocol/ >> (which even references RFC8484) > > Nope. The writer of the article apparently didn't even read the = > reference that the article gives to the Qihoo 360 analysis; that = > clearly shows the query and response are using the pre-8484 Google = > API, not RFC 8484. Well it still shows the danger of an publicly available infrastructure = for name resolution that hides in other traffic and therefore is hard to = block. > Again: DNS-over-HTTPS has been possible for long before RFC 8484, and = > there are many ways to do it that don't conform to the standard. While this is true, having a standard encourages large players to have = such an infrastructure as we see now. This is a real problem for = enterprises and everybody that uses DNS to deliver a service, which is = why we have to make sure that these publicly available large = infrastructures are deployed in a sensible way both from the services = and client side, as otherwise the bad guys will use this infrastructure = for bad stuff. As you note there has been other ways to evade the network name = resolution before (VPNs, public DNS, proxies), but they either had a = small number of targets, or a traffic/port pattern that was easy to = block. The fact that Google has a publicly available DNS resolution = system on their main website and this is used by malware clearly shows = the danger of it. The same problem would arise if someone offered = RFC8484 on the same host that runs a popular website, which is why we = need to discuss the deployment of it. So long -Ralf =E2=80=94-- Ralf Weber From nobody Sun Jul 7 15:49:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BDEA1200B7 for ; Sun, 7 Jul 2019 15:49:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xlxGwg69KMjD for ; Sun, 7 Jul 2019 15:49:08 -0700 (PDT) Received: from mail.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2285112004C for ; Sun, 7 Jul 2019 15:49:08 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Sun, 7 Jul 2019 15:49:06 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Sun, 7 Jul 2019 15:49:06 -0700 From: Paul Hoffman To: Ralf Weber CC: "add@ietf.org" Thread-Topic: [Add] [Ext] List of ADD? Thread-Index: AQHVNRMMaSF7siL01Uycz+go267XR6bAN46A Date: Sun, 7 Jul 2019 22:49:06 +0000 Message-ID: <76EEC636-C537-4FD9-952E-1C9A80C62BE4@icann.org> References: <90703947-B064-4617-AA64-5D82DB85B69F@icann.org> <0C9B5EF0-655D-4415-AC62-012F851B68EB@fl1ger.de> In-Reply-To: <0C9B5EF0-655D-4415-AC62-012F851B68EB@fl1ger.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: <7E19E395403C794EADF66EA8F4AE7BAA@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [Ext] List of ADD? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jul 2019 22:49:10 -0000 Small factual correction: On Jul 7, 2019, at 3:26 PM, Ralf Weber wrote: >=20 > The fact that Google has a publicly available DNS resolution system on th= eir main website and this is used by malware clearly shows the danger of it= . The analysis given in the Qihoo 360 description of this malware clearly sho= ws that the DNS resolver was Cloudflare, not Google. --Paul Hoffman= From nobody Mon Jul 8 06:22:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FD3D12019D for ; Mon, 8 Jul 2019 06:22:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.602 X-Spam-Level: X-Spam-Status: No, score=-0.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, PDS_NO_HELO_DNS=1.295, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=innovationslab-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pFc1JsUeiRhF for ; Mon, 8 Jul 2019 06:21:59 -0700 (PDT) Received: from mail-qt1-x832.google.com (mail-qt1-x832.google.com [IPv6:2607:f8b0:4864:20::832]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94FA51201EE for ; Mon, 8 Jul 2019 06:21:59 -0700 (PDT) Received: by mail-qt1-x832.google.com with SMTP id d23so17990634qto.2 for ; Mon, 08 Jul 2019 06:21:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=innovationslab-net.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to; bh=8zdxVU5+XyJfAiT1eh0ha/uMbLNBp/gbrWkYuxs2Odo=; b=JJU9+jkkskdYdJXVun1KeuiLwEVmneS8YNU7dwugLR2S9vqR9qwlcZs65vz2fVCcgM 2hAe0A4lNdMQNDAkc0sR3N+gX+kKqvxXUbo1LmkjDbepC02y1KT3u8P/y0KRlzLu6bcG 5QekD6JjA4yKIQl6AQBGsXQQy2fBc+e6kedjagjsWLlZIkhgLlcDy5bZ13pQOWNuTXQU MaiyIvCmW5dl2/qhzrk+z+3z5rEIQok4S6/gtMFElIsSZ3EA/yynxtMhw0vLqvoMzMH+ FSv7kAxZMhKmdYKTLApv0tNGVXyizfjDjRjHX+k1GO0mpL1XlX/oOO6I+KdMNfXEtgXf 0kMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=8zdxVU5+XyJfAiT1eh0ha/uMbLNBp/gbrWkYuxs2Odo=; b=jMsQp30/EUSqyH8Aumg40+3XkybHJzlr5q1xiPs7BEU39RJdxDBgOsYpRedNa99SVY SF+p0hi34NETcuSGFsqDvqDpyg6bL6bqQeyHnCQ+dbar8m63lccpjXvAHedlRBA/NW8J 9cBXR5aRO+9CE0D1xjJ9ukDOyQkY/pTGS3/KlZ78y7BZ4kTXsvXfBy3H6B3imd+jqSu5 NDy06ALRbnpllGTCUlTbjicPIDqj6slX51W6K2tN+lGHjfWq7HjIRHWPTt6o7Sgze5kz c7GtAgLylU8KYgA5KcPlABk1RLwOTy9+8gUmG7b5EtNgS/zWpqP4H18aiIe+lsx6OYEv bqiw== X-Gm-Message-State: APjAAAVuclSOcHvibbR9xXVMVaEZJjIcmNJa/uNOcG+QFmFeoAIFUKIm S+3GlAoSMrXOFUXSw93oVcJn9kA/sZI= X-Google-Smtp-Source: APXvYqyEP8AXgnH7fDHF39z0fUsd3SaPB0MN2AB7PgO1oh+wHhx2nWLrprwQSfbvDnwmcyL8yvDs+A== X-Received: by 2002:aed:3ee9:: with SMTP id o38mr13891413qtf.193.1562592118250; Mon, 08 Jul 2019 06:21:58 -0700 (PDT) Received: from clemson.local (nat-gwifi.jhuapl.edu. [128.244.87.132]) by smtp.gmail.com with ESMTPSA id v75sm7537974qka.38.2019.07.08.06.21.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 08 Jul 2019 06:21:57 -0700 (PDT) To: Barry Greene Cc: add@ietf.org References: <2ab90a6a-dd40-b7a0-b380-4dcbd657c89c@innovationslab.net> From: Brian Haberman Openpgp: preference=signencrypt Autocrypt: addr=brian@innovationslab.net; keydata= mQINBFm5KgYBEACs2icafejrG19L5DRNFq8Q2O+K+LRxjR4qAElZDnXFXNA2ipFWPeT0J2wa KJ+h9UdfhDm8DzULB553CYm+Q3XF1N56TglkIRMZYc7mYXZEr3x7e4fmX4kD4qMjBLG8cL26 rEe3Q0qaiMGY69/4o5coVMT0qmHjgCH1tkG+L2Y8MKr1gFxS18eO8MVoWe1yDKuyxFSElHGB 3mZn4gcqeCaemPGG3CiVNlp4KnijpNcSgvseXbkQEA4IXEsIvUL8MIwOTXg9Gh5cbtisZpuf +4B0LNMUSqWlqyKd9M3KCMj+dW4vsFytc00Z+GyQ+ArOR9GwTdAwJ5qqVODTvbjKqOR1zolJ 1JxLUtSiv7Lx5x2OrCexPYXkzlTkjG9Imtg2XNh55R/JKMC3KU1NQL3nS9tJXeoRWNgWSZrG MsrbeejbqLVb9LblXNpgLciJ96XHMvYAXX7p4LAwivzSRrVg46vErYIAV6EvDvwVENWW8JCU 0vX5iTGfkEwU4KxCa7WAmmD8yiNspHP1J0uk93Sta5K0PuTi7b+EZlCjdrqOEWLGPv6qXlIu FwLLcCaDs3XdVvwgNM+UFRxFH1aOVQQKCiCOCcNlwgYG1u4ZbD2T6hd/d2tOAKu/MNnQVF7d Cfi2BtSjzglLcY61e37zqTM04BgU+LniZ7V99yneM6DM2UzgkwARAQABtClCcmlhbiBIYWJl cm1hbiA8YnJpYW5AaW5ub3ZhdGlvbnNsYWIubmV0PokCQAQTAQoAKgIbAwUJB4YfgAULCQgH AwUVCgkICwUWAgMBAAIeAQIXgAUCWbkqSAIZAQAKCRBo1jycU9GLYQixD/9UX0uiAvbJ+4dK z3Ne3kUdDK0Lk73RGfFgE/ezsc9I6ED82h+arC8pAoDnBWgzTxugZdbexek983bgMq02XFsG pJf7hudeKnB8UmtjTc0j1UUgi129FYyBmINS2Lz1gpEOygFfbeOGLJK5qZJwD3I3O6yN8SUZ uwahXXd1aEB+d1eGhNqxkjQ+L7vdfTlN662GWog3ROMwUbrg0+QAbn/Vlp2iIYO6VERUZ9Yr GfFJX9b9LKa6AHxzAaqFIix1h2wBiIacpIBGU/4+3+wL5zkCbGSRzoIHW8srllj7ehgwwfNx QevibuZWJ4XpHpIxrtsmBO7ERFk8pN7oiQ9M3b2Cg9OBD5vgxyMCHEKIblWyKz8GLtz5357L ORU1EBWB8BoJPBHz3u7bZE+jH9+w5PpI087Ae78KCDkTNj7o2wbkRoYLmLpMo8DOwAumyy5R 2DuRu0cn5Rw5pFjlJkyfM0Wf80Ml/SINrUORWeqSbsHSX8i+Y0Oyt5JNo9NFbgN0Gn/Qo364 I8cLgbvUAyFHwhnmbHB+QXFCGAy73NOQ+g2fCRPeSbihhYa34ugfmd4oa6W2w805ixzM7iGr P+wDB1dhA7eHKVmoo9Kxvm9VzU+2homYGEROd/H6n0BMvWtp1oFh/JvEgZN6dVLg3p+XX5Zj Ggy568bIY4P5kP7pAxh017kCDQRZuSoGARAAtCWxW1cRne/iGbFuibvB8d3upcbCB7oz4LWk LSE20Db2ymn04ici9V+wBSWX57me5jQdwMi/gzVVZcupbzWTg5Yhv7Qt7CKORJLEKo6nULbb 4aEpdOXD9s7wwx+foFjzjtDOH/JYoB+OEe2oW39VmK6EsIx7ClsLf6+cih5yApZHtmV+2M3J YSxD2kCUE619ITFLAkMf203ap5vJ6DDaaKnVoNhF9qV7jlJEceGqHTBG4KkBX/zNCehMIfhr ViY/B2IWAHeuZ99lnCPx2mehGGa4XLjQauUkY9KB7dOq/ODyt+7SL0dfWrOVf3BnU3C308b4 9YdId8KI4dJ30nfXn6ifTK9STZHZE+Mt1sIVmtEguqMXEk/axZmT14x194c7ZPmU/uCQTE3U y1NFs4Yof50WF1ze0CyN2ycmqx11mHjP5+L23TqcdIWmJG+EtdHUAFpu42kbB0fML3Oc/cEU SmWK3WpF5YPljLM2gyh3RXjuiBnaGoJaKTOj5zXQ2G2l3/ijbn9FbqmFup+R352dxUyakXEP xNe3HdyjfyUcy/RJNeZz/lgUIhkxWQjOOU1RIN41RtCKcF9tJjMwgQvI51QmPvf90/6ab3I/ vwEpjlRb4AbuWfPWe89J+Z3TG97V9sntlMcQ6MGiPLbyFpiXIf2150e6FxZdJtipVwY2d/kA EQEAAYkCJQQYAQoADwUCWbkqBgIbDAUJB4YfgAAKCRBo1jycU9GLYfy0EACYrxb4nWtOnIu0 N7rXXo/0ZjaBTyUhJ6hzy2D7rt3vv/qj2ui+N21ui/yMDS928za/XRfP25qN9A1puioHqN4l SAsxwCC3mT9GJXVXVgivg3MeciqBXoOdnk1hUkP1CTKL3qZ9pSuw8bPlNE7+b1xF7Oce37YH +QRVmBXbGwTxtDTCZ9Js0/IpiUtg9QCfmryB1r/fD0TFb8b9aCBuVeKocWSuX9UXRt7zRGM8 BJwOLvdLdGvV8us1imlBKFLai4L8CPgihuc/s7ZB0r3pgW697hXScWhGHF3OUWbPFVkNyivM xtDcq+9ZlUMrxFbwUEABi8NFwvzwn+YJQqlrPiF4xxsScYpnIlfWEuP6Vpp6Z/u5x+1MNyZb oxNWWaevMVeo3tdRV9F6/YFqucw4JQ9HqlCKQ62sW9+e5SSlxGNlV4j9cchG6a4fAZqxL+pS ks+KitK3ap/R4RUG+nbjLlhCwGJIti8lxvdYAoPqjtwEUmMJv4dIl0/2h1495cwBIi7XeRKZ Rx38TV3G3LCx0J8dFhkyTG5TxUZQFgHjznkIX7bzeSQX72MxT0b/tc38yM71WpAgAY+MlHCT FQRKqIQsH/4MFir+g/oV2uPNGwmg0QEOnv9zZ79JJ/nBmuXC2RwUVTtZgtiZXhaP0afvR0eg WPEzptIZZCSmtBOOYkfsAw== Message-ID: <77611009-274c-a900-866b-e543a6d8053c@innovationslab.net> Date: Mon, 8 Jul 2019 09:21:56 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="WwoH8UFiWVVXGYQTGeniVzUOjy9IznFC2" Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 13:22:11 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --WwoH8UFiWVVXGYQTGeniVzUOjy9IznFC2 Content-Type: multipart/mixed; boundary="nP4KgBjGPkcu4cvInfZK3Eitog9IfCAhm"; protected-headers="v1" From: Brian Haberman To: Barry Greene Cc: add@ietf.org Message-ID: <77611009-274c-a900-866b-e543a6d8053c@innovationslab.net> Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? References: <2ab90a6a-dd40-b7a0-b380-4dcbd657c89c@innovationslab.net> In-Reply-To: --nP4KgBjGPkcu4cvInfZK3Eitog9IfCAhm Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Hi Barry, On 7/5/19 6:07 AM, Barry Greene wrote: >=20 > The issues that Andrew is bring up would take that dprive-bcp draft in = a totally different direction. Is this want you want? Would the authors b= e open to the change? >=20 My reason for pointing out the dprive BCP is to make sure everyone is aware of that document. As for the content... It is a dprive WG document, so it is subject to consensus-based changes. Neither I, as dprive co-chair, nor the draft authors have any more influence over the content than any other IETF participant. What I don't want is for 2 BCPs from different WGs to conflict with one another, hence the pointer. Regards, Brian >> On Jul 4, 2019, at 9:29 AM, Brian Haberman = wrote: >> >> Signed PGP part >> >> >> On 7/3/19 3:41 PM, andrew.fidler@bt.com wrote: >>> There are many challenges facing enterprise and internet service prov= ider / operator networks that intend to deploy and operate DoH (and DoT) = resolver services. The IETF should consider developing a BCP which docume= nts these concerns and provide appropriate guidance. Some of these issues= include: >> >> Please remember that there is already an operationally-focused BCP dra= ft >> for DoT. >> >> https://datatracker.ietf.org/doc/draft-ietf-dprive-bcp-op/ >> >> Regards, >> Brian >> >> >> >=20 --nP4KgBjGPkcu4cvInfZK3Eitog9IfCAhm-- --WwoH8UFiWVVXGYQTGeniVzUOjy9IznFC2 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEUZk246qFfyoMW2DGaNY8nFPRi2EFAl0jQ3QACgkQaNY8nFPR i2FJ2A/+IKthWoYMkASja+DEff0FALz1kWqTeL3+JH+lP3UqHmc2oGYZKI8IaZUp VoKBcDri2raYqJ/cacVrBx6WLi0amTuJLj+yYlFBg4WZTjZ4Em9DMLKnVU3HbpTV Uy3FJL8Z10xNMkBWYg3vN2ZloFth4+/pCya+nyeMESJTTgOhGJnaAUzi1c4/ZHgA nZOrFbqkgVq2mqHQgSk2pdAIG/+Q03KMLreA6B6/2azG6oYMEvMcBt0BHpHO1ePO W5t9BvGk9U3WcaxNvBC1FWlPOiVJL8CglXoeE8T8yiy8oZi7Gw3UGxdYOen5TG9Q 2gClTXQe22RwTJJzg7atgNV2UXLQ4XS3O2MHnSJLgpKq0U53UvKXOD+9DST8dYZ6 9rvkLstBc3YXsD6gDM8mYWFM5mRlcxStWvkLxnGZks2BGRXCJJzmjXewuE9UFxAN MmG7ArNZhR1uXnGopPxCnqb8eiQqzdUr7go6BlMhvz4LOSxxe/qgmRMR9QYuqKdr MM0chATweXiU6qLDJukKTfNW97f4e6MIbvZKuWgbfh4vFlx46cEiaZamb9Mrqjbx eUAZdmb61wmdjI2Liv0SvRzGhhiXABd9MLszacSSCt/LD/PyV73eOJrKadovP3QB eibOYKKQR7S3pb5mcFPAdldV4E62cDkSaLIk0LyoRpHjFJjudOY= =jdnI -----END PGP SIGNATURE----- --WwoH8UFiWVVXGYQTGeniVzUOjy9IznFC2-- From nobody Mon Jul 8 11:29:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C6311204B2 for ; Mon, 8 Jul 2019 11:29:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KjAyfeyv6Qr7 for ; Mon, 8 Jul 2019 11:29:05 -0700 (PDT) Received: from pigeon.buunabet.com (pigeon.groveronline.com [198.145.19.6]) by ietfa.amsl.com (Postfix) with ESMTP id 0A627120463 for ; Mon, 8 Jul 2019 11:29:04 -0700 (PDT) Received: by pigeon.buunabet.com (Postfix, from userid 501) id 25D5160788; Mon, 8 Jul 2019 11:29:04 -0700 (PDT) Received: from [10.248.37.184] (guest-nat.fw1.untrust.pdx1.mozilla.net [63.245.220.200]) (using TLSv1.2 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by pigeon.buunabet.com (Postfix) with ESMTPSA id 82A105FD6F for ; Mon, 8 Jul 2019 11:29:03 -0700 (PDT) References: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> To: add@ietf.org From: Andy Grover Openpgp: preference=signencrypt Autocrypt: addr=andy@pmtu.dev; keydata= mQENBFz6mPMBCAClDMGqYBeCSE0Q+rU7v0JibtGh+nSZoNTSdXOHUkk3rN7rmJwdjlWsL0aT 2BGsSYBQjuqlculeJAQq6GG8dj7gjkDX8zVvjNPVqZxNd0bRh9DFE5AZrz3TiTIUwNauKWE9 XvVCMn/ZfzEJhehLa7SUs5vgZ6NHaScq4KZByfNsmiu/n+mPRhJOjgIN7fql5u+ElnNHxOP3 Z9vsoQc5pS9YAMKtEvyWgljm4fbZMs6VBDUGJGaLRmALF5VrJ5AJKzbZWZmaXYNqoxdtakT5 PhJuXkqdnrijZw8TJCglQ/z2wiq2HCU2pzq6/l+19yV0m9iegEuPgtAuwqkh4ecsPAbbABEB AAG0IUFuZHkgR3JvdmVyIDxhZ3JvdmVyQG1vemlsbGEuY29tPokBVAQTAQgAPhYhBKVh7hV4 1gY7lZbAkBVqKb2tr6NBBQJc+pjzAhsDBQkDwmcABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA AAoJEBVqKb2tr6NB7uwH/RIEtXUCpRGCbVO5LyXmlzTCue9djrb8YrvOOyeVzUxA5kIskguB 5DH7X7RuVa1PlsfsG2F40/5/bPS/fjYIUOGxTQdyiXGeVPotDvg4vaC/3zV16gs8YxOgzKgb P7QhFLHkZoITe6gOv4R0QH1qvRkbg9cyyPr5FoIPaLoXDnw4DWxaNBUSsN+fPRI87yUjPO1v kL+OWBOnBsHxNGaHjd/s9WsIUp8RbLbfMEI+xlM8lM+r5ccECkMS/l9NFX+mCMUlRXqTkd49 mWYJWY5zNnLyqbAZcaRGCrFlX/gjDn8p+pXQEdvtbbqy3KMofxrmf73ECSStM0WnOEgWtSFG ycW5AQ0EXPqY8wEIAMY7xc/W7mIt2nyAe9K/5RiuyGaDItuaEbFzfRmxFvISJm3s5LiyyrGA 82o0HQWqoMjPyLd+pGSSxHL5aWCUsj5vt/rV0FCPvC8W3a0bWxHa+sbb0VeAHna18Ozav1Cx RFLW437tqaD8yF5yh1c0aGolCqv2LjMHetm+UmFoQVbSfcJoxpXepJFVDwvrqqlL+5BoQM15 MzCwux/D8RCgNlTXTnlfm6bRvlD5ttgDoyzN7qYwm+RjA9Izhyps39fKzdk8xkgeu/A55C94 KcPuSs4U9ti7WeU+CubDaLB3bxp7KCyjWpX3oS2CxHFnQsBAbzGx8UeH3dXbdni1AjE71wkA EQEAAYkBPAQYAQgAJhYhBKVh7hV41gY7lZbAkBVqKb2tr6NBBQJc+pjzAhsMBQkDwmcAAAoJ EBVqKb2tr6NBP2MH/0g/e3idsu/ajGzRx6CaRd/ZNxG0/p0aYT4iQWUEt0KZVyHKf17OQK2z u3QSGjSR2V1H419U0m5V3HSMQmy5XrGi3ks4f01Cgq2HiYizhwVwqNVfZERY+WavEIr35w/L eJqEI2Cm4PySxbOOuFig6R7GAknL76iKQBlMH8uX7yV9p0JnrI6tn0lm2n4UjW76CJ3Fk6gD wqoDYDQXfIxYtyMD6QUfiSDZ+8KZoCMDYQQsEcDBz0hRI2mHwL1jHkGNMcVOhBZPtUHinFTc EiQKDXQKkBvschbpbcfJI5g82v6Bl5M995ob7wsXy8VN5+usot+bKqQHGYMsBMbqJf+Ci1I= X-Forwarded-Message-Id: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> Message-ID: <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> Date: Mon, 8 Jul 2019 11:29:02 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: [Add] new draft: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 18:29:17 -0000 Hello all, We've posted an initial draft of draft-grover-add-policy-detection, which proposes a method of identifying if content filtering or other policy is implemented on the local resolver, so applications doing DNS resolution can adjust their behavior. Thanks -- Regards -- Andy -------- Forwarded Message -------- Subject: New Version Notification for draft-grover-add-policy-detection-00.txt Date: Mon, 08 Jul 2019 10:46:45 -0700 From: internet-drafts@ietf.org To: Andy Grover , Peter Saint-Andre A new version of I-D, draft-grover-add-policy-detection-00.txt has been successfully submitted by Peter Saint-Andre and posted to the IETF repository. Name: draft-grover-add-policy-detection Revision: 00 Title: DNS Resolver-Based Policy Detection Domain Document date: 2019-07-08 Group: Individual Submission Pages: 6 URL: https://www.ietf.org/internet-drafts/draft-grover-add-policy-detection-00.txt Status: https://datatracker.ietf.org/doc/draft-grover-add-policy-detection/ Htmlized: https://tools.ietf.org/html/draft-grover-add-policy-detection-00 Htmlized: https://datatracker.ietf.org/doc/html/draft-grover-add-policy-detection Abstract: This document specifies the behavior that is expected from the Domain Name System with regard to DNS queries for the special-use domain name 'TBD.arpa' and designates this domain as a special-use domain name. From nobody Mon Jul 8 11:57:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 571D0120719 for ; Mon, 8 Jul 2019 11:57:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verisign.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DnnhLQFnkHzN for ; Mon, 8 Jul 2019 11:57:13 -0700 (PDT) Received: from mail1.verisign.com (mail1.verisign.com [72.13.63.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2B204120717 for ; Mon, 8 Jul 2019 11:57:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verisign.com; l=3076; q=dns/txt; s=VRSN; t=1562612233; h=from:to:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version:subject; bh=0cgvXXvZQ6yCbew8W9eM9KkZVKxLI//RcbOf9HYOhRQ=; b=DVqSichXR0KVlNBGzqus+oiZ4jDCZ6IjD6xlar0FbytauUDz1UeyQczv benj/aBU/GyFvXAAOag37Ln9TI0RrEB2qkRlceL/+ipVrZievrrzqlJLz Y/3rlBjFvJJuAfZOaT8I4wqRWEsgrIiP6C08uw+dM4DLGjGMeTwLsnYuw x0LHtahV5dOJ6GHEVOZadqcxsKBTvjHOTEC9AmZGKFKE8ke7xPMzaU1kE N6fmbA+JkJnsPOQO5mEODyZ2a40LzCD8z5t2Z8W/OmWTg5KJMjLCkoI4D w7xDFKX8f+z6ZwyKHmN5W48mI8MucQHe9fna9Z0FPkIIh+odFHaUHY1IS Q==; X-IronPort-AV: E=Sophos;i="5.63,466,1557187200"; d="scan'208";a="10609872" IronPort-PHdr: =?us-ascii?q?9a23=3ADvERRRNz4gvkU1+fxD4l6mtUPXoX/o7sNwtQ0K?= =?us-ascii?q?IMzox0IvT6rarrMEGX3/hxlliBBdydt6sezbaO+Pm7AiQp2tWoiDg6aptCVh?= =?us-ascii?q?sI2409vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFR?= =?us-ascii?q?rhKAF7Ovr6GpLIj8Swyuu+54Dfbx9HiTagf79+Nhq7oRneusULj4ZvJLs6xw?= =?us-ascii?q?fUrHdPZ+lY335jK0iJnxb76Mew/Zpj/DpVtvk86cNOUrj0crohQ7BAAzsoL2?= =?us-ascii?q?465MvwtRneVgSP/WcTUn8XkhVTHQfI6gzxU4rrvSv7sup93zSaPdHzQLspVz?= =?us-ascii?q?mu87tnRRn1gyoBKjU38nzYitZogaxbvhyvugB/zYDXboGbNvVxcKLdcs8VS2?= =?us-ascii?q?VORctRSzdOAoagY4cTFecMP+BVpJT9qVsUqhu+ABGhCO3txDBWgH/5wLM10/?= =?us-ascii?q?46EQHB2gwsB88FvnHOo9XvMKceX/2+wa7LzTXDcfxW3yry55bSchA6pvGMW6?= =?us-ascii?q?l9cdTPxkk1FgPFlVSQqYPjPz+PyusNtG2b4vNmWOmyhWAnrARxrSKuxscqko?= =?us-ascii?q?TJh5waykzK9Sljx4Y1P9K4RUhmatCnCJtdrzyWO5dsTs8/QWxltjw2xqAGtJ?= =?us-ascii?q?O1ZiQHx5AqywbCZ/CbaYSE/xDuWPqLLTtli39oe6iziwux/ES4xO3zSMq53E?= =?us-ascii?q?pPoydAkNTDqmwB2AbW58SaVvRy4kKs1DaS2A/N5OFJJEQ5mrfGJJE/xLM7i4?= =?us-ascii?q?Advl7ZHiDsnUX7lKqWdkI59ee28+nnebDmpoOEN49zlwH+LrwimsyhDuQ8NQ?= =?us-ascii?q?gDR3WW9/ik2rH+/UL3WLpEgfwqnqXHqpzaO9gUpqmjAw9NyIos8QuwAy240N?= =?us-ascii?q?QChnkHKkhJdw6Aj4jsI13OIfb4Aumjg1m0jTtn2+rKMqDjD5jDNHTPjbfscL?= =?us-ascii?q?hn50NTzAc/1dVf6IhVCrEFLvLzQEjxtNnAAx86Mwy73eDnB8hj2YMEQmKPBa?= =?us-ascii?q?mZPbjMsVCW/OIvIvKMZI4auDb7MfQq+/nujXohlV8HYaapxYcXaGy/Hvl+OU?= =?us-ascii?q?qWfGfjj8wAEWgUogo+QvbmiFqYUT5cND6OWPd27z03IIOrEYmFQZqiyvTV1S?= =?us-ascii?q?u3Npxbem4ADUqDRyTGbYKBDr0sZSSeL9V6lTpAHZuoUYtrnUWttAL8x7d9Ne?= =?us-ascii?q?3S0jMVr5P41ddzoebUkEdhpnRPE82B3jTVHClPlWQSSmpu0Q=3D=3D?= X-IPAS-Result: =?us-ascii?q?A2FiAACfkSNd/zGZrQplHgEGBwaBUwkLAYMAgSwKhBKYT?= =?us-ascii?q?pUUFIFnCQEBAQEBAQEBAQcBJQoBAQKEPgIXgkU0CQ4BAwEBAQQBAQEBBAEBA?= =?us-ascii?q?QKLIAELgjoiHE1rAQEBAQEBIwJELQMDIxE4CxICAQgaAiYCAgIwFQYBBgMCB?= =?us-ascii?q?BMUgw4BghmqOIEyhDYCDkGFLIEMKAGLdYFBPoE4H4JMPoJhAQECAQGBIYNGM?= =?us-ascii?q?oImBIhwhXyFIJZGAwYCgheGVoRshACEXYIsbYY0jjGNMIdAj30CBAIEBQIVg?= =?us-ascii?q?VCCEXAvSwGCQQmCb4hOhT9yAY1PgSEBAQ?= Received: from BRN1WNEX02.vcorp.ad.vrsn.com (10.173.153.49) by BRN1WNEX02.vcorp.ad.vrsn.com (10.173.153.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Mon, 8 Jul 2019 14:57:04 -0400 Received: from BRN1WNEX02.vcorp.ad.vrsn.com ([fe80::7c0a:1cc:5def:9dde]) by BRN1WNEX02.vcorp.ad.vrsn.com ([fe80::7c0a:1cc:5def:9dde%4]) with mapi id 15.01.1713.004; Mon, 8 Jul 2019 14:57:04 -0400 From: "Henderson, Karl" To: "add@ietf.org" Thread-Topic: [EXTERNAL] New Version Notification for draft-hal-adot-operational-considerations-00.txt Thread-Index: AQHVNb5cemRBkCyRDU6cz6cEQfbWG6bBEnUA Date: Mon, 8 Jul 2019 18:57:04 +0000 Message-ID: <088F4881-BF32-4EC3-907E-DA9538962545@verisign.com> References: <156261197748.1097.13781803597501449499.idtracker@ietfa.amsl.com> In-Reply-To: <156261197748.1097.13781803597501449499.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.a.190512 x-originating-ip: [10.170.148.18] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: [Add] FW: New Version Notification for draft-hal-adot-operational-considerations-00.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 18:57:19 -0000 Rmlyc3QgdmVyc2lvbiBvZiBhIHByb3Bvc2FsIGZvciBBdXRob3JpdGF0aXZlIEROUyBvdmVyIFRM UyBPcGVyYXRpb25hbCBDb25zaWRlcmF0aW9ucy4gVGhlIGF1dGhvcnMgd2VsY29tZSByZXZpZXcg YW5kIGZlZWRiYWNrLg0KDQpSZWdhcmRzLA0KS2FybCBIZW5kZXJzb24NClNyLiBSZXNlYXJjaGVy DQpWZXJpc2lnbiBMYWJzDQoNCg0K77u/T24gNy84LzE5LCAyOjUyIFBNLCAiaW50ZXJuZXQtZHJh ZnRzQGlldGYub3JnIiA8aW50ZXJuZXQtZHJhZnRzQGlldGYub3JnPiB3cm90ZToNCg0KICAgIA0K ICAgIEEgbmV3IHZlcnNpb24gb2YgSS1ELCBkcmFmdC1oYWwtYWRvdC1vcGVyYXRpb25hbC1jb25z aWRlcmF0aW9ucy0wMC50eHQNCiAgICBoYXMgYmVlbiBzdWNjZXNzZnVsbHkgc3VibWl0dGVkIGJ5 IEthcmwgSGVuZGVyc29uIGFuZCBwb3N0ZWQgdG8gdGhlDQogICAgSUVURiByZXBvc2l0b3J5Lg0K ICAgIA0KICAgIE5hbWU6CQlkcmFmdC1oYWwtYWRvdC1vcGVyYXRpb25hbC1jb25zaWRlcmF0aW9u cw0KICAgIFJldmlzaW9uOgkwMA0KICAgIFRpdGxlOgkJQXV0aG9yaXRhdGl2ZSBETlMtb3Zlci1U TFMgT3BlcmF0aW9uYWwgQ29uc2lkZXJhdGlvbnMNCiAgICBEb2N1bWVudCBkYXRlOgkyMDE5LTA3 LTA4DQogICAgR3JvdXA6CQlJbmRpdmlkdWFsIFN1Ym1pc3Npb24NCiAgICBQYWdlczoJCTEyDQog ICAgVVJMOiAgICAgICAgICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy9k cmFmdC1oYWwtYWRvdC1vcGVyYXRpb25hbC1jb25zaWRlcmF0aW9ucy0wMC50eHQNCiAgICBTdGF0 dXM6ICAgICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaGFsLWFk b3Qtb3BlcmF0aW9uYWwtY29uc2lkZXJhdGlvbnMvDQogICAgSHRtbGl6ZWQ6ICAgICAgIGh0dHBz Oi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1oYWwtYWRvdC1vcGVyYXRpb25hbC1jb25zaWRl cmF0aW9ucy0wMA0KICAgIEh0bWxpemVkOiAgICAgICBodHRwczovL2RhdGF0cmFja2VyLmlldGYu b3JnL2RvYy9odG1sL2RyYWZ0LWhhbC1hZG90LW9wZXJhdGlvbmFsLWNvbnNpZGVyYXRpb25zDQog ICAgDQogICAgDQogICAgQWJzdHJhY3Q6DQogICAgICAgRE5TIG92ZXIgVExTIChEb1QpIGhhcyBi ZWVuIGdhaW5pbmcgYXR0ZW50aW9uLCBwcmltYXJpbHkgYXMgYSBtZWFucw0KICAgICAgIG9mIGNv bW11bmljYXRpb24gYmV0d2VlbiBzdHViIHJlc29sdmVycyBhbmQgcmVjdXJzaXZlIHJlc29sdmVy cy4NCiAgICAgICBUaGVyZSBoYXZlIGFsc28gYmVlbiBkaXNjdXNzaW9ucyBhbmQgZXhwZXJpbWVu dHMgaW52b2x2aW5nIHRoZSB1c2Ugb2YNCiAgICAgICBEb1QgdG8gY29tbXVuaWNhdGUgd2l0aCBh dXRob3JpdGF0aXZlIG5hbWVzZXJ2ZXJzIChBdXRob3JpdGF0aXZlIEROUw0KICAgICAgIG92ZXIg VExTIG9yICJBRG9UIiksIGluY2x1ZGluZyBjb21tdW5pY2F0aW9uIGJldHdlZW4gcmVjdXJzaXZl IGFuZA0KICAgICAgIGF1dGhvcml0YXRpdmUgcmVzb2x2ZXJzLiAgSG93ZXZlciwgd2UgaGF2ZSBp ZGVudGlmaWVkIGEgbnVtYmVyIG9mDQogICAgICAgb3BlcmF0aW9uYWwgY29uY2VybnMgd2l0aCBB RG9ULiAgVGhlc2Ugb3BlcmF0aW9uYWwgY29uY2VybnMgbmVlZCB0bw0KICAgICAgIGJlIGFkZHJl c3NlZCBwcmlvciB0byBBRG9UJ3MgZGVwbG95bWVudCBhdCBzY2FsZSBieSBETlMgb3BlcmF0b3Jz IGluDQogICAgICAgb3JkZXIgdG8gbWFpbnRhaW4gdGhlIHN0YWJpbGl0eSBhbmQgcmVzaWxpZW5j ZSBvZiB0aGUgZ2xvYmFsIEROUy4NCiAgICAgICBUaGUgZG9jdW1lbnQgYWxzbyBwcm92aWRlcyBz b21lIHN1Z2dlc3RlZCBuZXh0IHN0ZXBzIHRvIGFkdmFuY2UgdGhlDQogICAgICAgb3BlcmF0b3Ig Y29tbXVuaXR5J3MgdW5kZXJzdGFuZGluZyBvZiBBRG9UJ3Mgb3BlcmF0aW9uYWwgaW1wYWN0Lg0K ICAgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICANCiAgICANCiAgICANCiAgICBQbGVh c2Ugbm90ZSB0aGF0IGl0IG1heSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGlt ZSBvZiBzdWJtaXNzaW9uDQogICAgdW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYg YXJlIGF2YWlsYWJsZSBhdCB0b29scy5pZXRmLm9yZy4NCiAgICANCiAgICBUaGUgSUVURiBTZWNy ZXRhcmlhdA0KICAgIA0KICAgIA0KDQo= From nobody Mon Jul 8 12:39:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CACD120373 for ; Mon, 8 Jul 2019 12:39:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P_O5LCdu5-Uu for ; Mon, 8 Jul 2019 12:39:36 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCB98120322 for ; Mon, 8 Jul 2019 12:39:28 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id A6C23BE3E; Mon, 8 Jul 2019 20:39:26 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X9SDJMfhk1t8; Mon, 8 Jul 2019 20:39:24 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 9CD47BE24; Mon, 8 Jul 2019 20:39:24 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1562614764; bh=z53Z05wMaaxbCH9RxOlHxYDoTCMRebG4lY9kubJN4hY=; h=Subject:To:References:From:Date:In-Reply-To:From; b=UBe50BxietLJCtVPUenZzpZkAn9Un1j8ROhYIWR9ROw4CWuy97Uo9cYIfpjR7gZWi g4gxsD3/eUr2klFyDFe1ZwSh2qdB5QioMqV2gEGSm+wNjq54Js4xfkcdXj4HRFGwSi 1a6b1bWQrl4rnR1K+nNDEcqwCA7lRZQcsFjQzx8M= To: "Henderson, Karl" , "add@ietf.org" References: <156261197748.1097.13781803597501449499.idtracker@ietfa.amsl.com> <088F4881-BF32-4EC3-907E-DA9538962545@verisign.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <91823055-dc9e-bffe-af80-6ce1233ae19f@cs.tcd.ie> Date: Mon, 8 Jul 2019 20:39:23 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: <088F4881-BF32-4EC3-907E-DA9538962545@verisign.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="hmpFbT56wrIuqtWNmzr8r0ddRkElaHHhH" Archived-At: Subject: Re: [Add] FW: New Version Notification for draft-hal-adot-operational-considerations-00.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 19:39:40 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --hmpFbT56wrIuqtWNmzr8r0ddRkElaHHhH Content-Type: multipart/mixed; boundary="JxWesX16kD1M7xkMDdOlfyvlBejyjv2Qo"; protected-headers="v1" From: Stephen Farrell To: "Henderson, Karl" , "add@ietf.org" Message-ID: <91823055-dc9e-bffe-af80-6ce1233ae19f@cs.tcd.ie> Subject: Re: [Add] FW: New Version Notification for draft-hal-adot-operational-considerations-00.txt References: <156261197748.1097.13781803597501449499.idtracker@ietfa.amsl.com> <088F4881-BF32-4EC3-907E-DA9538962545@verisign.com> In-Reply-To: <088F4881-BF32-4EC3-907E-DA9538962545@verisign.com> --JxWesX16kD1M7xkMDdOlfyvlBejyjv2Qo Content-Type: multipart/mixed; boundary="------------DD9A6874D08E0E21CE6A6E6D" Content-Language: en-GB This is a multi-part message in MIME format. --------------DD9A6874D08E0E21CE6A6E6D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 08/07/2019 19:57, Henderson, Karl wrote: > First version of a proposal for Authoritative DNS over TLS > Operational Considerations. The authors welcome review and feedback. A few comments: - I'm not clear what there is related to applications doing DNS. Calling for detailed and thorough exploration of the effects of turning on TLS between recursive and authoritative servers makes perfect sense and is something that has been absolutely uncontroversial in the dprive WG, which is already chartered to look at exactly that. - Reading the draft I get the strong impression that the authors don't like DNS/TLS in any form. ISTM a good/fair/balanced analysis would not leave such an impression. I assume the authors do agree there are, after all, some benefits to turning on TLS as well. Is that correct? If so, why is there no mention of that side of the coin at all? - draft-green again? Sigh. If you want to re-run that fiasco, then sure, if we must, I'm willing to try help kill that zombie bad idea again if necessary, but do any of us really think going there would be a productive use of time and energy? At a higher level, I had hoped we might have moved on towards more objective analyses by now. This draft doesn't appear to me to be a step in that direction. Cheers, S. >=20 > Regards, Karl Henderson Sr. Researcher Verisign Labs >=20 >=20 > =EF=BB=BFOn 7/8/19, 2:52 PM, "internet-drafts@ietf.org" > wrote: >=20 >=20 > A new version of I-D, > draft-hal-adot-operational-considerations-00.txt has been > successfully submitted by Karl Henderson and posted to the IETF > repository. >=20 > Name: draft-hal-adot-operational-considerations Revision: 00 Title: > Authoritative DNS-over-TLS Operational Considerations Document date: > 2019-07-08 Group: Individual Submission Pages: 12 URL: > https://www.ietf.org/internet-drafts/draft-hal-adot-operational-conside= rations-00.txt > >=20 Status: https://datatracker.ietf.org/doc/draft-hal-adot-operational-consideration= s/ > Htmlized: > https://tools.ietf.org/html/draft-hal-adot-operational-considerations-0= 0 > >=20 Htmlized: https://datatracker.ietf.org/doc/html/draft-hal-adot-operational-consider= ations >=20 >=20 > Abstract: DNS over TLS (DoT) has been gaining attention, primarily as > a means of communication between stub resolvers and recursive > resolvers. There have also been discussions and experiments involving > the use of DoT to communicate with authoritative nameservers > (Authoritative DNS over TLS or "ADoT"), including communication > between recursive and authoritative resolvers. However, we have > identified a number of operational concerns with ADoT. These > operational concerns need to be addressed prior to ADoT's deployment > at scale by DNS operators in order to maintain the stability and > resilience of the global DNS. The document also provides some > suggested next steps to advance the operator community's > understanding of ADoT's operational impact. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of > submission until the htmlized version and diff are available at > tools.ietf.org. >=20 > The IETF Secretariat >=20 >=20 >=20 --------------DD9A6874D08E0E21CE6A6E6D Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------DD9A6874D08E0E21CE6A6E6D-- --JxWesX16kD1M7xkMDdOlfyvlBejyjv2Qo-- --hmpFbT56wrIuqtWNmzr8r0ddRkElaHHhH Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0jm+sACgkQWrL68XsX K+ojLg//XwXFgNASgf7DSNBEtm6dlIsfuTgJZOdSwAoV8LkRFgej/X3YejhvkPpw 0J4o3hEXL0vZkDfA0pyRdgfuTeoNELWyNi1M3QPrUT7UnmpHMNxk4eQ2HreXK6KX sShOj7gsy7svcjzAqEHHYA73vcqjbBTj6tXc2WIyaouAxAqlp6IOxQKb8kecU7HD I5uhJ4Zxeje+NXmQekudDr/FOrtCiMVwN3QWtxNivswSSe6HiV9UnVZOvgk1nrTX oSY3r8wa3nYtioT8oflVifGJmnZ7h9/6/D6bVcm54Ko6VrgCZRIXe0Z+QcTICd4b 1iFzATHYbTX5XpJct5gXD+hh1l3C0PCY6EgwyFYKNmC8KaPPVQw8v3P9rWayOYRw 2D+sDjG2sSNCOwGKfxmA9PHTWSG2Wz0EN+LamVVIPjXt4thbfaHtVz4vdzHBPygP yP9jbmGZgKH0GxKM1IJjEyHpigXqvHi/j0lX9nGsa//AA08ug4KVTJGyoFNghBkJ h4VWstP0ceD5NXqTohSS75KqqlUw1ks2XJlB1s42UVeJQR7NppBgoOFksYP9OGRZ j4z3CaGv0sA2IIdvxN/9tghcBqzhh/h1k4JvkSWlEejIeHun/W6lG4I+2IWaRCA2 Cdsf0jrqOlOKNUV/mm4wHZUi8b3xlIEWwT7tJNZfYV93EKFrvI4= =2OZn -----END PGP SIGNATURE----- --hmpFbT56wrIuqtWNmzr8r0ddRkElaHHhH-- From nobody Mon Jul 8 13:42:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38221120296 for ; Mon, 8 Jul 2019 13:42:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.704 X-Spam-Level: X-Spam-Status: No, score=-0.704 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, PDS_NO_HELO_DNS=1.295, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mozilla.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id az0yzfjkz0tL for ; Mon, 8 Jul 2019 13:42:27 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B903B1202F6 for ; Mon, 8 Jul 2019 13:42:27 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id m24so28884859ioo.2 for ; Mon, 08 Jul 2019 13:42:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mozilla.com; s=google; h=subject:to:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=weaEmWy6BgIpp8XYdmuDRaGdZmksidHWB0mONTsXoQw=; b=e4YoaceWZWsxuya3KWjzx+8FqNrmS25Ay7AG1pUh5uggTD+EJis7iVcX4ibdIS6rPb VhiX7myyizDsB2Tl2hxeC80FhMFu3ZQKcm29QwKKP6A0uDTVmbL0al35KID/ZYle/lZW uBIQlXw06C33tUzH228SJul+YraNrNPQ2PBN4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=weaEmWy6BgIpp8XYdmuDRaGdZmksidHWB0mONTsXoQw=; b=UAmxm8RmaEFoLFlqjOhgJGG/3N4Am2uOnegd26P26PX776ZiPB6As5mDrTzMNgx/QP NgiV0V+GMmRSCwhadur2wmpPjGj0gj7F9j8zXDq9pH85F2xaCmLyovEIS3X2uLjtkZ7w VsA9gXswL+gwdiT3UNWS6+AsuFwxHEzEr5kooonLVFgGLh3C/HTujXYf4ZncsLOcWYXw 9FutzcHP+1pzTGlBlaQnIKOMAF7IxGP6gPCll9n9kouQ25tvYp03DKjGor5zj30sdQyR KFtwh5nX7BJv1pTcnSERjv4yQjB4y8qeg4f7x9Bq6O/nOtOuDX7fFVWK8siWSWlihl15 7IzA== X-Gm-Message-State: APjAAAVTvOl8wxvAnxv2ZulHt7QbWL91ZaOwXLauzc7UwZyj93GF2Qvh 0wXLfp3sbXBTLXHh7Zm8wp29eQ== X-Google-Smtp-Source: APXvYqzCudJ3VUrTqNmAAKD81Zu3PXqqLbeEua9LYFOdwNR6Ow9TYqCD18b6doDaWeq/vf9PZ6imyg== X-Received: by 2002:a02:54c1:: with SMTP id t184mr24706943jaa.10.1562618547015; Mon, 08 Jul 2019 13:42:27 -0700 (PDT) Received: from dragon.local ([76.25.3.152]) by smtp.gmail.com with ESMTPSA id u4sm23965010iol.59.2019.07.08.13.42.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 08 Jul 2019 13:42:26 -0700 (PDT) To: Andy Grover , add@ietf.org References: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> From: Peter Saint-Andre Openpgp: preference=signencrypt Autocrypt: addr=stpeter@mozilla.com; prefer-encrypt=mutual; keydata= mQINBFonEf4BEADvZ+RGsJoOyZaw2rKedB9pBb2nNXVGgymNS9+FAL/9SsfcrKaGYSiWEz7P Lvc97hWH3LACFAHvnzoktv+4IWHjItvhdi9kUQ3Gcbahe55OcdZuSXXH3w5cHF0rKz9aYRpN jENqXM5dA8x4zIymJraqYvHlFsuuPB8rcRIV9SKsvcy14w9iRqu770NjXfE/aIsyRwwmTPiU FQ0fOSDPA/x2DLjed/GYHem90C5vF4Er9InMqH5KAMLnjIYZ9DbPx5c5EME4zW/d648HOvPB bm+roZs4JTHBhjlrTtzDDpMcxHq1e8YPvSdDLPvgFXDcTD4+ztkdO5rvDkbc61QFcLlidU8H 3KBiOVMA/5Rgl4lcWZzGfJBnwvSrKVPsxzpuCYDg01Y/7TH4AuVkv5Na6jKymJegjxEuJUNw CBzAhxOb0H9dXROkvxnRdYS9f0slcNDBrq/9h9dIBOqLhoIvhu+Bhz6L/NP5VunQWsEleGaO 3gxGh9PP/LMyjweDjPz74+7pbyOW0b5VnIDFcvCTJKP0sBJjRU/uqmQ25ckozuYrml0kqVGp EfxhSKVqCFoAS4Q7ux99yT4re2X1kmlHh3xntzmOaRpcZsS8mJEnVyhJZBMOhqE280m80ZbS CYghd2K0EIuRbexd+lfdjZ+t8ROMMdW5L51CJVigF0anyYTcAwARAQABtCdQZXRlciBTYWlu dC1BbmRyZSA8c3RwZXRlckBtb3ppbGxhLmNvbT6JAlQEEwEIAD4WIQQ1VSPTuPTvyWCdvvRl YYwYf2gUqQUCWicR/gIbIwUJCWYBgAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBlYYwY f2gUqdaREAChG8qU1853mP0sv2Mersns8TLG1ztgoKHvMXFlMUpNz6Oi6CjjaMNFhP7eUY4T D43+yQs7f4qCkOAPWuuqO8FbNWQ+yUoVkqF8NUrrVkZUlZ1VZBMQHNlaEwwu1CGoHsLoRohP SiZ0hpmGTWB3V6cDDK4KN6nl610WJbzE9LeKY1AxtePdJi2KM281U0Fz8ntij1jWu0gF2xU4 Sez46JDogHLWKgd0srauhcCVzZjAhiWrXp1+ryzSWYaZO8Kh8SnF1f4o6jtYikMqkxUaI5nX wvD3kNX4AMSkCAZfG7Jcfj/SLDojTcREgO87g7B9bcOOsHN4lj3lHoFV0aXpgPmjfIvAjJHu fHkXZAQAH8w0u9bgJqRn703+A4NPfLopnjegyhlNi7fQ3cMQV1H7Oj7WrB/pCcprx+1u/6Uq oTtDwWh1U5uVthVAI0QojpNWR08zABDX19TlGtVoeygaQV3CAEolxTiYQtCfVavUzUplCZ/t 3v4YiRov+NylflJd+1akyOs1IAgARf444BnoH1fotkpfXNOpp9wUXXwsQcFRdP7vpMkSCkc0 sxPNTVX3ei0QImp4NsrFdaep7LV3zEb3wkAp6KE5Qno4hVVEypULbvB0G6twNZbeRfcs2Rjp jnPb2fofvg2WhAKB20dnRfIfK8OKTD/P+JDcauJANjmekLkCDQRaJxH+ARAApPwkbOTChAQu jMvteb/xcwuL5JZElmLxIqvJhqybV7JknM+3ATyN0CTYQFvPTgIrhpk4zSn0A6pEePdK8mKK 5/aHyd7pr7rLEi1sI/X3UE8ld/E83MExksKrYbs0UX1wSQwYXU6g64KicnuP2Abqg+8wrQ18 1nPcZci9jJI75XVPnTdUpZD5aaQWGp7IJ06NTbiOk30I50ORfulgKoe4m3UfsMALFxIx3pJk oy76xC2tjxYGf+4Uq1M0iK3Wy655GrcwXq/5ieODNUcAZzvK5hsUVRodBq0Lq3g1ivQF4ba7 RQayDzlW6XgoeU49xnCr9XdZYnTnj4iaPmr2NtY6AacBwRz+bJsyugeSyGgHsnVGyUSMk8YN wZHvUykMjH21LLzIUX5NFlcumLUXDOECELCJwewui4W81sI5Sq/WDJet+iJwwylUX22TSulG VwDS+j66TLZpk1hEwPanGLwFBSosafqSNBMDVWegKWvZZVyoNHIaaQbrTIoAwuAGvdVncSQz ttC6KkaFlAtlZt3+eUFWlMUOQ9jxQKTWymyliWKrx+S6O1cr4hwVRbg7RQkpfA8E2Loa13oO vRSQy/M2YBRZzRecTKY6nslJo6FWTftpGO7cNcvbmQ6I++5cBG1B1eNy2RFGJUzGh1vlYo51 pdfSg0U1oPHBPCHNvPYCJ7UAEQEAAYkCPAQYAQgAJhYhBDVVI9O49O/JYJ2+9GVhjBh/aBSp BQJaJxH+AhsMBQkJZgGAAAoJEGVhjBh/aBSpAw0P/1tEcEaZUO1uLenNtqysi3mQ6qAHYALR Df3p2z/RBKRVx0DJlzDfDvJ2R/GRwoo+vyCviecuG2RNKmJbf1vSm/QTtbQMUjwut9mx6KCY CyKwniqdhaMBmjCfV2DB2MxxZLYMtDfx/2mY7vzAci7AkjC+RkSUByMEOkyscUydKC/ETdf9 tvI8GhTY/8Q7JSylS3lQA5pMUHiIf+KpSmqKZeBPkGc7nSKM1w1UKUvFAsyyVsiG6A/hWrTr 7tTQAl7YfjtOGE8n4IKGktvrT99bbh9wdWKZ5FdHUN9hx2Q8VP8+0lR1CH2laVFbEwCOv1vM W4cgQDLxwwpo1iOTdHBVtQDxlQ9hPMKVlB1KP9KjchxuiLc24wLmCjP3pDMml4LQxOYB34Eq cgPZ3uHvJZG309sb2wTMTWaXobWNI++ZrsRD5GTmuzF3kkx3krtrq6HI5NSaemxK6MTDTjDN Rj/OwTl0yU35eJXuuryB20GFOSUsxiw00I2hMGQ1Cy9L/+IW6Dvotd8O3LmKh2tFArzXaKLx /rZyGNurS/Go5YjHp8wdJOs7Ka2p1U31js24PMWO6hf6hIiY2WRUsnE6xZNhvBTgKOY6u0KT V6hTevFqEw7OAZDCWUoE2Ob2/oHGZCCMW5SLAMgp7eihF0kGf2S2CmpIFYXGb61hAD8SqSY7 Fn7V Message-ID: <5a6eb897-56b2-b0c4-9710-7df95dfe844d@mozilla.com> Date: Mon, 8 Jul 2019 14:42:25 -0600 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] new draft: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 20:42:38 -0000 A point of clarification... Paul Hoffman was kind enough to point us to draft-sah-resolver-information and draft-sah-resinfo-doh just now, which intend to solve a similar problem. It's not that we think those I-Ds define a bad approach, instead we missed them entirely. We will read them between now and the Montreal meeting so that we can discuss them intelligently in person and on the relevant discussion lists. Sorry about the lack of due diligence! Peter On 7/8/19 12:29 PM, Andy Grover wrote: > Hello all, > > We've posted an initial draft of draft-grover-add-policy-detection, > which proposes a method of identifying if content filtering or other > policy is implemented on the local resolver, so applications doing DNS > resolution can adjust their behavior. > > Thanks -- Regards -- Andy > > -------- Forwarded Message -------- > Subject: New Version Notification for > draft-grover-add-policy-detection-00.txt > Date: Mon, 08 Jul 2019 10:46:45 -0700 > From: internet-drafts@ietf.org > To: Andy Grover , Peter Saint-Andre > > > > A new version of I-D, draft-grover-add-policy-detection-00.txt > has been successfully submitted by Peter Saint-Andre and posted to the > IETF repository. > > Name: draft-grover-add-policy-detection > Revision: 00 > Title: DNS Resolver-Based Policy Detection Domain > Document date: 2019-07-08 > Group: Individual Submission > Pages: 6 > URL: > https://www.ietf.org/internet-drafts/draft-grover-add-policy-detection-00.txt > Status: > https://datatracker.ietf.org/doc/draft-grover-add-policy-detection/ > Htmlized: > https://tools.ietf.org/html/draft-grover-add-policy-detection-00 > Htmlized: > https://datatracker.ietf.org/doc/html/draft-grover-add-policy-detection > > > Abstract: > This document specifies the behavior that is expected from the Domain > Name System with regard to DNS queries for the special-use domain > name 'TBD.arpa' and designates this domain as a special-use domain > name. > From nobody Mon Jul 8 14:11:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 508AC120086 for ; Mon, 8 Jul 2019 14:11:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bX__xR-gF6cM for ; Mon, 8 Jul 2019 14:11:02 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 3AC12120075 for ; Mon, 8 Jul 2019 14:11:02 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id DB57C5F43074; Mon, 8 Jul 2019 23:11:00 +0200 (CEST) Received: from [172.19.152.50] (p54B8A0E0.dip0.t-ipconnect.de [84.184.160.224]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 4F71B5F42F3A; Mon, 8 Jul 2019 23:11:00 +0200 (CEST) From: "Ralf Weber" To: "Andy Grover" Cc: add@ietf.org Date: Mon, 08 Jul 2019 23:10:59 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> References: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] new draft: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 21:11:05 -0000 Moin! On 8 Jul 2019, at 20:29, Andy Grover wrote: > We've posted an initial draft of draft-grover-add-policy-detection, > which proposes a method of identifying if content filtering or other > policy is implemented on the local resolver, so applications doing DNS > resolution can adjust their behavior. In what way? While there are lots of MUST in the draft for DNS elements I did not find a single word on what applications then do with that information. To get more detailed on the DNS side 5.5 is not how DNS works. Authoritative DNS servers reply with REFUSED or referrals to stuff they don’t know. The can only answer NXDomain if they are authoritative for the domain. 5.4 and 5.6 together are contradictory as a DNS server operator for sure runs a Caching DNS server, but one is MUST (the server software) and one is SHOULD (the server operator). Why, and why does the application description (5.2) doesn’t have any normative language? So long -Ralf —-- Ralf Weber From nobody Mon Jul 8 15:31:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 027811200C5 for ; Mon, 8 Jul 2019 15:31:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9yHPTZA3vKgO for ; Mon, 8 Jul 2019 15:31:02 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DA5C120337 for ; Mon, 8 Jul 2019 15:31:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1562625060; x=2426538660; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=2BIaf9dRLarmC5xBDtVv3RBlIoIOyAJKgMemFZR1w4E=; b=09puLHeO/+SV+q7cSCKPPo03ghG2r6T+CVaP6zqvEl2Mg/zTmo6OQdm+XxFzMDuN xSR/dWUA3SuEONKHAXrEBfalRu6nT/H2Thn8VyyCMRWlZ0V8H7mjoT1J6SbnoT5L JUuqFvR7GZZk5bU7ixr0HrfiJtCGREnIJfkU1OzKgRVUntzLDE4dstwrWdFxW8+l m94XYKYm1b/JdvTFUhVWoQbbh2FFbJ3c5c0x+02yE/fWXfeF5dOgFp0h5wbUVjqC dnv9gJfAssllXwhtBvxx5OH9OgaWQVjOb/zMYDK+inA5GysW7EscRziLC9Lc5TKs JygSF9DQ+8dQKHiCtwNJYA==; X-AuditID: 60729ed4-4a0ee9e00000add3-7f-5d23c4241a63 Received: from COPDCEXC36.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 45.EC.44499.424C32D5; Mon, 8 Jul 2019 16:31:00 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC36.cable.comcast.com (147.191.125.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Mon, 8 Jul 2019 18:30:33 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.006; Mon, 8 Jul 2019 18:30:33 -0400 From: "Livingood, Jason" To: Stephen Farrell , "Henderson, Karl" , "add@ietf.org" Thread-Topic: [Add] FW: New Version Notification for draft-hal-adot-operational-considerations-00.txt Thread-Index: AQHVNb5fg/u+hBB2EkCoeyzVn67q6qbBVW4AgAAL04D//+zDAA== Date: Mon, 8 Jul 2019 22:30:33 +0000 Message-ID: <5028B709-4525-4756-9070-B9FC6640F1E2@cable.comcast.com> References: <156261197748.1097.13781803597501449499.idtracker@ietfa.amsl.com> <088F4881-BF32-4EC3-907E-DA9538962545@verisign.com> <91823055-dc9e-bffe-af80-6ce1233ae19f@cs.tcd.ie> In-Reply-To: <91823055-dc9e-bffe-af80-6ce1233ae19f@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1a.0.190609 x-originating-ip: [96.114.156.8] Content-Type: text/plain; charset="utf-8" Content-ID: <6A360ABC5AE22C439F5F0E63BB7CC9D6@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrOKsWRmVeSWpSXmKPExsWSUDRnsq7KEeVYg7OnVSz+n17HZvH7+XdG i+l7r7E7MHus7b7K5nFi2RVWjyVLfjIFMEc1MNqUZBSlJpa4pKal5hWn2nEpYACbpNS0/KJU 18SinMqg1JzUROzKQCpTUnMyy1KL9LEao4/VnIQupoy/W18yFhyRr/j1/yhbA+MduS5GTg4J AROJg0ubmbsYuTiEBI4wSSzvn8sK4TQzSUw90MgO4ZxilHh6bBcjSAubgJnE3YVXwFpEBPoY JVbuWwCU4OAQFkiT+HmJC8QUEUiXmHMzB6RcRMBJYuvbZewgNouAikTnhWOsIDavgIvE8qfT mSDmb2OU+PaoH6yIU8BW4tr7LcwgNqOAmMT3U2uYQGxmAXGJW0/mM0GcLSCxZM95ZghbVOLl 439gQ0UF9CUOn3vACBFXkNi+fxsLyD3MApoS63fpQ4yxknjd+J0ZwlaUmNL9kB3iHkGJkzOf sEC0ikscPrKDdQKjxCwkm2chTJqFZNIsJJNmIZm0gJF1FSOfpZmeoaGJnqGphZ6RodEmRnDy mXdlB+Pl6R6HGAU4GJV4eDU2KccKsSaWFVfmHmKU4GBWEuHd5w4U4k1JrKxKLcqPLyrNSS0+ xCjNwaIkzjtlknSskEB6YklqdmpqQWoRTJaJg1OqgVH6j1+Lf6hM0hKlqY311yeZyf+a3dZZ ee+ar+Rr3VnsxwQvXHWJVJumfz7EQPBeefvzUtv8zOdn1qbtvsWVrKjfd+6Fx57NvE03nr73 D1P93Hlon1HPWbUThjefsKYL7roez7B2X9TX3FVujkony562hUzo23c//Xr4kqul8zeI5P1q PH22+IESS3FGoqEWc1FxIgA8cuSrOgMAAA== Archived-At: Subject: Re: [Add] FW: New Version Notification for draft-hal-adot-operational-considerations-00.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 22:31:17 -0000 T24gNy84LzE5LCAzOjQwIFBNLCAiQWRkIG9uIGJlaGFsZiBvZiBTdGVwaGVuIEZhcnJlbGwiIDxh ZGQtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2Ygc3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5p ZT4gd3JvdGU6DQo+ICBSZWFkaW5nIHRoZSBkcmFmdCBJIGdldCB0aGUgc3Ryb25nIGltcHJlc3Np b24gdGhhdA0KICAgIHRoZSBhdXRob3JzIGRvbid0IGxpa2UgRE5TL1RMUyBpbiBhbnkgZm9ybS4g DQoNCltKTF0gWW91J3ZlIGVpdGhlciBtaXNyZWFkIHRoZSBkcmFmdCBvciB3ZSBuZWVkIHRvIG1h a2UgdXBkYXRlcyBpbiB0aGUgLTAxIHRvIGZpeCB0aGlzIHBlcmNlcHRpb24uIFRoZSBhdXRob3Jz IGFyZSBpbiBmYWN0IG5vdCBvcHBvc2VkIHRvIERvVCwgYW5kIGFyZSBlbmRlYXZvcmluZyB0byBz b3J0IG91dCBhbGwgdGhlIG9wZXJhdGlvbmFsIGlzc3VlcyB0aGF0IG5lZWQgdG8gYmUgc29ydGVk IHRvIGRvIERvVCBiZXR3ZWVuIGEgcmVjdXJzaXZlIGFuZCBhdXRob3JpdGF0aXZlIHNlcnZlciAt IGF0IHNjYWxlLiBBcyB5b3UgbWlnaHQgaW1hZ2luZSwgYXV0aCBvcGVyYXRvcnMgc3VjaCBhcyBU TEQgb3BlcmF0b3JzIHdpbGwgYmUgdmVyeSBjYXJlZnVsIGluIHRlc3RpbmcgYW5kIGRlcGxveWlu ZyBEb1Qgc3VwcG9ydCBhbmQgd2UncmUgZm9jdXNlZCBvbiBob3cgdG8gbWFrZSBwcm9ncmVzcyBv biB0aGlzIGZyb250LiBBbmQgc3VjaCBhIGRlcGxveW1lbnQgbmVlZHMgdG8gSU1PIGJlIHVuZGVy dGFrZW4gd2l0aCBjbGVhciBleWVzIGFuZCBmb2N1c2luZyBvbiBhbGwgdGhlIHBvc3NpYmxlIHJp c2tzIGFuZCBiYXJyaWVycyB0byBzY2FsaW5nIHVwIGFuZCBvcGVyYXRpbmcgcmVsaWFibHkuIA0K DQo+IElTVE0gYQ0KICAgIGdvb2QvZmFpci9iYWxhbmNlZCBhbmFseXNpcyB3b3VsZCBub3QgbGVh dmUgc3VjaCBhbg0KICAgIGltcHJlc3Npb24uIEkgYXNzdW1lIHRoZSBhdXRob3JzIGRvIGFncmVl IHRoZXJlIGFyZSwNCiAgICBhZnRlciBhbGwsIHNvbWUgYmVuZWZpdHMgdG8gdHVybmluZyBvbiBU TFMgYXMgd2VsbC4NCiAgICBJcyB0aGF0IGNvcnJlY3Q/IElmIHNvLCB3aHkgaXMgdGhlcmUgbm8g bWVudGlvbiBvZg0KICAgIHRoYXQgc2lkZSBvZiB0aGUgY29pbiBhdCBhbGw/DQoNCltKTF0gUGVy aGFwcyB5b3UgYmVsaWV2ZSB0aGVyZSdzIHN0aWxsIGFuIGFyZ3VtZW50IHRha2luZyBwbGFjZSB3 aGVuIHRoZSBhcmd1bWVudCBpbiBmYXZvciBvZiBlbmNyeXB0aW9uIGhhcyBhbHJlYWR5IGJlZW4g d29uIGFuZCB3ZeKAmXJlIGRvd24gdG8gaW1wbGVtZW50YXRpb24/IFRoZSBhdXRob3JzIGRvbuKA mXQgYmVsaWV2ZSBkZXBsb3lpbmcgZW5jcnlwdGVkIEROUyBpcyBpbiBkZWJhdGUgLSBpdCBpcyBn b2luZyB0byBoYXBwZW4uIFRoaXMgaXMgYXJvdW5kIGhvdyB0byBnZXQgYXV0aG9yaXRhdGl2ZSBv cGVyYXRvcnMgdG8gZG8gc28gc3VjY2Vzc2Z1bGx5LCB3aGljaCBtZWFucyBpZGVudGlmeWluZyBh bGwgdGhlIHRlY2huaWNhbC9vcGVyYXRpb25hbCByaXNrcyBhbmQgZGV2ZWxvcGluZyBhcHByb2Fj aGVzIHRvIG1lYXN1cmUsIG1vbml0b3IsIGFuZCBjb250cm9sIGZvciBvciBtaXRpZ2F0ZSB0aGVt LiANCiAgICANCj4gIGRyYWZ0LWdyZWVuIGFnYWluPyBTaWdoLiBJZiB5b3Ugd2FudCB0byByZS1y dW4NCiAgICB0aGF0IGZpYXNjbywgdGhlbiBzdXJlLCBpZiB3ZSBtdXN0LCBJJ20gd2lsbGluZyB0 bw0KICAgIHRyeSBoZWxwIGtpbGwgdGhhdCB6b21iaWUgYmFkIGlkZWEgYWdhaW4gaWYgbmVjZXNz YXJ5LA0KICAgIGJ1dCBkbyBhbnkgb2YgdXMgcmVhbGx5IHRoaW5rIGdvaW5nIHRoZXJlIHdvdWxk IGJlDQogICAgYSBwcm9kdWN0aXZlIHVzZSBvZiB0aW1lIGFuZCBlbmVyZ3k/DQoNCltKTF0gSU1P IHlvdXIgc2FyY2FzbSBpc24ndCBwYXJ0aWN1bGFybHkgY29uc3RydWN0aXZlIGhlcmUuIFRoZSBz ZWN0aW9uIHRoYXQgaXQgaXMgbWVudGlvbmVkIGluIHBlcnRhaW5zIHRvIG9wZXJhdGlvbmFsIG1v bml0b3JpbmcgYW5kIHdlIG1lcmVseSBsaXN0IGEgZmV3IHNvbHV0aW9ucyBkaXNjdXNzZWQgaW4g dGhlIGNvbW11bml0eS4gV2UgY2VydGFpbmx5IG1lYW50IG5vIG9mZmVuc2UuIFNvdW5kcyBsaWtl IHlvdSBtYXkgYmUgYSBiaXQgY2xvc2VyIHRvIHRoYXQgaXNzdWUgYW5kIG1pZ2h0IGhhdmUgc29t ZSBicmllZiBmZWVkYmFjayBhcyB0byB3aHkgdGhhdCAxc3QgYnVsbGV0IHNob3VsZCBiZSByZW1v dmVkLiBXZSBhcmUgcGVyaGFwcyBub3QgYXMgZXhwZXJ0IGFzIHlvdSBvbiB0aGlzIHN1YmplY3Qg KG9yIFJ1c3Mgb3IgUmFscGgsIGV0Yy4pIHNvIHdvdWxkIGFwcHJlY2lhdGUgYW55IHRob3VnaHRz IHlvdSBtYXkgd2lzaCB0byBzaGFyZS4NCg0KICAgIA0KPiAgICBBdCBhIGhpZ2hlciBsZXZlbCwg SSBoYWQgaG9wZWQgd2UgbWlnaHQgaGF2ZSBtb3ZlZA0KICAgIG9uIHRvd2FyZHMgbW9yZSBvYmpl Y3RpdmUgYW5hbHlzZXMgYnkgbm93LiBUaGlzIGRyYWZ0DQogICAgZG9lc24ndCBhcHBlYXIgdG8g bWUgdG8gYmUgYSBzdGVwIGluIHRoYXQgZGlyZWN0aW9uLg0KDQpbSkxdIEknbSBzb3JyeSB5b3Ug ZmVlbCB0aGF0IHdheSAtIHRoaXMgaXMgbm90IHRoZSBpbnRlbnRpb24uIFBlcmhhcHMgc2VlaW5n IHdoYXQgSSBzdGF0ZWQgYWJvdmUsIHRoYXQgRE5TIGVuY3J5cHRpb24gaXMgbm90IGluIGRlYmF0 ZSBhbmQgdGhpcyBpcyBhYm91dCBzdGFydGluZyBhIGNvbnZlcnNhdGlvbiB3aXRoIG9wZXJhdGlv bnMgZm9sa3MgYWJvdXQgaG93IHRvIGdldCBpdCBkb25lIGF0IHNjYWxlLCBtaWdodCBjaGFuZ2Ug eW91ciBwZXJjZXB0aW9uIGFuZCBhc3N1bXB0aW9ucyBhYm91dCB0aGlzIGRyYWZ0PyBJZiBub3Qg dGhlbiBJIHN1cHBvc2Ugd2UnbGwgbmVlZCB0byBjb25zaWRlciBhZGRpbmcgc29tZSBtb3JlIGV4 cGxpY2l0IHRleHQgYWJvdXQgdGhhdC4NCg0KVGh4DQpKTA0KIA0KDQo= From nobody Mon Jul 8 15:48:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C8CA8120299 for ; Mon, 8 Jul 2019 15:48:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oY8ovzr2zvSe for ; Mon, 8 Jul 2019 15:48:06 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3DC8F12033F for ; Mon, 8 Jul 2019 15:48:06 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 75498BE50; Mon, 8 Jul 2019 23:48:04 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8vLlOJYDbRF3; Mon, 8 Jul 2019 23:48:02 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 86BF1BE4D; Mon, 8 Jul 2019 23:48:02 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1562626082; bh=mAs4Rx2eIt6idJuBi6MKZ28lJ3YfBucX+aZEVxwvVPY=; h=From:Subject:To:References:Date:In-Reply-To:From; b=YxQXKvddnhJaLqn0uNyMmNAq2riQFxslSsSTGObNTUCeZIrhpkrDLgqbiZOiVXv83 4EmswqC97TykUoHW5ajLLI7b7XvEEvGagvbRCY6oG611a/0+ediLoGdu+nKB0KkMoT ZOQY7pam3pJhoAly3dVA/jvhxO15e60RNHtNtAvA= From: Stephen Farrell To: "Livingood, Jason" , "Henderson, Karl" , "add@ietf.org" References: <156261197748.1097.13781803597501449499.idtracker@ietfa.amsl.com> <088F4881-BF32-4EC3-907E-DA9538962545@verisign.com> <91823055-dc9e-bffe-af80-6ce1233ae19f@cs.tcd.ie> <5028B709-4525-4756-9070-B9FC6640F1E2@cable.comcast.com> Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <8b89c2f6-4f82-f5b3-dbee-3469266be21b@cs.tcd.ie> Date: Mon, 8 Jul 2019 23:48:01 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: <5028B709-4525-4756-9070-B9FC6640F1E2@cable.comcast.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="pzpG6D7a7XDzoi4XWgKMccTRNrVQUbB6Y" Archived-At: Subject: Re: [Add] FW: New Version Notification for draft-hal-adot-operational-considerations-00.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 22:48:20 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --pzpG6D7a7XDzoi4XWgKMccTRNrVQUbB6Y Content-Type: multipart/mixed; boundary="af3eTw55K0B5gG5WtnHgli60l9gJQawgp"; protected-headers="v1" From: Stephen Farrell To: "Livingood, Jason" , "Henderson, Karl" , "add@ietf.org" Message-ID: <8b89c2f6-4f82-f5b3-dbee-3469266be21b@cs.tcd.ie> Subject: Re: [Add] FW: New Version Notification for draft-hal-adot-operational-considerations-00.txt References: <156261197748.1097.13781803597501449499.idtracker@ietfa.amsl.com> <088F4881-BF32-4EC3-907E-DA9538962545@verisign.com> <91823055-dc9e-bffe-af80-6ce1233ae19f@cs.tcd.ie> <5028B709-4525-4756-9070-B9FC6640F1E2@cable.comcast.com> In-Reply-To: <5028B709-4525-4756-9070-B9FC6640F1E2@cable.comcast.com> --af3eTw55K0B5gG5WtnHgli60l9gJQawgp Content-Type: multipart/mixed; boundary="------------34A4C22F7D2FB82E0BA187DE" Content-Language: en-GB This is a multi-part message in MIME format. --------------34A4C22F7D2FB82E0BA187DE Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 08/07/2019 23:30, Livingood, Jason wrote: > On 7/8/19, 3:40 PM, "Add on behalf of Stephen Farrell" > wrote: >> Reading the draft I get the strong impression that > the authors don't like DNS/TLS in any form. >=20 > [JL] You've either misread the draft or we need to make updates in > the -01 to fix this perception. The authors are in fact not opposed > to DoT, and are endeavoring to sort out all the operational issues > that need to be sorted to do DoT between a recursive and > authoritative server - at scale. As you might imagine, auth operators > such as TLD operators will be very careful in testing and deploying > DoT support and we're focused on how to make progress on this front. > And such a deployment needs to IMO be undertaken with clear eyes and > focusing on all the possible risks and barriers to scaling up and > operating reliably. Ok, maybe the draft-green reference (see below) hit too sore a sore-point but I'd expected to see e.g. some consideration that authoritative servers might (or might not) prefer that not all accesses to the names they serve end up in passive DNS databases, and that they might prefer their answers not be as easily modified en-route if there is a feasible way to get to use of TLS at scale (and presumably if they're not doing DNSSEC). I mean, if there's no benefit in turning it on, they just won't, and there won't be any new problem. If they do turn it on, presumably that'd be for some positive reason and not just in reaction to some kind of peer pressure. >=20 >> ISTM a > good/fair/balanced analysis would not leave such an impression. I > assume the authors do agree there are, after all, some benefits to > turning on TLS as well. Is that correct? If so, why is there no > mention of that side of the coin at all? >=20 > [JL] Perhaps you believe there's still an argument taking place when > the argument in favor of encryption has already been won and we=E2=80=99= re > down to implementation? The authors don=E2=80=99t believe deploying enc= rypted > DNS is in debate - it is going to happen. This is around how to get > authoritative operators to do so successfully, which means > identifying all the technical/operational risks and developing > approaches to measure, monitor, and control for or mitigate them. Again, being careful ahead of time for recursive to authoritative has been assumed by everyone involved in dprive with whom I've spoken at least. And that makes total sense. >> draft-green again? Sigh. If you want to re-run > that fiasco, then sure, if we must, I'm willing to try help kill that > zombie bad idea again if necessary, but do any of us really think > going there would be a productive use of time and energy? >=20 > [JL] IMO your sarcasm isn't particularly constructive here.=20 I wasn't being sarcastic, I mean every word literally. Which is sad, but draft-green and associated things caused about 2 years of major angst and kerfuffle in the TLS WG and is the cause of a sorta rift between the IETF and ETSI (who rubber-stamped the proposal rejected by TLS and then called that eTLS), so this is a really bad reference to include. And draft-green was all about weakening TLS. Honestly, if you can get out another rev before the cutoff that omitted that, I suspect you'd save you and us all some time. > The > section that it is mentioned in pertains to operational monitoring > and we merely list a few solutions discussed in the community. We > certainly meant no offense. Sounds like you may be a bit closer to > that issue and might have some brief feedback as to why that 1st > bullet should be removed. We are perhaps not as expert as you on this > subject (or Russ or Ralph, etc.) so would appreciate any thoughts you > may wish to share. >=20 >=20 >> At a higher level, I had hoped we might have moved > on towards more objective analyses by now. This draft doesn't appear > to me to be a step in that direction. >=20 > [JL] I'm sorry you feel that way - this is not the intention. Perhaps > seeing what I stated above, that DNS encryption is not in debate and > this is about starting a conversation with operations folks about how > to get it done at scale, might change your perception and assumptions > about this draft? If not then I suppose we'll need to consider adding > some more explicit text about that. I do think some consideration of the benefits helps to evaluate the costs, yes. And apologies if I've over-reacted to the draft-green reference, but my interpretation of that is that it was entirely about debating the core design of TLS, and weakening that. Cheers, S. >=20 > Thx JL >=20 >=20 --------------34A4C22F7D2FB82E0BA187DE Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------34A4C22F7D2FB82E0BA187DE-- --af3eTw55K0B5gG5WtnHgli60l9gJQawgp-- --pzpG6D7a7XDzoi4XWgKMccTRNrVQUbB6Y Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0jyCEACgkQWrL68XsX K+rLvw//T2UFwk/z1uLNQXPcSQJ+IIQFo4AEGgVcHFeHbf6bYHN09OGLsUWWj5vJ nbAVy9VqhySXO6xBVLkKZnjB4Uym2TyX+9UhLowflIkIlrCskcq7dVcVUNNvdXtN z4BQDKEKgOQHXBqNtosrXgJ/kOfLFoxczaU4T99cbjlvLC6B//XgUE6uxASfhsVR Wjur4I3iaj00mjLVK5/ulciu8ENVuBayZKKkLj4x+Mnch5u+8Avm0IrD6sZ2XlaA x/0HWzTe63iQKD2oR8PWyUmXk9554GM0TYc/JTcrbXEPg5gxrSajEf73LwQ6oBOr qgqmteTC2pF/xxUb/0CbrMvaZr10SbllxbkTSY8dyxuTr9V6NKA923cz2xQlxvTS wn/A1PgB93fAAzvEDMTlGTqJgBEhIbwmmQplOQFb06L8JluPSybkhIpFxCCTG9hS Qb8xjQSF8V7Tk5sZGLjQG/hiKTaIoAgmCqPNU2aDl+yad/yILCEziIlPFewJyI0L u4vE7Xtm/mw46hXoYg0A1LDRpeIJv7kWxmLPnCpBYaPRwDLOnPsXiYIDviV3bmau gXfupv6IiT23rj1r7L9mJP8IsTQ7ehFTWW3rPr3hvf9+4hDCYV8csJvJwJMmt7V9 KgAMJtLO7BthJm6UrmF9aZE9EvO1ZQDu3PNDlttz8Zv/eJ5my2I= =oWN0 -----END PGP SIGNATURE----- --pzpG6D7a7XDzoi4XWgKMccTRNrVQUbB6Y-- From nobody Mon Jul 8 18:29:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A685012023F for ; Mon, 8 Jul 2019 18:29:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qqM3qE7noPl3 for ; Mon, 8 Jul 2019 18:29:31 -0700 (PDT) Received: from burnttofu.net (burnttofu.net [IPv6:2607:fc50:1:9d00::9977]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B85C5120307 for ; Mon, 8 Jul 2019 18:29:29 -0700 (PDT) Received: from elwha.brokendns.net (elwha.brokendns.net [IPv6:2607:f2f8:a544:0:0:0:0:2]) by burnttofu.net (8.15.2/8.15.2) with ESMTPS id x691THLX009849 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Mon, 8 Jul 2019 21:29:19 -0400 (EDT) (envelope-from michael@brokendns.net) Received: from kimberton.burnttofu.net (unknown [IPv6:2604:5500:c2c2:fb00::7777]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by elwha.brokendns.net (5.65c/IDA-1.4.4/5.63) with ESMTPSA id AD6945D253; Mon, 8 Jul 2019 18:29:16 -0700 (PDT) To: Stephen Farrell , "Livingood, Jason" , "Henderson, Karl" , "add@ietf.org" References: <156261197748.1097.13781803597501449499.idtracker@ietfa.amsl.com> <088F4881-BF32-4EC3-907E-DA9538962545@verisign.com> <91823055-dc9e-bffe-af80-6ce1233ae19f@cs.tcd.ie> <5028B709-4525-4756-9070-B9FC6640F1E2@cable.comcast.com> <8b89c2f6-4f82-f5b3-dbee-3469266be21b@cs.tcd.ie> From: Michael Sinatra Message-ID: <24392f2e-9f42-d778-2546-34f2bd1f160d@brokendns.net> Date: Mon, 8 Jul 2019 18:29:10 -0700 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <8b89c2f6-4f82-f5b3-dbee-3469266be21b@cs.tcd.ie> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.6.2 (burnttofu.net [IPv6:2607:fc50:1:9d00:0:0:0:9977]); Mon, 08 Jul 2019 21:29:20 -0400 (EDT) Archived-At: Subject: Re: [Add] FW: New Version Notification for draft-hal-adot-operational-considerations-00.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2019 01:29:33 -0000 Howdy, On 2019-07-08 15:48, Stephen Farrell wrote: > > Hiya, > > On 08/07/2019 23:30, Livingood, Jason wrote: >> On 7/8/19, 3:40 PM, "Add on behalf of Stephen Farrell" >> wrote: >>> Reading the draft I get the strong impression that >> the authors don't like DNS/TLS in any form. >> >> [JL] You've either misread the draft or we need to make updates in >> the -01 to fix this perception. The authors are in fact not opposed >> to DoT, and are endeavoring to sort out all the operational issues >> that need to be sorted to do DoT between a recursive and >> authoritative server - at scale. As you might imagine, auth operators >> such as TLD operators will be very careful in testing and deploying >> DoT support and we're focused on how to make progress on this front. >> And such a deployment needs to IMO be undertaken with clear eyes and >> focusing on all the possible risks and barriers to scaling up and >> operating reliably. For the most part, as an authoritative server operator, I found the draft to be useful and informative. But I do agree with Stephen on two counts: First, parts of the draft, notably section 1.1, tend to be overly dismissive of the benefits of ADoT in their tone. That section appears to come to the conclusion that there are limited benefits to ADoT versus recursive DoT (rDoT?) or other forms of encryption. A counter example is recursive resolvers running on home networks, where the customer can be identified by the recursive server making the queries. EDNS(0) Client Subnet is another, as identified by the draft. Although Section 1.1 seems to acknowledge that the jury is still out, parts of it are written *as though* a conclusion has already been achieved. Perhaps an additional avenue for study is to examine the various use-cases and analyze the risks and benefits of DNS encryption. [snip] >>> draft-green again? Sigh. If you want to re-run >> that fiasco, then sure, if we must, I'm willing to try help kill that >> zombie bad idea again if necessary, but do any of us really think >> going there would be a productive use of time and energy? >> >> [JL] IMO your sarcasm isn't particularly constructive here. > > I wasn't being sarcastic, I mean every word literally. Which is > sad, but draft-green and associated things caused about 2 years > of major angst and kerfuffle in the TLS WG and is the cause of > a sorta rift between the IETF and ETSI (who rubber-stamped the > proposal rejected by TLS and then called that eTLS), so this is > a really bad reference to include. And draft-green was all about > weakening TLS. Honestly, if you can get out another rev before > the cutoff that omitted that, I suspect you'd save you and us > all some time. The second agreement I have is that I'd like not to see static D-H given much (if any) consideration in the doc. Since the audience is DNS server operators, I'd rather see considerations for instrumenting the *servers* (recursive and/or authoritative) so that monitoring information can be *securely* transmitted and analyzed. I didn't participate in the debate around draft-green, but I spent some time several months ago reading the TLS WG mailing list archives (and I can speculate that it was MUCH easier to spend 1-2 hours reading mail archives than to spend 1-2 years actually participating in the debate), and I'd like to believe that the questions are settled and that we probably don't want to re-open them. Put differently, since we're talking about DNS-over-*TLS*, then we should trust the TLS WG to have done the right thing consensus-wise and build upon their work rather than re-inspecting it (or giving the appearance that we want to do so). And I do think there are other ways of solving the monitoring consideration (e.g. logging or post-decryption dnstap-like functionality) that should appear in section 3.5 that might well provide a quite reasonable alternative to weakening TLS. That brings up one picky point: The bullet point about the use of a TLS proxy has implications for both section 3.5 and 3.6, not just 3.6, as DNS queries could be monitored post-encryption between the proxy and server endpoint. So it's a potential solution to both monitoring and architectural issues that may arise. Overall there's a lot to think about here, and I appreciate the effort, and plan to go over these considerations more carefully in the coming days--and may have additional comments. michael From nobody Tue Jul 9 02:26:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B9AE1203F8 for ; Tue, 9 Jul 2019 02:26:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0ovoXKUEvh1e for ; Tue, 9 Jul 2019 02:26:32 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 396FB1203E8 for ; Tue, 9 Jul 2019 02:26:32 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 0A0646A234; Tue, 9 Jul 2019 11:26:30 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1562664390; bh=JquWR4Jr58JLT/LDHC8UkaaDeC5KLWkSEBbiiLI3k/8=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From; b=vn3MzieQ3+RrhbZeI9NETQbTzeV7hMWS8qoNEm+pjCmvaThFm8pg7qybN53JPWtys TQ7yOZzDkOVS4NydzTMtyUOCjzp0zXOA5Ma2jBxcQlG84/jKvMyVzjxoIBaNOp9rUT xDWI2FnDn13L3mKH2lZVNTgn1emiXZ9DPTEJj5X0L4j8wzi+CT+GE9TSBDE8fSwhp+ fpcp5/EMrSYx6apkdvWXEYOy7rr20ZvVFwzHIxNN+ZJhnvmN8bR0Kwte/t2UrASAI0 bJbKJKOmhxrks5qYhpwqPdm6mI8exLujZXlRdM8KLe9LvZFyq58TKg787vM5yDQ0we CtDVh5yUo5vhQ== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id F24193C03A4; Tue, 9 Jul 2019 11:26:29 +0200 (CEST) Date: Tue, 9 Jul 2019 11:26:29 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Peter Saint-Andre , Andy Grover , add@ietf.org Message-ID: <690466758.309.1562664389937@appsuite-gw1.open-xchange.com> In-Reply-To: <5a6eb897-56b2-b0c4-9710-7df95dfe844d@mozilla.com> References: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> <5a6eb897-56b2-b0c4-9710-7df95dfe844d@mozilla.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev6 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] new draft: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2019 09:26:34 -0000 > Il 8 luglio 2019 22:42 Peter Saint-Andre ha scritto: > > > A point of clarification... > > Paul Hoffman was kind enough to point us to > draft-sah-resolver-information and draft-sah-resinfo-doh just now, which > intend to solve a similar problem. It's not that we think those I-Ds > define a bad approach, instead we missed them entirely. We will read > them between now and the Montreal meeting so that we can discuss them > intelligently in person and on the relevant discussion lists. > > Sorry about the lack of due diligence! Still, if I remember the two sah drafts correctly, they define the basic framework for discovering information about the local resolver, but neither deals with discovering local policy, so we could still turn this effort into an additional document building on sah-resolver to add that piece of information. If we do, however, I would suggest that we work on a much more nuanced expression of policy behaviour, including the origin of the policy (user, network or law) and perhaps even a description of the reasons and of the types of destinations that are affected. While "neutral" applications might just want to discover that policy exists and avoid Do*-to-the-cloud in any such case, I would expect "opinionated" applications ;-) to behave differently depending on specific policy types and sources, as well as, maybe, the location of the user and other factors. In such case, and barring the problem of lying resolvers, having more detailed information would lead to matching the expectations of the user much more precisely. Ciao, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Tue Jul 9 03:08:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4F791203FC for ; Tue, 9 Jul 2019 03:08:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=m/oO4dTw; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=0CdVTDkj Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3PvIWQZQ1sbQ for ; Tue, 9 Jul 2019 03:08:07 -0700 (PDT) Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 266CD120390 for ; Tue, 9 Jul 2019 03:08:07 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 4CD0E21391 for ; Tue, 9 Jul 2019 06:08:06 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Tue, 09 Jul 2019 06:08:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=jx70Kt5DJBbhaom8Fzrh+pKAPODcObY 4nPzfY97tI3c=; b=m/oO4dTw47JyV4x/uQb05GLm5WsFx833I+OwkLgDXsHP0n0 4fJVtWM3S+S/MY4Ec/+yxuudtcUzcnpvcKTlYawzaahUTeF0hOtfTiPuEVaP0ZyE blvnSFdu/uUxHziQlhJvUVxq/mtet63F171+DPFKzwggCdW1pV0SlpyIquj1qRvo yoxk/wSMUSIWtFx2L4cUpCjoqNz9R6lsfSWWsI9O9LDnH+wpn1LLTqFgDb2hzmx+ ww/b0Ye2UvkkqPLvdiQPKkWekgh2ufpWhOgkYWtqaWqsB5JCtZLT1jT+N4THx870 uq32K4gBoRt1thtLAIc3f12nLhmoAKYhisYvt7w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=jx70Kt 5DJBbhaom8Fzrh+pKAPODcObY4nPzfY97tI3c=; b=0CdVTDkjRIzW9YPrvxJEnH 7KKpP8LsudRkd4DjhKRbGFzJfZkO9Xn6buhZ0EENmCm7mq69+ZbefLoHz2siS98O 3JWVTiNP1vYpcbLJiA9ZAhz5KEuzO6RVIFh+lS6dOkIu2buV245cuAmQSu2+TWuh edT9/x4Wawmec2CHFjqjN6u5Le7E/ug4uWAXQ1/Rqy50I8TEDyK9b8Og+W6j38oi oiBloPdGbrRJ0xs+ZKGoGsq/qHr6ZbUXuHHjc6NhQrYDqJ1y2d8+jrtVHlN6HngD bbE7+D1oXgcM0wykQsybKKyzMpxp4yuhU2lBKQqF8sfTDAOyU6Co90Zr2KjHbrFA == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrgedvgddvjecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofi gvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id C4AF1E0193; Tue, 9 Jul 2019 06:08:05 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-731-g19d3b16-fmstable-20190627v1 Mime-Version: 1.0 Message-Id: In-Reply-To: <690466758.309.1562664389937@appsuite-gw1.open-xchange.com> References: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> <5a6eb897-56b2-b0c4-9710-7df95dfe844d@mozilla.com> <690466758.309.1562664389937@appsuite-gw1.open-xchange.com> Date: Tue, 09 Jul 2019 20:08:05 +1000 From: "Martin Thomson" To: add@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Add] new draft: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2019 10:08:09 -0000 On Tue, Jul 9, 2019, at 19:26, Vittorio Bertola wrote: > Still, if I remember the two sah drafts correctly, they define the > basic framework for discovering information about the local resolver, > but neither deals with discovering local policy, That was my understanding also, which makes this useful at least in terms of framing. As an extension to the -sah drafts, if that is where the community is headed (I have my reservations), and this fits there, then changing to fit into that framework makes sense. As it stands, this seems much easier to implement. > If we do, however, I would suggest that we work on a much more nuanced > expression of policy behaviour, [...] In such case, and barring the problem of lying > resolvers, having more detailed information would lead to matching the > expectations of the user much more precisely. This is a more difficult point. If the intent is to build this sort of infrastructure, then I agree that it needs a lot more rigour. Probably both along the lines you suggest here, and finding ways in which that information can be authenticated. Personally, I don't hold high hopes of that sort of approach being successful, but only because the task is extraordinarily large in scope. If you include authentication, that likely requires building decentralized systems for establishing accountability, which is one of the Hard problems. My understanding of the approach Andy suggests that it is much less ambitious in scope. As I understand this, the view is that choosing your own resolver is important enough to deploy by default. Maybe that view says that it is inevitable. Importantly, it recognizes that this can't be a global default starting tomorrow. There will need to be an adjustment period. People use DNS in ways that are incompatible with this approach, which leads to surprising outcomes (like inadvertent circumvention of certain local policies). By providing an option to disable use of BYOR, this gives local administrators time to adjust their strategy. As you say, this is not an idea contemplated by the -sah drafts, but it could be complementary. Cheers, Martin From nobody Tue Jul 9 04:12:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79FC11200E9 for ; Tue, 9 Jul 2019 04:12:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verisign.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vv_CqNDp7h2F for ; Tue, 9 Jul 2019 04:12:36 -0700 (PDT) Received: from mail5.verisign.com (mail5.verisign.com [69.58.187.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63626120127 for ; Tue, 9 Jul 2019 04:12:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verisign.com; l=2476; q=dns/txt; s=VRSN; t=1562670757; h=from:to:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version:subject; bh=sXSwzLmmAcucuMl7LSTck2OwgQWOh/hI08f8shspCgE=; b=MFiIzaz4gm9HFBvZQnyHb34Kr2+BSEf2bjo3z5US/f78Y0gLf28Gm0D2 AIQB+elT+6HOA1h1DrgeU712KxRXyZKo5rp0uzR+4P/SzDEAZfUTaWmg9 SNJtzTx6OnEl2i9Z3ggZ8pzp6GIDHpaCxHIX56zgDm2TWAjRCy4QSoeBs vhN7HFbEZnbtPYM8995GUWPdx/k7ri8m8eV7zWynlAdru8VwvrjMo+JSm RqY9zfzP2Y7+heASWGhVhYoV2yQVA8UsYoFPLHmhjxWAv5VPuZMFRfD1D PMhVVXb0++MLmamDJQlvQKUvYsTN8wSTdxfTe10DfFvWXw4ZVQex+3AAx A==; X-IronPort-AV: E=Sophos;i="5.63,470,1557201600"; d="scan'208";a="7864832" IronPort-PHdr: =?us-ascii?q?9a23=3Az4DCTB3GGNr8a7wysmDT+DRfVm0co7zxezQtwd?= =?us-ascii?q?8ZsesXI//xwZ3uMQTl6Ol3ixeRBMOHsqgC17Cd6PCocFdDyK7JiGoFfp1IWk?= =?us-ascii?q?1NouQttCtkPvS4D1bmJuXhdS0wEZcKflZk+3amLRodQ56mNBXdrXKo8DEdBA?= =?us-ascii?q?j0OxZrKeTpAI7SiNm82/yv95HJbAhEmSSxbal9IRmoogncuMobipZ+J6gszR?= =?us-ascii?q?fEvmFGcPlMy2NyIlKTkRf85sOu85Nm7i9dpfEv+dNeXKvjZ6g3QqBWAzogM2?= =?us-ascii?q?Au+c3krgLDQheV5nsdSWoZjBxFCBXY4R7gX5fxtiz6tvdh2CSfIMb7Q6w4VS?= =?us-ascii?q?ik4qx2ThLjlSUJOCMj8GzPisJ+kr9VoA6vqRJ8zY7bYoCVO+ZxcKzSZt4aWX?= =?us-ascii?q?FOXsRNWyBdHo+xbY0CBPcBM+ZCqIn9okMDoRW8CwmrAOPvziFHhnnt0qIkz+?= =?us-ascii?q?shEhnK1xE9Ed0St3TUsMn1OKkPWu2y16nIzTLDb/dS2Tjj7ojHaQ4uru2PXb?= =?us-ascii?q?9rb8re11MvFwLejlWRpozlOSmZ2fgKs2ie9udtU/+khWAgqwF0uDevx8Esh5?= =?us-ascii?q?HIho0L1lDE+z91wIEvJd23TkNwfN2qEINIui2HK4d6WN4uTmNmtSog17ELuZ?= =?us-ascii?q?C2cDIFxZkk3xLTduCLf5KV7h/hSOqdOyp0iX1mdb6lmhq/8lCsyuPiWcS3zF?= =?us-ascii?q?pHqy9In9vQuXwRzRPe79WLRedh8Uqk2TuAyh7c6u9BLE0wiKXUNoAuz7gtnZ?= =?us-ascii?q?QJq0vDBDX5mEDuga+TcUUr5/an5vz8YrXjup+cL4h0ihziMqg2msywH+A4Mg?= =?us-ascii?q?8WUmWG5eqyzKDv8k3hTrtFj/I6jrTVvIrEJcsHoa65GRdV3pw55BmiFTumzs?= =?us-ascii?q?4YnWIBLF5fZB2HiI3pN0nPIPD+E/i/n0yhnCp3y/zcI7HsAJvAImLenLrhc7?= =?us-ascii?q?tx8UFRxQkrwdBa/Z1UC7UBIPzpWk/2sdzVFgQ5Mwyzw+bjDNVyyIUeVnmRDa?= =?us-ascii?q?CFM6PfqkGI6fw1I+mNf48VuTn9K/4/6/Hyin85nEcRfbO10psPdHC4AvNmLl?= =?us-ascii?q?2CYXrwnNgBCWcKsRQ4TODwhl2NSyRTZ2ysUKI44jE2E56pDZzZSoCxnLOOwT?= =?us-ascii?q?23HpxIaWpeEFCDDW/od5mYW/cLcC+SIc9hnSICVbe8VYAhzwqutAj8y7d/Ie?= =?us-ascii?q?fY5jMYuoz51Nh0/O3TlB4y9TpuA8uB1GGNSnp5kX4NRzAsxqBwvVZxylad3q?= =?us-ascii?q?hkjfxUD9tT5+lGUg0iL57T0/R6C8zuWgLGZtqGUkupTci9DDEwUN0x39EOb1?= =?us-ascii?q?x6G9W4gRCQlxatVvUOi7GTBJEytKzVxWL8I8JVwG2AyKItyVgrCIMbLnGrnq?= =?us-ascii?q?5y8U7dDpTTnkGdv62xM7gX0GjM+THHhSCNvExeXANqSqLDCCxHeEbMrM/46U?= =?us-ascii?q?WERLirIbgiOxFKj8+PNqUMbcfmxx0SR/fuPtjTeXm2nTLsXQiF3LKXbYXsPW?= =?us-ascii?q?4a2Q3RDUEemEYS8GqIcw8kCXHl6yjXADBGFF/zbQXr6+Y04CeyQkMczgyWYQ?= =?us-ascii?q?tmzbXjqTAPgvnJAdMU2rYJvi0soDYwVG222M7KQZLUvApmeKFRZ9kw61Rvy2?= =?us-ascii?q?/Dthd8MZrmJKdn0A1NOz9rtl/jgk0kQr5LltIn+Ssn?= X-IPAS-Result: =?us-ascii?q?A2E3AAD7dSRd/zCZrQpmGwEBAQEDAQEBBwMBAQGBVgMBA?= =?us-ascii?q?QELAYMAgSwKhBKUcJpvCQEBAQEBAQEBAQcBJQoBAQKEPgIXglA3Bg4BAwEBA?= =?us-ascii?q?QQBAQEBBAEBAQKGJQyCOiIcTWsBAQEBAQEjAkQsAQEBAQMdBhE6CQ4EAgEIE?= =?us-ascii?q?QQBAQECAh8HAgICMBUICAIEARIIgxuCGQOqOoEyhDIBhXwGgQwoAYt1gUE+h?= =?us-ascii?q?CM+gmECAoF2gnOCWASLdoJ2m2YDBgKCF4ZWjScjgiyHIY4zjTCHQY99AgQCB?= =?us-ascii?q?AUCFYFmgXtwUIJsgniIToU/cgGOYoEhAQE?= Received: from BRN1WNEX02.vcorp.ad.vrsn.com (10.173.153.49) by BRN1WNEX01.vcorp.ad.vrsn.com (10.173.153.48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Tue, 9 Jul 2019 07:12:33 -0400 Received: from BRN1WNEX02.vcorp.ad.vrsn.com ([fe80::7c0a:1cc:5def:9dde]) by BRN1WNEX02.vcorp.ad.vrsn.com ([fe80::7c0a:1cc:5def:9dde%4]) with mapi id 15.01.1713.004; Tue, 9 Jul 2019 07:12:33 -0400 From: "Hollenbeck, Scott" To: "stephen.farrell@cs.tcd.ie" , "khenderson=40verisign.com@dmarc.ietf.org" , "add@ietf.org" Thread-Topic: [EXTERNAL] Re: [Add] FW: New Version Notification for draft-hal-adot-operational-considerations-00.txt Thread-Index: AQHVNcTpkF8fzHxp+0SxWBiKU28zA6bCIdFA Date: Tue, 9 Jul 2019 11:12:33 +0000 Message-ID: References: <156261197748.1097.13781803597501449499.idtracker@ietfa.amsl.com> <088F4881-BF32-4EC3-907E-DA9538962545@verisign.com> <91823055-dc9e-bffe-af80-6ce1233ae19f@cs.tcd.ie> In-Reply-To: <91823055-dc9e-bffe-af80-6ce1233ae19f@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.170.148.18] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Add] FW: New Version Notification for draft-hal-adot-operational-considerations-00.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2019 11:12:39 -0000 PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBBZGQgPGFkZC1ib3VuY2VzQGll dGYub3JnPiBPbiBCZWhhbGYgT2YgU3RlcGhlbiBGYXJyZWxsDQo+IFNlbnQ6IE1vbmRheSwgSnVs eSA4LCAyMDE5IDM6MzkgUE0NCj4gVG86IEhlbmRlcnNvbiwgS2FybCA8a2hlbmRlcnNvbj00MHZl cmlzaWduLmNvbUBkbWFyYy5pZXRmLm9yZz47DQo+IGFkZEBpZXRmLm9yZw0KPiBTdWJqZWN0OiBb RVhURVJOQUxdIFJlOiBbQWRkXSBGVzogTmV3IFZlcnNpb24gTm90aWZpY2F0aW9uIGZvciBkcmFm dC1oYWwtDQo+IGFkb3Qtb3BlcmF0aW9uYWwtY29uc2lkZXJhdGlvbnMtMDAudHh0DQo+DQo+DQo+ IEhpeWEsDQo+DQo+IE9uIDA4LzA3LzIwMTkgMTk6NTcsIEhlbmRlcnNvbiwgS2FybCB3cm90ZToN Cj4gPiBGaXJzdCB2ZXJzaW9uIG9mIGEgcHJvcG9zYWwgZm9yIEF1dGhvcml0YXRpdmUgRE5TIG92 ZXIgVExTIE9wZXJhdGlvbmFsDQo+ID4gQ29uc2lkZXJhdGlvbnMuIFRoZSBhdXRob3JzIHdlbGNv bWUgcmV2aWV3IGFuZCBmZWVkYmFjay4NCj4NCj4gQSBmZXcgY29tbWVudHM6DQo+DQo+IC0gSSdt IG5vdCBjbGVhciB3aGF0IHRoZXJlIGlzIHJlbGF0ZWQgdG8gYXBwbGljYXRpb25zIGRvaW5nIERO Uy4gQ2FsbGluZyBmb3INCj4gZGV0YWlsZWQgYW5kIHRob3JvdWdoIGV4cGxvcmF0aW9uIG9mIHRo ZSBlZmZlY3RzIG9mIHR1cm5pbmcgb24gVExTIGJldHdlZW4NCj4gcmVjdXJzaXZlIGFuZCBhdXRo b3JpdGF0aXZlIHNlcnZlcnMgbWFrZXMgcGVyZmVjdCBzZW5zZSBhbmQgaXMgc29tZXRoaW5nDQo+ IHRoYXQgaGFzIGJlZW4gYWJzb2x1dGVseSB1bmNvbnRyb3ZlcnNpYWwgaW4gdGhlIGRwcml2ZSBX Rywgd2hpY2ggaXMgYWxyZWFkeQ0KPiBjaGFydGVyZWQgdG8gbG9vayBhdCBleGFjdGx5IHRoYXQu DQoNClRoaXMgaXMgb24gbWUuIEthcmwgYXNrZWQgbWUgd2hlcmUgdG8gc2VuZCBoaXMgbm90ZSwg YW5kIEkgYWR2aXNlZCBoaW0gdG8gc2VuZCBpdCB0byB0aGUgQUREIGxpc3QgYmFzZWQgb24gdGhl IGluc3RydWN0aW9ucyB0aGF0IEJhcnJ5IExlaWJhIHNlbnQgdG8gdGhlIERQUklWRSBsaXN0IG9u IDggQXByaWw6DQoNCmh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvZG5zLXBy aXZhY3kvMHhyREJKdlU3ZFpCY2pqRm4zTmlpR1ExN05vDQoNCiJBIG1haWxpbmcgbGlzdCBoYXMg YmVlbiBjcmVhdGVkIGZvciB0aGUgb25nb2luZyBkaXNjdXNzaW9uIG9mIGlzc3VlcyB3aXRoIERO UyBvdmVyIEhUVFBTLCBETlMgb3ZlciBUTFMsIGltcGxlbWVudGF0aW9uIGNob2ljZXMgZm9yIHRo b3NlLCBhcHBsaWNhdGlvbiB1c2FnZSwgb3BlcmF0aW9uYWwgY29uY2VybnMsIHByaXZhY3kgY29u Y2VybnMsIHBlcmZvcm1hbmNlIGNvbmNlcm5zLCBhbmQgYW55IG90aGVyIHN1Y2guICBQbGVhc2Ug dGFrZSBhbGwgdGhhdCByZWxhdGVkIGRpc2N1c3Npb24gdG8gdGhlIG5ldyBsaXN0IGFuZCBwbGVh c2Ugc3RvcCBkaXNjdXNzaW5nIGl0IG9uIERPSCwgRFBSSVZFLCBETlNPUCwgYW5kIGFueSBvdGhl ciBsaXN0cyDigJQgdGhhdCB3aWxsIGtlZXAgdGhlIHJlbGF0ZWQgZGlzY3Vzc2lvbiBpbiBvbmUg cGxhY2UsIGFuZCBhdm9pZCBmcmFnbWVudGluZyBpdCBhbmQgaGF2aW5nIHBlb3BsZSByZXBlYXQg dGhlbXNlbHZlcyBiZWNhdXNlIG9mIHRoZSBmcmFnbWVudGF0aW9uLg0KDQpUaGUgbmV3IGxpc3Qg aXMgY2FsbGVkIEFERCDigJQgQXBwbGljYXRpb25zIERvaW5nIEROUzoiDQoNClNvIHdoZXJlIHNo b3VsZCB0aGUgZGlzY3Vzc2lvbiB0YWtlIHBsYWNlPw0KDQpTY290dA0K From nobody Tue Jul 9 08:02:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2611912049E for ; Tue, 9 Jul 2019 08:02:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jIXP9psB24rk for ; Tue, 9 Jul 2019 08:02:56 -0700 (PDT) Received: from mail.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3CA241204FC for ; Tue, 9 Jul 2019 08:02:30 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 9 Jul 2019 08:02:27 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Tue, 9 Jul 2019 08:02:27 -0700 From: Paul Hoffman To: "Hollenbeck, Scott" CC: "add@ietf.org" Thread-Topic: [Ext] [Add] FW: New Version Notification for draft-hal-adot-operational-considerations-00.txt Thread-Index: AQHVNmdSPfSjQYfdFEmOHpc045SGEA== Date: Tue, 9 Jul 2019 15:02:27 +0000 Message-ID: <08AFCD82-35F3-4233-9CC8-AA3379770086@icann.org> References: <156261197748.1097.13781803597501449499.idtracker@ietfa.amsl.com> <088F4881-BF32-4EC3-907E-DA9538962545@verisign.com> <91823055-dc9e-bffe-af80-6ce1233ae19f@cs.tcd.ie> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: <44A431FC02EB5E4DB18781427C9CC8FB@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [Ext] FW: New Version Notification for draft-hal-adot-operational-considerations-00.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2019 15:02:57 -0000 On Jul 9, 2019, at 4:12 AM, Hollenbeck, Scott wrote: > So where should the discussion take place? This document is about recursive resolvers, not applications, using DoT. Th= at is clearly in the realm of DPRIVE's charter, so it should be discussed t= here. --Paul Hoffman= From nobody Tue Jul 9 15:51:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5E3A12006D for ; Tue, 9 Jul 2019 15:51:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xe83LiZziT9w for ; Tue, 9 Jul 2019 15:51:28 -0700 (PDT) Received: from mail.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AD0D120059 for ; Tue, 9 Jul 2019 15:51:28 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 9 Jul 2019 15:51:26 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Tue, 9 Jul 2019 15:51:25 -0700 From: David Huberman To: Joe Abley CC: "add@ietf.org" Thread-Topic: [Ext] Re: [Add] List of ADD? Thread-Index: AQHVNNKAJc6U0ATzMkCfusPJub/9lqa/tscAgANjiQA= Date: Tue, 9 Jul 2019 22:51:24 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.47.234] Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha256; boundary="B_3645543084_2128775970" MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [Ext] Re: List of ADD? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2019 22:51:30 -0000 --B_3645543084_2128775970 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: 7bit Hello, Thank you to Joe and nusenu for the helpful replies! Joe wrote: > Do you want to answer the question of what applications are doing DNS, > or to the questions of what applications are doing DNS with specific transports? > Both are interesting, I think, but usefully separate. Both, and I agree they're separate and interesting. When I talk about ADD to operators or to technically-inclined policy makers, I'm describing the overall playing field of ADD. OSes configured to use DoT are interesting, and the people I'm engaging with right now want to know who they are. They also want to know what other applications (apart from Firefox and Chrome) are using DoH. >From Joe and nusenu's reply, what I'm seeing includes: Netflix apps Bromite curl ... and a burgeoning toolset that software developers can use to implement ADD On the OS side, there are some Linux implementations using systemd that implement DoT. I don't know what other OSes are currently supporting, or imminently plan to support, DoT. I'd love to hear of any! Thanks! /david --B_3645543084_2128775970 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIH8wYJKoZIhvcNAQcCoIIH5DCCB+ACAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0B BwGgggWoMIIFpDCCBIygAwIBAgIQCCCjezVuaqyieF/3cJVtpTANBgkqhkiG9w0BAQsFADBl MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGln aWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBTSEEyIEFzc3VyZWQgSUQgQ0EwHhcNMTcx MjEzMDAwMDAwWhcNMjAxMjEyMTIwMDAwWjCBwTELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNh bGlmb3JuaWExFDASBgNVBAcTC0xvcyBBbmdlbGVzMTwwOgYDVQQKEzNJbnRlcm5ldCBDb3Jw b3JhdGlvbiBmb3IgQXNzaWduZWQgTmFtZXMgYW5kIE51bWJlcnMxIDAeBgNVBAMTF0Rhdmlk IEh1YmVybWFuIDIwMTcxMjExMScwJQYJKoZIhvcNAQkBFhhkYXZpZC5odWJlcm1hbkBpY2Fu bi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDdg9FuWh3v/L2kclVo95d6 WvPm7FTZ1brAC//JJ3Q6b7eUi4YGBIN+A3J6GDyybewuhYGb6lpMsx5/kKZk61g0OFFqI4vV IYI3hz8FYE1RFFs2t9i8f0ZaXp1N/fzhXUwX2yiTwP3ACJbfq8gtWFDd6fmj5+gs3h2ttkuC W6y9KYNzdDklvKmHWjKug14jZo9ONcuk7FpTnhvTk55GXVWm+4tFL04SMFxDeTq588zthhee tZpKyVzQsRWXrHUZjyz2dmrSXTzaNg0wS3mQZ0aSNQ2I0xidEZwSlQ98how3WD8CzNsdgPwH 7FzFu1hIz5DhiCLv/kU2wjGwvu6oxuxpAgMBAAGjggHxMIIB7TAfBgNVHSMEGDAWgBTnAiOA AE/Y17yUC9k/dDlJMjyKeTAdBgNVHQ4EFgQUlYQthwDehLcR6dDPAXFRD3H/ASswDAYDVR0T AQH/BAIwADAjBgNVHREEHDAagRhkYXZpZC5odWJlcm1hbkBpY2Fubi5vcmcwDgYDVR0PAQH/ BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDBDBgNVHSAEPDA6MDgGCmCG SAGG/WwEAQIwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCB iAYDVR0fBIGAMH4wPaA7oDmGN2h0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNI QTJBc3N1cmVkSURDQS1nMi5jcmwwPaA7oDmGN2h0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydFNIQTJBc3N1cmVkSURDQS1nMi5jcmwweQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUF BzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYWNl cnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDQS5jcnQwDQYJKoZIhvcN AQELBQADggEBAM0aLHYCdcGnWNf1xBSx9x353WzHbJ2XIiV3cMC9XxwhJDuEWRC+RIOmEgTl LKL0qPpSy/9HexawAJSWwJhrGVH1hAV3qYgijeeX7MkNezaLN0PdDd32TJZikU0V4LhMkfFQ 160BFWEB2o9zP4o5nB7fBiLhFqkzJ3pfqamZXlkhQNqZ7QVXgb8j/1hCjLB7/D3c+G/Vzhwb oqLsY0JazQS6bUWMhkTB4o+LIzNoHtP/8CfHlvoH6cU6clvFSIquOEdnqi4md/GTz56ApG0w cFi2NY+tGhbzwVXxGQXNh/sjn3uBYNcfHokuC2gC0C5HxzKTiBKWu6rpr9nelcgF55AxggIP MIICCwIBATB5MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNV BAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJ RCBDQQIQCCCjezVuaqyieF/3cJVtpTANBglghkgBZQMEAgEFAKBpMC8GCSqGSIb3DQEJBDEi BCB0neeYEkjh7hYJIk7iYCFDwFaVW0ifIryqNJhcBG5k8zAYBgkqhkiG9w0BCQMxCwYJKoZI hvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xOTA3MDkyMjUxMjRaMA0GCSqGSIb3DQEBAQUABIIB AJbZzJZYwMEOYf0KHWCorgeIhnFsNqJ7mjwYzAg/DWopTT5lHz9zfGXC13Soi0ladqfJdjYn /sXMyUOqmw7Z8OSnQsX7E7BMl6/UO/qqOX4+aQhJv5IKnp8QdoVnNPn0EVE00RNrcgceKpWK micVLSrTQDJg2QuPxK9L+aPhHxzwFakOuPeteunnGm0mtyMo0u7KdEzRfHn8lboBIA/Tzwn9 PMKczengyQg2W2wH39FjvgGUhabkVARRxuirKPG25J1HGg7cwIgckkN8jh3ttBS093FsQUs4 yVPa5kFSV68U5Cro6ldJC0loY3+cq1IDNzkHkVYX5Xr0vMXR60lsiMU= --B_3645543084_2128775970-- From nobody Wed Jul 10 04:50:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7EEE120111 for ; Wed, 10 Jul 2019 04:50:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K4imxj0Zlzrk for ; Wed, 10 Jul 2019 04:50:46 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [213.121.35.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4902C1200A3 for ; Wed, 10 Jul 2019 04:50:44 -0700 (PDT) Received: from tpw09926dag09g.domain1.systemhost.net (10.9.202.44) by BWP09926084.bt.com (10.36.82.115) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Wed, 10 Jul 2019 12:51:19 +0100 Received: from tpw09926dag09e.domain1.systemhost.net (10.9.202.36) by tpw09926dag09g.domain1.systemhost.net (10.9.202.44) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 10 Jul 2019 12:50:41 +0100 Received: from bwp09926078.bt.com (10.36.82.109) by tpw09926dag09e.domain1.systemhost.net (10.9.202.36) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Wed, 10 Jul 2019 12:50:41 +0100 Received: from GBR01-LO2-obe.outbound.protection.outlook.com (104.47.21.57) by smtpe1.intersmtp.com (10.36.82.109) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Wed, 10 Jul 2019 12:50:04 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=m+bWfdcrwcy3iyrmabRDHkd2JGo0Az3KEiAU6nEQXtM=; b=peemOunzgLnyB8R6PzK2wllJkaPbQ4PNMFHkCbPlgePBBnzCDdw6AymD04ZggxrjDyL0++4N8DCykzY7qLFrhoT35508bf7gbdvagMicvVbiFM72z15Okv7YjSB9ljtDnuzHZxwqxABxTS8L4vIVd7THHHdx6M48xYd0X+jz0BY= Received: from LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM (20.176.157.213) by LO2P123MB2013.GBRP123.PROD.OUTLOOK.COM (20.176.155.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2052.19; Wed, 10 Jul 2019 11:50:40 +0000 Received: from LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM ([fe80::10e2:bb2a:5a18:fac9]) by LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM ([fe80::10e2:bb2a:5a18:fac9%3]) with mapi id 15.20.2052.020; Wed, 10 Jul 2019 11:50:40 +0000 From: To: Thread-Topic: [Add] Thoughts on a DoH (and DoT) BCP? Thread-Index: AdUx1uEEFvBhHUWqSHedXSRbiDMGggAnfoKAACkiWoAAna40AABhN7Hg Date: Wed, 10 Jul 2019 11:50:40 +0000 Message-ID: References: <2ab90a6a-dd40-b7a0-b380-4dcbd657c89c@innovationslab.net> <77611009-274c-a900-866b-e543a6d8053c@innovationslab.net> In-Reply-To: <77611009-274c-a900-866b-e543a6d8053c@innovationslab.net> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.fidler@bt.com; x-originating-ip: [193.113.37.9] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f92dd747-6459-4355-9ad4-08d7052cd4ed x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P123MB2013; x-ms-traffictypediagnostic: LO2P123MB2013: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-antispam-2: 1 x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0094E3478A x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(346002)(39860400002)(396003)(136003)(376002)(366004)(13464003)(189003)(199004)(486006)(55016002)(5640700003)(256004)(81156014)(81166006)(14454004)(476003)(9686003)(8676002)(76116006)(6306002)(66476007)(66946007)(66446008)(305945005)(64756008)(229853002)(2906002)(7736002)(316002)(1730700003)(25786009)(74316002)(8936002)(68736007)(66556008)(2351001)(6436002)(76176011)(53546011)(5660300002)(71200400001)(6246003)(966005)(6116002)(186003)(7696005)(3846002)(6916009)(99286004)(11346002)(33656002)(66574012)(2501003)(6506007)(446003)(102836004)(52536014)(71190400001)(86362001)(26005)(53936002)(478600001)(66066001); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P123MB2013; H:LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: bt.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: RMLwyrgPzHCqDuYW5MyG8ZL99K0dsatDGUEUf0d3NGRu1KWyG0DSM7Tdc/h0jst2UPnze1P7JZAbKQmo4mr9/gtEiCWqRWRdBiTs8qFzCoJbIAuUwd0etgWFbdk4I8waGY7iwjWuWJCK2i1AplYRkN4kO4AQcIm1xbU1A5hYtp170RyHh2j72QxKDNqd+4jEeNjTRIqmCkuE6607NToF+e/J1iIuw+lfVDNCoLSNbPU74IETp1kqEEnbjq9dm7ZZngNQwc/E4Q2r9fDxzJQ1kEQGOp+/tMU73LtiyRpEqy8k/JvhSRJetrIzEV2i0M51Ak+YXZy+r7kdoykXR1/2GjBPR1h9+laa4w9WkojdWF0KBdAq0blOEVDsejteVZObyFwvVyb8VrCbIGO0V+G7VAvqZzeMDzxC3SBxV19gWaU= Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: f92dd747-6459-4355-9ad4-08d7052cd4ed X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Jul 2019 11:50:40.2957 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a7f35688-9c00-4d5e-ba41-29f146377ab0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.fidler@bt.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB2013 X-NAI-Spam-Flag: NO X-NAI-Spam-Level: X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0.2 X-NAI-Spam-Report: 5 Rules triggered * 0.1 -- GEN_SPAM_FEATRE * 0.1 -- THREAD_INDX_INVALD_VAL * 0 -- EDT_SDHA_ADR_FRG * 0 -- EDT_SDHA_DMN_FRG * 0 -- RV6586 X-NAI-Spam-Version: 2.2.0.9309 : core <6586> : inlines <7115> : streams <1826942> : uri <2865924> X-OriginatorOrg: bt.com Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Jul 2019 11:50:50 -0000 Thanks Barry / Brian for highlighting the dprive-bcp-draft, I agree we shou= ld not have two BCPs from different WGs conflicting with one another. Let u= s discuss this in the 15min BoF slot we have allocated for overlap with exi= sting chartered work in DPRIVE, DOH and DNSOP. On the potential topics list for a DoH BCP which areas do you believe are a= lready covered in the DPRIVE draft and/or ongoing DPRIVE work? Which areas= do you believe are not covered and should be considered by the ADD BoF? Thanks, Andy andrew.fidler@bt.com This email contains information from BT that might be privileged or confide= ntial. And it's only meant for the person above.=A0If that's not you, we're= sorry - we must have sent it to you by mistake. Please email us to let us = know, and don't copy or forward it to anyone else. Thanks. We monitor our email systems and may record all our emails. British Telecommunications plc R/O : 81 Newgate Street, London EC1A 7AJ Registered in England: No 1800000 -----Original Message----- From: Add [mailto:add-bounces@ietf.org] On Behalf Of Brian Haberman Sent: 08 July 2019 14:22 To: Barry Greene Cc: add@ietf.org Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? Hi Barry, On 7/5/19 6:07 AM, Barry Greene wrote: >=20 > The issues that Andrew is bring up would take that dprive-bcp draft in a = totally different direction. Is this want you want? Would the authors be op= en to the change? >=20 My reason for pointing out the dprive BCP is to make sure everyone is aware= of that document. As for the content... It is a dprive WG document, so it is subject to conse= nsus-based changes. Neither I, as dprive co-chair, nor the draft authors ha= ve any more influence over the content than any other IETF participant. What I don't want is for 2 BCPs from different WGs to conflict with one ano= ther, hence the pointer. Regards, Brian >> On Jul 4, 2019, at 9:29 AM, Brian Haberman wr= ote: >> >> Signed PGP part >> >> >> On 7/3/19 3:41 PM, andrew.fidler@bt.com wrote: >>> There are many challenges facing enterprise and internet service provid= er / operator networks that intend to deploy and operate DoH (and DoT) reso= lver services. The IETF should consider developing a BCP which documents th= ese concerns and provide appropriate guidance. Some of these issues include= : >> >> Please remember that there is already an operationally-focused BCP=20 >> draft for DoT. >> >> https://datatracker.ietf.org/doc/draft-ietf-dprive-bcp-op/ >> >> Regards, >> Brian >> >> >> >=20 From nobody Wed Jul 10 04:55:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89CAB1200C5 for ; Wed, 10 Jul 2019 04:55:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vKyw5nyYhl07 for ; Wed, 10 Jul 2019 04:55:47 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [213.121.35.75]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 776F91200A3 for ; Wed, 10 Jul 2019 04:55:46 -0700 (PDT) Received: from tpw09926dag10e.domain1.systemhost.net (10.9.202.37) by BWP09926080.bt.com (10.36.82.111) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Wed, 10 Jul 2019 12:55:42 +0100 Received: from tpw09926dag12h.domain1.systemhost.net (10.9.212.36) by tpw09926dag10e.domain1.systemhost.net (10.9.202.37) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 10 Jul 2019 12:55:42 +0100 Received: from bwp09926082.bt.com (10.36.82.113) by tpw09926dag12h.domain1.systemhost.net (10.9.212.36) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Wed, 10 Jul 2019 12:55:42 +0100 Received: from GBR01-LO2-obe.outbound.protection.outlook.com (104.47.21.57) by smtpe1.intersmtp.com (10.36.82.113) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Wed, 10 Jul 2019 12:55:41 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Thse2ZEagps2IgZrzYuk+G5xuIz19NOW3CjEyDP/7MI=; b=uY68ASlO+EAyLLDLGwc1d84OY2g7CxJSM9XcDKlN28ecUeNxLr55tpszGQOOZWj0of4zy5m5cPggeyPCMrm7y0PBHRSWpLe1ouar05H/WJhj85kVkkB0TkZcIpd2Q9YbOdTzjgWjiHyM/AnrT2C+ISXsUhcvaObZhrKYKjFgwM0= Received: from LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM (20.176.157.213) by LO2P123MB2494.GBRP123.PROD.OUTLOOK.COM (20.176.156.214) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2052.18; Wed, 10 Jul 2019 11:55:40 +0000 Received: from LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM ([fe80::10e2:bb2a:5a18:fac9]) by LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM ([fe80::10e2:bb2a:5a18:fac9%3]) with mapi id 15.20.2052.020; Wed, 10 Jul 2019 11:55:40 +0000 From: To: Thread-Topic: [Add] Thoughts on a DoH (and DoT) BCP? Thread-Index: AdUx1uEEFvBhHUWqSHedXSRbiDMGggACZkyAAU1hngA= Date: Wed, 10 Jul 2019 11:55:40 +0000 Message-ID: References: <04438640-16bf-3f73-4048-e5a10c34bfb5@cs.tcd.ie> In-Reply-To: <04438640-16bf-3f73-4048-e5a10c34bfb5@cs.tcd.ie> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.fidler@bt.com; x-originating-ip: [193.113.37.9] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 62654779-df06-4d6b-2dee-08d7052d87df x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P123MB2494; x-ms-traffictypediagnostic: LO2P123MB2494: x-microsoft-antispam-prvs: x-antispam-2: 1 x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0094E3478A x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(376002)(366004)(39860400002)(136003)(396003)(346002)(13464003)(199004)(189003)(81156014)(2501003)(2906002)(8936002)(8676002)(1730700003)(446003)(476003)(6246003)(305945005)(81166006)(66066001)(256004)(33656002)(74316002)(6916009)(6116002)(76176011)(3846002)(71200400001)(71190400001)(11346002)(52536014)(25786009)(486006)(64756008)(5660300002)(66946007)(14444005)(66476007)(186003)(66556008)(99286004)(26005)(76116006)(102836004)(53546011)(2351001)(6506007)(66446008)(7736002)(478600001)(66574012)(53936002)(14454004)(9686003)(7696005)(55016002)(6436002)(68736007)(5640700003)(86362001)(316002)(229853002); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P123MB2494; H:LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: bt.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: V2L+oaMiIoFhjqdVjYfGXZLNaIUwfXr5QV3DGup4yxpLA23A3yI+rZcFqo0mw1eoEzxlIJ52R3OfoB6E40xk1YDt6wuIghqYxFccHd+iZhROP3iusFkZ3S6kknRM7LJypXWe2E8ZlCv3ZSFtacFtYeAHGTX2ivDBw4hAreuNQCtAJkZDNYNKDrfKMPbi65ALGL2dHyZNtvVJn/eINB3QcusVSUoRshb1QEft62YpGInhU//An3JO3sqrj/YT0ApOdOKveY74CsbHt1KqMygrCfhYYfYuCWuI5FxFO+t6owgoU4v8/vYsdSIHihVzN5NPu+THuHezEK9xODd8Y1PCVJI2+agWG3r3DeY+ZknBoIXy+anEwi0y4ktvyugHrg/a3b0DOYcJDZ0sd8JYUjFxHQL77nfa9ef3KquKpzdsraU= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 62654779-df06-4d6b-2dee-08d7052d87df X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Jul 2019 11:55:40.6582 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a7f35688-9c00-4d5e-ba41-29f146377ab0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.fidler@bt.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB2494 X-NAI-Spam-Flag: NO X-NAI-Spam-Level: X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0.2 X-NAI-Spam-Report: 5 Rules triggered * 0.1 -- GEN_SPAM_FEATRE * 0.1 -- THREAD_INDX_INVALD_VAL * 0 -- EDT_SDHA_ADR_FRG * 0 -- EDT_SDHA_DMN_FRG * 0 -- RV6586 X-NAI-Spam-Version: 2.2.0.9309 : core <6586> : inlines <7115> : streams <1826943> : uri <2865926> X-OriginatorOrg: bt.com Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Jul 2019 11:55:50 -0000 U3RlcGhlbiwNCg0KT24gc3Vic2V0IHRvcGljcyBmb3IgdGhlIEJvRiwgYXBhcnQgZnJvbSBzcGxp dCBob3Jpem9uLCB3aGljaCBvdGhlciB0b3BpY3MgZG8geW91IHRoaW5rIHdpbGwgYW5kIHdvbid0 IGdldCBzdXBwb3J0IGFuZCB3aHk/DQoNClRoYW5rcywNCg0KQW5keQ0KDQphbmRyZXcuZmlkbGVy QGJ0LmNvbQ0KDQpUaGlzIGVtYWlsIGNvbnRhaW5zIGluZm9ybWF0aW9uIGZyb20gQlQgdGhhdCBt aWdodCBiZSBwcml2aWxlZ2VkIG9yIGNvbmZpZGVudGlhbC4gQW5kIGl0J3Mgb25seSBtZWFudCBm b3IgdGhlIHBlcnNvbiBhYm92ZS7CoElmIHRoYXQncyBub3QgeW91LCB3ZSdyZSBzb3JyeSAtIHdl IG11c3QgaGF2ZSBzZW50IGl0IHRvIHlvdSBieSBtaXN0YWtlLiBQbGVhc2UgZW1haWwgdXMgdG8g bGV0IHVzIGtub3csIGFuZCBkb24ndCBjb3B5IG9yIGZvcndhcmQgaXQgdG8gYW55b25lIGVsc2Uu IFRoYW5rcy4NCldlIG1vbml0b3Igb3VyIGVtYWlsIHN5c3RlbXMgYW5kIG1heSByZWNvcmQgYWxs IG91ciBlbWFpbHMuDQpCcml0aXNoIFRlbGVjb21tdW5pY2F0aW9ucyBwbGMNClIvTyA6IDgxIE5l d2dhdGUgU3RyZWV0LCBMb25kb24gRUMxQSA3QUoNClJlZ2lzdGVyZWQgaW4gRW5nbGFuZDogTm8g MTgwMDAwMA0KDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBTdGVwaGVuIEZh cnJlbGwgW21haWx0bzpzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllXSANClNlbnQ6IDAzIEp1bHkg MjAxOSAyMTo0Nw0KVG86IEZpZGxlcixBSkgsQW5keSxUUUcgUiA8YW5kcmV3LmZpZGxlckBidC5j b20+OyBhZGRAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbQWRkXSBUaG91Z2h0cyBvbiBhIERvSCAo YW5kIERvVCkgQkNQPw0KDQoNCkhpeWEsDQoNCk9uIDAzLzA3LzIwMTkgMjA6NDEsIGFuZHJldy5m aWRsZXJAYnQuY29tIHdyb3RlOg0KPiBUaGVyZSBhcmUgbWFueSBjaGFsbGVuZ2VzIGZhY2luZyBl bnRlcnByaXNlIGFuZCBpbnRlcm5ldCBzZXJ2aWNlIA0KPiBwcm92aWRlciAvIG9wZXJhdG9yIG5l dHdvcmtzIHRoYXQgaW50ZW5kIHRvIGRlcGxveSBhbmQgb3BlcmF0ZSBEb0ggDQo+IChhbmQgRG9U KSByZXNvbHZlciBzZXJ2aWNlcy4gVGhlIElFVEYgc2hvdWxkIGNvbnNpZGVyIGRldmVsb3Bpbmcg YSBCQ1AgDQo+IHdoaWNoIGRvY3VtZW50cyB0aGVzZSBjb25jZXJucyBhbmQgcHJvdmlkZSBhcHBy b3ByaWF0ZSBndWlkYW5jZS4NCg0KSSB0aGluayB0aGVyZSBhcmUgZGVmaW5pdGVseSB0aGluZ3Mg dG8gZmlndXJlIG91dCBzdWNoIGFzIHRob3NlIHlvdSBsaXN0IGJlbG93IGFuZCBtYXliZSBtb3Jl LiBJIGZpZ3VyZSB0aGUgdXBjb21pbmcgQm9GIHdvdWxkIGJlIGEgcmVhbCBzdWNjZXNzIGlmIHdl IGNvdWxkIGlkZW50aWZ5IGEgc3Vic2V0IG9mIHRob3NlIG9uIHdoaWNoIGJvdGggcGVvcGxlIHdo byBsaWtlLCBhbmQgcGVvcGxlIHdobyBkaXNsaWtlLCBEb0gvRG9UIHdhbnRlZCB0byB3b3JrLiBF Lmcgc3BsaXQgaG9yaXpvbiBzZWVtcyB0byBtZSB0byBiZSBhbiBhcmVhIHdoZXJlIHdlIGhhdmUg Y29tbW9uIGludGVyZXN0cyBpbiBmaWd1cmluZyBzb21ldGhpbmcgb3V0IHJlZ2FyZGxlc3Mgb2Yg b25lJ3Mgb3BpbmlvbnMgb2YgRG9IL0RvVCBvciBBREQgbW9yZSBnZW5lcmFsbHkuDQoNCkZXSVcs IEkgKG5vdCB2ZXJ5IGNvbmZpZGVudGx5Oy0pIHN1c3BlY3QgaXQgbWF5IGJlIHRoYXQgYnJlYWtp bmcgdGhlIHB1dGF0aXZlIHdvcmsgaW50byBzdWNoIGNodW5rcyBhbmQgcHJpb3JpdGlzaW5nIHRo b3NlIHdoZXJlIHdlIGd1ZXNzIHByb2dyZXNzIGNhbiBiZSBtYWRlIGluIHRoZSBJRVRGIG1heSBi ZSBtb3JlIGVmZmVjdGl2ZSB0aGFuIHRyeWluZyB0byBkZXZlbG9wIG9uZSBCQ1AgdG8gY292ZXIg YWxsIHRoZSBpc3N1ZXMuIFNvbWUgb2YgdGhlIGlzc3VlcyBkb24ndCByZWFsbHkgc2VlbSB0byBt ZSB0byBiZSBzdWNoIHRoYXQgd2UgY291bGQgZ2V0IHRvIHJvdWdoIGNvbnNlbnN1cyBpbiB0aGUg bmVhci10ZXJtIC0gYnV0IG1heWJlIGEgYml0IG9mIHdvcmtpbmcgb24gZWFzaWVyIHN0dWZmLCB0 b2dldGhlciB3aXRoIGhvd2V2ZXIgdGhpbmdzIG91dHNpZGUgdGhlIElFVEYgZXZvbHZlLCBjb3Vs ZCBjaGFuZ2UgdGhhdCBvdmVyIG5vdCB0b28gbXVjaCB0aW1lLg0KDQpDaGVlcnMsDQpTLg0KDQo+ IFNvbWUgb2YgdGhlc2UgaXNzdWVzIGluY2x1ZGU6DQo+IA0KPiAtICAgICAgICAgIHNlcnZlciBw ZXJmb3JtYW5jZSAmIG1lYXN1cmVtZW50IGNvbnNpZGVyYXRpb25zDQo+IA0KPiAtICAgICAgICAg IG5ldHdvcmsgcGVyZm9ybWFuY2UsIGNhcGFjaXR5IGFuZCByZXNpbGllbmNlIHBsYW5uaW5nDQo+ IA0KPiAtICAgICAgICAgIGltcGFjdCBvbiBleGlzdGluZyBpbmZyYXN0cnVjdHVyZTogbG9hZCBi YWxhbmNlcnMsIGNhcHRpdmUNCj4gcG9ydGFscywgTkFULCBwcm94aWVzIGFuZCBvbi1uZXQgY29u dGVudCBjYWNoZXMvQ0ROcw0KPiANCj4gLSAgICAgICAgICBDUEUgcHJvdmlzaW9uaW5nIC0gZmly c3QgY29ubmVjdGlvbiBzZXQtdXANCj4gDQo+IC0gICAgICAgICAgQ1BFIERvSCBwcm94eSBhbmQg Y2VydGlmaWNhdGUgb3B0aW9ucw0KPiANCj4gLSAgICAgICAgICBJbnRlcmFjdGlvbnMgYmV0d2Vl biBhcHBsaWNhdGlvbnMgYW5kIE9TL0tlcm5lbCBETlMNCj4gc2V0dGluZ3MNCj4gDQo+IC0gICAg ICAgICAgcHJvdmlkaW5nIERvSCBhbmQgRG9UIHNlcnZpY2VzIGluIHNwbGl0IEROUyBlbnZpcm9u bWVudHMNCj4gDQo+IC0gICAgICAgICAgYXV0aGVudGljYXRpb24gcmVxdWlyZW1lbnRzIGZvciBE b0ggYW5kIERvVCByZXNvbHZlcnMNCj4gDQo+IC0gICAgICAgICAgbWFuYWdlbWVudCBvZiBUTFMg c2Vzc2lvbnMgYXQgRE5TIHF1ZXJ5IHJhdGVzIC0gdGlja2V0DQo+IGR1cmF0aW9uLCByZXN0YXJ0 cywgZXRjLg0KPiANCj4gLSAgICAgICAgICBtaW5pbWlzaW5nIFRMUyBvdmVyaGVhZHMgZm9yIERv VCBhbmQgRG9IIHRyYWZmaWMNCj4gDQo+IC0gICAgICAgICAgcHJvdGVjdGlvbiBvZiBhcHBsaWNh dGlvbi1zcGVjaWZpYyBEb0ggYW5kIERvVCByZXNvbHZlcg0KPiBjb25maWd1cmF0aW9uDQo+IA0K PiANCj4gDQo+IEknZCBiZSB3aWxsaW5nIHRvIHdvcmsgb24gYSBCQ1Agb24gdGhpcyB0b3BpYy4g SXMgYW55b25lIGVsc2U/IFdoYXQgDQo+IG90aGVyIGtleSBpc3N1ZXMgc2hvdWxkIGJlIGNvbnNp ZGVyZWQ/DQo+IA0KPiBBbmR5IEZpZGxlciBhbmRyZXcuZmlkbGVyQGJ0LmNvbTxtYWlsdG86YW5k cmV3LmZpZGxlckBidC5jb20+DQo+IA0KPiBUaGlzIGVtYWlsIGNvbnRhaW5zIGluZm9ybWF0aW9u IGZyb20gQlQgdGhhdCBtaWdodCBiZSBwcml2aWxlZ2VkIG9yIA0KPiBjb25maWRlbnRpYWwuIEFu ZCBpdCdzIG9ubHkgbWVhbnQgZm9yIHRoZSBwZXJzb24gYWJvdmUuIElmIHRoYXQncyBub3QgDQo+ IHlvdSwgd2UncmUgc29ycnkgLSB3ZSBtdXN0IGhhdmUgc2VudCBpdCB0byB5b3UgYnkgbWlzdGFr ZS4gUGxlYXNlIA0KPiBlbWFpbCB1cyB0byBsZXQgdXMga25vdywgYW5kIGRvbid0IGNvcHkgb3Ig Zm9yd2FyZCBpdCB0byBhbnlvbmUgZWxzZS4NCj4gVGhhbmtzLiBXZSBtb25pdG9yIG91ciBlbWFp bCBzeXN0ZW1zIGFuZCBtYXkgcmVjb3JkIGFsbCBvdXIgZW1haWxzLiANCj4gQnJpdGlzaCBUZWxl Y29tbXVuaWNhdGlvbnMgcGxjIFIvTyA6IDgxIE5ld2dhdGUgU3RyZWV0LCBMb25kb24gRUMxQSAN Cj4gN0FKIFJlZ2lzdGVyZWQgaW4gRW5nbGFuZDogTm8gMTgwMDAwMA0KPiANCj4gDQo+IA0K From nobody Wed Jul 10 05:15:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A09E61202C3 for ; Wed, 10 Jul 2019 05:14:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dWXWa9mpPmXd for ; Wed, 10 Jul 2019 05:14:50 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [62.239.224.234]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7075120293 for ; Wed, 10 Jul 2019 05:14:48 -0700 (PDT) Received: from tpw09926dag12f.domain1.systemhost.net (10.9.212.20) by RDW083A012ED68.bt.com (10.187.98.38) with Microsoft SMTP Server (TLS) id 14.3.439.0; Wed, 10 Jul 2019 13:12:33 +0100 Received: from tpw09926dag14f.domain1.systemhost.net (10.9.212.22) by tpw09926dag12f.domain1.systemhost.net (10.9.212.20) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 10 Jul 2019 13:13:02 +0100 Received: from RDW083A010ED66.bt.com (10.187.98.36) by tpw09926dag14f.domain1.systemhost.net (10.9.212.22) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Wed, 10 Jul 2019 13:13:02 +0100 Received: from GBR01-LO2-obe.outbound.protection.outlook.com (104.47.21.56) by smtpe1.intersmtp.com (62.239.224.237) with Microsoft SMTP Server (TLS) id 14.3.439.0; Wed, 10 Jul 2019 13:11:53 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JKnXcjNMcwPuSAVEUw55ljQ0X7PyLUByCufbX0pMbdw=; b=iwBOxTdvPaL+pO2qOgNy2mTYhZOMqt6rCtOAJeq6yha7oei0TrVBMeeSpVJVNqSIE+jDUGxYgrgqSygGm0NZkP+KIMFmy13ecVHJQ9L/k6sQc32TWPqa5sMHnS1tUJCS/9M40zhjNuL+7p9+fWYNRF3QfrLF5JjPGdNdy8zQD+E= Received: from LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM (20.176.157.213) by LO2P123MB2367.GBRP123.PROD.OUTLOOK.COM (20.176.157.87) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2052.19; Wed, 10 Jul 2019 12:12:43 +0000 Received: from LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM ([fe80::10e2:bb2a:5a18:fac9]) by LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM ([fe80::10e2:bb2a:5a18:fac9%3]) with mapi id 15.20.2052.020; Wed, 10 Jul 2019 12:12:43 +0000 From: To: Thread-Topic: [Add] new draft: draft-grover-add-policy-detection-00 Thread-Index: AQHVNbsbbhT1QMZtgkCLF3xrtSOTOKbDwmCw Date: Wed, 10 Jul 2019 12:12:43 +0000 Message-ID: References: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> In-Reply-To: <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.fidler@bt.com; x-originating-ip: [193.113.37.9] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 846ef419-5f81-4ee0-2d91-08d7052fe945 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P123MB2367; x-ms-traffictypediagnostic: LO2P123MB2367: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-antispam-2: 1 x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0094E3478A x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(366004)(396003)(346002)(39860400002)(376002)(136003)(189003)(199004)(13464003)(53754006)(6116002)(3846002)(68736007)(86362001)(486006)(476003)(76116006)(99286004)(256004)(14444005)(6306002)(9686003)(6246003)(446003)(11346002)(1730700003)(81166006)(81156014)(2906002)(5660300002)(66556008)(66446008)(8936002)(64756008)(66476007)(66066001)(74316002)(26005)(8676002)(52536014)(305945005)(7736002)(53936002)(6506007)(76176011)(33656002)(53546011)(7696005)(14454004)(316002)(102836004)(71200400001)(71190400001)(966005)(186003)(478600001)(229853002)(2501003)(6436002)(5640700003)(55016002)(2351001)(66574012)(66946007)(25786009)(6916009); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P123MB2367; H:LO2P123MB2462.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: bt.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: b+xz2Kd1XB7VTjs2TALrLUyI6hbexhr1HlY8moDYQOzEZqxrHlvfaQCYn+vP4OcpHBoaqSTnMtXC5BKly7RUbPBnJkpNSquvRQLUr+/K0JBqT78hTc+Df4EiEWJU53xFU02wvnD4KE2SfZgZRoiMnpM7Yz3St0Z8qqw8zC6Uvnjl4RwS9wOUPt6Ti799O1aXNIQHY7BkKoNucxJzm/xKh45L9Ccl2xMag3e6uqX8T8FV3SiIlVvn/b+PE5PjpbqAF1ZKALru8DxgtjnQARkMxv7G71NBKvAXLHyT3g6lrGiJDCDHFgfjKFymYWGa5yNfGSddVS7wa2UDxDS2rjhrPtazmGCzadSrU5mI5TNYCbl7esPp7XSvH0029FU9q27oiBriLSz2bzkaiMMx3P6DjhCY5wa0hqvWnxwx9GRm3ns= Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 846ef419-5f81-4ee0-2d91-08d7052fe945 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Jul 2019 12:12:43.0631 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a7f35688-9c00-4d5e-ba41-29f146377ab0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.fidler@bt.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB2367 X-OriginatorOrg: bt.com Archived-At: Subject: Re: [Add] new draft: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Jul 2019 12:15:00 -0000 Andy, Re. draft-grover-add-policy-detection, how do you see from a protocol persp= ective clients handling a policy negotiation with servers? How will they b= ehave when the server's policy conflicts with the client's mandatory and op= tional policy preferences? For example if no suitable DoH (or DoT) server i= s available, when/how does the client fall back to plain text DNS?=20 Thanks Andy andrew.fidler@bt.com This email contains information from BT that might be privileged or confide= ntial. And it's only meant for the person above.=A0If that's not you, we're= sorry - we must have sent it to you by mistake. Please email us to let us = know, and don't copy or forward it to anyone else. Thanks. We monitor our email systems and may record all our emails. British Telecommunications plc R/O : 81 Newgate Street, London EC1A 7AJ Registered in England: No 1800000 -----Original Message----- From: Add [mailto:add-bounces@ietf.org] On Behalf Of Andy Grover Sent: 08 July 2019 19:29 To: add@ietf.org Subject: [Add] new draft: draft-grover-add-policy-detection-00 Hello all, We've posted an initial draft of draft-grover-add-policy-detection, which proposes a method of identifying if content filtering or other policy= is implemented on the local resolver, so applications doing DNS resolution= can adjust their behavior. Thanks -- Regards -- Andy -------- Forwarded Message -------- Subject: New Version Notification for draft-grover-add-policy-detection-00.txt Date: Mon, 08 Jul 2019 10:46:45 -0700 From: internet-drafts@ietf.org To: Andy Grover , Peter Saint-Andre A new version of I-D, draft-grover-add-policy-detection-00.txt has been successfully submitted by Peter Saint-Andre and posted to the IETF= repository. Name: draft-grover-add-policy-detection Revision: 00 Title: DNS Resolver-Based Policy Detection Domain Document date: 2019-07-08 Group: Individual Submission Pages: 6 URL: https://www.ietf.org/internet-drafts/draft-grover-add-policy-detection-00.t= xt Status: https://datatracker.ietf.org/doc/draft-grover-add-policy-detection/ Htmlized: https://tools.ietf.org/html/draft-grover-add-policy-detection-00 Htmlized: https://datatracker.ietf.org/doc/html/draft-grover-add-policy-detection Abstract: This document specifies the behavior that is expected from the Domain Name System with regard to DNS queries for the special-use domain name 'TBD.arpa' and designates this domain as a special-use domain name. -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add From nobody Wed Jul 10 10:15:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C143120047 for ; Wed, 10 Jul 2019 10:15:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xSj0HHIyViun for ; Wed, 10 Jul 2019 10:15:04 -0700 (PDT) Received: from pigeon.buunabet.com (pigeon.groveronline.com [198.145.19.6]) by ietfa.amsl.com (Postfix) with ESMTP id 92ADC120165 for ; Wed, 10 Jul 2019 10:15:01 -0700 (PDT) Received: by pigeon.buunabet.com (Postfix, from userid 501) id B1E516079B; Wed, 10 Jul 2019 10:15:00 -0700 (PDT) Received: from [192.168.1.47] (c-73-96-61-98.hsd1.or.comcast.net [73.96.61.98]) (using TLSv1.2 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by pigeon.buunabet.com (Postfix) with ESMTPSA id E17A65FE45 for ; Wed, 10 Jul 2019 10:14:59 -0700 (PDT) To: add@ietf.org References: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> From: Andy Grover Openpgp: preference=signencrypt Autocrypt: addr=andy@pmtu.dev; keydata= mQENBFz6mPMBCAClDMGqYBeCSE0Q+rU7v0JibtGh+nSZoNTSdXOHUkk3rN7rmJwdjlWsL0aT 2BGsSYBQjuqlculeJAQq6GG8dj7gjkDX8zVvjNPVqZxNd0bRh9DFE5AZrz3TiTIUwNauKWE9 XvVCMn/ZfzEJhehLa7SUs5vgZ6NHaScq4KZByfNsmiu/n+mPRhJOjgIN7fql5u+ElnNHxOP3 Z9vsoQc5pS9YAMKtEvyWgljm4fbZMs6VBDUGJGaLRmALF5VrJ5AJKzbZWZmaXYNqoxdtakT5 PhJuXkqdnrijZw8TJCglQ/z2wiq2HCU2pzq6/l+19yV0m9iegEuPgtAuwqkh4ecsPAbbABEB AAG0IUFuZHkgR3JvdmVyIDxhZ3JvdmVyQG1vemlsbGEuY29tPokBVAQTAQgAPhYhBKVh7hV4 1gY7lZbAkBVqKb2tr6NBBQJc+pjzAhsDBQkDwmcABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA AAoJEBVqKb2tr6NB7uwH/RIEtXUCpRGCbVO5LyXmlzTCue9djrb8YrvOOyeVzUxA5kIskguB 5DH7X7RuVa1PlsfsG2F40/5/bPS/fjYIUOGxTQdyiXGeVPotDvg4vaC/3zV16gs8YxOgzKgb P7QhFLHkZoITe6gOv4R0QH1qvRkbg9cyyPr5FoIPaLoXDnw4DWxaNBUSsN+fPRI87yUjPO1v kL+OWBOnBsHxNGaHjd/s9WsIUp8RbLbfMEI+xlM8lM+r5ccECkMS/l9NFX+mCMUlRXqTkd49 mWYJWY5zNnLyqbAZcaRGCrFlX/gjDn8p+pXQEdvtbbqy3KMofxrmf73ECSStM0WnOEgWtSFG ycW5AQ0EXPqY8wEIAMY7xc/W7mIt2nyAe9K/5RiuyGaDItuaEbFzfRmxFvISJm3s5LiyyrGA 82o0HQWqoMjPyLd+pGSSxHL5aWCUsj5vt/rV0FCPvC8W3a0bWxHa+sbb0VeAHna18Ozav1Cx RFLW437tqaD8yF5yh1c0aGolCqv2LjMHetm+UmFoQVbSfcJoxpXepJFVDwvrqqlL+5BoQM15 MzCwux/D8RCgNlTXTnlfm6bRvlD5ttgDoyzN7qYwm+RjA9Izhyps39fKzdk8xkgeu/A55C94 KcPuSs4U9ti7WeU+CubDaLB3bxp7KCyjWpX3oS2CxHFnQsBAbzGx8UeH3dXbdni1AjE71wkA EQEAAYkBPAQYAQgAJhYhBKVh7hV41gY7lZbAkBVqKb2tr6NBBQJc+pjzAhsMBQkDwmcAAAoJ EBVqKb2tr6NBP2MH/0g/e3idsu/ajGzRx6CaRd/ZNxG0/p0aYT4iQWUEt0KZVyHKf17OQK2z u3QSGjSR2V1H419U0m5V3HSMQmy5XrGi3ks4f01Cgq2HiYizhwVwqNVfZERY+WavEIr35w/L eJqEI2Cm4PySxbOOuFig6R7GAknL76iKQBlMH8uX7yV9p0JnrI6tn0lm2n4UjW76CJ3Fk6gD wqoDYDQXfIxYtyMD6QUfiSDZ+8KZoCMDYQQsEcDBz0hRI2mHwL1jHkGNMcVOhBZPtUHinFTc EiQKDXQKkBvschbpbcfJI5g82v6Bl5M995ob7wsXy8VN5+usot+bKqQHGYMsBMbqJf+Ci1I= Message-ID: Date: Wed, 10 Jul 2019 10:14:59 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] new draft: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Jul 2019 17:15:07 -0000 On 7/10/19 5:12 AM, andrew.fidler@bt.com wrote: > Re. draft-grover-add-policy-detection, how do you see from a protocol > perspective clients handling a policy negotiation with servers? How > will they behave when the server's policy conflicts with the client's > mandatory and optional policy preferences? For example if no suitable > DoH (or DoT) server is available, when/how does the client fall back > to plain text DNS? I would say it's only a negotiation in that the client is deciding whether to use app-based DNS such as DoH, or to not use it. This proposal doesn't tell the client anything about the local DNS resolver's policy, just that it *has* one, and it's up to the app to decide how to use that information -- the most straightforward case would be the app deciding that since the local resolver has special behavior (i.e. the policy), that app-based DNS would unavoidably bypass, that it's more important to keep that in place by using the default network resolver rather than doing app-based name resolution. This proposal doesn't touch on the example you give. If app-based DNS isn't working then policy or no, the default network DNS resolver should be used. -- Andy > -----Original Message----- > From: Add [mailto:add-bounces@ietf.org] On Behalf Of Andy Grover > Sent: 08 July 2019 19:29 > To: add@ietf.org > Subject: [Add] new draft: draft-grover-add-policy-detection-00 > > Hello all, > > We've posted an initial draft of draft-grover-add-policy-detection, > which proposes a method of identifying if content filtering or other policy is implemented on the local resolver, so applications doing DNS resolution can adjust their behavior. > > Thanks -- Regards -- Andy > > -------- Forwarded Message -------- > Subject: New Version Notification for > draft-grover-add-policy-detection-00.txt > Date: Mon, 08 Jul 2019 10:46:45 -0700 > From: internet-drafts@ietf.org > To: Andy Grover , Peter Saint-Andre > > > A new version of I-D, draft-grover-add-policy-detection-00.txt > has been successfully submitted by Peter Saint-Andre and posted to the IETF repository. > > Name: draft-grover-add-policy-detection > Revision: 00 > Title: DNS Resolver-Based Policy Detection Domain > Document date: 2019-07-08 > Group: Individual Submission > Pages: 6 > URL: > https://www.ietf.org/internet-drafts/draft-grover-add-policy-detection-00.txt > Status: > https://datatracker.ietf.org/doc/draft-grover-add-policy-detection/ > Htmlized: > https://tools.ietf.org/html/draft-grover-add-policy-detection-00 > Htmlized: > https://datatracker.ietf.org/doc/html/draft-grover-add-policy-detection > > > Abstract: > This document specifies the behavior that is expected from the Domain > Name System with regard to DNS queries for the special-use domain > name 'TBD.arpa' and designates this domain as a special-use domain > name. > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > From nobody Sat Jul 13 15:48:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A948F120163 for ; Sat, 13 Jul 2019 15:48:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.598 X-Spam-Level: X-Spam-Status: No, score=-0.598 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kkzEssrkd5T4 for ; Sat, 13 Jul 2019 15:48:17 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5BF3C120141 for ; Sat, 13 Jul 2019 15:48:17 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id g20so27967072ioc.12 for ; Sat, 13 Jul 2019 15:48:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=vHuLjO6cHmWEYNhyriBnOLjYnnlyLpXwEkTz9mWqeco=; b=Op+A+4d3zeH422696ktILt9XIYKAy1x6aVPtKHaLEhB84x3MlDVTBKAIR96otzMGrZ kPotQZ0eUyui1eMd76JzhIR+Cw6ZbJT1V3k2y8UWQrPMarbL42I2iIf4VOm1FWpCm23P 1+NqCn1Ze+DjDp+1fTAF2XH+E1Ygj9N71kxIpeh/Z3kW9/9DoZoRE5+LG8BviB++/F17 dx7Z/VxVWUfwDlyiNpq2c47XW0ah4R+lsmBzEN+7sU86V6hMAnEQmcJ2HPSNQWPYkZFz vZ4F7zA6L4elpVD24TVjSscrXGEnD989POuDwz0c3P63mxD+g4eofcEnYomZ1Sx/CIBK sVvw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=vHuLjO6cHmWEYNhyriBnOLjYnnlyLpXwEkTz9mWqeco=; b=SemiYelZqI9pDYql1cQmQZ2aigg8sfjQzpzz7NJxakUNB8u+7IGuHBkI8+idxNVQ5Q FHkmw7Lt/sahmRRDc9IXUDz29kPwxruIYjY7lHMw/mV9ocXoFh6VT08hyQ5AkuruUh8l BKZ3V8+rl2MlR/CloGrggmt7F+ANtoOsKY8WXp2tEZhbfpNvUu89oE8QQe86uI5SjAe0 UNnhpgSYfVtC/x+89X4e9/yiu8tWqFpgLBaNSJdqOuUQJJVvZwgjeKjlFOIQ2VslnqbD wGa8MAZjhZpOKp66xLd3S45eKqqnJ33x5T4Ot0Ql6KXaLpFx6EQ7yNbNNqRwhw4JfAah NgfA== X-Gm-Message-State: APjAAAXkRyyBqwilACsrveTt5DfMbiqzDUt0gzdN0JqEv7N/yzLCaqBd Sr6Ru3pVOvGx0yUUHg52CGEAnIL6ywjmNNxCCxF58M6CC+OunQ== X-Google-Smtp-Source: APXvYqwjzubzdB4A52nOKeif8x/2ztmOGGT/1JKYRMuNSYjwYnX9zVo8ImoenkSOhp5NxUmLhdHqQUn26pDNAuOcUpM= X-Received: by 2002:a05:6602:98:: with SMTP id h24mr18099479iob.49.1563058096114; Sat, 13 Jul 2019 15:48:16 -0700 (PDT) MIME-Version: 1.0 From: Rob Sayre Date: Sat, 13 Jul 2019 15:48:05 -0700 Message-ID: To: add@ietf.org Content-Type: multipart/alternative; boundary="0000000000009512c5058d97d2f0" Archived-At: Subject: [Add] draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Jul 2019 22:48:19 -0000 --0000000000009512c5058d97d2f0 Content-Type: text/plain; charset="UTF-8" This draft doesn't seem to conform to the requirements laid out in BCP 61. https://tools.ietf.org/html/bcp61 thanks, Rob --0000000000009512c5058d97d2f0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
This draft doesn't seem to conform to the requirements= laid out in BCP 61.


thanks,
Rob
--0000000000009512c5058d97d2f0-- From nobody Sun Jul 14 17:12:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B24D71202A1 for ; Sun, 14 Jul 2019 17:12:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p_sqS8ebdpH1 for ; Sun, 14 Jul 2019 17:12:33 -0700 (PDT) Received: from pigeon.buunabet.com (pigeon.groveronline.com [198.145.19.6]) by ietfa.amsl.com (Postfix) with ESMTP id 7ACC61200B7 for ; Sun, 14 Jul 2019 17:12:33 -0700 (PDT) Received: by pigeon.buunabet.com (Postfix, from userid 501) id B0FE8607B5; Sun, 14 Jul 2019 17:12:32 -0700 (PDT) Received: from [192.168.1.61] (c-73-96-61-98.hsd1.or.comcast.net [73.96.61.98]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.buunabet.com (Postfix) with ESMTPSA id 0FE3E60737; Sun, 14 Jul 2019 17:12:32 -0700 (PDT) Date: Sun, 14 Jul 2019 17:12:29 -0700 User-Agent: K-9 Mail for Android In-Reply-To: References: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----MSXGPK0IHKQ3T35N3J7NOTLG7RR1UM" Content-Transfer-Encoding: 7bit To: add@ietf.org,Rob Sayre From: Andy Grover Message-ID: Archived-At: Subject: Re: [Add] draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jul 2019 00:12:36 -0000 ------MSXGPK0IHKQ3T35N3J7NOTLG7RR1UM Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I don't follow, in what way? On July 13, 2019 3:48:05 PM PDT, Rob Sayre wrote: >This draft doesn't seem to conform to the requirements laid out in BCP >61=2E > >https://tools=2Eietf=2Eorg/html/bcp61 > >thanks, >Rob ------MSXGPK0IHKQ3T35N3J7NOTLG7RR1UM Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable I don't follow, in what way?

On July 13, 2019 3:48:05 PM PDT, Rob Sayre <sayrer@gmail=2E= com> wrote:
This draft doesn't seem to conform to the requirements la= id out in BCP 61=2E


<= /div>
thanks,
Rob
------MSXGPK0IHKQ3T35N3J7NOTLG7RR1UM-- From nobody Sun Jul 14 17:18:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2CA1E1202A1 for ; Sun, 14 Jul 2019 17:18:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1QiWTla2Pd9F for ; Sun, 14 Jul 2019 17:18:14 -0700 (PDT) Received: from mail-io1-xd33.google.com (mail-io1-xd33.google.com [IPv6:2607:f8b0:4864:20::d33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C2791200B7 for ; Sun, 14 Jul 2019 17:18:14 -0700 (PDT) Received: by mail-io1-xd33.google.com with SMTP id k8so31495814iot.1 for ; Sun, 14 Jul 2019 17:18:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=X+sfW4f7M+YcwyAtCMSaCcz/uUHXj8Od1bu4FAKKOq4=; b=gmFQWtqiBd6xzm3CsbFJAzGDvw1u50tswdjbGtRX5xStSIR4By2fkhDC4s0oR902PI QNB75935r5n3aJKycp7cNFq9OkP98MRgKt6S4KXJPqgxPsrLE19Zc3SrNKvGPzHRzQL9 ky+e8bTaIkE5Tc4hjG4dv8jBCoK131KqsKD3x3GwckLdW/jUZ76dDrj9HcLr6o7kQCOw +eS3YTEuzsvi7Jplt9oxupENcMfeVFl/aSterCWLw/+d8oVR2e5iqdFBVHmK3SAiXKKr 6dhoTvu25+mpF3t3+ll3JHaLrHWiKZ545i+dKBOPjMjnW6MU2DFt5gECiQWokRlqbkJT gtlw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=X+sfW4f7M+YcwyAtCMSaCcz/uUHXj8Od1bu4FAKKOq4=; b=J2vGSlg+RUlpFADLtScdpB+qcA6SguU+h9yLkISMIkyAKDG8Bu5HvRIluFMXX93IM6 leR+n4pVWMncYljTWbg7f+jzBe3L7HtD/zLL6KGgI7aJRrsYtfAmhMwTopzJ4VyR5Wx/ JDkrBJ+0QUHAUVZbBUVTREqBCcLukMZ3ZlCvu2lMquRZNo5BsFv/c7X8R8uk8TathZ/P WGgtA39760RqDWETazFoz5NG9Uck8y5HXZKCqldBN4vDZsjqlI+vT7lYqnfjsDx9PEaP YnN7cIaVwubmkNdZ+hKabTAde9mZbM1xCjZFVfeAP0ApHIb7j0Rc9zptLDJDvTsj2lzH mGqg== X-Gm-Message-State: APjAAAWZ7XFeoK/irUX7kd1TsXrur9RhFNSZ7cll4vxTALwlMqnruMOH 6t2bFvUTEhy8Ot9nq1X+E/iv+7EEC0ImZ5KTYjU= X-Google-Smtp-Source: APXvYqy2bkJ9wGGvbZCUSAvKnnrpoUljWypdcnU0X0EUgUIA1xskEYOdAQe85Wqjpt42Xmx1lIGIrFqg5D2/A4+lYaQ= X-Received: by 2002:a5e:c00e:: with SMTP id u14mr23352975iol.196.1563149893567; Sun, 14 Jul 2019 17:18:13 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Sun, 14 Jul 2019 17:18:01 -0700 Message-ID: To: Andy Grover Cc: add@ietf.org Content-Type: multipart/alternative; boundary="0000000000002308ec058dad328c" Archived-At: Subject: Re: [Add] draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jul 2019 00:18:17 -0000 --0000000000002308ec058dad328c Content-Type: text/plain; charset="UTF-8" It's right there in BCP 61: "However security must be a MUST IMPLEMENT so that end users will have the option of enabling it when the situation calls for it." It seems like this proposal standardizes automatically disabling security. Maybe we could generalize it. Let's add some domains to the draft that switch HTTPS to HTTP, and switch SSH to telnet. thanks, Rob On Sun, Jul 14, 2019 at 5:12 PM Andy Grover wrote: > I don't follow, in what way? > > On July 13, 2019 3:48:05 PM PDT, Rob Sayre wrote: >> >> This draft doesn't seem to conform to the requirements laid out in BCP 61. >> >> https://tools.ietf.org/html/bcp61 >> >> thanks, >> Rob >> > --0000000000002308ec058dad328c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
It's right there in BCP 61:
"However se= curity must be a MUST IMPLEMENT so that end users will have the option of e= nabling it when the situation calls for it."

It see= ms like this proposal standardizes automatically disabling security. Maybe = we could generalize it. Let's add some domains to the draft that switch= HTTPS to HTTP, and switch SSH to telnet.

thanks,<= /div>
Rob

On Sun, Jul 14, 2019 at 5:12 PM Andy Grover <andy@groveronline.com> wrote:
<= /div>
I don't fol= low, in what way?

On July 13, 2019 3:48:0= 5 PM PDT, Rob Sayre <sayrer@gmail.com> wrote:
This draft doesn't seem to conform to the requirements= laid out in BCP 61.

--0000000000002308ec058dad328c-- From nobody Sun Jul 14 17:31:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81ABE12009E for ; Sun, 14 Jul 2019 17:31:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fzjbk6YbZY4n for ; Sun, 14 Jul 2019 17:31:09 -0700 (PDT) Received: from mail-lf1-x12f.google.com (mail-lf1-x12f.google.com [IPv6:2a00:1450:4864:20::12f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5CE1112001A for ; Sun, 14 Jul 2019 17:31:09 -0700 (PDT) Received: by mail-lf1-x12f.google.com with SMTP id p197so9758376lfa.2 for ; Sun, 14 Jul 2019 17:31:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=qx/eAnX7I7Z7vJv3awukIFMtNrOuXfK33G7JrIl8ItU=; b=noJF5lUlcndP+joAemsd7QrFrhP7yLrPkYFgkIMVPk+nfGE6ZZi7/U2Ulg4OugasU1 P8VdAYeVmK3HzZUK6RT7eWaQdtn6TmfAFMwc5H0FYAiEQNITBEwvW1D2hbXeNflMEOxp rL1CMlMhxB4pzfzJaFOXsxA27g9KdNynhu2F8eeHHLo8iCU597UW+m+4yZU/RlkpNjqY cGG56JkIrP6g+BRBe0RB1PseH1q4jAcU9kM4VRmdKprKg8GNDuzh8XytobYEQBSupDDK L/FsNuyee2WPkMOMingZceypA8TiAMzn2B3yKsBzlYP8jjTU5Z8SiToSTbr90JahSC6q VVpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=qx/eAnX7I7Z7vJv3awukIFMtNrOuXfK33G7JrIl8ItU=; b=bnO1D3QwcirQPbYo7arIsXzNsxY0aLCnECfDEUri+F/0iCQmqaZjMVRYF3uNG6L4F3 JNalLp3fYQZmqiMASKq5ZLVSD1XSxDf58Tiba4DRTN8vWdxm09PaWoVEvTohjpsHqxuC G6zaX24WwXxzrfImdanEmsIxksbuVYspcSWoN9WRzOXf1wfrz4sspYsVlOfVlCPcdaUZ LGPghziDUeFa4IpDSucV17bou7PWSloi0HVEylkSHHRDtPwYAKjNgoFDyHvJWT5vXdTE JuQHvSUjDgbIRcOMADrOOdnusEofpDqYZwvnLNy8ICHPPjBHxQaUtRRbP93IcqhWkCLY tQoQ== X-Gm-Message-State: APjAAAXZbQz76rg+vNzZOCmPd4BRCkwQs9yjMC7sX6Ik/ximDVknJeFK X/kvcPGCiUl0rwzDSwf9zn073NgR1+lEayfi6fI= X-Google-Smtp-Source: APXvYqxsVNFxhu6YMK+DLAXVnzBfvI2ngeYmeOdSZ8lsAeVsu9bTuNy4qVKDYzGCHX7I/pTF9Bpg4XUwUSd7mHmpQcE= X-Received: by 2002:ac2:51a3:: with SMTP id f3mr9526393lfk.94.1563150667699; Sun, 14 Jul 2019 17:31:07 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Sun, 14 Jul 2019 17:30:31 -0700 Message-ID: To: Rob Sayre Cc: Andy Grover , add@ietf.org Content-Type: multipart/alternative; boundary="000000000000476aaf058dad602e" Archived-At: Subject: Re: [Add] draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jul 2019 00:31:11 -0000 --000000000000476aaf058dad602e Content-Type: text/plain; charset="UTF-8" On Sun, Jul 14, 2019 at 5:18 PM Rob Sayre wrote: > It's right there in BCP 61: > "However security must be a MUST IMPLEMENT so that end users will have the > option of enabling it when the situation calls for it." > > It seems like this proposal standardizes automatically disabling security. > Maybe we could generalize it. > Let's take a step back here. First, this document doesn't violate the section of BCP 61 you are quoting, because that text doesn't require that security be on by default. Second, there's plenty of precedent for opportunistic encryption in IETF; see, for instance: https://tools.ietf.org/rfcmarkup?doc=7435. Of course, this doesn't mean that this document is necessarily a good idea, but to the best of my knowledge it's not prohibited by any RFC. The question of whether it's a good idea is rather more complicated: at a high level we have a situation where nearly all DNS is unencrypted and sent to a resolver which is insecurely configured. Some of those resolvers do policy enforcement and in some of those cases, the user wanted that kind of policy enforcement, so just switching over to a secure Trusted Recursive Resolver potentially violates POLA, and it would be nice to be able to detect those cases and do something [0]. Now, of course, that signal itself is insecure, so this is pretty far from ideal, but the whole situation is pretty messy, so it seems worthwhile to explore the space a bit. > Let's add some domains to the draft that switch HTTPS to HTTP, and switch > SSH to telnet. > This sort of rhetoric doesn't seem particularly helpful. -Ekr [0] And this draft doesn't say what "something" is, so, how good an idea this is partly depends on what that is. > > thanks, > Rob > > On Sun, Jul 14, 2019 at 5:12 PM Andy Grover wrote: > >> I don't follow, in what way? >> >> On July 13, 2019 3:48:05 PM PDT, Rob Sayre wrote: >>> >>> This draft doesn't seem to conform to the requirements laid out in BCP >>> 61. >>> >>> https://tools.ietf.org/html/bcp61 >>> >>> thanks, >>> Rob >>> >> -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000476aaf058dad602e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sun, Jul 14, 2019 at 5:18 PM Rob S= ayre <sayrer@gmail.com> wrote= :
It's right there in BCP 61:
"However security must be= a MUST IMPLEMENT so that end users will have the option of enabling it whe= n the situation calls for it."

It seems like this p= roposal standardizes automatically disabling security. Maybe we could gener= alize it.

Let's take a ste= p back here. First, this document doesn't violate the section of BCP 61= you are quoting, because that text doesn't require that security be on= by default. Second, there's plenty of precedent for opportunistic encr= yption in IETF; see, for instance: https://tools.ietf.org/rfcmarkup?doc=3D7435. Of course,= this doesn't mean that this document is necessarily a good idea, but t= o the best of my knowledge it's not prohibited by any RFC.
The question of whether it's a good idea is rather more co= mplicated: at a high level we have a situation where nearly all DNS is unen= crypted and sent to a resolver which is insecurely configured. Some of thos= e resolvers do policy enforcement and in some of those cases, the user want= ed that kind of policy enforcement, so just switching over to a secure Trus= ted Recursive Resolver potentially violates POLA, and it would be nice to b= e able to detect those cases and do something [0]. Now, of course, that sig= nal itself is insecure, so this is pretty far from ideal, but the whole sit= uation is pretty messy, so it seems worthwhile to explore the space a bit.<= br>

=C2=A0
Let's add some domains to the dra= ft that switch HTTPS to HTTP, and switch SSH to telnet.

This sort of rhetoric doesn't seem particularl= y helpful.

-Ekr

[0] A= nd this draft doesn't say what "something" is, so, how good a= n idea this is partly depends on what that is.
=C2=A0

<= /div>
thanks,
Rob

<= div dir=3D"ltr" class=3D"gmail_attr">On Sun, Jul 14, 2019 at 5:12 PM Andy G= rover <andy@g= roveronline.com> wrote:
I don't follow, in what way?

On July 13, 2019 3:48:05 PM PDT, Rob Sayre <sayrer@gmail.com> wrote:
This draft doesn't seem to conform to the requirements= laid out in BCP 61.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000476aaf058dad602e-- From nobody Sun Jul 14 17:33:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 263FC12001A for ; Sun, 14 Jul 2019 17:33:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0uQMVQvG0-Yr for ; Sun, 14 Jul 2019 17:33:24 -0700 (PDT) Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9954D1200B7 for ; Sun, 14 Jul 2019 17:33:24 -0700 (PDT) Received: by mail-io1-xd2e.google.com with SMTP id o9so31522569iom.3 for ; Sun, 14 Jul 2019 17:33:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=k0+PRL5mR5HGY7GSNa7UJyPrIILVou1lU6q8os0cOHk=; b=g0KGxsyYYxEbsMr+JzkxmtbPN0gHDS8xqetUDl2h0si0FGPhhLcJkrh4VcwZUwQQcb yWd7VMhYzPy0gmVhWfshL/9wYiHA2sWgASzQhKfEXHJd1MSbfb+sBO6b2IwOAFoU2CCW ZraWBGCC/VYn2gdpjkScnQikwsf6jAb80oLJDlPrnw42RzR4JRDEmrxoovHRr6Dd96B5 EZcUeRG47I5eKmPzv10NXR9KdkgoNSro7pd+phWUMNY2zr/kGW+68uak2QN+ijRmQsLT qylyFCGVKZfXleHTuc/Q0/XG9EpTRnNqXwq8ZMDR2tLR6wixSc94wPrWmG4/9d2/hywL f83g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=k0+PRL5mR5HGY7GSNa7UJyPrIILVou1lU6q8os0cOHk=; b=TGLw1vd3BiDeMvAZwLuJjaYPEb5NcXdhb/EAtgyyL0uedSeDg0VQfx8Wwd8zXrUTnB 1fJWL0UJ33vuxE9yegCT7pfbI3PIhOI4y8gj0X2j66dev2tKNKt66C1pHUfx4b9pb/IF wRze/OW2kxH2XFU56WeL/2iGZO3Sq5qEj/gQ4CYAbTOWSkF95/dDghfUsPnggcyKSp3R iGH0bhn68BtCw729BwSdkKLpCglaqB3Y8pIcaq+f0eeyy7QuhwzdxwZv2fNhNaRMXfyo mmbYcoIBnINncVDY8ePNfpCW/1FClIpBKPpZN9qUy9WzpRWVZDhTg5vSptHllCjBLWbJ 8F9A== X-Gm-Message-State: APjAAAV3s0iPDh2AVUZKtOKB0dZ3vo36exz0Beu4C031q5klLAh8IY3E XkKQefmc6JwQ74LaSYsNDZNw1eIOjYduw8+Jx3g= X-Google-Smtp-Source: APXvYqxBm3i14W20ub89/ucyxz3mTGixqPpNZ3sSBt07eZxAHmw9IxvcEx9oEx/vVkDnuHpSE2XnNrm3xWHlz685ABU= X-Received: by 2002:a02:13c3:: with SMTP id 186mr24113031jaz.30.1563150803690; Sun, 14 Jul 2019 17:33:23 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Sun, 14 Jul 2019 17:33:12 -0700 Message-ID: To: Eric Rescorla Cc: Andy Grover , add@ietf.org Content-Type: multipart/alternative; boundary="0000000000006268fa058dad6815" Archived-At: Subject: Re: [Add] draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jul 2019 00:33:26 -0000 --0000000000006268fa058dad6815 Content-Type: text/plain; charset="UTF-8" On Sun, Jul 14, 2019 at 5:31 PM Eric Rescorla wrote: > > >> Let's add some domains to the draft that switch HTTPS to HTTP, and switch >> SSH to telnet. >> > > This sort of rhetoric doesn't seem particularly helpful. > What's the difference? thanks, Rob --0000000000006268fa058dad6815 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sun, Jul 14, 2019 at 5:31 PM Eric Resc= orla <ekr@rtfm.com> wrote:
=C2=A0
Let's ad= d some domains to the draft that switch HTTPS to HTTP, and switch SSH to te= lnet.

This sort of rhetoric doe= sn't seem particularly helpful.

=
What's the difference?

thanks,
Rob=C2=A0
--0000000000006268fa058dad6815-- From nobody Sun Jul 14 17:36:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3415F12009E for ; Sun, 14 Jul 2019 17:36:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DqZo-L4JPMiJ for ; Sun, 14 Jul 2019 17:36:33 -0700 (PDT) Received: from mail-lj1-x231.google.com (mail-lj1-x231.google.com [IPv6:2a00:1450:4864:20::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F81A12001A for ; Sun, 14 Jul 2019 17:36:33 -0700 (PDT) Received: by mail-lj1-x231.google.com with SMTP id m23so14319895lje.12 for ; Sun, 14 Jul 2019 17:36:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=LapiY9ojuMZn/45QbHboxoOeyMsE35aTdn8FwZ308lU=; b=rBYP0nsGCmfgadlfkzZzV3lGoWgkwaTU31bKpvQbRUN8hoso5JxA8vZygkKD1EKENu 6DxReieiZdeDlNXc9ggF7L3IkjYKjYuWMaAQgm7NJvjEHbeTnRgodSqNWPmJdNgJBAr/ fLmjFv9crKnTyZ0e/sKp5FNI0KaOrLnaH+O+uMAC6y2HaLst33Nbhu8LYC53k3fIKmb/ PMn9JAZcBYpo6OCPR8yZLztyujJup5xm4OnOoBh1EOyCh+72cZCMWC7W4NLHAdC388yb gjbuzcoX4bZ/hDroyLiAdeqjRIw0sIXC8xd1syTmjmVsDU9fBVBnFAnAuiUz0owU0vWT GibA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=LapiY9ojuMZn/45QbHboxoOeyMsE35aTdn8FwZ308lU=; b=CLVQ3I1+YJaqf0annSi4D08df8R3wVSzLb28SNvU4DI12APQVdQbMSZV0tx0JTldhS wCQzf8I1HsSce9sE/8AO3Rknn2pnHtaq144hPJsgYpM8uN12ZnE42AYP+vjtYe74wXTh 5zEL00xlzep7VD8I96ahetJimaROOiUaFon50y6R3GYeuGaB7XmdsExQpl/bl0a7bSkD BkWVNv5Cpz+mDrhiCDYIGdXrQdnb3vF66h3gd3XRSznAw+AwjU/ZdxsQnGwSK53gpBVQ /VhMUdBND4ePlzNjHpLwPl5nQXbBEZT0PhA26+D29Kfk6h4WIT3M4d0qeOlRQBtoCNMW M8Rg== X-Gm-Message-State: APjAAAUT9y++bPUX5HqTu2PdE/DbJ98R514FRUtUVkWnTWy8yOOLibCs wL1pgZr03eUuzwuyp4lS0Jy1alObOQ8iRu0K3XQ= X-Google-Smtp-Source: APXvYqy6xRg7rjqRiwC/QWtUErcLRK0GkoahzDe7UJSAGigYkcYw4kjHyE9KSXrER9tofddJkfAEH/zhQUZUEkDVffo= X-Received: by 2002:a2e:b0e6:: with SMTP id h6mr11886421ljl.18.1563150991395; Sun, 14 Jul 2019 17:36:31 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Sun, 14 Jul 2019 17:35:55 -0700 Message-ID: To: Rob Sayre Cc: Andy Grover , add@ietf.org Content-Type: multipart/alternative; boundary="000000000000929d18058dad7323" Archived-At: Subject: Re: [Add] draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jul 2019 00:36:35 -0000 --000000000000929d18058dad7323 Content-Type: text/plain; charset="UTF-8" On Sun, Jul 14, 2019 at 5:33 PM Rob Sayre wrote: > On Sun, Jul 14, 2019 at 5:31 PM Eric Rescorla wrote: > >> >> >>> Let's add some domains to the draft that switch HTTPS to HTTP, and >>> switch SSH to telnet. >>> >> >> This sort of rhetoric doesn't seem particularly helpful. >> > > What's the difference? > I believe I answered this question in my previous response. -Ekr --000000000000929d18058dad7323 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sun, Jul 14, 2019 at 5:33 PM Rob S= ayre <sayrer@gmail= .com> wrote:
On Sun, Jul 14, 2019 at 5:31 PM Eric = Rescorla <ekr@rtfm.com= > wrote:
=C2=A0
Let's add some domains to the draft that switch HTTPS to HTTP= , and switch SSH to telnet.

Thi= s sort of rhetoric doesn't seem particularly helpful.
=

What's the difference?

I believe I answered this question in my= previous response.

-Ekr

<= /div>
--000000000000929d18058dad7323-- From nobody Sun Jul 14 17:37:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65C1B1200B7 for ; Sun, 14 Jul 2019 17:37:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yqYh9F9tv_Xf for ; Sun, 14 Jul 2019 17:37:54 -0700 (PDT) Received: from mail-io1-xd2d.google.com (mail-io1-xd2d.google.com [IPv6:2607:f8b0:4864:20::d2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 499F612001A for ; Sun, 14 Jul 2019 17:37:54 -0700 (PDT) Received: by mail-io1-xd2d.google.com with SMTP id j5so27268989ioj.8 for ; Sun, 14 Jul 2019 17:37:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6QSfs0wcT3akpWoDBq+xxaCdLoZ0S9mhlbqrZDe0YpI=; b=dHp0iYvQSfaZSCRtaZVVUGNm/FrdAjHlnUOmhJ0dap2veV5TQM3uRq4GMfDH8vXBny BQfSu8J+teRQJT1arlsawJio6CEBudN4YsAMSGIi4wyeBe25x1VScMxQ6nKortYwgMQM mFQQNNnGUnPTVRcvOaE4s9fq62Ju8QsuY+AdO928I4O1gm8A5Ekcqk6Yhon/SUdUtT0h Gusqc6LLOr/bQxwy11SOzNTF4VwwTir6A7+9uJ3D7GRHgm8Z1V1zgmzEeMEotcsjHY7M dd8AHHkYwZxaSFosyrmjjbWgZv/sLi6i4PcfUu+5tPM95hPnIZLsflAzhx7sTfcE21sO RZyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6QSfs0wcT3akpWoDBq+xxaCdLoZ0S9mhlbqrZDe0YpI=; b=k8165C2cI2IeX2BR7yXP0brxOxxxUFn2N7vS4Qk5b+VT/xDRxW0ZBlswHFWQ+42ToP Orxxrv+srfqrV1yFHaafSdv677wjyqUcMwXEr/lqUgD+gsrbQesFrzjQ89Jk/3/3y4we vDkGicv7rFsX5PF3gITcosym6hw0awsfmJ28C6M2xbMP03Jb+AIKQkG/BJ1XGR/4fv99 d79ZcoaGdodmjHqNcT4o0cA5pYhetXYKIdXahqdNDqfuu4WbH3awuI1k3689sXoC0PZT 8YVjJEic+g75IlnXKkLw2Hm1kMpIEtm+j5pawYaSi5t7+9nXcDnSS36un7DThgBMdzsm 9Q+g== X-Gm-Message-State: APjAAAUgoWVBw+z9f2Pp1Fe1tBqLkmHi7AZXX62dPheYr0koG6wX4Ql6 vsDL805kWkdqztATuyHK/9Uh5u7/BNFWRwthj1d5MHkXs6b8JQ== X-Google-Smtp-Source: APXvYqyXpJPgyfwzjx0ajbPhjq7NqZb2RDdhr7J/kLVjHiVtZV5OsPNBD+D3cUO/NCDN05Cs0LWZR9/Bb2qVg8EfYtw= X-Received: by 2002:a02:1087:: with SMTP id 129mr25878115jay.131.1563151073613; Sun, 14 Jul 2019 17:37:53 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Sun, 14 Jul 2019 17:37:42 -0700 Message-ID: To: Eric Rescorla Cc: Andy Grover , add@ietf.org Content-Type: multipart/alternative; boundary="000000000000791ae4058dad78cd" Archived-At: Subject: Re: [Add] draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jul 2019 00:37:55 -0000 --000000000000791ae4058dad78cd Content-Type: text/plain; charset="UTF-8" On Sun, Jul 14, 2019 at 5:36 PM Eric Rescorla wrote: > > > On Sun, Jul 14, 2019 at 5:33 PM Rob Sayre wrote: > >> On Sun, Jul 14, 2019 at 5:31 PM Eric Rescorla wrote: >> >>> >>> >>>> Let's add some domains to the draft that switch HTTPS to HTTP, and >>>> switch SSH to telnet. >>>> >>> >>> This sort of rhetoric doesn't seem particularly helpful. >>> >> >> What's the difference? >> > > I believe I answered this question in my previous response > Hmm, maybe we could encrypt them using Dual_EC_DRBG. thanks, Rob --000000000000791ae4058dad78cd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sun, Jul 14, 2019 at 5:36 PM Eric = Rescorla <ekr@rtfm.com> wrote:
<= div dir=3D"ltr">

On Sun, Jul 14, 2019 at 5:33 PM Rob Sayre <sayrer@gmail.com> wro= te:
On Sun, Jul 14, 2019 at 5:31 PM Eric Rescorla <ekr@rtfm.com> wrote:<= br>
=C2=A0
Let= 9;s add some domains to the draft that switch HTTPS to HTTP, and switch SSH= to telnet.

This sort of rhetor= ic doesn't seem particularly helpful.

What's the difference?
<= div>
I believe I answered this question in my previous respon= se

Hmm, maybe we could en= crypt them using=C2=A0Dual_EC_DRBG.

thanks,
<= div>Rob --000000000000791ae4058dad78cd-- From nobody Mon Jul 15 03:27:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F8AB12004D for ; Mon, 15 Jul 2019 03:26:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PThi1ptW3-hQ for ; Mon, 15 Jul 2019 03:26:57 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C217120096 for ; Mon, 15 Jul 2019 03:26:57 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id C3BE16A28F for ; Mon, 15 Jul 2019 12:26:53 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563186413; bh=/OKCfavETPZSVS0ReXSxOnmfIkR9U0jcFOWvfowMtn0=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From; b=NUpuklH5Xt194Gr1nC/2buW5WXttivxE3UB0cCdGh5FV2ZZ8xBaeqOPNgQnhwOFdR xiWgp57Sv7TFnKQyDDnTt1nB5s7yPJyB9cFvrxj30VGaFYSL4Sd6aajDHQ544+zCVF 8T5S1vv6tNjMHnisF9zmP2h/qCcFoJ3HUfaoigqU7fiNx9N87h7v0eUq6dHTfZyvCO 5Lpbia9Y/PmLEIxBt/Gjn+w8sfwBMgYIK5RrY3869PJejRgzfs8dMJKVKEJFIJuxTs neRiQwSrKWhVUqSTUFwttPmfAOdB6gVI51/GJVK/ySMWlUGFelcIdcQ6qwbSrGbOd+ O0QrieP782tdQ== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id B6D903C0433 for ; Mon, 15 Jul 2019 12:26:53 +0200 (CEST) Date: Mon, 15 Jul 2019 12:26:53 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: add@ietf.org Message-ID: <1280826247.5057.1563186413694@appsuite-gw1.open-xchange.com> In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev8 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jul 2019 10:26:59 -0000

Il 15 luglio 2019 02:30 Eric Rescorla <ekr@rtfm.com> ha scritto:

The question of whether it's a good idea is rather more complicated: at a high level we have a situation where nearly all DNS is unencrypted and sent to a resolver which is insecurely configured. Some of those resolvers do policy enforcement and in some of those cases, the user wanted that kind of policy enforcement, so just switching over to a secure Trusted Recursive Resolver potentially violates POLA, and it would be nice to be able to detect those cases and do something [0].
Also, often that policy enforcement is actually being done on behalf of the user to increase his/her security, so even if we only wanted to focus on maximizing security, the choice would be between connecting securely to a (from the user's point of view) less secure resolver, and connecting insecurely to a more secure resolver; which option of the two is in the end more secure depends on the specific case (threat scenarios and their likelihood), so I think each application will make its own choice, often asking the user. Of course the proper solution is to have a way for the users to connect securely to the more secure resolver, but in the meantime both options should be made available.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
From nobody Mon Jul 15 06:15:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 185C712008B for ; Mon, 15 Jul 2019 06:15:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nMe5j8rA8vYm for ; Mon, 15 Jul 2019 06:15:09 -0700 (PDT) Received: from mail-yw1-xc2c.google.com (mail-yw1-xc2c.google.com [IPv6:2607:f8b0:4864:20::c2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D138412011B for ; Mon, 15 Jul 2019 06:15:07 -0700 (PDT) Received: by mail-yw1-xc2c.google.com with SMTP id z197so7315761ywd.13 for ; Mon, 15 Jul 2019 06:15:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=wISHc4Dcpnl9Maeo1s3zJECQhg3ZumRynrLixpDOPp4=; b=HRd970oo1P5OJzSnd6lLHpLL2vZuB90+DqSVSEA8JwD+BtSlpnKxumFGf3qETa+bJv 2BnScfS06b3VEQSbkQy9rZJNueb5I36FQ9TeZfaLfHrCpJOcLPOPUKmQANkSbaIGB0Tx QpP9FqAhYHve/ZPWV3KI5Vj1wDI0phc5GIClJ+CaskUEwsxjDMb0WlPv7BC9cWYhZo++ L6GqUddN6Z16JkSBC9igoN19eIemiTmXxjhA1GK2lrBML58AZOJfh2C0glzX4mNSbPQO tDaaP2vrrqozlcIppG7kUze0yVx7VGyX44BD7Xr9r1Qa2F3RCMc1RvyCVrdAbhNIyvw1 jr6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=wISHc4Dcpnl9Maeo1s3zJECQhg3ZumRynrLixpDOPp4=; b=Uv2LSFpxERRksjvwbC7EGn/lUMtdlCAGQsRWjbNzkWF3L6PRp86PoP7j7/xBT9iTFQ X+LI/7wtV5L/Tuz89tNuTBii0P4yVr82S0S9Kig52OEM9QW+krNncRE8rqYCxfJtZX79 4rK9wbJqC0MDeiYxjw+i7I4i9pFUbRwRPBsoklQeWpGYRELMkk2/m1rAG3QHte3Xj4O+ HsEPNYl80zEo65wM/lIg8cfk8F8A5e5UzjDz0q/dNfA3kPdLJDR89qAkbt+5DbL0ZFkE /rLk4GMS8Etg6CS4OaKxJvetREfyA2aibE8ERuv4PTnbChbYEAAcSm8EB3eaZQb02ik9 Qv6g== X-Gm-Message-State: APjAAAV4nojc5jFCIwNxybmxUtau+bbQtXuqScLxTnuvlQEZbKQM5JYY do4W5PK+0sRMmzexfU+6YOwFKi2E1E1tAgS6pQQhjrl4K78= X-Google-Smtp-Source: APXvYqyfmE2HIAfTke2nVRV2Rsbr0zKUAPEIsoUhR8Wiz1i+bMcOXDkRaT4eiKr6X6aaVfLWx7SzFV3UbbX/JonNj1A= X-Received: by 2002:a81:a253:: with SMTP id z19mr14779847ywg.13.1563196506577; Mon, 15 Jul 2019 06:15:06 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Alec Muffett Date: Mon, 15 Jul 2019 14:14:29 +0100 Message-ID: To: add@ietf.org Content-Type: multipart/alternative; boundary="0000000000007d20f9058db80c87" Archived-At: Subject: Re: [Add] draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jul 2019 13:15:11 -0000 --0000000000007d20f9058db80c87 Content-Type: text/plain; charset="UTF-8" Rather than snark, I would like to raise the negative example of "Haystack", a failed security and anonymity tool from several years back, which collapsed in much contentiousness. I was involved in revealing its flaws, so am deeply aware of the story: * https://www.theguardian.com/media/2010/mar/29/austin-heap-megas-innovator-award [context] * https://www.computerworlduk.com/it-business/-awardwinning-haystack-security-system-could-risk-iranian-lives--3569566/ * https://dropsafe.crypticide.com/article/4409 * https://liberationtech.stanford.narkive.com/jMCy8EpJ/deconstructing-the-security-risks-narrative-of-haystack#post2 Long story short: the application upon startup "beaconed" its existence in a way which could lead to those who used it to be revealed to repressive authorities, contra both its intention and its advertising. It strikes me that any system - in pursuit of "protecting" the user with "filters" - which both delegates the ability for the feature to be used to some environmental authority and also reveals its use, is: * defeating the intention of security, or at least placing the threat model of the environment above that of the user, and... * revolting against the end-to-end principle which drives so much of ancient, and modern, internet architecture As I understand it, we went to great lengths to ensure that TLS1.3 was not open for environmentally-driven "downgrade attacks" to be possible; I cannot reconcile this stance with the above proposal, where: * [as I understand it] any cafe owner using PiHole will be able to suppress TBD.arpa resolution, and disable DoH * [as I understand it] any state telco (Iran, above?) can suppress TBD.arpa resolution, and arrest anyone who attempts to resolve it for using "non-compliant" software * albeit the desire to protect people with MITM-filters is variously legislated and appears desirable, I cannot see how delivery of such is now compatible with the themes of rfc7258 Hence, I do and will strongly disapprove of this, and any other, proposition that would disable -- or, importantly, reveal! -- explicit DoH enablement choices that have made by a user. I believe that DoH is a long-awaited universal good, and that it should become common, even default, in order to foster consumer choice both in the application space, and in the space of DNS providers; and that such choice that must not be overridden by "environmental factors" - for all such filters are men in the middle. If not -- if policy detection and disablement is acceptable -- then why did we work to expunge downgrade attacks in TLS1.3? - alec --0000000000007d20f9058db80c87 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Rather than sn= ark, I would like to raise the negative example of "Haystack", a = failed security and anonymity tool from several years back, which collapsed= in much contentiousness.

= I was involved in revealing its flaws, so am deeply aware of the story:


Long story = short: the application upon startup "beaconed" its existence in a= way which could lead to those who used it to be revealed to repressive aut= horities, contra both its intention and its advertising.

It strikes me that any system - in pursuit o= f "protecting" the user with "filters" - which both del= egates the ability for the feature to be used to some environmental authori= ty and also reveals its use, is:

* defeating the intention of security, or at least placing the thr= eat model of the environment above that of the user, and...
* revolting against the end-to-end principle which drives so much = of ancient, and modern, internet architecture
As I understand it, we went to great lengths to ens= ure that TLS1.3 was not open for environmentally-driven "downgrade att= acks" to be possible; I cannot reconcile this stance with the above pr= oposal, where:

* [as I und= erstand it] any cafe owner using PiHole will be able to suppress TBD.arpa r= esolution, and disable DoH
* [as I understand it] any= state telco (Iran, above?) can suppress TBD.arpa resolution, and arrest an= yone who attempts to resolve it for using "non-compliant" softwar= e
* albeit the desire to protect people with MITM-fil= ters is variously legislated and appears desirable, I cannot see how delive= ry of such is now compatible with the themes of rfc7258

Hence, I do and will strongly disapprove of t= his, and any other, proposition that would disable -- or, importantly, reve= al! -- explicit DoH enablement choices that have made by a user.

I believe that DoH is a long-awaited= universal good, and that it should become common, even default, in order t= o foster consumer choice both in the application space, and in the space of= DNS providers; and that such choice that must not be overridden by "e= nvironmental factors" - for all such filters are men in the middle.

If not -- if policy detectio= n and disablement is acceptable -- then why did we work to expunge downgrad= e attacks in TLS1.3?

- ale= c

--0000000000007d20f9058db80c87-- From nobody Mon Jul 15 06:18:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0257F120103 for ; Mon, 15 Jul 2019 06:18:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AjOB2LMXE90z for ; Mon, 15 Jul 2019 06:18:33 -0700 (PDT) Received: from mail-yw1-xc32.google.com (mail-yw1-xc32.google.com [IPv6:2607:f8b0:4864:20::c32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25E631200F4 for ; Mon, 15 Jul 2019 06:18:33 -0700 (PDT) Received: by mail-yw1-xc32.google.com with SMTP id u141so7336958ywe.4 for ; Mon, 15 Jul 2019 06:18:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=wBCjTKHt35uOhm0sNpibv6bhuaVea4BSGWnHJP9iCcc=; b=CqoWwPcVRohttRiaf4efHr7yssWK11r/7lCQZpVLMfOT8BZWqug6hwZ+6woaIQKkGi /ECf5Sr11N3fTBu9LYP05RNbR9ARJAGlKSbiDcDPLjKVqIsMWZqnHwyGMZBxvECAoocb y2XjPMaWzZCsjP/McAGDWfLwUiNZHAnKMvzSU6S3G49XJABws1M+yyE717tRLXttgBLr HppNYYavFuROy8HE07BI8F5FnI+0Z8UUcBYfBUiIIUj/cuOrsokGYChacsoWbLeR791r 8vplvNjm/P91+uU6LmiZc4e7Vegl70i9xV+dqJhuKmquyjFKFFK+cm2poAdM2jesUKYz Mhkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=wBCjTKHt35uOhm0sNpibv6bhuaVea4BSGWnHJP9iCcc=; b=gLqyBhHphwYqihZTeqh+xqcP6lqaqEn4kpPaBsWKUR73hMjhMoyxnSompdrfAGwl0H /5wsbzvlkEf1kr6yC6hsnVhl89/k9+mRSKCzilzQpV7ZSjKVrU1KQs/NIsCel0oqn0F8 0axVDvj2HRSis+/+cEbJNv+wyUlzWe1Dsg4AwYFfVzwhpglO2zYsu2hq6xvd+AidLn0t Rmyyaf1bYQC9u1WRBHb4s9J11XGkPLN0E0G7n/Ns3p3ZZB72luKvSfZUXnN912qvtVDl yH8eE7zalhb5DxzOTSGOSoC2PGiHbnKd82eKofJAnnEJdQHB9+dTBIP+lKUsyyeMlAlP 67MQ== X-Gm-Message-State: APjAAAXYtx+zmKF/gLld6hf25sz72fwDWwRkSLZ9pFDxbjmjh2xL2nAJ oPvnr70WbzHk+qMFEajSfY+X4oUxu0J6QqzggHIFWmIJWUk= X-Google-Smtp-Source: APXvYqyhBqmmm83aKjkZbKFgVlz0jGpKW+Dma4FNTWqMngxfa797GfFq1HGXb/Jlhgjt+xt6mzP2ZLbMNdEPpV6A2t4= X-Received: by 2002:a0d:f9c3:: with SMTP id j186mr1276643ywf.116.1563196712132; Mon, 15 Jul 2019 06:18:32 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Alec Muffett Date: Mon, 15 Jul 2019 14:17:55 +0100 Message-ID: To: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000bda4fd058db8185a" Archived-At: Subject: Re: [Add] draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jul 2019 13:18:35 -0000 --000000000000bda4fd058db8185a Content-Type: text/plain; charset="UTF-8" On Mon, 15 Jul 2019 at 14:14, Alec Muffett wrote: > > * [as I understand it] any cafe owner using PiHole will be able to > suppress TBD.arpa resolution, and disable DoH > * [as I understand it] any state telco (Iran, above?) can suppress > TBD.arpa resolution, and arrest anyone who attempts to resolve it for using > "non-compliant" software > * albeit the desire to protect people with MITM-filters is variously > legislated and appears desirable, I cannot see how delivery of such is now > compatible with the themes of rfc7258 > Alas how often one hits "Send" and then realises what one should have added: * [as I understand it] any telco, state-sponsored or otherwise, can capture the IP address of any host which beacons/attempts to resolve "TBD.arpa", and then block all traffic to it, or else divert the latter for "special treatment" That's not really in the spirit of rfc7258, either. - alec -- http://dropsafe.crypticide.com/aboutalecm --000000000000bda4fd058db8185a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, 15 Jul 2019 at 1= 4:14, Alec Muffett <alec.muffe= tt@gmail.com> wrote:
<= div dir=3D"ltr">

* [as I understand it] any cafe owner using PiHole will = be able to suppress TBD.arpa resolution, and disable DoH
* [as I understand it] any state telco (Iran, above?) can suppress TBD.= arpa resolution, and arrest anyone who attempts to resolve it for using &qu= ot;non-compliant" software
* albeit the desire t= o protect people with MITM-filters is variously legislated and appears desi= rable, I cannot see how delivery of such is now compatible with the themes = of rfc7258

Alas how often one hits "Send" and then rea= lises what one should have added:

* [as I understa= nd it] any telco, state-sponsored or otherwise, can capture the IP address = of any host which beacons/attempts to resolve "TBD.arpa", and the= n block all traffic to it, or else divert the latter for "special trea= tment"

That's not really in the spirit of= rfc7258, either.

=C2=A0 =C2=A0 - alec
<= br>
--
http://dropsafe.cry= pticide.com/aboutalecm
--000000000000bda4fd058db8185a-- From nobody Mon Jul 15 06:55:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3A90120155 for ; Mon, 15 Jul 2019 06:55:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 84C1Oudvg8ds for ; Mon, 15 Jul 2019 06:55:14 -0700 (PDT) Received: from mail-yb1-xb30.google.com (mail-yb1-xb30.google.com [IPv6:2607:f8b0:4864:20::b30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20A5B12013D for ; Mon, 15 Jul 2019 06:55:14 -0700 (PDT) Received: by mail-yb1-xb30.google.com with SMTP id d9so1905041ybf.3 for ; Mon, 15 Jul 2019 06:55:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=mdDiIDhswLUpbyElDNzP1oU2NL9iCKtW6TQdMGz2UmI=; b=nEKO7VJPENZWK3yAUiPUK6e1my63P7gJRFCfn/j6sFqyhA3/eyGw7Nj3+i/smApdAX T1tMKpWAS2w1Zxe6Dh6+B/sTHYPMt6GbveyLmb/bJ2+h9d2KmgUmzzad8CRgaeSmcceU Cf/xfgz56ZL05A5VZ311FE2Ev5FCPPO6K3kOdhgRUoXqVVctsNPXFFA1ndtgncbLzWNU FKeTMvQxX/QX03GFkBhZsh19QafvKVNE0sEd4S1atUHTJY2DnZ4/twfD5xi/zXy9XcVn mh6DlCApGEmro5toawqwgjkKKYYBtxItjWVDs8Qf7MCC9cPbV4ODvI0L3o9qJCJ1oVkv UF2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=mdDiIDhswLUpbyElDNzP1oU2NL9iCKtW6TQdMGz2UmI=; b=Z7q14b02dFfn27/H5fZIPHd7M6PSn1g5CMt5dYEIQc0DgoqHbCcjrPDr/NrdSrQTAZ Emc0br/btTTX+0x4x9Wcq+m+/mwtFA35ymjoebLyn8Fmi5sWBz9Gf5KObYCFFEEGOLx2 8qrjx4HyujOFksSyu4atb+fCI6uHFg96wpAskQc5rUlS2leRR4WFGumz2i/w7abWAZPi Aaw40IH0aZ3MSvu/qb/akbPxDaSLWqo9m858CUCYc/hznywZiMAgTTHqK2RcmyI7Mg7u 0XaIC3Fe8V/xCGv2zzZTq1Xfq53TSVzjZ+H+A7iBiLMnHtmlSRFSzujD07Bi3CQavRRB tctA== X-Gm-Message-State: APjAAAXodgvwe7Eq9Q0w/VcjHGkZzrk2vIicNm9UPnG9sTx2nIdnGn8x jxWyYngpsCqCfSLKlCNXVsy6OY+NeMfLZl8Q9R7oJ+jrgeE= X-Google-Smtp-Source: APXvYqz6kUUf0XchwwtTsxkBluX6x/1FvE7U2oZycFvjsAVgG7cyKOR6oq4dW6F3E1yUmDtvmbU1bYd/5mtZEVhfb/Q= X-Received: by 2002:a25:5557:: with SMTP id j84mr14713614ybb.25.1563198913044; Mon, 15 Jul 2019 06:55:13 -0700 (PDT) MIME-Version: 1.0 References: <1280826247.5057.1563186413694@appsuite-gw1.open-xchange.com> In-Reply-To: <1280826247.5057.1563186413694@appsuite-gw1.open-xchange.com> From: Alec Muffett Date: Mon, 15 Jul 2019 14:54:36 +0100 Message-ID: To: Vittorio Bertola Cc: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000ece7fb058db89b6d" Archived-At: Subject: Re: [Add] draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jul 2019 13:55:17 -0000 --000000000000ece7fb058db89b6d Content-Type: text/plain; charset="UTF-8" On Mon, 15 Jul 2019 at 11:27, Vittorio Bertola wrote: > Also, often that policy enforcement is actually being done on behalf of > the user to increase his/her security, so even if we only wanted to focus > on maximizing security, the choice would be between connecting securely to > a (from the user's point of view) less secure resolver, and connecting > insecurely to a more secure resolver; which option of the two is in the end > more secure depends on the specific case (threat scenarios and their > likelihood), so I think each application will make its own choice, often > asking the user. Of course the proper solution is to have a way for the > users to connect securely to the more secure resolver, but in the meantime > both options should be made available. > Hi Vittorio! May I please observe for everyone that one of the quirks which will complicate discussion of this proposal, is overloading of the word "secure" in descriptions like this? I am presuming that most people here have worked with some kind of "threat modelling", but the high-level challenge here is that the word "secure" (and "more/less secure") is abstract and not descriptive of "why" someone might want to use one resolver over another; or why the environment surrounding that user may wish to impose a different resolver upon them. Hence something like: *Also, often that policy enforcement is actually being done on behalf of the user to increase his/her {PRIVACY, INTEGRITY}, so even if we only wanted to focus on maximizing {PRIVACY, INTEGRITY}, the choice would be between connecting {PRIVATELY, TAMPERPROOFLY, ASSUREDLY} to a (from the user's point of view) less {PRIVATE, TRUSTWORTHY, TAMPERPROOF} resolver, and connecting {WITH WEAK PRIVACY, ASSURANCE, TRUST} to a more {PRIVATE, TRUSTWORTHY} resolver; which option of the two is in the end more {PRIVATELY, TAMPERPROOF} depends on the specific case (threat scenarios and their likelihood), so I think each application will make its own choice, often asking the user. Of course the proper solution is to have a way for the users to connect {PRIVATELY, TAMPERPROOFLY} to the more {PRIVATE, TRUSTWORTHY} resolver, but in the meantime both options should be made available.* ...delete as applicable? :-) tl;dr - the "S" word does not mean anything without further explanation. - alec -- http://dropsafe.crypticide.com/aboutalecm --000000000000ece7fb058db89b6d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, 15 Jul 2019 at 1= 1:27, Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:
Also, often that policy enforcement is actually being done on behalf of = the user to increase his/her security, so even if we only wanted to focus o= n maximizing security, the choice would be between connecting securely to a= (from the user's point of view) less secure resolver, and connecting i= nsecurely to a more secure resolver; which option of the two is in the end = more secure depends on the specific case (threat scenarios and their likeli= hood), so I think each application will make its own choice, often asking t= he user. Of course the proper solution is to have a way for the users to co= nnect securely to the more secure resolver, but in the meantime both option= s should be made available.=C2=A0

Hi Vittorio!

May I please observe for everyone = that one of the quirks which will complicate discussion of this proposal, i= s overloading of the word "secure" in descriptions like this?

I am presuming that most people here have worked with= some kind of "threat modelling", but the high-level challenge he= re is that the word "secure" (and "more/less secure") i= s abstract and not descriptive of "why" someone might want to use= one resolver over another; or why the environment surrounding that user ma= y wish to impose a different resolver upon them.

H= ence something like:

Also, often that policy enforcement is actually bei= ng done on behalf of the user to increase his/her {PRIVACY, INTEGRITY}, so = even if we only wanted to focus on maximizing {PRIVACY, INTEGRITY}, the cho= ice would be between connecting {PRIVATELY, TAMPERPROOFLY, ASSUREDLY} to a = (from the user's point of view) less {PRIVATE, TRUSTWORTHY, TAMPERPROOF= } resolver, and connecting {WITH WEAK PRIVACY, ASSURANCE, TRUST} to a more = {PRIVATE, TRUSTWORTHY} resolver; which option of the two is in the end more= {PRIVATELY, TAMPERPROOF} depends on the specific case (threat scenarios an= d their likelihood), so I think each application will make its own choice, = often asking the user. Of course the proper solution is to have a way for t= he users to connect {PRIVATELY, TAMPERPROOFLY} to the more {PRIVATE, TRUSTW= ORTHY} resolver, but in the meantime both options should be made available.=

...delete as applicable? :-)
=

tl;dr - the "S" word does not mean anything w= ithout further explanation.

=C2=A0 =C2=A0 =C2=A0- = alec=C2=A0

--
http://dropsafe.crypticide.com/aboutalecm
--000000000000ece7fb058db89b6d-- From nobody Tue Jul 16 03:31:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7BD3812023F for ; Tue, 16 Jul 2019 03:31:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KqWYMT98Y-wy for ; Tue, 16 Jul 2019 03:31:50 -0700 (PDT) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10056.outbound.protection.outlook.com [40.107.1.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 076F6120074 for ; Tue, 16 Jul 2019 03:31:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=VCDaVvH/VPulEjOANI8EPCRiUfPzRnQ7H9xYBlxpOZbhExlRm/ZesJ0t+4dFYzJO54Lezvqh5O88NvqMnT9ns6JiPd63S/Y7q+d+KxQh6jpkkTdFUwypaggGLwbkhHs6PxmZa4ermnDzGJ29B/e4RUrSWm6NmMFqHwLd7+S9qcI6jeZa0wUxC43NvOvnY0FuQiwGrhfmTsf7s5H3vcM/j5TkU8oF6QR8c72uaD96Pu2uM6o9Hjv5H/kQMJk9K7WGCZWj1oT9uJQY/Uj9bIOC2K/glFE+DfpE/zD34fZ1nAc3SGG2kzKit7p36J1HFrOX4AwuVQdizD2TfBesrBmExA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jyXpvC7rQb/3SGZXAvw6cG9YFvCY8dLS0jNw+qCyDlY=; b=JGyVwqfH1ry6j1dzBfa+t1W2K/gXfJcVbq1eN+OQZUVxiMkQ5jvK7fiy2bNwK1to3jN/ijVFUqi9mLfpWv9cFt5VQjLENK5zRAtr0hjm4MgW5egaEXblSlrZysyT/Coyu10ZllhTNIGxldMRVng2abY/EbT5SzckDIY6tJFKqEB5DznLEFMIVKsCyS/jn0OqimM/fakyxB6uZWi8/vqkrj3VzDPTAs31sYAUJ3CSpAkH9BZcEj/FNr7ZlEjvm2IVxv5t/gf0vpkmO0yWt5cQqpBO0OZDMleK9wuIhzORfd4QISBjprin1XTK3zwc6Pyd/g9floIBjJCNNK9GEUux8A== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=sky.uk;dmarc=pass action=none header.from=sky.uk;dkim=pass header.d=sky.uk;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jyXpvC7rQb/3SGZXAvw6cG9YFvCY8dLS0jNw+qCyDlY=; b=onxkjAVOdG/oEsLE99c6S8vj/UQBbsa5ZlUN5uDXuRO9WFnP4ZXxtu+M2ZnGQrVeQDLAJQuJg8He5A9DcmPXKU7XAkHiTd/xnnguBlEY8oNrsO163xrOiVifYz8kN3R/EHXreinJMiOiggyKiED46o3BzYt3OhmQrS0X5wD7ig4= Received: from DB6PR0602MB2805.eurprd06.prod.outlook.com (10.172.248.15) by DB6PR0602MB2823.eurprd06.prod.outlook.com (10.172.248.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2073.13; Tue, 16 Jul 2019 10:31:47 +0000 Received: from DB6PR0602MB2805.eurprd06.prod.outlook.com ([fe80::251a:5b99:bf14:1921]) by DB6PR0602MB2805.eurprd06.prod.outlook.com ([fe80::251a:5b99:bf14:1921%5]) with mapi id 15.20.2073.012; Tue, 16 Jul 2019 10:31:47 +0000 From: "Dixon, Hugh" To: Alec Muffett , "add@ietf.org" Thread-Topic: [EXTERNAL] Re: [Add] draft-grover-add-policy-detection-00 Thread-Index: AQHVOw9dnoSdkELwNk2T1hCmFh8Zf6bLqU6AgAF0rAA= Date: Tue, 16 Jul 2019 10:31:46 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190708 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hugh.Dixon@sky.uk; x-originating-ip: [90.216.150.239] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ac16d5ac-ec63-4299-38eb-08d709d8ce07 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DB6PR0602MB2823; x-ms-traffictypediagnostic: DB6PR0602MB2823: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0100732B76 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(136003)(396003)(39860400002)(366004)(376002)(346002)(52314003)(199004)(189003)(99286004)(36756003)(561944003)(8676002)(33656002)(25786009)(53546011)(86362001)(102836004)(186003)(6506007)(6246003)(11346002)(3846002)(76176011)(26005)(446003)(7736002)(6512007)(476003)(53936002)(54896002)(2616005)(2906002)(229853002)(6486002)(478600001)(236005)(6116002)(6306002)(966005)(2501003)(71190400001)(71200400001)(6436002)(110136005)(14444005)(316002)(486006)(256004)(606006)(76116006)(91956017)(5024004)(66476007)(81156014)(5660300002)(8936002)(66946007)(64756008)(66556008)(66446008)(14454004)(81166006)(68736007)(66066001)(58126008); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0602MB2823; H:DB6PR0602MB2805.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: biHVrGL9sHOqQc9OzD0oj9VjsNcD2yIiMieDYMRg7QhcIXkyr/NjwWSFfjn9rlZ9git0vu9NpuY+Sbk4DMnFUkHTdf5czK4y+13OcueUj5Z4L/af+w9mS37uth/gGBLndCS3bY/63n55ggUCmZ4OKFjyOo62rrgseGkjnLN3vi+fT1MjOWNHk5/12I3/U0g7+2wtkWV2J+qR/8nt7OljIoo+qS6odjoFCRUHwJdPFdz09tHYOWnV4DP5Fg2C780+o05NQNQbpPq20S6kPfXhnzLagW2PpOY8Psimun4nZZRM4tTl4zy+D6e8v9s5FcXJ47K+9hI7tKhTKgpzwx2HJ6aEmyuo9Txu8vae8NVv0TPxeu3ilRo9fj3pS6FRszBgWc3HkJwxb2nYKMy4opX6jw2P01xT3VkXJwkI7yqBkyc= Content-Type: multipart/alternative; boundary="_000_A45F4F74D6C1435AA52FC2DEA82E2999skyuk_" MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: ac16d5ac-ec63-4299-38eb-08d709d8ce07 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Jul 2019 10:31:46.8601 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: hugh.dixon@sky.uk X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0602MB2823 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 10:31:53 -0000 --_000_A45F4F74D6C1435AA52FC2DEA82E2999skyuk_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQWxlYyDigJMNCkdpdmVuIHRoYXQgdGhpcyBpcyBhdCBpdHMgY29yZSAoanVzdCkgYSBwcm90 b2NvbCBmb3IgYXNraW5nIChhbnkpIEROUyBzZXJ2ZXIgd2hldGhlciBpdCBoYXMgYSBmaWx0ZXJp bmcgcG9saWN5LCB3b27igJl0IOKAnG5vbi1jb21wbGlhbnQgc29mdHdhcmXigJ0gd2lsbCBiZSB0 aGUgc29ydCBvZiBzb2Z0d2FyZSB3aGljaCBkb2VzIG5vdCBiZWFjb24/ICAoc29ydC1vZiBkZXRl Y3RhYmxlIGJ1dCBub3QgaWYgaXTigJlzIGVzc2VudGlhbGx5IG9wdGlvbmFsIGFwcCBiZWhhdmlv dXIgYW55d2F5LCBzdWNoIHRoYXQgdGhlIGFic2VuY2Ugb2YgYSBiZWFjb24gaXNu4oCZdCBhIHNp Z25pZmljYW50IOKAnGZsYWfigJ0g4oCTIGNlcnRhaW5seSBub3QgYXMgbXVjaCBvZiBhIG9uZSBh cyBub24tZXhpc3RlbnQgRE5TIGFjdGl2aXR5IC0gYXMgaXQgd291bGQgYmUgaWYgYWxsIGxvb2t1 cHMgaGF2ZSBnb25lIERvSC10by10aGlyZC1wYXJ0eSk/DQpJIHRoaW5rIHRoaXMgaXMganVzdCBh IHBvbGljeS1zaWduYWxsaW5nIHByb3RvY29sLCB0byBlbmFibGUgdXNlcnMgd2hvIOKAnHdhbnQg dG/igJ0gdG8gdXNlIHRoZSBwcmVmZXJyZWQgcG9saWN5LWltcGxlbWVudGluZyByZXNvbHZlciAo cXVpdGUgcG9zc2libHkgdXNpbmcgRG9IIGFzIHRoZSB0cmFuc3BvcnQpLiAgVGhlIHdvcmRpbmcg Z2V0cyBhIHRvdWNoIGNvbmZ1c2luZyBpbiB0aGVyZSDigJMgSeKAmW0gc3VyZSBhIG5leHQgZHJh ZnQgd291bGQgbWFrZSB0aGUgZGlzdGluY3Rpb24gY2xlYXJlci4NCk15IGNvbW1lbnRzIGFyZSBu b3QgYSBjb21tZW50YXJ5IG9uIHRoZSB3aWRlciBlZmZlY3RpdmVuZXNzIG9mIHRoZSBkcmFmdCBw cm9wb3NhbCBieSB0aGUgd2F5LCBqdXN0IG9uIHRoZSBzcGVjaWZpYyBleGFtcGxlIGdpdmVuLg0K DQpIDQoNCkZyb206IEFkZCA8YWRkLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFsZiBvZiBBbGVj IE11ZmZldHQgPGFsZWMubXVmZmV0dEBnbWFpbC5jb20+DQpEYXRlOiBNb25kYXksIDE1IEp1bHkg MjAxOSBhdCAxNDoxOA0KVG86ICJhZGRAaWV0Zi5vcmciIDxhZGRAaWV0Zi5vcmc+DQpTdWJqZWN0 OiBbRVhURVJOQUxdIFJlOiBbQWRkXSBkcmFmdC1ncm92ZXItYWRkLXBvbGljeS1kZXRlY3Rpb24t MDANCg0KT24gTW9uLCAxNSBKdWwgMjAxOSBhdCAxNDoxNCwgQWxlYyBNdWZmZXR0IDxhbGVjLm11 ZmZldHRAZ21haWwuY29tPG1haWx0bzphbGVjLm11ZmZldHRAZ21haWwuY29tPj4gd3JvdGU6DQoN CiogW2FzIEkgdW5kZXJzdGFuZCBpdF0gYW55IGNhZmUgb3duZXIgdXNpbmcgUGlIb2xlIHdpbGwg YmUgYWJsZSB0byBzdXBwcmVzcyBUQkQuYXJwYSByZXNvbHV0aW9uLCBhbmQgZGlzYWJsZSBEb0gN CiogW2FzIEkgdW5kZXJzdGFuZCBpdF0gYW55IHN0YXRlIHRlbGNvIChJcmFuLCBhYm92ZT8pIGNh biBzdXBwcmVzcyBUQkQuYXJwYSByZXNvbHV0aW9uLCBhbmQgYXJyZXN0IGFueW9uZSB3aG8gYXR0 ZW1wdHMgdG8gcmVzb2x2ZSBpdCBmb3IgdXNpbmcgIm5vbi1jb21wbGlhbnQiIHNvZnR3YXJlDQoq IGFsYmVpdCB0aGUgZGVzaXJlIHRvIHByb3RlY3QgcGVvcGxlIHdpdGggTUlUTS1maWx0ZXJzIGlz IHZhcmlvdXNseSBsZWdpc2xhdGVkIGFuZCBhcHBlYXJzIGRlc2lyYWJsZSwgSSBjYW5ub3Qgc2Vl IGhvdyBkZWxpdmVyeSBvZiBzdWNoIGlzIG5vdyBjb21wYXRpYmxlIHdpdGggdGhlIHRoZW1lcyBv ZiByZmM3MjU4DQoNCkFsYXMgaG93IG9mdGVuIG9uZSBoaXRzICJTZW5kIiBhbmQgdGhlbiByZWFs aXNlcyB3aGF0IG9uZSBzaG91bGQgaGF2ZSBhZGRlZDoNCg0KKiBbYXMgSSB1bmRlcnN0YW5kIGl0 XSBhbnkgdGVsY28sIHN0YXRlLXNwb25zb3JlZCBvciBvdGhlcndpc2UsIGNhbiBjYXB0dXJlIHRo ZSBJUCBhZGRyZXNzIG9mIGFueSBob3N0IHdoaWNoIGJlYWNvbnMvYXR0ZW1wdHMgdG8gcmVzb2x2 ZSAiVEJELmFycGEiLCBhbmQgdGhlbiBibG9jayBhbGwgdHJhZmZpYyB0byBpdCwgb3IgZWxzZSBk aXZlcnQgdGhlIGxhdHRlciBmb3IgInNwZWNpYWwgdHJlYXRtZW50Ig0KDQpUaGF0J3Mgbm90IHJl YWxseSBpbiB0aGUgc3Bpcml0IG9mIHJmYzcyNTgsIGVpdGhlci4NCg0KICAgIC0gYWxlYw0KDQot LQ0KaHR0cDovL2Ryb3BzYWZlLmNyeXB0aWNpZGUuY29tL2Fib3V0YWxlY208aHR0cHM6Ly9ldXIw MS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHAlM0ElMkYlMkZkcm9w c2FmZS5jcnlwdGljaWRlLmNvbSUyRmFib3V0YWxlY20mZGF0YT0wMiU3QzAxJTdDaHVnaC5kaXhv biU0MHNreS51ayU3QzNkYzYzMmU1ZWRkZjQ0ZTE4OTEyMDhkNzA5MjZmOWYyJTdDNjhiODY1ZDVj ZjE4NGIyYjgyYTRhNGVkZGI5YzUyMzclN0MwJTdDMCU3QzYzNjk4NzkzNTMzMjk3MDUxMyZzZGF0 YT0zMDR5Wng2SmN4cnlsQnhVbmNFJTJCNnNkUEJQV3lPN3FCQTVJQlBQOFJ0MXMlM0QmcmVzZXJ2 ZWQ9MD4NCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tDQpUaGlzIGVtYWlsIGlzIGZyb20gYW4gZXh0ZXJuYWwgc291cmNl LiBQbGVhc2UgZG8gbm90IG9wZW4gYXR0YWNobWVudHMgb3IgY2xpY2sgbGlua3MgZnJvbSBhbiB1 bmtub3duIG9yIHN1c3BpY2lvdXMgb3JpZ2luLiBQaGlzaGluZyBhdHRlbXB0cyBjYW4gYmUgcmVw b3J0ZWQgYnkgc2VuZGluZyB0aGVtIHRvIHBoaXNoaW5nQHNreS51ayBhcyBhdHRhY2htZW50cy4g VGhhbmsgeW91DQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KDQpJbmZvcm1hdGlvbiBpbiB0aGlzIGVtYWlsIGluY2x1 ZGluZyBhbnkgYXR0YWNobWVudHMgbWF5IGJlIHByaXZpbGVnZWQsIGNvbmZpZGVudGlhbCBhbmQg aXMgaW50ZW5kZWQgZXhjbHVzaXZlbHkgZm9yIHRoZSBhZGRyZXNzZWUuIFRoZSB2aWV3cyBleHBy ZXNzZWQgbWF5IG5vdCBiZSBvZmZpY2lhbCBwb2xpY3ksIGJ1dCB0aGUgcGVyc29uYWwgdmlld3Mg b2YgdGhlIG9yaWdpbmF0b3IuIElmIHlvdSBoYXZlIHJlY2VpdmVkIGl0IGluIGVycm9yLCBwbGVh c2Ugbm90aWZ5IHRoZSBzZW5kZXIgYnkgcmV0dXJuIGUtbWFpbCBhbmQgZGVsZXRlIGl0IGZyb20g eW91ciBzeXN0ZW0uIFlvdSBzaG91bGQgbm90IHJlcHJvZHVjZSwgZGlzdHJpYnV0ZSwgc3RvcmUs IHJldHJhbnNtaXQsIHVzZSBvciBkaXNjbG9zZSBpdHMgY29udGVudHMgdG8gYW55b25lLiBQbGVh c2Ugbm90ZSB3ZSByZXNlcnZlIHRoZSByaWdodCB0byBtb25pdG9yIGFsbCBlLW1haWwgY29tbXVu aWNhdGlvbiB0aHJvdWdoIG91ciBpbnRlcm5hbCBhbmQgZXh0ZXJuYWwgbmV0d29ya3MuIFNLWSBh bmQgdGhlIFNLWSBtYXJrcyBhcmUgdHJhZGVtYXJrcyBvZiBTa3kgTGltaXRlZCBhbmQgU2t5IElu dGVybmF0aW9uYWwgQUcgYW5kIGFyZSB1c2VkIHVuZGVyIGxpY2VuY2UuDQoNClNreSBVSyBMaW1p dGVkIChSZWdpc3RyYXRpb24gTm8uIDI5MDY5OTEpLCBTa3ktSW4tSG9tZSBTZXJ2aWNlIExpbWl0 ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjA2NzA3NSksIFNreSBTdWJzY3JpYmVycyBTZXJ2aWNlcyBM aW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIzNDAxNTApIGFuZCBTa3kgQ1AgTGltaXRlZCAoUmVn aXN0cmF0aW9uIE5vLiA5NTEzMjU5KSBhcmUgZGlyZWN0IG9yIGluZGlyZWN0IHN1YnNpZGlhcmll cyBvZiBTa3kgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMjQ3NzM1KS4gQWxsIG9mIHRoZSBj b21wYW5pZXMgbWVudGlvbmVkIGluIHRoaXMgcGFyYWdyYXBoIGFyZSBpbmNvcnBvcmF0ZWQgaW4g RW5nbGFuZCBhbmQgV2FsZXMgYW5kIHNoYXJlIHRoZSBzYW1lIHJlZ2lzdGVyZWQgb2ZmaWNlIGF0 IEdyYW50IFdheSwgSXNsZXdvcnRoLCBNaWRkbGVzZXggVFc3IDVRRA0K --_000_A45F4F74D6C1435AA52FC2DEA82E2999skyuk_ Content-Type: text/html; charset="utf-8" Content-ID: <53B11137CBA3B343AFFB6D657922A26E@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFz Ow0KCXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow Y207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoi SFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4w MDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ29uc29sYXMiLHNlcmlm O30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0 eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1y aWdodDowY207DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNt Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJ Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpz cGFuLkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1h dHRlZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhU TUwgUHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWlseToiQ29uc29sYXMiLHNlcmlmO30NCi5Nc29D aHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4w cHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdp bjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdl OldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tR0Ii IGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1VUyI+SGkgQWxlYyDigJMgPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5HaXZlbiB0aGF0 IHRoaXMgaXMgYXQgaXRzIGNvcmUgKGp1c3QpIGEgcHJvdG9jb2wgZm9yIGFza2luZyAoYW55KSBE TlMgc2VydmVyIHdoZXRoZXIgaXQgaGFzIGEgZmlsdGVyaW5nIHBvbGljeSwgd29u4oCZdCDigJxu b24tY29tcGxpYW50IHNvZnR3YXJl4oCdIHdpbGwgYmUgdGhlIHNvcnQgb2Ygc29mdHdhcmUgd2hp Y2ggZG9lcyBub3QgYmVhY29uPw0KICZuYnNwOyhzb3J0LW9mIGRldGVjdGFibGUgYnV0IG5vdCBp ZiBpdOKAmXMgZXNzZW50aWFsbHkgb3B0aW9uYWwgYXBwIGJlaGF2aW91ciBhbnl3YXksIHN1Y2gg dGhhdCB0aGUgYWJzZW5jZSBvZiBhIGJlYWNvbiBpc27igJl0IGEgc2lnbmlmaWNhbnQg4oCcZmxh Z+KAnSDigJMgY2VydGFpbmx5IG5vdCBhcyBtdWNoIG9mIGEgb25lIGFzIG5vbi1leGlzdGVudCBE TlMgYWN0aXZpdHkgLSBhcyBpdCB3b3VsZCBiZSBpZiBhbGwgbG9va3VwcyBoYXZlIGdvbmUgRG9I LXRvLXRoaXJkLXBhcnR5KT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkkgdGhpbmsgdGhp cyBpcyBqdXN0IGEgcG9saWN5LXNpZ25hbGxpbmcgcHJvdG9jb2wsIHRvIGVuYWJsZSB1c2VycyB3 aG8g4oCcd2FudCB0b+KAnSB0byB1c2UgdGhlIHByZWZlcnJlZCBwb2xpY3ktaW1wbGVtZW50aW5n IHJlc29sdmVyIChxdWl0ZSBwb3NzaWJseSB1c2luZyBEb0ggYXMgdGhlIHRyYW5zcG9ydCkuJm5i c3A7IFRoZSB3b3JkaW5nIGdldHMgYQ0KIHRvdWNoIGNvbmZ1c2luZyBpbiB0aGVyZSDigJMgSeKA mW0gc3VyZSBhIG5leHQgZHJhZnQgd291bGQgbWFrZSB0aGUgZGlzdGluY3Rpb24gY2xlYXJlci48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPk15IGNvbW1lbnRzIGFyZSBub3QgYSBjb21tZW50 YXJ5IG9uIHRoZSB3aWRlciBlZmZlY3RpdmVuZXNzIG9mIHRoZSBkcmFmdCBwcm9wb3NhbCBieSB0 aGUgd2F5LCBqdXN0IG9uIHRoZSBzcGVjaWZpYyBleGFtcGxlIGdpdmVuLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1s YW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5IPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1m YXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2 IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGlu ZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+QWRkICZsdDthZGQtYm91bmNlc0Bp ZXRmLm9yZyZndDsgb24gYmVoYWxmIG9mIEFsZWMgTXVmZmV0dCAmbHQ7YWxlYy5tdWZmZXR0QGdt YWlsLmNvbSZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+TW9uZGF5LCAxNSBKdWx5IDIwMTkgYXQgMTQ6 MTg8YnI+DQo8Yj5UbzogPC9iPiZxdW90O2FkZEBpZXRmLm9yZyZxdW90OyAmbHQ7YWRkQGlldGYu b3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5bRVhURVJOQUxdIFJlOiBbQWRkXSBkcmFmdC1n cm92ZXItYWRkLXBvbGljeS1kZXRlY3Rpb24tMDA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gTW9uLCAx NSBKdWwgMjAxOSBhdCAxNDoxNCwgQWxlYyBNdWZmZXR0ICZsdDs8YSBocmVmPSJtYWlsdG86YWxl Yy5tdWZmZXR0QGdtYWlsLmNvbSI+YWxlYy5tdWZmZXR0QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3Rl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBj bSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4qIFthcyBJIHVuZGVyc3RhbmQgaXRdIGFueSBjYWZlIG93bmVyIHVzaW5nIFBp SG9sZSB3aWxsIGJlIGFibGUgdG8gc3VwcHJlc3MgVEJELmFycGEgcmVzb2x1dGlvbiwgYW5kIGRp c2FibGUgRG9IPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4qIFthcyBJIHVuZGVyc3RhbmQgaXRdIGFueSBzdGF0ZSB0ZWxjbyAoSXJhbiwgYWJvdmU/ KSBjYW4gc3VwcHJlc3MgVEJELmFycGEgcmVzb2x1dGlvbiwgYW5kIGFycmVzdCBhbnlvbmUgd2hv IGF0dGVtcHRzIHRvIHJlc29sdmUgaXQgZm9yIHVzaW5nICZxdW90O25vbi1jb21wbGlhbnQmcXVv dDsgc29mdHdhcmU8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiogYWxiZWl0IHRoZSBkZXNpcmUgdG8gcHJvdGVjdCBwZW9wbGUgd2l0aCBNSVRNLWZp bHRlcnMgaXMgdmFyaW91c2x5IGxlZ2lzbGF0ZWQgYW5kIGFwcGVhcnMgZGVzaXJhYmxlLCBJIGNh bm5vdCBzZWUgaG93IGRlbGl2ZXJ5IG9mIHN1Y2ggaXMgbm93IGNvbXBhdGlibGUgd2l0aCB0aGUg dGhlbWVzIG9mIHJmYzcyNTg8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFsYXMgaG93IG9mdGVuIG9uZSBo aXRzICZxdW90O1NlbmQmcXVvdDsgYW5kIHRoZW4gcmVhbGlzZXMgd2hhdCBvbmUgc2hvdWxkIGhh dmUgYWRkZWQ6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiogW2FzIEkgdW5kZXJzdGFuZCBpdF0gYW55IHRlbGNvLCBzdGF0ZS1zcG9uc29yZWQg b3Igb3RoZXJ3aXNlLCBjYW4gY2FwdHVyZSB0aGUgSVAgYWRkcmVzcyBvZiBhbnkgaG9zdCB3aGlj aCBiZWFjb25zL2F0dGVtcHRzIHRvIHJlc29sdmUgJnF1b3Q7VEJELmFycGEmcXVvdDssIGFuZCB0 aGVuIGJsb2NrIGFsbCB0cmFmZmljIHRvIGl0LCBvciBlbHNlIGRpdmVydCB0aGUgbGF0dGVyIGZv ciAmcXVvdDtzcGVjaWFsIHRyZWF0bWVudCZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGF0J3Mgbm90IHJlYWxseSBpbiB0aGUgc3Bp cml0IG9mIHJmYzcyNTgsIGVpdGhlci48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAtIGFsZWM8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBocmVmPSJodHRwczovL2V1cjAxLnNhZmVsaW5rcy5w cm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cCUzQSUyRiUyRmRyb3BzYWZlLmNyeXB0aWNp ZGUuY29tJTJGYWJvdXRhbGVjbSZhbXA7ZGF0YT0wMiU3QzAxJTdDaHVnaC5kaXhvbiU0MHNreS51 ayU3QzNkYzYzMmU1ZWRkZjQ0ZTE4OTEyMDhkNzA5MjZmOWYyJTdDNjhiODY1ZDVjZjE4NGIyYjgy YTRhNGVkZGI5YzUyMzclN0MwJTdDMCU3QzYzNjk4NzkzNTMzMjk3MDUxMyZhbXA7c2RhdGE9MzA0 eVp4NkpjeHJ5bEJ4VW5jRSUyQjZzZFBCUFd5TzdxQkE1SUJQUDhSdDFzJTNEJmFtcDtyZXNlcnZl ZD0wIiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL2Ryb3BzYWZlLmNyeXB0aWNpZGUuY29tL2Fib3V0 YWxlY208L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgYWxpZ249ImNlbnRlciIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO3RleHQtYWxpZ246Y2VudGVyIj4N CjxiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVT Ij4tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLTwvc3Bhbj48L2I+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBhbGlnbj0iY2VudGVyIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87dGV4dC1hbGlnbjpjZW50ZXIiPg0KPGI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPlRoaXMgZW1haWwgaXMg ZnJvbSBhbiBleHRlcm5hbCBzb3VyY2UuIFBsZWFzZSBkbyBub3Qgb3BlbiBhdHRhY2htZW50cyBv ciBjbGljayBsaW5rcyBmcm9tIGFuIHVua25vd24gb3Igc3VzcGljaW91cyBvcmlnaW4uIFBoaXNo aW5nIGF0dGVtcHRzIGNhbiBiZSByZXBvcnRlZCBieSBzZW5kaW5nIHRoZW0gdG8gcGhpc2hpbmdA c2t5LnVrIGFzIGF0dGFjaG1lbnRzLg0KIFRoYW5rIHlvdTwvc3Bhbj48L2I+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBhbGlnbj0iY2VudGVyIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87dGV4dC1hbGlnbjpjZW50 ZXIiPg0KPGI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6 RU4tVVMiPi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tPC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KSW5mb3Jt YXRpb24gaW4gdGhpcyBlbWFpbCBpbmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzIG1heSBiZSBwcml2 aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5kIGlzIGludGVuZGVkIGV4Y2x1c2l2ZWx5IGZvciB0aGUg YWRkcmVzc2VlLiBUaGUgdmlld3MgZXhwcmVzc2VkIG1heSBub3QgYmUgb2ZmaWNpYWwgcG9saWN5 LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdzIG9mIHRoZSBvcmlnaW5hdG9yLiBJZiB5b3UgaGF2ZSBy ZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxlYXNlDQogbm90aWZ5IHRoZSBzZW5kZXIgYnkgcmV0dXJu IGUtbWFpbCBhbmQgZGVsZXRlIGl0IGZyb20geW91ciBzeXN0ZW0uIFlvdSBzaG91bGQgbm90IHJl cHJvZHVjZSwgZGlzdHJpYnV0ZSwgc3RvcmUsIHJldHJhbnNtaXQsIHVzZSBvciBkaXNjbG9zZSBp dHMgY29udGVudHMgdG8gYW55b25lLiBQbGVhc2Ugbm90ZSB3ZSByZXNlcnZlIHRoZSByaWdodCB0 byBtb25pdG9yIGFsbCBlLW1haWwgY29tbXVuaWNhdGlvbiB0aHJvdWdoIG91ciBpbnRlcm5hbCBh bmQNCiBleHRlcm5hbCBuZXR3b3Jrcy4gU0tZIGFuZCB0aGUgU0tZIG1hcmtzIGFyZSB0cmFkZW1h cmtzIG9mIFNreSBMaW1pdGVkIGFuZCBTa3kgSW50ZXJuYXRpb25hbCBBRyBhbmQgYXJlIHVzZWQg dW5kZXIgbGljZW5jZS4NCjxicj4NCjxicj4NClNreSBVSyBMaW1pdGVkIChSZWdpc3RyYXRpb24g Tm8uIDI5MDY5OTEpLCBTa3ktSW4tSG9tZSBTZXJ2aWNlIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBO by4gMjA2NzA3NSksIFNreSBTdWJzY3JpYmVycyBTZXJ2aWNlcyBMaW1pdGVkIChSZWdpc3RyYXRp b24gTm8uIDIzNDAxNTApIGFuZCBTa3kgQ1AgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiA5NTEz MjU5KSBhcmUgZGlyZWN0IG9yIGluZGlyZWN0IHN1YnNpZGlhcmllcyBvZiBTa3kgTGltaXRlZCAo UmVnaXN0cmF0aW9uDQogTm8uIDIyNDc3MzUpLiBBbGwgb2YgdGhlIGNvbXBhbmllcyBtZW50aW9u ZWQgaW4gdGhpcyBwYXJhZ3JhcGggYXJlIGluY29ycG9yYXRlZCBpbiBFbmdsYW5kIGFuZCBXYWxl cyBhbmQgc2hhcmUgdGhlIHNhbWUgcmVnaXN0ZXJlZCBvZmZpY2UgYXQgR3JhbnQgV2F5LCBJc2xl d29ydGgsIE1pZGRsZXNleCBUVzcgNVFEDQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_A45F4F74D6C1435AA52FC2DEA82E2999skyuk_-- From nobody Tue Jul 16 04:26:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D5A01203FA for ; Tue, 16 Jul 2019 04:26:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q3PQaXIONHa2 for ; Tue, 16 Jul 2019 04:26:47 -0700 (PDT) Received: from mail-yb1-xb34.google.com (mail-yb1-xb34.google.com [IPv6:2607:f8b0:4864:20::b34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4039612004D for ; Tue, 16 Jul 2019 04:26:47 -0700 (PDT) Received: by mail-yb1-xb34.google.com with SMTP id x188so2905640yba.8 for ; Tue, 16 Jul 2019 04:26:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Rl0ZPg0Edfrsf2QM9B+rWT+j5j0p2TkGaYGREOyHcMM=; b=bfmkVpMw3IqvcTSX6M3vUpkFr3sCIW8IIkuLOSHTKXzmCJ5sH9W+rp4k9tFgyuomjS 3buH77o+nf0AnIrODxIDKGXJ2LnssRUza+HQDilx0+hWaDDXZ+kxL+lKT0H5c77MJm9N iBWCLyzwN6ZzP/V2ko72GxAVUIKETIQyD3N3MI97yHim+Lprt4mHlJNkd35YUfee/mne tz3RExdQyJNwfVyv4lLEoYjecZBD6DejfgmBpYJXPdjHGLL8fJZFTjM/yKN1lVV7bnNq SPSFYkzXmEBCXdTSfggn9WtkBJNuyghv+5kYBr7tl4d2OXqGUM7kShxqp5ffSnG3MTqU wIWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Rl0ZPg0Edfrsf2QM9B+rWT+j5j0p2TkGaYGREOyHcMM=; b=WbKIRDs/HeiFWF7SLGsKn7hj0S3j+RHBBck868Atgq7jwUVUUngp0qvq42aKRLs/+4 QHMEGYMEijtvr4PSj5UvHhqHX5el8Q/P56K3bHU+HaioOSCkv2bNlfCzLb/Mbh0AXl6T 3XuvvbAkn1f+CXCF6OXcfN52VtOiMI9Npji9vbLZ/KTKr+dgN3nN9nusvzbaQcfbaNFC mTBT6+DMbwhusu3+TfDh3/1/SSdKx/F9tN/aea8mWjtGqqJOm4pwr0yloCs8zbxbIlpd PTABkEYFaRywAtEiJODHbW+RK21nRfvoXJON1nh/81FhxnC5p9IKOx3KH5XUb6OqQH3x TgVQ== X-Gm-Message-State: APjAAAVCHntg3WO8v4wLPy9bVdyiq/vpDCmYWVIP4TVyZqx7G0/jASJN Vl2CCZTxDUCPAQFzRKIW8olPTYAVh3JA62f5IIVp6BQU X-Google-Smtp-Source: APXvYqy35zhJItp1vCfYaTmOL8r/o93pEB7E5P/IdzfqJYR+kVFSIfr4zzGrfx/OIPzi4Qf7DHjUwEZbHDr6MMBf2ws= X-Received: by 2002:a25:fd5:: with SMTP id 204mr19180269ybp.245.1563276406129; Tue, 16 Jul 2019 04:26:46 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Alec Muffett Date: Tue, 16 Jul 2019 12:26:36 +0100 Message-ID: To: "Dixon, Hugh" Cc: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000df8950058dcaa6a4" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 11:26:49 -0000 --000000000000df8950058dcaa6a4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 16 Jul 2019, 11:31 Dixon, Hugh, wrote: > Hi Alec =E2=80=93 > Hi Hugh! Given that this is at its core (just) a protocol for asking (any) DNS > server whether it has a filtering policy, won=E2=80=99t =E2=80=9Cnon-comp= liant software=E2=80=9D > will be the sort of software which does not beacon? > That's kinda the whole point; the problem is that innocent people might try using Firefox to access Twitter from Turkey during a civil rights crackdown, their Firefox-implementing-this-mechanism will give them away as trying to evade Government blocking of Twitter, and they will end up arrested or worse. Not everyone is in a position to welcome or appreciate upstream DNS filtering "for their own good" - for instance, this example from Turkey: https://www.mic.com/articles/85987/turkish-protesters-are-spray-painting-8-= 8-8-8-and-8-8-4-4-on-walls-here-s-what-it-means It would seem regressive of Mozilla's principles to assist someone getting identified & thrown in jail for non-compliance with repressive blocking; not to mention - to repeat - the other obvious possibility is that any IP address which beacons-out a lookup of TBD.arpa will immediately be blackholed / firewalled, again to dissuade people from fact-checking their government's spokespeople. Or, perhaps you would consider this non-compliant-behaviour, worthy of such sanction? - alec --000000000000df8950058dcaa6a4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 16 Jul 2019, 11:31 Dixon, Hugh, <Hugh.Dixon@sky.uk> wrote:

Hi Alec =E2=80=93


Hi Hugh!

Given that this is at its core (just) a protoc= ol for asking (any) DNS server whether it has a filtering policy, won=E2=80= =99t =E2=80=9Cnon-compliant software=E2=80=9D will be the sort of software = which does not beacon?


That's kinda the whole point; the problem is that in= nocent people might try using Firefox to access Twitter from Turkey during = a civil rights crackdown, their Firefox-implementing-this-mechanism will gi= ve them away as trying to evade Government blocking of Twitter, and they wi= ll end up arrested or worse.

Not everyone is in a position to welcome or appreciate upstream DNS fi= ltering "for their own good" - for instance, this example from Tu= rkey:


I= t would seem regressive of Mozilla's principles to assist someone getti= ng identified & thrown in jail for non-compliance with repressive block= ing; not to mention - to repeat - the other obvious possibility is that any= IP address which beacons-out a lookup of TBD.arpa will immediately be blac= kholed / firewalled, again to dissuade people from fact-checking their gove= rnment's spokespeople.

Or, perhaps you would consider this non-compliant-behaviour, worthy of s= uch sanction?

- alec

--000000000000df8950058dcaa6a4-- From nobody Tue Jul 16 04:50:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C8E61200DE for ; Tue, 16 Jul 2019 04:50:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g3-U0qTW0dLC for ; Tue, 16 Jul 2019 04:50:38 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-eopbgr140058.outbound.protection.outlook.com [40.107.14.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A591912004D for ; Tue, 16 Jul 2019 04:50:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=BrN2/Yv6DBdaHmkxUYw7YGiLCqtv2lrRhAS6LqB2nTHX8Op43ezKzeBPWAacg6YnE++lecY03l/+bqZF4zQPqD/ufIL1sPd6a4ryP89fdN7lQUu2FJ7GCbLkTZTDcAqkKV4oJOBWej/1iv5wAEhTsYqDKfEVJZf5wj4Omv1BykPOfMDa8Wiu8aHG8ssMPWPe6GXKeu0GESKfboecErtg297AVGYu/vEOYXFO/n5wVibUvZ4SUq0LoyX2O1OXX+yilfhHl+B7wj+1JGuxVMO4Kw4KwbekaTN/FhgVtcL7HzR88ERXfvuSrg15O7W37tkk5yXqVJxb4hCDpQF6NCkXKw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MJ//613SI+pwd41IUYhtibiZujvlE7e119xUm7hSKpE=; b=GYPbxeXG3DaT7K3L4yed0FD9e9xycZBbgkXX07XrMrpqCxd0wGJQUhfHGswLaxCfVv9l6Si83cHDCbG31oDEFQ70IS3YqN959KByKYdbHZ5SY0KDcQ48dk8nUlW8dSjXaavQXOJCjq3biqpuD3CKusL+JLxsEHEluK8Mn5W7QURRFHWeHYOaSnlj50yYPza7HyONGPeigw8zFtujPSTg+/Uy8g8qU7aWg/lhJdiqVkD8ggIJIC8kItmkG+d2UyY2NWLzxskJPRHrKmV9l7ZICKbpALW3VhIw75cpaBwVw3YQ94wex6bItQZCBXgLOknypiAQyKM9+YUQ+jvw613Aww== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=sky.uk;dmarc=pass action=none header.from=sky.uk;dkim=pass header.d=sky.uk;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MJ//613SI+pwd41IUYhtibiZujvlE7e119xUm7hSKpE=; b=iZtUSCeoFHU8ciH4DVHGxL4m7GVb4TcBxN9LcpFklgEAqXDjz0xNeAJd43vNWxQu7uq8x2vKK8JyGx6KqiBw8AoSVtvo/c5m1tyqaFtX+JkWk1sfnHWvRoQhaDOdf3wt9533DS4Y7yE4tP/myfr3stP4rZj7x4Y1jkjl9oJvOcE= Received: from DB6PR0602MB2805.eurprd06.prod.outlook.com (10.172.248.15) by DB6PR0602MB3320.eurprd06.prod.outlook.com (10.170.212.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2073.14; Tue, 16 Jul 2019 11:50:35 +0000 Received: from DB6PR0602MB2805.eurprd06.prod.outlook.com ([fe80::251a:5b99:bf14:1921]) by DB6PR0602MB2805.eurprd06.prod.outlook.com ([fe80::251a:5b99:bf14:1921%5]) with mapi id 15.20.2073.012; Tue, 16 Jul 2019 11:50:35 +0000 From: "Dixon, Hugh" To: Alec Muffett CC: "add@ietf.org" Thread-Topic: [EXTERNAL] Re: [Add] draft-grover-add-policy-detection-00 Thread-Index: AQHVOw9dnoSdkELwNk2T1hCmFh8Zf6bLqU6AgAF0rAD///6PAIAAF3UA Date: Tue, 16 Jul 2019 11:50:34 +0000 Message-ID: <7938F8BD-8CE4-4DE7-A9E0-74CCDEDA9BDC@sky.uk> References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190708 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hugh.Dixon@sky.uk; x-originating-ip: [90.216.150.239] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 78649921-ec4d-4118-bc19-08d709e3d023 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DB6PR0602MB3320; x-ms-traffictypediagnostic: DB6PR0602MB3320: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0100732B76 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(376002)(136003)(396003)(366004)(346002)(189003)(199004)(124014002)(256004)(14444005)(64756008)(76116006)(8676002)(66446008)(53936002)(66946007)(5024004)(91956017)(81156014)(6436002)(446003)(6306002)(316002)(81166006)(11346002)(66556008)(58126008)(66476007)(66066001)(76176011)(71190400001)(71200400001)(2616005)(68736007)(54896002)(6486002)(6246003)(236005)(53546011)(3846002)(8936002)(2906002)(36756003)(33656002)(6506007)(6116002)(6512007)(5660300002)(99286004)(7736002)(186003)(102836004)(476003)(25786009)(478600001)(486006)(14454004)(229853002)(26005)(6916009)(86362001)(4326008); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0602MB3320; H:DB6PR0602MB2805.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:0; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: OWU0VC4xJvbg9T69iQHnoIuguoPvJicGu+Fq7e7A1SvD2kJeg89UFMG84D6AF/tPQkG1fGirtovoJN6ssz5AI3cWsiCC8yuHErd/LsCMlykYgYqxQQT4fpdMwOxFMEkn0wvA/Zd0O30tj8TONJ/4uQOndVSGsypo8JjW0MFEOjsYk+OmYGnImBCX2FLpCjXtw/LYxAqGenYg/sUe2GCus8p4UfwVUJhnMIvgdQmV/1opZDEPX6RGrBVM2ZXPhoYVOWt1yFteodOoS8z0UYV07EzAxhun7Si6z9rspzMK2wyrNHKcozYk+J7rGD1i3UFzVZ8EbKXSRj5zZT1kVM9P5mWfPjb7ffjelvVEyRUWHTqghGXyTLoiXkgOMWG+GPAjAtysBa92sg2BnUDd5nOc3+i3kKidc63gQ86x0vnTKus= Content-Type: multipart/alternative; boundary="_000_7938F8BD8CE44DE7A9E074CCDEDA9BDCskyuk_" MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 78649921-ec4d-4118-bc19-08d709e3d023 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Jul 2019 11:50:34.8894 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: hugh.dixon@sky.uk X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0602MB3320 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 11:50:41 -0000 --_000_7938F8BD8CE44DE7A9E074CCDEDA9BDCskyuk_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 W2dhaCDigJMgY2Fu4oCZdCBnZXQgbWFpbCBjbGllbnQgdG8gaW5kZW50LWFuZC1tYXJrIHF1b3Rl ZCBjb250ZW50IHByb3Blcmx5Li4gIHNvcnJ5IOKAkyB1c2luZyBidWxsZXRzIOKApiBdDQoNCkZy b206IEFsZWMgTXVmZmV0dCA8YWxlYy5tdWZmZXR0QGdtYWlsLmNvbT4NCkRhdGU6IFR1ZXNkYXks IDE2IEp1bHkgMjAxOSBhdCAxMjoyNg0KVG86ICJEaXhvbiwgSHVnaCIgPEh1Z2guRGl4b25Ac2t5 LnVrPg0KQ2M6ICJhZGRAaWV0Zi5vcmciIDxhZGRAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0VY VEVSTkFMXSBSZTogW0FkZF0gZHJhZnQtZ3JvdmVyLWFkZC1wb2xpY3ktZGV0ZWN0aW9uLTAwDQoN Ck9uIFR1ZSwgMTYgSnVsIDIwMTksIDExOjMxIERpeG9uLCBIdWdoLCA8SHVnaC5EaXhvbkBza3ku dWs8bWFpbHRvOkh1Z2guRGl4b25Ac2t5LnVrPj4gd3JvdGU6DQpIaSBBbGVjIOKAkw0KSGkgSHVn aCENCg0KR2l2ZW4gdGhhdCB0aGlzIGlzIGF0IGl0cyBjb3JlIChqdXN0KSBhIHByb3RvY29sIGZv ciBhc2tpbmcgKGFueSkgRE5TIHNlcnZlciB3aGV0aGVyIGl0IGhhcyBhIGZpbHRlcmluZyBwb2xp Y3ksIHdvbuKAmXQg4oCcbm9uLWNvbXBsaWFudCBzb2Z0d2FyZeKAnSB3aWxsIGJlIHRoZSBzb3J0 IG9mIHNvZnR3YXJlIHdoaWNoIGRvZXMgbm90IGJlYWNvbj8NCg0KwrcgICAgICAgICBUaGF0J3Mg a2luZGEgdGhlIHdob2xlIHBvaW50OyB0aGUgcHJvYmxlbSBpcyB0aGF0IGlubm9jZW50IHBlb3Bs ZSBtaWdodCB0cnkgdXNpbmcgRmlyZWZveCB0byBhY2Nlc3MgVHdpdHRlciBmcm9tIFR1cmtleSBk dXJpbmcgYSBjaXZpbCByaWdodHMgY3JhY2tkb3duLCB0aGVpciBGaXJlZm94LWltcGxlbWVudGlu Zy10aGlzLW1lY2hhbmlzbSB3aWxsIGdpdmUgdGhlbSBhd2F5IGFzIHRyeWluZyB0byBldmFkZSBH b3Zlcm5tZW50IGJsb2NraW5nIG9mIFR3aXR0ZXIsIGFuZCB0aGV5IHdpbGwgZW5kIHVwIGFycmVz dGVkIG9yIHdvcnNlLg0KRG9lc27igJl0IHJlcXVlc3RpbmcgVEJELmFycGEgc2lnbmFsIGludGVu dC10by1jb21wbHkgcmF0aGVyIHRoYW4gdGhlIG90aGVyIHdheSBhcm91bmQ/ICBJIGRvbuKAmXQg cXVpdGUgZ2V0IHRoZSBsaW5rIGJldHdlZW4g4oCcLi4gdGhlaXIgRmlyZWZveC1pbXBsZW1lbnRp bmctdGhpcy1tZWNoYW5pc20gLi7igJ0gYW5kIOKAnC4udHJ5aW5nIHRvIGV2YWRlIC4uIGJsb2Nr aW5nIC4u4oCdLiBBdCBhbnkgcmF0ZSwgaXTigJlzIGEgZHJhZnQgcG9saWN5LWRpc2NvdmVyeSBw cm90b2NvbCBub3QgYW4gaW1wbGVtZW50YXRpb24gZ3VpZGUsIG5vPw0KDQoNCsK3ICAgICAgICAg Tm90IGV2ZXJ5b25lIGlzIGluIGEgcG9zaXRpb24gdG8gd2VsY29tZSBvciBhcHByZWNpYXRlIHVw c3RyZWFtIEROUyBmaWx0ZXJpbmcgImZvciB0aGVpciBvd24gZ29vZCIgLSBmb3IgaW5zdGFuY2Us IHRoaXMgZXhhbXBsZSBmcm9tIFR1cmtleToNClRoZSBwcm90byBkb2VzbuKAmXQgc2F5IHRoYXQg 4oCTIGl0IGp1c3QgZHJhZnRzIGEgcG9zc2libGUgbWVjaGFuaXNtIGZvciBhbnkgRE5TIHJlc29s dmVyIHRvIGluZGljYXRlIHRvIHRoZSBjYWxsZXIgdGhhdCB0aGVyZSBpcyBwb2xpY3kuICBDb3Vs ZCBiZSBmb3IgbG90cyBvZiByZWFzb25zLCBhbmQgdXNlcnMgd2l0aCBkZXZpY2Uvb3MvYXBwIGFk bWluIGludGVudCBhbmQgcmlnaHRzIG1pZ2h0IHdlbGwgbm90IGNoZWNrIGl0LCBhY3Qgb24gaXQs IG5vdCBhY3Qgb24gaXQsIHNvbWV0aW1lcyBhY3Qgb24gaXQvaW50ZXJhY3Qgd2l0aCBpdC4NCg0K DQoNCsK3ICAgICAgICAgSXQgd291bGQgc2VlbSByZWdyZXNzaXZlIG9mIE1vemlsbGEncyBwcmlu Y2lwbGVzIHRvIGFzc2lzdCBzb21lb25lIGdldHRpbmcgaWRlbnRpZmllZCAmIHRocm93biBpbiBq YWlsIGZvciBub24tY29tcGxpYW5jZSB3aXRoIHJlcHJlc3NpdmUgYmxvY2tpbmc7IG5vdCB0byBt ZW50aW9uIC0gdG8gcmVwZWF0IC0gdGhlIG90aGVyIG9idmlvdXMgcG9zc2liaWxpdHkgaXMgdGhh dCBhbnkgSVAgYWRkcmVzcyB3aGljaCBiZWFjb25zLW91dCBhIGxvb2t1cCBvZiBUQkQuYXJwYSB3 aWxsIGltbWVkaWF0ZWx5IGJlIGJsYWNraG9sZWQgLyBmaXJld2FsbGVkLCBhZ2FpbiB0byBkaXNz dWFkZSBwZW9wbGUgZnJvbSBmYWN0LWNoZWNraW5nIHRoZWlyIGdvdmVybm1lbnQncyBzcG9rZXNw ZW9wbGUuDQpJIGRvbuKAmXQgZ2V0IChzZWUgYWJvdmUpIHdoeSBhIGNoZWNrIGZvciBUQkQuYXJw YSBpbmRpY2F0ZXMgaW50ZW50IHRvIHN1YnZlcnQuICBJIHdhcyB0aGlua2luZyBbaW50ZW50IHRv IHN1YnZlcnRdIDw9PiBbbm90IGNoZWNraW5nIFRCRC5hcnBhXSAuLj8NCg0KSA0KDQpJbmZvcm1h dGlvbiBpbiB0aGlzIGVtYWlsIGluY2x1ZGluZyBhbnkgYXR0YWNobWVudHMgbWF5IGJlIHByaXZp bGVnZWQsIGNvbmZpZGVudGlhbCBhbmQgaXMgaW50ZW5kZWQgZXhjbHVzaXZlbHkgZm9yIHRoZSBh ZGRyZXNzZWUuIFRoZSB2aWV3cyBleHByZXNzZWQgbWF5IG5vdCBiZSBvZmZpY2lhbCBwb2xpY3ks IGJ1dCB0aGUgcGVyc29uYWwgdmlld3Mgb2YgdGhlIG9yaWdpbmF0b3IuIElmIHlvdSBoYXZlIHJl Y2VpdmVkIGl0IGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgYnkgcmV0dXJuIGUt bWFpbCBhbmQgZGVsZXRlIGl0IGZyb20geW91ciBzeXN0ZW0uIFlvdSBzaG91bGQgbm90IHJlcHJv ZHVjZSwgZGlzdHJpYnV0ZSwgc3RvcmUsIHJldHJhbnNtaXQsIHVzZSBvciBkaXNjbG9zZSBpdHMg Y29udGVudHMgdG8gYW55b25lLiBQbGVhc2Ugbm90ZSB3ZSByZXNlcnZlIHRoZSByaWdodCB0byBt b25pdG9yIGFsbCBlLW1haWwgY29tbXVuaWNhdGlvbiB0aHJvdWdoIG91ciBpbnRlcm5hbCBhbmQg ZXh0ZXJuYWwgbmV0d29ya3MuIFNLWSBhbmQgdGhlIFNLWSBtYXJrcyBhcmUgdHJhZGVtYXJrcyBv ZiBTa3kgTGltaXRlZCBhbmQgU2t5IEludGVybmF0aW9uYWwgQUcgYW5kIGFyZSB1c2VkIHVuZGVy IGxpY2VuY2UuDQoNClNreSBVSyBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDI5MDY5OTEpLCBT a3ktSW4tSG9tZSBTZXJ2aWNlIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjA2NzA3NSksIFNr eSBTdWJzY3JpYmVycyBTZXJ2aWNlcyBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIzNDAxNTAp IGFuZCBTa3kgQ1AgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiA5NTEzMjU5KSBhcmUgZGlyZWN0 IG9yIGluZGlyZWN0IHN1YnNpZGlhcmllcyBvZiBTa3kgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5v LiAyMjQ3NzM1KS4gQWxsIG9mIHRoZSBjb21wYW5pZXMgbWVudGlvbmVkIGluIHRoaXMgcGFyYWdy YXBoIGFyZSBpbmNvcnBvcmF0ZWQgaW4gRW5nbGFuZCBhbmQgV2FsZXMgYW5kIHNoYXJlIHRoZSBz YW1lIHJlZ2lzdGVyZWQgb2ZmaWNlIGF0IEdyYW50IFdheSwgSXNsZXdvcnRoLCBNaWRkbGVzZXgg VFc3IDVRRA0K --_000_7938F8BD8CE44DE7A9E074CCDEDA9BDCskyuk_ Content-Type: text/html; charset="utf-8" Content-ID: <7BECE64818DB1E48998A05AC237FBA1D@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow Y207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNv TGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowY207 DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltYXJnaW4tYm90dG9tOjBjbTsNCgltYXJnaW4tbGVmdDoz Ni4wcHQ7DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3Jt YWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1h cmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowY207DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28t c3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10 eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24x DQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3 Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0 IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxNjU2NzE0MTg4Ow0KCW1z by1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczo3MDU4NTA5MjQgNzc2 NDQ0NTYgMTM0ODA3NTU1IDEzNDgwNzU1NyAxMzQ4MDc1NTMgMTM0ODA3NTU1IDEzNDgwNzU1NyAx MzQ4MDc1NTMgMTM0ODA3NTU1IDEzNDgwNzU1Nzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxl dmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpX aW5nZGluZ3M7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7DQoJ bXNvLWJpZGktZm9udC1mYW1pbHk6Q2FsaWJyaTt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDps ZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7 fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1p bHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglm b250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3Qg bDA6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVy IE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9u dC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjE4MDk0MDAxMjM7 DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjE2NjM5ODQx ODYgMTM0ODA3NTUzIDEzNDgwNzU1NSAxMzQ4MDc1NTcgMTM0ODA3NTUzIDEzNDgwNzU1NSAxMzQ4 MDc1NTcgMTM0ODA3NTUzIDEzNDgwNzU1NSAxMzQ4MDc1NTc7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwx OmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBO ZXciO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQt ZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4 LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2 ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv gqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30N CkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5 OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9u dC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZlbDkNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRv bTowY207fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4N Cjxib2R5IGxhbmc9IkVOLUdCIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xh c3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNv LWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPltnYWgg4oCTIGNhbuKAmXQgZ2V0IG1haWwgY2xpZW50 IHRvIGluZGVudC1hbmQtbWFyayBxdW90ZWQgY29udGVudCBwcm9wZXJseS4uJm5ic3A7IHNvcnJ5 IOKAkyB1c2luZyBidWxsZXRzIOKApiBdPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt dG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpi bGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xv cjpibGFjayI+QWxlYyBNdWZmZXR0ICZsdDthbGVjLm11ZmZldHRAZ21haWwuY29tJmd0Ozxicj4N CjxiPkRhdGU6IDwvYj5UdWVzZGF5LCAxNiBKdWx5IDIwMTkgYXQgMTI6MjY8YnI+DQo8Yj5Ubzog PC9iPiZxdW90O0RpeG9uLCBIdWdoJnF1b3Q7ICZsdDtIdWdoLkRpeG9uQHNreS51ayZndDs8YnI+ DQo8Yj5DYzogPC9iPiZxdW90O2FkZEBpZXRmLm9yZyZxdW90OyAmbHQ7YWRkQGlldGYub3JnJmd0 Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW0VYVEVSTkFMXSBSZTogW0FkZF0gZHJhZnQtZ3Jv dmVyLWFkZC1wb2xpY3ktZGV0ZWN0aW9uLTAwPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBU dWUsIDE2IEp1bCAyMDE5LCAxMTozMSBEaXhvbiwgSHVnaCwgJmx0OzxhIGhyZWY9Im1haWx0bzpI dWdoLkRpeG9uQHNreS51ayIgdGFyZ2V0PSJfYmxhbmsiPkh1Z2guRGl4b25Ac2t5LnVrPC9hPiZn dDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGNtIDBjbSAw Y20gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBjbSI+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SGkgQWxlYyDigJM8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkhpIEh1Z2ghPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQg I0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0 O21hcmdpbi1yaWdodDowY20iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6MTEuNTVwdCI+DQpHaXZlbiB0aGF0IHRoaXMgaXMgYXQgaXRzIGNvcmUgKGp1 c3QpIGEgcHJvdG9jb2wgZm9yIGFza2luZyAoYW55KSBETlMgc2VydmVyIHdoZXRoZXIgaXQgaGFz IGEgZmlsdGVyaW5nIHBvbGljeSwgd29u4oCZdCDigJxub24tY29tcGxpYW50IHNvZnR3YXJl4oCd IHdpbGwgYmUgdGhlIHNvcnQgb2Ygc29mdHdhcmUgd2hpY2ggZG9lcyBub3QgYmVhY29uPw0KPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjI5LjU1cHQ7dGV4dC1pbmRlbnQ6LTE4LjBwdDttc28tbGlzdDpsMSBsZXZlbDEgbGZvMiI+DQo8 IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6U3ltYm9sIj48c3Bh biBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7CtzxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90 O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+VGhhdCdzIGtp bmRhIHRoZSB3aG9sZSBwb2ludDsgdGhlIHByb2JsZW0gaXMgdGhhdCBpbm5vY2VudCBwZW9wbGUg bWlnaHQgdHJ5IHVzaW5nIEZpcmVmb3ggdG8gYWNjZXNzIFR3aXR0ZXIgZnJvbSBUdXJrZXkgZHVy aW5nIGEgY2l2aWwgcmlnaHRzIGNyYWNrZG93biwgdGhlaXIgRmlyZWZveC1pbXBsZW1lbnRpbmct dGhpcy1tZWNoYW5pc20gd2lsbCBnaXZlIHRoZW0gYXdheSBhcyB0cnlpbmcgdG8NCiBldmFkZSBH b3Zlcm5tZW50IGJsb2NraW5nIG9mIFR3aXR0ZXIsIGFuZCB0aGV5IHdpbGwgZW5kIHVwIGFycmVz dGVkIG9yIHdvcnNlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RG9lc27i gJl0IHJlcXVlc3RpbmcgVEJELmFycGEgc2lnbmFsIGludGVudC10by1jb21wbHkgcmF0aGVyIHRo YW4gdGhlIG90aGVyIHdheSBhcm91bmQ/ICZuYnNwO0kgZG9u4oCZdCBxdWl0ZSBnZXQgdGhlIGxp bmsgYmV0d2VlbiDigJwuLiB0aGVpciBGaXJlZm94LWltcGxlbWVudGluZy10aGlzLW1lY2hhbmlz bSAuLuKAnSBhbmQg4oCcLi50cnlpbmcgdG8gZXZhZGUgLi4gYmxvY2tpbmcgLi7igJ0uIEF0IGFu eSByYXRlLCBpdOKAmXMgYSBkcmFmdA0KIHBvbGljeS1kaXNjb3ZlcnkgcHJvdG9jb2wgbm90IGFu IGltcGxlbWVudGF0aW9uIGd1aWRlLCBubz88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoyOS41NXB0 O3RleHQtaW5kZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzIiPg0KPCFbaWYgIXN1 cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OlN5bWJvbCI+PHNwYW4gc3R5bGU9 Im1zby1saXN0Oklnbm9yZSI+wrc8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBO ZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPk5vdCBldmVyeW9uZSBpcyBp biBhIHBvc2l0aW9uIHRvIHdlbGNvbWUgb3IgYXBwcmVjaWF0ZSB1cHN0cmVhbSBETlMgZmlsdGVy aW5nICZxdW90O2ZvciB0aGVpciBvd24gZ29vZCZxdW90OyAtIGZvciBpbnN0YW5jZSwgdGhpcyBl eGFtcGxlIGZyb20gVHVya2V5OjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ VGhlIHByb3RvIGRvZXNu4oCZdCBzYXkgdGhhdCDigJMgaXQganVzdCBkcmFmdHMgYSBwb3NzaWJs ZSBtZWNoYW5pc20gZm9yIGFueSBETlMgcmVzb2x2ZXIgdG8gaW5kaWNhdGUgdG8gdGhlIGNhbGxl ciB0aGF0IHRoZXJlIGlzIHBvbGljeS4mbmJzcDsgQ291bGQgYmUgZm9yIGxvdHMgb2YgcmVhc29u cywgYW5kIHVzZXJzIHdpdGggZGV2aWNlL29zL2FwcCBhZG1pbiBpbnRlbnQgYW5kIHJpZ2h0cyBt aWdodCB3ZWxsIG5vdCBjaGVjaw0KIGl0LCBhY3Qgb24gaXQsIG5vdCBhY3Qgb24gaXQsIHNvbWV0 aW1lcyBhY3Qgb24gaXQvaW50ZXJhY3Qgd2l0aCBpdC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mjku NTVwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjI5LjU1cHQ7dGV4dC1pbmRlbnQ6LTE4LjBwdDttc28tbGlzdDps MSBsZXZlbDEgbGZvMiI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6U3ltYm9sIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7CtzxzcGFuIHN0eWxl PSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48 IVtlbmRpZl0+SXQgd291bGQgc2VlbSByZWdyZXNzaXZlIG9mIE1vemlsbGEncyBwcmluY2lwbGVz IHRvIGFzc2lzdCBzb21lb25lIGdldHRpbmcgaWRlbnRpZmllZCAmYW1wOyB0aHJvd24gaW4gamFp bCBmb3Igbm9uLWNvbXBsaWFuY2Ugd2l0aCByZXByZXNzaXZlIGJsb2NraW5nOyBub3QgdG8gbWVu dGlvbiAtIHRvIHJlcGVhdCAtIHRoZSBvdGhlciBvYnZpb3VzIHBvc3NpYmlsaXR5IGlzIHRoYXQg YW55IElQIGFkZHJlc3MNCiB3aGljaCBiZWFjb25zLW91dCBhIGxvb2t1cCBvZiBUQkQuYXJwYSB3 aWxsIGltbWVkaWF0ZWx5IGJlIGJsYWNraG9sZWQgLyBmaXJld2FsbGVkLCBhZ2FpbiB0byBkaXNz dWFkZSBwZW9wbGUgZnJvbSBmYWN0LWNoZWNraW5nIHRoZWlyIGdvdmVybm1lbnQncyBzcG9rZXNw ZW9wbGUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGRvbuKAmXQgZ2V0 IChzZWUgYWJvdmUpIHdoeSBhIGNoZWNrIGZvciBUQkQuYXJwYSBpbmRpY2F0ZXMgaW50ZW50IHRv IHN1YnZlcnQuJm5ic3A7IEkgd2FzIHRoaW5raW5nIFtpbnRlbnQgdG8gc3VidmVydF0gJmx0Oz0m Z3Q7IFtub3QgY2hlY2tpbmcgVEJELmFycGFdIC4uPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5IPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCkluZm9ybWF0aW9uIGlu IHRoaXMgZW1haWwgaW5jbHVkaW5nIGFueSBhdHRhY2htZW50cyBtYXkgYmUgcHJpdmlsZWdlZCwg Y29uZmlkZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBleGNsdXNpdmVseSBmb3IgdGhlIGFkZHJlc3Nl ZS4gVGhlIHZpZXdzIGV4cHJlc3NlZCBtYXkgbm90IGJlIG9mZmljaWFsIHBvbGljeSwgYnV0IHRo ZSBwZXJzb25hbCB2aWV3cyBvZiB0aGUgb3JpZ2luYXRvci4gSWYgeW91IGhhdmUgcmVjZWl2ZWQg aXQgaW4gZXJyb3IsIHBsZWFzZQ0KIG5vdGlmeSB0aGUgc2VuZGVyIGJ5IHJldHVybiBlLW1haWwg YW5kIGRlbGV0ZSBpdCBmcm9tIHlvdXIgc3lzdGVtLiBZb3Ugc2hvdWxkIG5vdCByZXByb2R1Y2Us IGRpc3RyaWJ1dGUsIHN0b3JlLCByZXRyYW5zbWl0LCB1c2Ugb3IgZGlzY2xvc2UgaXRzIGNvbnRl bnRzIHRvIGFueW9uZS4gUGxlYXNlIG5vdGUgd2UgcmVzZXJ2ZSB0aGUgcmlnaHQgdG8gbW9uaXRv ciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb24gdGhyb3VnaCBvdXIgaW50ZXJuYWwgYW5kDQogZXh0 ZXJuYWwgbmV0d29ya3MuIFNLWSBhbmQgdGhlIFNLWSBtYXJrcyBhcmUgdHJhZGVtYXJrcyBvZiBT a3kgTGltaXRlZCBhbmQgU2t5IEludGVybmF0aW9uYWwgQUcgYW5kIGFyZSB1c2VkIHVuZGVyIGxp Y2VuY2UuDQo8YnI+DQo8YnI+DQpTa3kgVUsgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyOTA2 OTkxKSwgU2t5LUluLUhvbWUgU2VydmljZSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIwNjcw NzUpLCBTa3kgU3Vic2NyaWJlcnMgU2VydmljZXMgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAy MzQwMTUwKSBhbmQgU2t5IENQIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUxMzI1OSkgYXJl IGRpcmVjdCBvciBpbmRpcmVjdCBzdWJzaWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQgKFJlZ2lzdHJh dGlvbg0KIE5vLiAyMjQ3NzM1KS4gQWxsIG9mIHRoZSBjb21wYW5pZXMgbWVudGlvbmVkIGluIHRo aXMgcGFyYWdyYXBoIGFyZSBpbmNvcnBvcmF0ZWQgaW4gRW5nbGFuZCBhbmQgV2FsZXMgYW5kIHNo YXJlIHRoZSBzYW1lIHJlZ2lzdGVyZWQgb2ZmaWNlIGF0IEdyYW50IFdheSwgSXNsZXdvcnRoLCBN aWRkbGVzZXggVFc3IDVRRA0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_7938F8BD8CE44DE7A9E074CCDEDA9BDCskyuk_-- From nobody Tue Jul 16 05:29:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9EFDA120413 for ; Tue, 16 Jul 2019 05:29:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mkh293S0hKff for ; Tue, 16 Jul 2019 05:29:29 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4B0F12004F for ; Tue, 16 Jul 2019 05:29:28 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 5D1786A31C; Tue, 16 Jul 2019 14:29:25 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563280165; bh=6aSJCNupAmwgFQBqesD803Ah3eoE7IpEIck8oOrqJ+0=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=0/dMqd/6gRQAXQpBmo0d303nJr/vVY0pqh0LvN2KFluW6g9BNWL2rTWPi360NpcQ6 wDfsT8Jl7cSZmZbiAJRpKboIbG27OYfGfFTbRxbSx8mm6pH7BlMDdxjzaMONAR0ULX TPqx2x2Opf+dTlLQ4Nh2/JYnJvT8WY5LDnxp+85sP0K6Hq6J3e8iit7yhmYt9D+/i7 nLwiKdiSlUz1bplCApgsc5uCmfdm36frrGe9vuj2FeGsAzRgik7wNGK1w4RkGicvbq Ss0tPyMJFWwbtMA3CRr+M38pu25Bwu8W6GAIW54iEKiTGSFgnuYETxJuR5Ae/Us5YC p5fmYDUmv2NXQ== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 4D1943C036F; Tue, 16 Jul 2019 14:29:25 +0200 (CEST) Date: Tue, 16 Jul 2019 14:29:25 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Alec Muffett Cc: add@ietf.org Message-ID: <468200083.8561.1563280165254@appsuite-gw1.open-xchange.com> In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev8 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 12:29:31 -0000

Il 16 luglio 2019 13:26 Alec Muffett <alec.muffett@gmail.com> ha scritto:

That's kinda the whole point; the problem is that innocent people might try using Firefox to access Twitter from Turkey during a civil rights crackdown, their Firefox-implementing-this-mechanism will give them away as trying to evade Government blocking of Twitter, and they will end up arrested or worse.
I agree with you that it would be foolish for Firefox to look for local policies in that case, and it would endanger the user; that is a case where no policy discovery should ever be performed, and I would find that totally justified, with the caveat that if you replace "innocent people" with criminals, "Twitter" with a criminal website, and "Turkey" with the Western-democratic country that you like, you get the very same technical situation but with a completely different policy, regulatory and ethical flavour; but how to tell the two situations apart is a policy/UX problem that each application has to solve for itself.

However, that case does not make a policy discovery mechanism useless or unnecessary.

There are two symmetric cases of adversarial scenarios: one is the one that you describe, i.e. an application needing to bypass any local policy without leaving traces, and the other one is the local resolver willing to enforce any local policy even on users that want to bypass it by using other resolvers. In both cases, the non-cooperative actor will just ignore whatever mechanism for local resolver and policy discovery we devise: the application will not perform any policy discovery attempt, and the resolver will not advertise that it applies any policy. So, the fact that a discovery mechanism exists is irrelevant for those two cases.

On the other hand, the case by far most common is that of an ordinary consumer in an averagely democratic country that wants to access the Internet as securely as possible, relying for that on all the actors - the application, the Internet access provider and the public authorities. In that case, it is reasonable to expect that those actors cooperate and exchange the necessary information to establish the best possible environment for the final user, generally following whatever configuration the user prefers or needs for the application-level services to work. This, I guess, is the use case that the draft wants to address.

Ciao,

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
From nobody Tue Jul 16 07:22:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF00412012A for ; Tue, 16 Jul 2019 07:22:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oXAeUVik38H3 for ; Tue, 16 Jul 2019 07:22:08 -0700 (PDT) Received: from mail-lj1-x243.google.com (mail-lj1-x243.google.com [IPv6:2a00:1450:4864:20::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C36CF120086 for ; Tue, 16 Jul 2019 07:22:07 -0700 (PDT) Received: by mail-lj1-x243.google.com with SMTP id k18so20141593ljc.11 for ; Tue, 16 Jul 2019 07:22:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=tGk9yeUeQ69ACsfHtZziKsCI6UAgA8PcFGEpHqKiEbc=; b=BN9vAbzk8whmtUbhFdP1D94zjEw+ldOfNDJYSf3f2qTPYeOgLFXHvGQlx23KsP8JrV zzoM69XnhGJDVRkk28HsuSLGPNmrw7/qyKAxOi8gevU3GlD5PJE+cPFjVsnoGT9I52wh Wez+NW3grf0TYx4gn8w0CCp+F+jQCpCakd0gQAHjFM96kroLFPz4NfC2vO9y3EgTp1xv WXX10aF98haAXsHnsLaFaJ8nBF5P1q9oTeexjfIzdOhGhbtbuHZLZXSvWMFBd08UJeA0 RTKeT0UOOOjb9DCuiL6OhpA3FnoZ5x0byUChS4/E+pFYNGBXxD/uokW6u2f+ta/3OBV7 2GPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=tGk9yeUeQ69ACsfHtZziKsCI6UAgA8PcFGEpHqKiEbc=; b=eCMkleggNz4ddAvH9BRM4Tp6heJQwin5CC9EnSlxNmP+1pT9s8s+0oSCC47mD47i7x UdKnLBx+zRgrMyIay+0pOUq384bQv/ozTEQgb/bd1lc3VCsuk3R/wLQBzBofS+KCLaVw cNLIgCgzRCaMEVAgIXFQAXh4B1uWBJ5IUHRv3x9EVWE44rabY99PX0UXKKux+jn/YCNP 3ocQmlUWK4apPVYcyd9dzqNnM2O5gV+vNw9aaQOyK1ONbwx4eUqbRIjbCJbwFWVnXZcA xK+tO/hraVqhpT1aCh1kCnZbEtkRWEgDkGpcZqYnRjgkP0Mnsj37S4sbCuQmvhLCWoTZ sMFA== X-Gm-Message-State: APjAAAWnAwNe1/JUFfWfXmISEiQ5xmbCIivlash7wE32+J6B2xOTKD3q CXy37Gs2asFxN0cxuqu3M2w6tlOT9OuAFgmE/yQ= X-Google-Smtp-Source: APXvYqwDj+ajAvGgjh8faWBoVG4uUXTMpYhZy60mG1js5CCKqTCYRX1jx5E0UKd4oWO9clXvgdyP2Uh8H7WmjLkXQ3A= X-Received: by 2002:a2e:9cd4:: with SMTP id g20mr16814580ljj.205.1563286925975; Tue, 16 Jul 2019 07:22:05 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Tue, 16 Jul 2019 07:21:28 -0700 Message-ID: To: Alec Muffett Cc: "Dixon, Hugh" , add@ietf.org Content-Type: multipart/alternative; boundary="000000000000e7c6e2058dcd193d" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 14:22:10 -0000 --000000000000e7c6e2058dcd193d Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Alec, This is a good question. As I alluded to in my response to Robert Sayre, DoH has a difficult deployment problem. Specifically, whether we like it or not, there are some environments in which DNS filtering is in place and the user wants it that way (parental [0] or anti-malware filtering are good examples of this). Now, this isn't an issue for a situation in which the user has explicitly enabled DoH with a preference or setting, because the user has indicated they want that (just as if they installed a VPN). And I agree that if the user has done that, then the client should insist on DoH whatever the local network environment. This is more analagous to the TLS 1.3 case where we know that the user wants TLS. The more difficult situation, however, is if you want to switch the client's defaults, in which case you risk changing the user's experience in a way they didn't want, which is also suboptimal. So, it would be good to determine when that is the case and avoid doing it/warn the user/something. In some cases, it's possible to do this in a secure way (e.g., see if there are enterprise settings for a specific resolver), but sometimes there is no local setting and I'm not aware of a secure way to detect that case (I agree that the mechanism in this draft is insecure). In this case, the problem seems more difficult. In any case, hopefully this clarifies the situation. If you have good ideas for the best way to address the problem, I would certainly be interested. -Ekr [0] We can debate who the user in parental controls cases is, but general the parent is the one who owns the device. On Tue, Jul 16, 2019 at 4:26 AM Alec Muffett wrote= : > On Tue, 16 Jul 2019, 11:31 Dixon, Hugh, wrote: > >> Hi Alec =E2=80=93 >> > > Hi Hugh! > > Given that this is at its core (just) a protocol for asking (any) DNS >> server whether it has a filtering policy, won=E2=80=99t =E2=80=9Cnon-com= pliant software=E2=80=9D >> will be the sort of software which does not beacon? >> > > That's kinda the whole point; the problem is that innocent people might > try using Firefox to access Twitter from Turkey during a civil rights > crackdown, their Firefox-implementing-this-mechanism will give them away = as > trying to evade Government blocking of Twitter, and they will end up > arrested or worse. > > Not everyone is in a position to welcome or appreciate upstream DNS > filtering "for their own good" - for instance, this example from Turkey: > > > https://www.mic.com/articles/85987/turkish-protesters-are-spray-painting-= 8-8-8-8-and-8-8-4-4-on-walls-here-s-what-it-means > > It would seem regressive of Mozilla's principles to assist someone gettin= g > identified & thrown in jail for non-compliance with repressive blocking; > not to mention - to repeat - the other obvious possibility is that any IP > address which beacons-out a lookup of TBD.arpa will immediately be > blackholed / firewalled, again to dissuade people from fact-checking thei= r > government's spokespeople. > > Or, perhaps you would consider this non-compliant-behaviour, worthy of > such sanction? > > - alec > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000e7c6e2058dcd193d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Alec,

This is a good question.

As I allud= ed to in my response to Robert Sayre, DoH has a difficult
deployment pro= blem. Specifically, whether we like it or not, there are
some environmen= ts in which DNS filtering is in place and the user
wants it that way (pa= rental [0] or anti-malware filtering are good
examples of this).

= Now, this isn't an issue for a situation in which the user has
expli= citly enabled DoH with a preference or setting, because the user
has ind= icated they want that (just as if they installed a VPN). And I
agree tha= t if the user has done that, then the client should insist on
DoH whatev= er the local network environment. This is more analagous
to the TLS 1.3 = case where we know that the user wants TLS.

The more difficult situa= tion, however, is if you want to switch the
client's defaults, in wh= ich case you risk changing the user's
experience in a way they didn&= #39;t want, which is also suboptimal.=C2=A0 So,
it would be good to dete= rmine when that is the case and avoid doing
it/warn the user/something. = In some cases, it's possible to do this in
a secure way (e.g., see i= f there are enterprise settings for a
specific resolver), but sometimes = there is no local setting and I'm
not aware of a secure way to detec= t that case (I agree that the
mechanism in this draft is insecure). In t= his case, the problem seems
more difficult.

In any case, hopefull= y this clarifies the situation. If you have
good ideas for the best way = to address the problem, I would certainly
be interested.

-Ekr
=

[0] We can debate who the user in parental controls cases is, butgeneral the parent is the one who owns the device.


On Tue, Jul 16,= 2019 at 4:26 AM Alec Muffett <alec.muffett@gmail.com> wrote:
On Tue, 16 Jul 2019, 11:31 Dixon, Hugh,= <Hugh.Dixon@sky.uk> wrote:

Hi Alec =E2=80=93


Hi Hugh!

Given that this is at its core (just) a protoc= ol for asking (any) DNS server whether it has a filtering policy, won=E2=80= =99t =E2=80=9Cnon-compliant software=E2=80=9D will be the sort of software = which does not beacon?


That's kinda the whole point; the problem is that in= nocent people might try using Firefox to access Twitter from Turkey during = a civil rights crackdown, their Firefox-implementing-this-mechanism will gi= ve them away as trying to evade Government blocking of Twitter, and they wi= ll end up arrested or worse.

Not everyone is in a position to welcome or appreciate upstream DNS fi= ltering "for their own good" - for instance, this example from Tu= rkey:


<= div dir=3D"auto">It would seem regressive of Mozilla's principles to as= sist someone getting identified & thrown in jail for non-compliance wit= h repressive blocking; not to mention - to repeat - the other obvious possi= bility is that any IP address which beacons-out a lookup of TBD.arpa will i= mmediately be blackholed / firewalled, again to dissuade people from fact-c= hecking their government's spokespeople.

Or, perhaps you would consider this non-compliant-beha= viour, worthy of such sanction?

- alec

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000e7c6e2058dcd193d-- From nobody Tue Jul 16 08:24:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16B95120783 for ; Tue, 16 Jul 2019 08:24:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dl3jmFzw2T7Q for ; Tue, 16 Jul 2019 08:24:18 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B15AD120790 for ; Tue, 16 Jul 2019 08:24:10 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id j5so36353304ioj.8 for ; Tue, 16 Jul 2019 08:24:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hj77lW4UlnYouvRN1oWqJIi0QC+Zn65pT9dfI8uPwlk=; b=cj1vSZerDMel5yau//faABYWL1o9eJkRcGkrqiJKJ/aw9kljpFziUDS05cmt23w9SH lJ60c8xinQZRHzOkcWsXydq8fbJdtF1pVMx6aANmA0mo0+uhJuXHcanMYCK7eIc76DkD M3bjn6tiRdQrzQQkgMTzmni4c/jD0leBeKukPpATkHfH+hiHvT/eKgYa8Rp+lqN4ntht nQDK4RDdsJqy5+cV9ODhT1DsF8qLZrmYEeiLnTy3U4qFcARkEiPAgKzb82sr42nFEyRZ lbmkyap7dzzTXj7fJITZh0a0g5cvjtGrezEvTujlHSu9dPVuGKfqzOiKaIj2laqehDpC d5nQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hj77lW4UlnYouvRN1oWqJIi0QC+Zn65pT9dfI8uPwlk=; b=jHF6b/trOVI+waqDagCXxWEN+Cntp4y9Qw/giMf6M+qWBXLsxz/+IoZadooHIXEYG/ Tt+XLzzFqEOU7Fg5KqbIO3hhdAoSoL8uIL4LtQwkQ0FtbCX2FoZjqFGVO0zbb+MLgouK Xs+rrhQWQ1uD/yJPZT470oY/W5Mb3MmmFjKMZYVyLYB2JraJUFeByQJDzn5HM03AYerS UCrkWvKogdclv5rXW7XV0CbBgVfRH/abeYrw/1k6iHrcqkPESsQVp8NRuIf19Jb0QQCn Mm0EDXCBWfIB/BK/gryKI4CzRNHwtmTxem2CUCY0HZHY9D5befLEle/8h97pifK8Ummd eFnw== X-Gm-Message-State: APjAAAVVGc0G3g+ih+XA2lFHVBbJkQyqlpmXXBDjE5KiOsbnCJWyBrSD Xxjg/Ux0G3y0XTVn8GMx90DNFAvAdvDtTLIMciE= X-Google-Smtp-Source: APXvYqxdrRCeGmrRyDOcyXR4UTvcdtH/nC3Cog0na1WIQb8Mi6eEpSjhyswtEk5Kyom3NKvyZjIVReHmR6HSjF6z2is= X-Received: by 2002:a02:13c3:: with SMTP id 186mr34537322jaz.30.1563290649831; Tue, 16 Jul 2019 08:24:09 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Tue, 16 Jul 2019 08:23:58 -0700 Message-ID: To: Eric Rescorla Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="000000000000dd2b51058dcdf7d0" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 15:24:21 -0000 --000000000000dd2b51058dcdf7d0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 16, 2019 at 7:22 AM Eric Rescorla wrote: > Hi Alec, > > This is a good question. > > As I alluded to in my response to Robert Sayre, DoH has a difficult > deployment problem. Specifically, whether we like it or not, there are > some environments in which DNS filtering is in place and the user > wants it that way (parental [0] or anti-malware filtering are good > examples of this). > Parental controls and malware detection are usually done on the device. https://www.apple.com/newsroom/2019/04/the-facts-about-parental-control-app= s/ https://blog.google/products/chrome/cleaner-safer-web-chrome-cleanup/ > > In any case, hopefully this clarifies the situation. > It does not. thanks, Rob > > > On Tue, Jul 16, 2019 at 4:26 AM Alec Muffett > wrote: > >> On Tue, 16 Jul 2019, 11:31 Dixon, Hugh, wrote: >> >>> Hi Alec =E2=80=93 >>> >> >> Hi Hugh! >> >> Given that this is at its core (just) a protocol for asking (any) DNS >>> server whether it has a filtering policy, won=E2=80=99t =E2=80=9Cnon-co= mpliant software=E2=80=9D >>> will be the sort of software which does not beacon? >>> >> >> That's kinda the whole point; the problem is that innocent people might >> try using Firefox to access Twitter from Turkey during a civil rights >> crackdown, their Firefox-implementing-this-mechanism will give them away= as >> trying to evade Government blocking of Twitter, and they will end up >> arrested or worse. >> >> Not everyone is in a position to welcome or appreciate upstream DNS >> filtering "for their own good" - for instance, this example from Turkey: >> >> >> https://www.mic..com/articles/85987/turkish-protesters-are-spray-paintin= g-8-8-8-8-and-8-8-4-4-on-walls-here-s-what-it-means >> >> >> It would seem regressive of Mozilla's principles to assist someone >> getting identified & thrown in jail for non-compliance with repressive >> blocking; not to mention - to repeat - the other obvious possibility is >> that any IP address which beacons-out a lookup of TBD.arpa will immediat= ely >> be blackholed / firewalled, again to dissuade people from fact-checking >> their government's spokespeople. >> >> Or, perhaps you would consider this non-compliant-behaviour, worthy of >> such sanction? >> >> - alec >> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000dd2b51058dcdf7d0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 7:22 AM Eric = Rescorla <ekr@rtfm.com> wrote:
H= i Alec,

This is a good question.

As I alluded to in my respon= se to Robert Sayre, DoH has a difficult
deployment problem. Specifically= , whether we like it or not, there are
some environments in which DNS fi= ltering is in place and the user
wants it that way (parental [0] or anti= -malware filtering are good
examples of this).

Parental controls and malware detection are usually done o= n the device.

=C2=A0

In any case, hopefully this clarifies the situation= .=C2=A0

It does not.
thanks,
Rob

=C2=A0

<= br>
On Tue,= Jul 16, 2019 at 4:26 AM Alec Muffett <alec.muffett@gmail.com> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">
On Tue, 16 Ju= l 2019, 11:31 Dixon, Hugh, <Hugh.Dixon@sky.uk> wrote:

Hi Alec =E2=80=93


Hi Hugh!

=

Given that this is at its core (just) a protoc= ol for asking (any) DNS server whether it has a filtering policy, won=E2=80= =99t =E2=80=9Cnon-compliant software=E2=80=9D will be the sort of software = which does not beacon?


That's kinda the whole point; the problem is that in= nocent people might try using Firefox to access Twitter from Turkey during = a civil rights crackdown, their Firefox-implementing-this-mechanism will gi= ve them away as trying to evade Government blocking of Twitter, and they wi= ll end up arrested or worse.

Not everyone is in a position to welcome or appreciate upstream DNS fi= ltering "for their own good" - for instance, this example from Tu= rkey:


=
It would seem regressive of Mozilla's principles to a= ssist someone getting identified & thrown in jail for non-compliance wi= th repressive blocking; not to mention - to repeat - the other obvious poss= ibility is that any IP address which beacons-out a lookup of TBD.arpa will = immediately be blackholed / firewalled, again to dissuade people from fact-= checking their government's spokespeople.

Or, perhaps you would consider this non-compliant-beh= aviour, worthy of such sanction?

- alec

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000dd2b51058dcdf7d0-- From nobody Tue Jul 16 08:26:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA767120155 for ; Tue, 16 Jul 2019 08:26:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T7CT-LnlFexj for ; Tue, 16 Jul 2019 08:26:53 -0700 (PDT) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60088.outbound.protection.outlook.com [40.107.6.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 85968120154 for ; Tue, 16 Jul 2019 08:26:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hanayEwzYr4hAkOV7kq0nCUgaS23owx1WaidRpPCThNxn2qh0N0prTEag+/xlMeLoKFyj1LLnNfMAhevg0I2OXUV1S2ebBktBR5DbDI5sHbCR2o7oacsrQRLmNiCmnsmQQpR9DLSotjdxW2jMaIo2tn9YjxKZ2gLWx5JXGkTG8/PHNZLQDee0s6PjKI5sdTEcYmNHCJQOnVEVcnJxnT9NyhBaIoZQ9WntmdquB5d3WByfGvhdcfY9tA1n3ggqVc5uXrzGjp8nUBP1Tv6J6cg3U1O7hLXvKAWYZEDdzGn0gSp1MThjtJV5YL2zxDoR+dEE6cgILP82A7uHBTJiyR68A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1XpTn8IG8BKUnk/vM/KdUt5VP+Iu60FQ4f0eQeEvkk8=; b=VBgljmAkoslCKx6gDoXFDZZAR7d0/6suxudzDGbE8gLVg4iVBrdnEXefIFJ/4JFSutCzkiFu8M3iZT0XMwGF6+XUxLNvX5cmxNBs6p7JrSfhIEwGyc4Wo6F1H2zp9RyL5gfz7Kb1HNdy34UhFvSA+zn8kyYIvTBGQalTSfo4+WA6mtmTycsSI2UGWN4MEyyGrZXzzUi5D+sI55sWLC4kqn9OWIuB50yrLZ4XJ/U8ftpveZrXL3OBtRaSZgBXk3GUuRLzkQhU5nELxCvhnoZGRIBSHEBtgHIva8KvirtRkb0M/f3q7Iq7x8oTfKj+EaV7pbiepXX70AOYBhC4WzQQDA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=sky.uk;dmarc=pass action=none header.from=sky.uk;dkim=pass header.d=sky.uk;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1XpTn8IG8BKUnk/vM/KdUt5VP+Iu60FQ4f0eQeEvkk8=; b=CWhOu+FX2auNPvzwadeG3pM88t6ygkr7TFUzm5Bd5tjQm6QQAi/+Jy8gJgMFkgEFhR5UZwvPo2BbBS4/2Lza+6j6e2ETCyUd6eDTU4d4VDH0n6K89yNnGHmJi0Kk57AzPUU1rhXq7O54AIooeg/MlhRJMxBX1x+6LXe5/tR6zFg= Received: from DB6PR0602MB2805.eurprd06.prod.outlook.com (10.172.248.15) by DB6PR0602MB2792.eurprd06.prod.outlook.com (10.172.247.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2073.10; Tue, 16 Jul 2019 15:26:51 +0000 Received: from DB6PR0602MB2805.eurprd06.prod.outlook.com ([fe80::251a:5b99:bf14:1921]) by DB6PR0602MB2805.eurprd06.prod.outlook.com ([fe80::251a:5b99:bf14:1921%5]) with mapi id 15.20.2073.012; Tue, 16 Jul 2019 15:26:51 +0000 From: "Dixon, Hugh" To: "add@ietf.org" Thread-Topic: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 Thread-Index: AQHVO+HZi3y9aV95fEOFKTOmNKVStKbNXTUAgAARkoA= Date: Tue, 16 Jul 2019 15:26:51 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190708 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hugh.Dixon@sky.uk; x-originating-ip: [90.216.150.239] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b3114d66-e3fd-4407-7c0f-08d70a0206ad x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DB6PR0602MB2792; x-ms-traffictypediagnostic: DB6PR0602MB2792: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7219; x-forefront-prvs: 0100732B76 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(376002)(346002)(396003)(39860400002)(136003)(366004)(199004)(189003)(66946007)(66556008)(91956017)(76116006)(66476007)(236005)(102836004)(66446008)(2906002)(64756008)(81156014)(256004)(5024004)(229853002)(58126008)(53546011)(8676002)(1730700003)(81166006)(68736007)(14444005)(33656002)(2351001)(26005)(5640700003)(2501003)(54896002)(25786009)(6306002)(6512007)(6436002)(36756003)(6486002)(966005)(5660300002)(186003)(14454004)(6116002)(3846002)(6506007)(76176011)(6916009)(53936002)(606006)(7736002)(66574012)(8936002)(478600001)(86362001)(11346002)(66066001)(476003)(446003)(6246003)(486006)(71190400001)(71200400001)(316002)(2616005)(99286004); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0602MB2792; H:DB6PR0602MB2805.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: a5cRMkFC30zwXubGTVaW5agr2GW87QwtQ9r+hTqyqRVd5ZmIptSesV/FrNggSB15rOo+UJtqHuYK8cDQYAmgDv44Rx/d/J6y/29LitQPhsOcDCmk/1DbuYmd5KZ+NXiG6HKcFGfGsWh7qc+fKCDnOp5iG2G6vy0Wf41QarQ1jx3ZfBVBtO2lgqFohZZjqNUN5L1GvyMAJJUTnuCYREYJmOSUfRjRj96c483ZCgyej0k5x2LbY3UaIPQJbdFFv+BAzBKORh+x4lPcMDZLJqsghJYBqQBhims1vTgf46XN+RCcng/FKwgJXbDti8cPW8gy26+dC5h6Zh7EpaSaH+9RBJEu9oEPMjAL6r9UxDs38NTbdTNS733YsdWN8CLh/2AgyUjuYL+BY39bD1F/nAwtpIrNR3W0tzJE+toYWfg+Jyk= Content-Type: multipart/alternative; boundary="_000_D4D5BD8E4BCE45719A59C139406C079Dskyuk_" MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: b3114d66-e3fd-4407-7c0f-08d70a0206ad X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Jul 2019 15:26:51.3729 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: hugh.dixon@sky.uk X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0602MB2792 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 15:26:57 -0000 --_000_D4D5BD8E4BCE45719A59C139406C079Dskyuk_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 4oCcdXN1YWxseeKAnSBpcyBhIGRpc3RpbmN0bHkgc3RhdGlzdGljYWwgdGVybS4gIERvIHlvdSBo YXZlIGFueSBkYXRhID8NCg0KDQpPbiBUdWUsIEp1bCAxNiwgMjAxOSBhdCA3OjIyIEFNIEVyaWMg UmVzY29ybGEgPGVrckBydGZtLmNvbTxtYWlsdG86ZWtyQHJ0Zm0uY29tPj4gd3JvdGU6DQpIaSBB bGVjLA0KDQpUaGlzIGlzIGEgZ29vZCBxdWVzdGlvbi4NCg0KQXMgSSBhbGx1ZGVkIHRvIGluIG15 IHJlc3BvbnNlIHRvIFJvYmVydCBTYXlyZSwgRG9IIGhhcyBhIGRpZmZpY3VsdA0KZGVwbG95bWVu dCBwcm9ibGVtLiBTcGVjaWZpY2FsbHksIHdoZXRoZXIgd2UgbGlrZSBpdCBvciBub3QsIHRoZXJl IGFyZQ0Kc29tZSBlbnZpcm9ubWVudHMgaW4gd2hpY2ggRE5TIGZpbHRlcmluZyBpcyBpbiBwbGFj ZSBhbmQgdGhlIHVzZXINCndhbnRzIGl0IHRoYXQgd2F5IChwYXJlbnRhbCBbMF0gb3IgYW50aS1t YWx3YXJlIGZpbHRlcmluZyBhcmUgZ29vZA0KZXhhbXBsZXMgb2YgdGhpcykuDQoNClBhcmVudGFs IGNvbnRyb2xzIGFuZCBtYWx3YXJlIGRldGVjdGlvbiBhcmUgdXN1YWxseSBkb25lIG9uIHRoZSBk ZXZpY2UuDQoNCmh0dHBzOi8vd3d3LmFwcGxlLmNvbS9uZXdzcm9vbS8yMDE5LzA0L3RoZS1mYWN0 cy1hYm91dC1wYXJlbnRhbC1jb250cm9sLWFwcHMvPGh0dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnBy b3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5hcHBsZS5jb20lMkZu ZXdzcm9vbSUyRjIwMTklMkYwNCUyRnRoZS1mYWN0cy1hYm91dC1wYXJlbnRhbC1jb250cm9sLWFw cHMlMkYmZGF0YT0wMiU3QzAxJTdDSHVnaC5EaXhvbiU0MHNreS51ayU3QzNkZTRjMTU1YmJkNjQz MzIxMGIzMDhkNzBhMDFhNzRjJTdDNjhiODY1ZDVjZjE4NGIyYjgyYTRhNGVkZGI5YzUyMzclN0Mw JTdDMCU3QzYzNjk4ODg3NDUyNjY5MjMwNyZzZGF0YT1lUU9WMmJZNVllVCUyRnJoY294JTJGY2Zt Y0pxOGkxVXlqWFFsWmc3R0hUVSUyRkowJTNEJnJlc2VydmVkPTA+DQpodHRwczovL2Jsb2cuZ29v Z2xlL3Byb2R1Y3RzL2Nocm9tZS9jbGVhbmVyLXNhZmVyLXdlYi1jaHJvbWUtY2xlYW51cC88aHR0 cHM6Ly9ldXIwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNB JTJGJTJGYmxvZy5nb29nbGUlMkZwcm9kdWN0cyUyRmNocm9tZSUyRmNsZWFuZXItc2FmZXItd2Vi LWNocm9tZS1jbGVhbnVwJTJGJmRhdGE9MDIlN0MwMSU3Q0h1Z2guRGl4b24lNDBza3kudWslN0Mz ZGU0YzE1NWJiZDY0MzMyMTBiMzA4ZDcwYTAxYTc0YyU3QzY4Yjg2NWQ1Y2YxODRiMmI4MmE0YTRl ZGRiOWM1MjM3JTdDMCU3QzAlN0M2MzY5ODg4NzQ1MjY2OTIzMDcmc2RhdGE9JTJGcGNaeWJXUU4l MkJodGxBSkF2RG9rJTJGOHJIdnNReTZOdzBvSEtmNlk5YWpmWSUzRCZyZXNlcnZlZD0wPg0KDQoN CkluIGFueSBjYXNlLCBob3BlZnVsbHkgdGhpcyBjbGFyaWZpZXMgdGhlIHNpdHVhdGlvbi4NCg0K SXQgZG9lcyBub3QuDQoNCnRoYW5rcywNClJvYg0KDQoNCkluZm9ybWF0aW9uIGluIHRoaXMgZW1h aWwgaW5jbHVkaW5nIGFueSBhdHRhY2htZW50cyBtYXkgYmUgcHJpdmlsZWdlZCwgY29uZmlkZW50 aWFsIGFuZCBpcyBpbnRlbmRlZCBleGNsdXNpdmVseSBmb3IgdGhlIGFkZHJlc3NlZS4gVGhlIHZp ZXdzIGV4cHJlc3NlZCBtYXkgbm90IGJlIG9mZmljaWFsIHBvbGljeSwgYnV0IHRoZSBwZXJzb25h bCB2aWV3cyBvZiB0aGUgb3JpZ2luYXRvci4gSWYgeW91IGhhdmUgcmVjZWl2ZWQgaXQgaW4gZXJy b3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBieSByZXR1cm4gZS1tYWlsIGFuZCBkZWxldGUg aXQgZnJvbSB5b3VyIHN5c3RlbS4gWW91IHNob3VsZCBub3QgcmVwcm9kdWNlLCBkaXN0cmlidXRl LCBzdG9yZSwgcmV0cmFuc21pdCwgdXNlIG9yIGRpc2Nsb3NlIGl0cyBjb250ZW50cyB0byBhbnlv bmUuIFBsZWFzZSBub3RlIHdlIHJlc2VydmUgdGhlIHJpZ2h0IHRvIG1vbml0b3IgYWxsIGUtbWFp bCBjb21tdW5pY2F0aW9uIHRocm91Z2ggb3VyIGludGVybmFsIGFuZCBleHRlcm5hbCBuZXR3b3Jr cy4gU0tZIGFuZCB0aGUgU0tZIG1hcmtzIGFyZSB0cmFkZW1hcmtzIG9mIFNreSBMaW1pdGVkIGFu ZCBTa3kgSW50ZXJuYXRpb25hbCBBRyBhbmQgYXJlIHVzZWQgdW5kZXIgbGljZW5jZS4NCg0KU2t5 IFVLIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjkwNjk5MSksIFNreS1Jbi1Ib21lIFNlcnZp Y2UgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMDY3MDc1KSwgU2t5IFN1YnNjcmliZXJzIFNl cnZpY2VzIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjM0MDE1MCkgYW5kIFNreSBDUCBMaW1p dGVkIChSZWdpc3RyYXRpb24gTm8uIDk1MTMyNTkpIGFyZSBkaXJlY3Qgb3IgaW5kaXJlY3Qgc3Vi c2lkaWFyaWVzIG9mIFNreSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIyNDc3MzUpLiBBbGwg b2YgdGhlIGNvbXBhbmllcyBtZW50aW9uZWQgaW4gdGhpcyBwYXJhZ3JhcGggYXJlIGluY29ycG9y YXRlZCBpbiBFbmdsYW5kIGFuZCBXYWxlcyBhbmQgc2hhcmUgdGhlIHNhbWUgcmVnaXN0ZXJlZCBv ZmZpY2UgYXQgR3JhbnQgV2F5LCBJc2xld29ydGgsIE1pZGRsZXNleCBUVzcgNVFEDQo= --_000_D4D5BD8E4BCE45719A59C139406C079Dskyuk_ Content-Type: text/html; charset="utf-8" Content-ID: <52A1B25C4AEECA4FBC33095EFED646FA@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5F bWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzIu MHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3Jk U2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLUdCIiBsaW5r PSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMi PuKAnHVzdWFsbHnigJ0gaXMgYSBkaXN0aW5jdGx5IHN0YXRpc3RpY2FsIHRlcm0uJm5ic3A7IERv IHlvdSBoYXZlIGFueSBkYXRhID88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+T24gVHVlLCBKdWwgMTYsIDIwMTkgYXQgNzoyMiBBTSBFcmljIFJl c2NvcmxhICZsdDs8YSBocmVmPSJtYWlsdG86ZWtyQHJ0Zm0uY29tIj5la3JAcnRmbS5jb208L2E+ Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNt IDBjbSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBBbGVjLDxicj4NCjxicj4NClRoaXMgaXMgYSBnb29kIHF1 ZXN0aW9uLjxicj4NCjxicj4NCkFzIEkgYWxsdWRlZCB0byBpbiBteSByZXNwb25zZSB0byBSb2Jl cnQgU2F5cmUsIERvSCBoYXMgYSBkaWZmaWN1bHQ8YnI+DQpkZXBsb3ltZW50IHByb2JsZW0uIFNw ZWNpZmljYWxseSwgd2hldGhlciB3ZSBsaWtlIGl0IG9yIG5vdCwgdGhlcmUgYXJlPGJyPg0Kc29t ZSBlbnZpcm9ubWVudHMgaW4gd2hpY2ggRE5TIGZpbHRlcmluZyBpcyBpbiBwbGFjZSBhbmQgdGhl IHVzZXI8YnI+DQp3YW50cyBpdCB0aGF0IHdheSAocGFyZW50YWwgWzBdIG9yIGFudGktbWFsd2Fy ZSBmaWx0ZXJpbmcgYXJlIGdvb2Q8YnI+DQpleGFtcGxlcyBvZiB0aGlzKS48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ UGFyZW50YWwgY29udHJvbHMgYW5kIG1hbHdhcmUgZGV0ZWN0aW9uIGFyZSA8Yj51c3VhbGx5PC9i PiBkb25lIG9uIHRoZSBkZXZpY2UuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3Rl Y3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5hcHBsZS5jb20lMkZuZXdz cm9vbSUyRjIwMTklMkYwNCUyRnRoZS1mYWN0cy1hYm91dC1wYXJlbnRhbC1jb250cm9sLWFwcHMl MkYmYW1wO2RhdGE9MDIlN0MwMSU3Q0h1Z2guRGl4b24lNDBza3kudWslN0MzZGU0YzE1NWJiZDY0 MzMyMTBiMzA4ZDcwYTAxYTc0YyU3QzY4Yjg2NWQ1Y2YxODRiMmI4MmE0YTRlZGRiOWM1MjM3JTdD MCU3QzAlN0M2MzY5ODg4NzQ1MjY2OTIzMDcmYW1wO3NkYXRhPWVRT1YyYlk1WWVUJTJGcmhjb3gl MkZjZm1jSnE4aTFVeWpYUWxaZzdHSFRVJTJGSjAlM0QmYW1wO3Jlc2VydmVkPTAiPmh0dHBzOi8v d3d3LmFwcGxlLmNvbS9uZXdzcm9vbS8yMDE5LzA0L3RoZS1mYWN0cy1hYm91dC1wYXJlbnRhbC1j b250cm9sLWFwcHMvPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGEgaHJlZj0iaHR0cHM6Ly9ldXIwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5v dXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGYmxvZy5nb29nbGUlMkZwcm9kdWN0cyUyRmNo cm9tZSUyRmNsZWFuZXItc2FmZXItd2ViLWNocm9tZS1jbGVhbnVwJTJGJmFtcDtkYXRhPTAyJTdD MDElN0NIdWdoLkRpeG9uJTQwc2t5LnVrJTdDM2RlNGMxNTViYmQ2NDMzMjEwYjMwOGQ3MGEwMWE3 NGMlN0M2OGI4NjVkNWNmMTg0YjJiODJhNGE0ZWRkYjljNTIzNyU3QzAlN0MwJTdDNjM2OTg4ODc0 NTI2NjkyMzA3JmFtcDtzZGF0YT0lMkZwY1p5YldRTiUyQmh0bEFKQXZEb2slMkY4ckh2c1F5Nk53 MG9IS2Y2WTlhamZZJTNEJmFtcDtyZXNlcnZlZD0wIj5odHRwczovL2Jsb2cuZ29vZ2xlL3Byb2R1 Y3RzL2Nocm9tZS9jbGVhbmVyLXNhZmVyLXdlYi1jaHJvbWUtY2xlYW51cC88L2E+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1s ZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBwdDttYXJnaW4t bGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48YnI+DQpJbiBhbnkgY2FzZSwgaG9wZWZ1bGx5IHRoaXMgY2xhcmlmaWVzIHRoZSBzaXR1YXRp b24uJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkl0IGRvZXMgbm90LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj50aGFua3MsPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Sb2I8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCkluZm9ybWF0aW9uIGluIHRoaXMgZW1h aWwgaW5jbHVkaW5nIGFueSBhdHRhY2htZW50cyBtYXkgYmUgcHJpdmlsZWdlZCwgY29uZmlkZW50 aWFsIGFuZCBpcyBpbnRlbmRlZCBleGNsdXNpdmVseSBmb3IgdGhlIGFkZHJlc3NlZS4gVGhlIHZp ZXdzIGV4cHJlc3NlZCBtYXkgbm90IGJlIG9mZmljaWFsIHBvbGljeSwgYnV0IHRoZSBwZXJzb25h bCB2aWV3cyBvZiB0aGUgb3JpZ2luYXRvci4gSWYgeW91IGhhdmUgcmVjZWl2ZWQgaXQgaW4gZXJy b3IsIHBsZWFzZQ0KIG5vdGlmeSB0aGUgc2VuZGVyIGJ5IHJldHVybiBlLW1haWwgYW5kIGRlbGV0 ZSBpdCBmcm9tIHlvdXIgc3lzdGVtLiBZb3Ugc2hvdWxkIG5vdCByZXByb2R1Y2UsIGRpc3RyaWJ1 dGUsIHN0b3JlLCByZXRyYW5zbWl0LCB1c2Ugb3IgZGlzY2xvc2UgaXRzIGNvbnRlbnRzIHRvIGFu eW9uZS4gUGxlYXNlIG5vdGUgd2UgcmVzZXJ2ZSB0aGUgcmlnaHQgdG8gbW9uaXRvciBhbGwgZS1t YWlsIGNvbW11bmljYXRpb24gdGhyb3VnaCBvdXIgaW50ZXJuYWwgYW5kDQogZXh0ZXJuYWwgbmV0 d29ya3MuIFNLWSBhbmQgdGhlIFNLWSBtYXJrcyBhcmUgdHJhZGVtYXJrcyBvZiBTa3kgTGltaXRl ZCBhbmQgU2t5IEludGVybmF0aW9uYWwgQUcgYW5kIGFyZSB1c2VkIHVuZGVyIGxpY2VuY2UuDQo8 YnI+DQo8YnI+DQpTa3kgVUsgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyOTA2OTkxKSwgU2t5 LUluLUhvbWUgU2VydmljZSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIwNjcwNzUpLCBTa3kg U3Vic2NyaWJlcnMgU2VydmljZXMgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMzQwMTUwKSBh bmQgU2t5IENQIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUxMzI1OSkgYXJlIGRpcmVjdCBv ciBpbmRpcmVjdCBzdWJzaWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQgKFJlZ2lzdHJhdGlvbg0KIE5v LiAyMjQ3NzM1KS4gQWxsIG9mIHRoZSBjb21wYW5pZXMgbWVudGlvbmVkIGluIHRoaXMgcGFyYWdy YXBoIGFyZSBpbmNvcnBvcmF0ZWQgaW4gRW5nbGFuZCBhbmQgV2FsZXMgYW5kIHNoYXJlIHRoZSBz YW1lIHJlZ2lzdGVyZWQgb2ZmaWNlIGF0IEdyYW50IFdheSwgSXNsZXdvcnRoLCBNaWRkbGVzZXgg VFc3IDVRRA0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_D4D5BD8E4BCE45719A59C139406C079Dskyuk_-- From nobody Tue Jul 16 08:38:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B13A91207CB for ; Tue, 16 Jul 2019 08:38:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NyBRB2rYdgZa for ; Tue, 16 Jul 2019 08:38:48 -0700 (PDT) Received: from mail-lf1-x129.google.com (mail-lf1-x129.google.com [IPv6:2a00:1450:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63AC91207BF for ; Tue, 16 Jul 2019 08:38:48 -0700 (PDT) Received: by mail-lf1-x129.google.com with SMTP id q26so14067981lfc.3 for ; Tue, 16 Jul 2019 08:38:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=rUyaUVjciB8nHCJfnZqIrKSeag8+t7Bejn6lFx97DvE=; b=bTw1YTLrp5m+CZV7RyNu8CGBcPT4wCXS1idiOQ1eUouLYXw18mr/sJl35uL+ot6wM+ Enb/jPStqPqeqE7t4gFLJjeJFgZrIqvtGowBK3WrDXTa/dS4nfbD99FmDUJzzt4UXoeM Ka4fjJwFMROFVK7Y5ZnR1dEW3IwUYCemw3D3MGUo6RjVWSkZXEHmxR4jkOo+XLM0P6PR ZMsgu1dt9W9iv5/0N4Yie1Cf4OP9N8wU65pmjCWGLQ7E/DT3RrhHVSHnrnDZfCjYQMsu eH0dPapZNkbCwYLp/APIAYCWr3qz/ygqc/nS2/Oxiv/SbQc5rvV8yJc3VPGOyd9UH3Q7 3Ipw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=rUyaUVjciB8nHCJfnZqIrKSeag8+t7Bejn6lFx97DvE=; b=Y8CamSUKrorIkoisSgCmmVuBV+8ERkwBFei5UqEGwGQlC4hPf+o4t+cEZbHdYfSxCS IYVbIshx5thIIUZqUh7/L67Oqr8LtO+mJe1HOOnZN3uSKAjF1mPtDEdJF6DtR6RnG+8E rg3324iLUvIgHX2g91dM1wAdrZflYxtdsD8HdsVwDws1YLooHcN5cRioYmEX4NzoeOVc l5Z/9qd+j2+ncl+DNZjCVN918108h/YAR81XujZpW05+fUHNxiQeBlxPiJ9QjZzemVjs Cgbs9pb3jrGvP0JtKUDrrlI1RxecHFAQjbDt3n1q/kDOMNToOpq7uKBwNZqnl6OXisKo CTsA== X-Gm-Message-State: APjAAAW7SS+R45TBUYwbYK7uQV2iDXJNtqcqPdiD/IDqHteZFenKO7UF p8AgF5pQb3vi7wFGmNn4jUyjiUdbbGq+1iyaQ3M= X-Google-Smtp-Source: APXvYqzIPukjCXvdUSQtivko8Wsgij1IzAccbGlgc3oPIulEgnOGNA7fd5xH5/OHe4XNbajgSQHD14304Shdv+nCzWs= X-Received: by 2002:ac2:5336:: with SMTP id f22mr14565512lfh.180.1563291526695; Tue, 16 Jul 2019 08:38:46 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Tue, 16 Jul 2019 08:38:09 -0700 Message-ID: To: Rob Sayre Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="000000000000211e42058dce2c7c" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 15:38:51 -0000 --000000000000211e42058dce2c7c Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 8:24 AM Rob Sayre wrote: > > > On Tue, Jul 16, 2019 at 7:22 AM Eric Rescorla wrote: > >> Hi Alec, >> >> This is a good question. >> >> As I alluded to in my response to Robert Sayre, DoH has a difficult >> deployment problem. Specifically, whether we like it or not, there are >> some environments in which DNS filtering is in place and the user >> wants it that way (parental [0] or anti-malware filtering are good >> examples of this). >> > > Parental controls and malware detection are usually done on the device. > > > https://www.apple.com/newsroom/2019/04/the-facts-about-parental-control-apps/ > https://blog.google/products/chrome/cleaner-safer-web-chrome-cleanup/ > They are often done, but not always. For instance: https://www.xfinity.com/support/articles/set-up-parental-controls-with-comcast-networking https://www.quad9.net/faq/#How_does_Quad9_protect_me_from_malicious_domains -Ekr --000000000000211e42058dce2c7c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 8:24 AM Rob S= ayre <sayrer@gmail= .com> wrote:


On Tue, Jul 16, 2019 at 7:22 AM E= ric Rescorla <ekr@rtfm= .com> wrote:
Hi Alec,

This is a good question.

As I a= lluded to in my response to Robert Sayre, DoH has a difficult
deployment= problem. Specifically, whether we like it or not, there are
some enviro= nments in which DNS filtering is in place and the user
wants it that way= (parental [0] or anti-malware filtering are good
examples of this).
=

Parental controls and malware detect= ion are usually done on the device.

=

They are often done, but not always.= For instance:

<= /div>
-Ekr

--000000000000211e42058dce2c7c-- From nobody Tue Jul 16 08:39:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E59D1207D0 for ; Tue, 16 Jul 2019 08:39:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AvI-V-YrVKEf for ; Tue, 16 Jul 2019 08:39:12 -0700 (PDT) Received: from mail-io1-xd2d.google.com (mail-io1-xd2d.google.com [IPv6:2607:f8b0:4864:20::d2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE8FD1207BF for ; Tue, 16 Jul 2019 08:39:12 -0700 (PDT) Received: by mail-io1-xd2d.google.com with SMTP id z3so40692101iog.0 for ; Tue, 16 Jul 2019 08:39:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=1A+qmRYYYNHpcL0jwAbLKcYrT0QpnXWDKAiCTZ0ktUU=; b=OjiB7sbd5v7W9s32LiEPlfYom9IBgjtaCNbnkvRhP2V136qG3Ue9lDM6iAj7NqDA2p lSciUUHvQZBCPPwBkidu2YqdRDht0N5PPU2WDJBjfQ2YN0qekzaCn0PuO+b4WEbPJE1z K3TTl3ByAQ4M3WVrRqQluRo6zVgCzy1wSVtW6Nyu8qBW37B2fcJUrTnboofgOqgh8+tl odHB26tiflAqu4/vumARoe+nG5ZM88hck2bdq2yCRt1KksqOJz9AF6f5gAvXJzRxHcH3 auA9JDVI7s+jUdFMcILGwZOfY2sSGeHRgYqUfZtyar+9FLrdhg5uP/VgYsOF4PMhChfh N3DA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=1A+qmRYYYNHpcL0jwAbLKcYrT0QpnXWDKAiCTZ0ktUU=; b=hxwJVBzpPW5xXH6xJyx4EYfoeRMG/ZbKCLP2S1PaUj0XZrlF3OaY9gKYehktUWWFgq YJE697kTaDhVyMOxClxBY//XFS2ORNi+Yo/dnUJfolu/l9ZTo6iMVEZPBsHaLlWDaywM pRIs0aEjGglsrHzZ0c0UlZ7xIYEEXaPIbsgQ1c+jmxBbcJjdE/4T6OffY4O9jSbq9AJT KcUaejx8+i9+wc+r32WqKUxQqxfRalX/jSADQQnAzbHwzzqYbAvBVjY9Ae/FJaNLjbv4 z+P+JRmJHJlB8btc82CylLiYPn5NpjJj9hh3T4LV5V0UPi0xrGlEYoMbWxP9XXpqbq+/ /ZUQ== X-Gm-Message-State: APjAAAVSHZpWYUhQG+Bs3dCSTrW4HD/91XhSUfsA12fNQJ68rMProqQw wki3DFgtFIPgFT4HW5mUywKbONARlIOttEq5uDE= X-Google-Smtp-Source: APXvYqwFQB47J9ZDSV97CR5uYm4qM6r+7HQx108Ehr+UjSNkCj75kD6qjvzA1YCIJG5GNZGgNRmygRySN/TQywWqMHg= X-Received: by 2002:a02:5a02:: with SMTP id v2mr34487313jaa.124.1563291551825; Tue, 16 Jul 2019 08:39:11 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Tue, 16 Jul 2019 08:39:00 -0700 Message-ID: To: "Dixon, Hugh" Cc: "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000a08335058dce2dd8" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 15:39:14 -0000 --000000000000a08335058dce2dd8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 16, 2019 at 8:27 AM Dixon, Hugh wrote: > =E2=80=9Cusually=E2=80=9D is a distinctly statistical term. Do you have = any data ? > Sure, here's how parental control features work: https://www.apple.com/families/ Windows Defender is a good example of malware removal and parental control: https://www.microsoft.com/en-us/windows/comprehensive-security That's the default software shipped by Apple and Microsoft. I have to concur that this looks like a downgrade attack. thanks, Rob --000000000000a08335058dce2dd8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 16, 2019 at 8:27 AM Dixon, Hu= gh <Hugh.Dixon=3D40sky.uk@dma= rc.ietf.org> wrote:

=E2=80=9Cusually=E2=80=9D is a distinctly stat= istical term.=C2=A0 Do you have any data ?


Sure, here's how parental control features work:=


Windows Defender is= a good example of malware removal and parental control:


That's the default software shipped by Appl= e and Microsoft. I have to concur that this looks like a downgrade attack.<= /div>

thanks,
Rob

--000000000000a08335058dce2dd8-- From nobody Tue Jul 16 09:10:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08D9212087B for ; Tue, 16 Jul 2019 09:10:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VbBfYdLY8Quv for ; Tue, 16 Jul 2019 09:10:37 -0700 (PDT) Received: from mail-io1-xd43.google.com (mail-io1-xd43.google.com [IPv6:2607:f8b0:4864:20::d43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6A633120879 for ; Tue, 16 Jul 2019 09:10:37 -0700 (PDT) Received: by mail-io1-xd43.google.com with SMTP id g20so40778680ioc.12 for ; Tue, 16 Jul 2019 09:10:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=s2kkACFEiAaEFAW84b0dGctUBtXgRCxU6uVpXnYoRPU=; b=q+s4apAToKjEbTF8MN+bxTzVELEwoqZ+SSZYW/6sOAyD6kkmUZjxDo0bAGj27wKkqn AX2SKlvthxviDqUjmq4RioWLhhVshVmKfY6P61smJPbzFM1XlxgA0oZxLK7w/I/rP71K euwNDfsuml9Swvc/tXoKZAyn8uHlS+Yv3DGY6zQLeucvB9zYZUg0VmTqEFSJPHPnzVFT jyOTdzVa8QdX7U7nlICfmCATxPn0xJVmKK54nGtXno0/yS7a8smvLn7ZHLaNrQmdur9y rEP+6UrsWZvKNl3DPHT9PK1niM4LhftR5mnPbTqLuc+rLYwXRAMe+aCFcilQ0VuRZGYI RWZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=s2kkACFEiAaEFAW84b0dGctUBtXgRCxU6uVpXnYoRPU=; b=tmLlKkd5ObliYyc50T80JhFlbnYttCMhTv0hnvQXYAgfACxShgtmpbpli+nDHfvtYu WFL1vt8MlQAFhmcl/yS+085eWsheWhipabUcgrgqssdc8BXb3js+7HtRAWQhk/baYNQy DYcFXeFy8NWnxs+lKGguRDOOQArAdbePZqHcHIJaeNsUCeuZVpKnDvzY82rt9vQ2A814 7MLLk18XaZciL9a3UQL0qcG1XvgRXkBzB4WDmyqZj2k5dOcRI9qBTD8QwNNuOQqmB2yM Nx34tQ+Lkm9yWni2xAyD/2V5S4cacOWrDm+Nhw08JvtGg++lRfg8aoOAKgGVjVfHUnnG vbIA== X-Gm-Message-State: APjAAAWV6OAqpnzyw+gegUyzNQ4eezpkv/B6sryWjhfCcnmFtH2T4bta pLQGbYYfpX0gOasL0+sOB2m/B5JAislQT8dV+W0= X-Google-Smtp-Source: APXvYqxeg9SY91Fqtyca1doYpTFFYV4JP4SpnIG1K6/D3ZftbDO3eZq7oDnmuyaj5wRg6V9bd0crib45JDG5IVkzIo4= X-Received: by 2002:a6b:6d07:: with SMTP id a7mr9099377iod.254.1563293435449; Tue, 16 Jul 2019 09:10:35 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Tue, 16 Jul 2019 09:10:24 -0700 Message-ID: To: Eric Rescorla Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="000000000000e657bc058dce9dc9" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 16:10:39 -0000 --000000000000e657bc058dce9dc9 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 8:38 AM Eric Rescorla wrote: > > They are often done, but not always. For instance: > > https://www.xfinity.com/support/articles/set-up-parental-controls-with-comcast-networking > https://www.quad9.net/faq/#How_does_Quad9_protect_me_from_malicious_domains > I agree that some companies sell these products, but it doesn't seem like they would work very well. In any case, BCP 188 covers the issue we're describing quite well. "The same techniques to achieve [Pervasive Monitoring] can be used regardless of motivation. Thus, we cannot defend against the most nefarious actors while allowing monitoring by other actors no matter how benevolent some might consider them to be, since the actions required of the attacker are indistinguishable from other attacks." Pervasive Monitoring Is an Attack https://tools.ietf.org/html/rfc7258 thanks, Rob --000000000000e657bc058dce9dc9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 16, 2019 at 8:38 AM Eric Resc= orla <ekr@rtfm.com> wrote:

I agree that some companies sell these pr= oducts, but it doesn't seem like they would work very well.
<= br>
In any case, BCP 188 covers the issue we're describing qu= ite well.

"The same techniques to achieve= [Pervasive Monitoring] can be used regardless of motivation.=C2=A0 Thus, w= e cannot defend against the most nefarious actors while allowing monitoring= by other actors no matter how benevolent some might consider them to be, s= ince the actions required of the attacker are indistinguishable from other = attacks."

Pervasive Monitoring Is an Attack

thanks,
Ro= b

--000000000000e657bc058dce9dc9-- From nobody Tue Jul 16 09:30:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BF041208B6 for ; Tue, 16 Jul 2019 09:30:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6T07hbLzmVTl for ; Tue, 16 Jul 2019 09:30:04 -0700 (PDT) Received: from NAM04-BN3-obe.outbound.protection.outlook.com (mail-bn3nam04on0708.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe4e::708]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94A6A1208F9 for ; Tue, 16 Jul 2019 09:29:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=KEazhYEs48OH+sWYrrrHI+gWnk+fpRq4nHYb+9XO5NjFXfA0jWLQssoE5RiKIFYUq16ZL4KkZTwhLZmt4spNOafgGadtU13NBJWt3UiNj4Jat28ClmCAee0swq5U0uLaXhfucnO2rFfT/ROE5l9wvSOx85t5hT7LjIeCTUXhnkymlmH7lCWGgW4uKsWdHx/yQDQAJZp5Zjz0mRbZpQZtr7lX7gQgNyE1kVFtydYN0asnUOHj1Flq1r584h9qx9I1KNOjngU299j77r2EgwBdxAoi2hvG2yvauBZVnc44QEtcurZ0SFN8J3uK7B78LPBuZ3k/pxxxCY2e1pD/YjN5og== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rz6/dlg8M2miv/SBINacZe7qTOS5WfSp1gSmddmbTtw=; b=Fy+uZ+RTr6dCUph8g/hSzfeQfdS1I03ascA3CfK0rlfH9ga4zMPodrgryCsQJ6PkYGPIqRM3u/ZgUEwIi/PdhDRdEmxadeELshFBEjgmKda0rfZZgTODqZ0VoYQuoHX2gaN4k1pdfZi+rCL8HMSgkVevCbFCrb8rUrwUBpE/qAyzzC2/VdrgeQlE4/UKGh4ehq3KjFzl3ndXMg3IQ99bLld7L27OWzDsxL5Jj4N9uRGVG6Ib1tp38Q9G9GuguJrKaaKo1Rh6eoUS0EWc/w8DozRetOOwbnMEnATIKUR0xeLGCHM3meX/P2GWceiTTKHkPYVbb8R6XH6X/06LjX6h6g== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rz6/dlg8M2miv/SBINacZe7qTOS5WfSp1gSmddmbTtw=; b=dWO0SXdQ7HQmulO9/Y5oFyrKh4Pdcm49KpmPld12NQGgD1oaH58Hj7XmDLwkdUijhzUKfhAvqX8vUFrJl6Gu5ulUjIxz8wmatSb3q3F6N5+UUD7aRhNUymmCa7B54+dt7qEvi+oNs5Pjq/W3uYc+JV2pAsCFhhDNKMNcnwVJu3A= Received: from BN8PR21MB1202.namprd21.prod.outlook.com (20.179.73.142) by BN8PR21MB1251.namprd21.prod.outlook.com (20.179.74.28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.0; Tue, 16 Jul 2019 16:29:56 +0000 Received: from BN8PR21MB1202.namprd21.prod.outlook.com ([fe80::695f:2ff8:262a:7ff8]) by BN8PR21MB1202.namprd21.prod.outlook.com ([fe80::695f:2ff8:262a:7ff8%5]) with mapi id 15.20.2115.002; Tue, 16 Jul 2019 16:29:56 +0000 From: Tommy Jensen To: Rob Sayre , Eric Rescorla CC: "add@ietf.org" , "Dixon, Hugh" , Alec Muffett Thread-Topic: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 Thread-Index: AQHVO+HgDyrUoGuKfEi56qAYaR1dx6bNXTUAgAAD94CAAAkDAIAABJkJ Date: Tue, 16 Jul 2019 16:29:56 +0000 Message-ID: References: , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2001:4898:80e8:2:c164:a69d:7cf6:4496] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9b8f7a54-547a-444c-70a3-08d70a0ad6f6 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:BN8PR21MB1251; x-ms-traffictypediagnostic: BN8PR21MB1251: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 0100732B76 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(396003)(346002)(136003)(376002)(39860400002)(366004)(189003)(199004)(110136005)(606006)(91956017)(53936002)(8990500004)(54906003)(25786009)(10290500003)(2906002)(66556008)(476003)(64756008)(4326008)(66446008)(66476007)(486006)(76116006)(66946007)(68736007)(966005)(478600001)(19627405001)(5660300002)(6246003)(52536014)(10090500001)(6306002)(71200400001)(14454004)(22452003)(316002)(71190400001)(86362001)(46003)(105004)(6506007)(7736002)(53546011)(33656002)(102836004)(99286004)(6436002)(14444005)(186003)(76176011)(6116002)(8936002)(8676002)(256004)(446003)(236005)(81166006)(81156014)(11346002)(9686003)(229853002)(54896002)(74316002)(55016002)(7696005); DIR:OUT; SFP:1102; SCL:1; SRVR:BN8PR21MB1251; H:BN8PR21MB1202.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: EKreR8iCDCw5uww7mzo40ElOSqtUFez9In5M1Z7hScIFldx7Rdqv7iQ7c+pZlI1JNk2W7+Ik95MDhKZqpzhy/H30wZnsYeINdBUcLFq5CXFqQ1pJ7gko34G7WZvm2j/ia2xceiPcxYsxMChWVOjG1ogsX7RyAOy0mqsrBtW3yEUWnzz9Q3tHM8IDPvxL3db0s4iVQebNWAqfAvMdYNzOJdCRtkETqtNISqycNsfuLvKQad/1T1tTbzEJT1Jf+sjOdFvmKDh4e0r6pHO5/gqOv03dcjZ3UNrzUUZwvgO+tH3hcmWfqW8tJ+cJNB3mZvZWmFrAG/OH1++S+amaIbUletX/SnEmmt0AD7LSyOBxSv1iCIxrs2JZfwJQuypWnCQldUmTQcUlK+v9oyswl0mzKqd/F4ATfNE01Uhbhcg47KE= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BN8PR21MB120290722B8E3A7DE85443A1FACE0BN8PR21MB1202namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9b8f7a54-547a-444c-70a3-08d70a0ad6f6 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Jul 2019 16:29:56.6181 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tojens@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR21MB1251 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 16:30:07 -0000 --_000_BN8PR21MB120290722B8E3A7DE85443A1FACE0BN8PR21MB1202namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I agree that some companies sell these products, but it doesn't seem like t= hey would work very well. Based on what data? From the non-technical customer perspective, it might a= ctually be easier than learning each platform's chosen security/family frie= ndly software. We shouldn't so easily dismiss an existing use case. Thanks, Tommy ________________________________ From: Add on behalf of Rob Sayre Sent: Tuesday, July 16, 2019 9:10 AM To: Eric Rescorla Cc: add@ietf.org ; Dixon, Hugh ; Alec Muff= ett Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 On Tue, Jul 16, 2019 at 8:38 AM Eric Rescorla > wrote: They are often done, but not always. For instance: https://www.xfinity.com/support/articles/set-up-parental-controls-with-comc= ast-networking https://www.quad9.net/faq/#How_does_Quad9_protect_me_from_malicious_domains= I agree that some companies sell these products, but it doesn't seem like t= hey would work very well. In any case, BCP 188 covers the issue we're describing quite well. "The same techniques to achieve [Pervasive Monitoring] can be used regardle= ss of motivation. Thus, we cannot defend against the most nefarious actors= while allowing monitoring by other actors no matter how benevolent some mi= ght consider them to be, since the actions required of the attacker are ind= istinguishable from other attacks." Pervasive Monitoring Is an Attack https://tools.ietf.org/html/rfc7258 thanks, Rob --_000_BN8PR21MB120290722B8E3A7DE85443A1FACE0BN8PR21MB1202namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
<= span style=3D"font-size: 15px;">Based on what data? From the non-technical = customer perspective, it might actually be easier than learning each platfo= rm's chosen security/family friendly software. We shouldn't so easily dismiss an existing use case.
<= span style=3D"font-size: 15px;">
<= span style=3D"font-size: 15px;">Thanks,
<= span style=3D"font-size: 15px;">Tommy
From: Add <add-bounces@i= etf.org> on behalf of Rob Sayre <sayrer@gmail.com>
Sent: Tuesday, July 16, 2019 9:10 AM
To: Eric Rescorla <ekr@rtfm.com>
Cc: add@ietf.org <add@ietf.org>; Dixon, Hugh <Hugh.Dixon@sk= y.uk>; Alec Muffett <alec.muffett@gmail.com>
Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-= 00
 
On Tue, Jul 16, 2019 at 8:38 AM Eric Rescorla <ekr@rtfm.com> wrote:

I agree that some companies sell these products, but it doesn't seem l= ike they would work very well.

In any case, BCP 188 covers the issue we're describing quite well.

"The same techniques to achieve [Pervasive Monitoring] can be use= d regardless of motivation.  Thus, we cannot defend against the most n= efarious actors while allowing monitoring by other actors no matter how ben= evolent some might consider them to be, since the actions required of the attacker are indistinguishable from other atta= cks."

Pervasive Monitoring Is an Attack

thanks,
Rob

--_000_BN8PR21MB120290722B8E3A7DE85443A1FACE0BN8PR21MB1202namp_-- From nobody Tue Jul 16 09:33:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24C0A1208BA for ; Tue, 16 Jul 2019 09:33:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bYbrgy8VlWNL for ; Tue, 16 Jul 2019 09:33:38 -0700 (PDT) Received: from burnttofu.net (burnttofu.net [IPv6:2607:fc50:1:9d00::9977]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 686821208B0 for ; Tue, 16 Jul 2019 09:33:38 -0700 (PDT) Received: from elwha.brokendns.net (elwha.brokendns.net [IPv6:2607:f2f8:a544:0:0:0:0:2]) by burnttofu.net (8.15.2/8.15.2) with ESMTPS id x6GGXYLp044774 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Tue, 16 Jul 2019 12:33:36 -0400 (EDT) (envelope-from michael@brokendns.net) Received: from Michaels-MacBook-Pro.local (50-197-156-42-static.hfc.comcastbusiness.net [50.197.156.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by elwha.brokendns.net (5.65c/IDA-1.4.4/5.63) with ESMTPSA id 69A115D948 for ; Tue, 16 Jul 2019 09:33:33 -0700 (PDT) To: add@ietf.org References: From: Michael Sinatra Message-ID: Date: Tue, 16 Jul 2019 09:33:32 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.6.2 (burnttofu.net [IPv6:2607:fc50:1:9d00:0:0:0:9977]); Tue, 16 Jul 2019 12:33:36 -0400 (EDT) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 16:33:40 -0000 On 7/16/19 8:38 AM, Eric Rescorla wrote: > > > On Tue, Jul 16, 2019 at 8:24 AM Rob Sayre > wrote: > > > > On Tue, Jul 16, 2019 at 7:22 AM Eric Rescorla > wrote: > > Hi Alec, > > This is a good question. > > As I alluded to in my response to Robert Sayre, DoH has a difficult > deployment problem. Specifically, whether we like it or not, > there are > some environments in which DNS filtering is in place and the user > wants it that way (parental [0] or anti-malware filtering are good > examples of this). > > > Parental controls and malware detection are usually done on the device. > > https://www.apple.com/newsroom/2019/04/the-facts-about-parental-control-apps/ > https://blog.google/products/chrome/cleaner-safer-web-chrome-cleanup/ > > > They are often done, but not always. For instance: > https://www.xfinity.com/support/articles/set-up-parental-controls-with-comcast-networking > https://www.quad9.net/faq/#How_does_Quad9_protect_me_from_malicious_domains Also, note that parental controls are but one use-case. There are a number of enterprises which require DNS-based filtering, *in addition to* other controls on the endpoint. The entire USG and many of its contractors are required to do DNS filtering. Many organizations that provide grants to educational institutions have conditions that the recipient of the grant must make efforts to "block porn" (and yes, that's about the extent of the definition). DNS filtering is a very reasonable way of complying. Institutional DNS filtering works well with DoT configured at the system level on the stub resolver, and supported by the institution. DoH can be made compatible with institutional filtering requirements, but it can also easily skirt those requirements: the devil is in the defaults. Mozilla, with its documented plans to circumvent institutional DNS with Mozilla-blessed services running DoH, exemplifies the case where the default behavior is going to be incompatible with institutional requirements and regulatory frameworks. The result is predictable: Where endpoints are under strict control, Mozilla will be uninstalled and effectively banned. Where endpoint controls are not as strict, attempts will be made to block well-known DoH services. This is already being done in some sectors. Unless we find ways of making DoH compatible with institutional controls, the banhammer will come down and we will end up in an arguably worse spot (think proxy decryption of all HTTPS, banning of certain browsers, blocking of well-known services, etc.). Personally, I don't want that to happen, but I fear it will if we don't make DoH more flexible by default. michael From nobody Tue Jul 16 09:50:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7BEAF12095B for ; Tue, 16 Jul 2019 09:50:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3-7FFV3n4ZyJ for ; Tue, 16 Jul 2019 09:50:19 -0700 (PDT) Received: from mail-lf1-x12d.google.com (mail-lf1-x12d.google.com [IPv6:2a00:1450:4864:20::12d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBFAA120956 for ; Tue, 16 Jul 2019 09:50:18 -0700 (PDT) Received: by mail-lf1-x12d.google.com with SMTP id v85so14210537lfa.6 for ; Tue, 16 Jul 2019 09:50:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=bTczHMnHVunVihHj9hVdyXeUkVP4PRRVqBxORdbHK9s=; b=j5rwJv4pqf/LBZnx/Abb2FP0V0PVetYsc4d/Gx4IQHdsIXmNBujfPpqkO+QnDgHi0x J5n3EW2OCmwXTsGKyUxiQIc4FSAsASHNIQHunJxhUUYPYPakInc19mxhHLq6Cs+QgbX5 kOzRjPoEjcdfbr00vpb2mGjJ50Hr7Ib+jDmzbYzJO1Ds9yL08YFADEvCxayMD/5zU3HR Gcdg6eUdsKIDDlOa0fJi/wswXnZHvqhd2qD0ioMgtBd8nc18CIskL4YLw8XtxjR1DcYI +sCRNZ/vwiHnqNO+I0jicZIweUZ2tp/uWq1aMjX2wXv4eq3Dp0C3//WwsN8zESxf+oTo yujw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bTczHMnHVunVihHj9hVdyXeUkVP4PRRVqBxORdbHK9s=; b=hk1g0pnSiF9PMPJrYMclXeWnVqLPlLhzLRZA1GmVldT0OnvN2nft4Km5mjwUQr7+8L uVd82ncYRKDLm0WgfhtU4b8eQFPXWkyoxhhipzH5bVmw+aPMciK5ZPcwZYhEX+nVkd84 UdFpz6+U5+1L9Td1rKguxLYdb4G8Sp4xmC7R7HpOmiJYmEknnKHy/inmtB0buf94Kp5t cSdBx0DFVUUfIIeg1n8Wor4/02qeOt7H49js09a73uJANMkJSA97zeyh9p6A5b9O6Y3u VcwaCcOuyU2QVouWXHy6/QrXncG6+K47uUAv/5WNa5UmtKyRp3iOaFI/3XDXOWnKTzOY 9gug== X-Gm-Message-State: APjAAAX79BGxRrmE/iovnFHBs/GRC23baOhR2Q31tNyjeu+cs6419joO j2R1v4P1CW54fih+ABzeYffUtqHmQX53JTrjfZm3sQ== X-Google-Smtp-Source: APXvYqzdi1ME7Q9uriqnq+i/R1JVfCSMwqdXL+Gf4ejqG5/VIB/hykbrI2IwdH06m5uT6csjCQvp+SaMMQ+27VPDw0E= X-Received: by 2002:ac2:4202:: with SMTP id y2mr3403903lfh.178.1563295816894; Tue, 16 Jul 2019 09:50:16 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Tue, 16 Jul 2019 09:49:39 -0700 Message-ID: To: Michael Sinatra Cc: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000d864a4058dcf2bf8" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 16:50:21 -0000 --000000000000d864a4058dcf2bf8 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 9:33 AM Michael Sinatra wroteil is in the defaults. > > Mozilla, with its documented plans to circumvent institutional DNS with > Mozilla-blessed services running DoH, exemplifies the case where the > default behavior is going to be incompatible with institutional > requirements and regulatory frameworks. The result is predictable: > Where endpoints are under strict control, Mozilla will be uninstalled > and effectively banned. Obviously, I can't control whether people install or uninstall any particular piece of software, but I do want to emphasize that (1) enterprise policy can be used to disable and configure DoH and (2) Firefox will disable DoH entirely if an enterprise policy is in place but it doesn't otherwise configure DoH. -Ekr --000000000000d864a4058dcf2bf8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 9:33 AM Micha= el Sinatra <michael@brokendns.n= et> wroteil is in the defaults.

Mozilla, with its documented plans to circumvent institutional DNS with Mozilla-blessed services running DoH, exemplifies the case where the
default behavior is going to be incompatible with institutional
requirements and regulatory frameworks.=C2=A0 The result is predictable: Where endpoints are under strict control, Mozilla will be uninstalled
and effectively banned.

Obviously, I can= 9;t control whether people install or uninstall any particular piece of sof= tware,
but I do want to emphasize that (1) enterprise policy can = be used to disable and configure
DoH and (2) Firefox will disable= DoH entirely if an enterprise policy is in place but it
doesn= 9;t otherwise configure DoH.

-Ekr
<= /div> --000000000000d864a4058dcf2bf8-- From nobody Tue Jul 16 10:22:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8876C12003F for ; Tue, 16 Jul 2019 10:22:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cpoit3-lmb0z for ; Tue, 16 Jul 2019 10:22:39 -0700 (PDT) Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com [IPv6:2a00:1450:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1DE5C120A8E for ; Tue, 16 Jul 2019 10:22:26 -0700 (PDT) Received: by mail-lj1-x22b.google.com with SMTP id t28so20738166lje.9 for ; Tue, 16 Jul 2019 10:22:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=tL+2fwbMmluuj+Cf6KHwNSMHcpph5com9DTQx9Obj9s=; b=sYaqtMOupFHw+HHFqhDZA+pSU4nHXZ9ZDcF0VrKIYyqOfws5nEsIro/fnaJTAT4ukf KCqBoEjtsSbQlq/H70GyIAHC/bWzI9sYnFj+hNApsEgfksdwA53p+na2/CRzNJdlOhYv 3/lQ/mu5sLnDu395hICDU+J3hk3E7Nt9u3vmmNPNciqNCD6T7vzNV+3fktFmFFpsYZlO LZ/7UJEy+syCXpDQaXMCzrHs63nYRQ2Sop1xrbz+sFHAFxtCf8aoFst8Mymcu70ZgzbI xNXZw4cMgYaJiCRamYx0JozmzVrbxKZTIya/5V3cYaDXSfLaa60v4/6xYs3EbOylXLTm oqxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=tL+2fwbMmluuj+Cf6KHwNSMHcpph5com9DTQx9Obj9s=; b=Xns4a4U5J5TnuO8Qr7KOi9Yb7HtiM/eExy6OAQW/TijYuFB7xFpCn0m3a/MQM1VYET s/BDVfWDwfhF+0pn9gpGemkGPSiAFXhMwjjOR//iprlgkv2Mw8Z8DgH3MpXi5XQrbypk rLU1inVSChhgQyl3F/8hQn9QHctgFt88puYIzN5cEadumHgR4tI5KmM+46Dk4A68T/dE HEK6JifyKzgtwPhU2+tn45jd4vo36E7k4y6ff8xT/h7iu0+hOdEeO3O6zlPAicu3rvkt npwUZS3sJpriBkddtLqPh2BqZm6HWN1BSLRBtP670pNohomLw9XMwM5ugxwNA6n9lPtM 6ePA== X-Gm-Message-State: APjAAAVupIr1VpuBxwEv23p0ekS1j7YDW7YHsXXXRyGqC3N5pKxk44KN zX3Hl4IaRTIVzhDhFkF8nWzPr5YcwDf8vB70Qfg= X-Google-Smtp-Source: APXvYqzgmxILjy53OkQLLx4RmxcoQuNRGhnwU5RX/rM0iG2Dxt8Nh9wv+QnSIKsw33DSw49F38n/tLr6XbSO4NrJatM= X-Received: by 2002:a2e:b0e6:: with SMTP id h6mr17512747ljl.18.1563297744371; Tue, 16 Jul 2019 10:22:24 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Tue, 16 Jul 2019 10:21:47 -0700 Message-ID: To: Rob Sayre Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="000000000000bb54c1058dcf9eb6" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 17:22:40 -0000 --000000000000bb54c1058dcf9eb6 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 9:10 AM Rob Sayre wrote: > In any case, BCP 188 covers the issue we're describing quite well. > > "The same techniques to achieve [Pervasive Monitoring] can be used > regardless of motivation. Thus, we cannot defend against the most > nefarious actors while allowing monitoring by other actors no matter how > benevolent some might consider them to be, since the actions required of > the attacker are indistinguishable from other attacks." > > Pervasive Monitoring Is an Attack > https://tools.ietf.org/html/rfc7258 > I'm quite familiar with this BCP but given it's emphasis on passive monitoring and the associated interest in opportunistic security (RFC 7435) I don't see any conflict here. -Ekr > > thanks, > Rob > > --000000000000bb54c1058dcf9eb6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 9:10 AM Rob S= ayre <sayrer@gmail.com> wrote= :
In any case, BCP 188 covers the issue we= 're describing quite well.

"The same = techniques to achieve [Pervasive Monitoring] can be used regardless of moti= vation.=C2=A0 Thus, we cannot defend against the most nefarious actors whil= e allowing monitoring by other actors no matter how benevolent some might c= onsider them to be, since the actions required of the attacker are indistin= guishable from other attacks."

Pervasive Moni= toring Is an Attack

I'm quite familiar with this BC= P but given it's emphasis on passive monitoring and the associated inte= rest in opportunistic security (RFC 7435) I don't see any conflict here= .

-Ekr




thanks,
Rob

--000000000000bb54c1058dcf9eb6-- From nobody Tue Jul 16 10:26:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3996A120ABD for ; Tue, 16 Jul 2019 10:25:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i5dkMrv6sPyn for ; Tue, 16 Jul 2019 10:25:53 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 75FB9120AC7 for ; Tue, 16 Jul 2019 10:25:53 -0700 (PDT) Received: from [10.10.206.14] (unknown [161.12.34.245]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id AB1502421249; Tue, 16 Jul 2019 17:25:50 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Tue, 16 Jul 2019 18:25:49 +0100 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <53A70CFB-4191-41F9-A33E-047E0F092B66@rfc1035.com> References: To: Michael Sinatra X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 17:26:00 -0000 > On 16 Jul 2019, at 17:33, Michael Sinatra = wrote: >=20 > Unless we find ways of making DoH compatible with institutional = controls, the banhammer will come down and we will end up in an arguably = worse spot (think proxy decryption of all HTTPS, banning of certain = browsers, blocking of well-known services, etc.). Personally, I don't = want that to happen, but I fear it will if we don't make DoH more = flexible by default. Obligatory nit-picking: What you're actually talking about here is one deployment/application of = DoH, not the protocol itself. The basic protocol is fine (pretty much). = It's how the protocol gets used that can create problems. DoH doesn't = have to or need to become "compatible with institutional controls". It's = the applications and services which use DoH might have to do that. FWIW, I agree with what you say if "DoH" was replaced with "DoH = deployment". From nobody Tue Jul 16 10:35:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 561B0120ADC for ; Tue, 16 Jul 2019 10:35:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=innovationslab-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fr--Sc-reBot for ; Tue, 16 Jul 2019 10:35:19 -0700 (PDT) Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E255120A90 for ; Tue, 16 Jul 2019 10:35:19 -0700 (PDT) Received: by mail-qt1-x82a.google.com with SMTP id z4so20462018qtc.3 for ; Tue, 16 Jul 2019 10:35:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=innovationslab-net.20150623.gappssmtp.com; s=20150623; h=subject:to:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to; bh=sxPJG9AEK3YLwb63zNr4NWxQa40O/m25o/wV5Z7JDbY=; b=fhoehhdr684zJwF9Roxy7WQt51dpE6m/83IgtlwD3YjeDYfPrIXo7NspS9CzBnqljG Z5cejVzk6zXD7hhODeg/FFTgrdjuHR6lZOyNHuqTetcpgMlyE40Ujl9UNeIn/zCYIHI2 AieoAgUktEW2DsiwOzLgbGboqU6yXFYNCE7sNK2E15nPqYFj8A75AJVIqDYrpQyJcGvW F8FqPXU61BnvUNqnZVdBBTSCqjSy3F8BOthecOZFTk17Q0FFRonziJpuiTNVfA0ZPUu1 P7EOUSYjx1YRTSsF0xeY1hK4de2U2T2b8RdRkh1OnkJMEGJQkzQFyTqJXKDbgOb2e5Y/ caYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=sxPJG9AEK3YLwb63zNr4NWxQa40O/m25o/wV5Z7JDbY=; b=bYvllpTTqGrA/ue83M6lm38utZYRZ5Vqoxr+ufkBvOww06eCvFPy67x8wBr3PNHNTn plH+HxUWWaQj6o7LmuPhaKns9SP4oCrJ4Nn3Rje6iEjeenVQA0uxThVQRjQSedTni5Wn V5pFL5iNucs9TbrX7br6PxKwkbIn9bMg9bfe5U/fQv9tn+wy6Au67BSstBYrjzStSuFX nFX3nGB2WSpdRAFkvclyb+mwXBsrwfvcMwkRgHQxt+wM+mV77P1mGv/uEhfRhOxgSCkJ RTs6SZym2Y24PLb/r32qMyet4bpgj5yPh6drt1Mgt8bthTY71bnsa57NyJ2cbXqgz/C4 wEZQ== X-Gm-Message-State: APjAAAUPGy32qFL0OTdq6i11yXNim59UE2jyQa60tys3rV2jAJX06ATc j1ZXRUfao2MRqgPZ1ijRZnmD8t2F X-Google-Smtp-Source: APXvYqyQpE7RACBRmKxoCOtrM1RQZmsREtD2aRLh9S2xaB+66mLzFl4bfuDI1deV+n/VuY4W4LUpFA== X-Received: by 2002:a0c:88e9:: with SMTP id 38mr24679234qvo.31.1563298517981; Tue, 16 Jul 2019 10:35:17 -0700 (PDT) Received: from clemson.local (nat-gwifi.jhuapl.edu. [128.244.87.132]) by smtp.gmail.com with ESMTPSA id d23sm9291406qkk.46.2019.07.16.10.35.17 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 16 Jul 2019 10:35:17 -0700 (PDT) To: add@ietf.org References: <2ab90a6a-dd40-b7a0-b380-4dcbd657c89c@innovationslab.net> <77611009-274c-a900-866b-e543a6d8053c@innovationslab.net> From: Brian Haberman Openpgp: preference=signencrypt Autocrypt: addr=brian@innovationslab.net; keydata= mQINBFm5KgYBEACs2icafejrG19L5DRNFq8Q2O+K+LRxjR4qAElZDnXFXNA2ipFWPeT0J2wa KJ+h9UdfhDm8DzULB553CYm+Q3XF1N56TglkIRMZYc7mYXZEr3x7e4fmX4kD4qMjBLG8cL26 rEe3Q0qaiMGY69/4o5coVMT0qmHjgCH1tkG+L2Y8MKr1gFxS18eO8MVoWe1yDKuyxFSElHGB 3mZn4gcqeCaemPGG3CiVNlp4KnijpNcSgvseXbkQEA4IXEsIvUL8MIwOTXg9Gh5cbtisZpuf +4B0LNMUSqWlqyKd9M3KCMj+dW4vsFytc00Z+GyQ+ArOR9GwTdAwJ5qqVODTvbjKqOR1zolJ 1JxLUtSiv7Lx5x2OrCexPYXkzlTkjG9Imtg2XNh55R/JKMC3KU1NQL3nS9tJXeoRWNgWSZrG MsrbeejbqLVb9LblXNpgLciJ96XHMvYAXX7p4LAwivzSRrVg46vErYIAV6EvDvwVENWW8JCU 0vX5iTGfkEwU4KxCa7WAmmD8yiNspHP1J0uk93Sta5K0PuTi7b+EZlCjdrqOEWLGPv6qXlIu FwLLcCaDs3XdVvwgNM+UFRxFH1aOVQQKCiCOCcNlwgYG1u4ZbD2T6hd/d2tOAKu/MNnQVF7d Cfi2BtSjzglLcY61e37zqTM04BgU+LniZ7V99yneM6DM2UzgkwARAQABtClCcmlhbiBIYWJl cm1hbiA8YnJpYW5AaW5ub3ZhdGlvbnNsYWIubmV0PokCQAQTAQoAKgIbAwUJB4YfgAULCQgH AwUVCgkICwUWAgMBAAIeAQIXgAUCWbkqSAIZAQAKCRBo1jycU9GLYQixD/9UX0uiAvbJ+4dK z3Ne3kUdDK0Lk73RGfFgE/ezsc9I6ED82h+arC8pAoDnBWgzTxugZdbexek983bgMq02XFsG pJf7hudeKnB8UmtjTc0j1UUgi129FYyBmINS2Lz1gpEOygFfbeOGLJK5qZJwD3I3O6yN8SUZ uwahXXd1aEB+d1eGhNqxkjQ+L7vdfTlN662GWog3ROMwUbrg0+QAbn/Vlp2iIYO6VERUZ9Yr GfFJX9b9LKa6AHxzAaqFIix1h2wBiIacpIBGU/4+3+wL5zkCbGSRzoIHW8srllj7ehgwwfNx QevibuZWJ4XpHpIxrtsmBO7ERFk8pN7oiQ9M3b2Cg9OBD5vgxyMCHEKIblWyKz8GLtz5357L ORU1EBWB8BoJPBHz3u7bZE+jH9+w5PpI087Ae78KCDkTNj7o2wbkRoYLmLpMo8DOwAumyy5R 2DuRu0cn5Rw5pFjlJkyfM0Wf80Ml/SINrUORWeqSbsHSX8i+Y0Oyt5JNo9NFbgN0Gn/Qo364 I8cLgbvUAyFHwhnmbHB+QXFCGAy73NOQ+g2fCRPeSbihhYa34ugfmd4oa6W2w805ixzM7iGr P+wDB1dhA7eHKVmoo9Kxvm9VzU+2homYGEROd/H6n0BMvWtp1oFh/JvEgZN6dVLg3p+XX5Zj Ggy568bIY4P5kP7pAxh017kCDQRZuSoGARAAtCWxW1cRne/iGbFuibvB8d3upcbCB7oz4LWk LSE20Db2ymn04ici9V+wBSWX57me5jQdwMi/gzVVZcupbzWTg5Yhv7Qt7CKORJLEKo6nULbb 4aEpdOXD9s7wwx+foFjzjtDOH/JYoB+OEe2oW39VmK6EsIx7ClsLf6+cih5yApZHtmV+2M3J YSxD2kCUE619ITFLAkMf203ap5vJ6DDaaKnVoNhF9qV7jlJEceGqHTBG4KkBX/zNCehMIfhr ViY/B2IWAHeuZ99lnCPx2mehGGa4XLjQauUkY9KB7dOq/ODyt+7SL0dfWrOVf3BnU3C308b4 9YdId8KI4dJ30nfXn6ifTK9STZHZE+Mt1sIVmtEguqMXEk/axZmT14x194c7ZPmU/uCQTE3U y1NFs4Yof50WF1ze0CyN2ycmqx11mHjP5+L23TqcdIWmJG+EtdHUAFpu42kbB0fML3Oc/cEU SmWK3WpF5YPljLM2gyh3RXjuiBnaGoJaKTOj5zXQ2G2l3/ijbn9FbqmFup+R352dxUyakXEP xNe3HdyjfyUcy/RJNeZz/lgUIhkxWQjOOU1RIN41RtCKcF9tJjMwgQvI51QmPvf90/6ab3I/ vwEpjlRb4AbuWfPWe89J+Z3TG97V9sntlMcQ6MGiPLbyFpiXIf2150e6FxZdJtipVwY2d/kA EQEAAYkCJQQYAQoADwUCWbkqBgIbDAUJB4YfgAAKCRBo1jycU9GLYfy0EACYrxb4nWtOnIu0 N7rXXo/0ZjaBTyUhJ6hzy2D7rt3vv/qj2ui+N21ui/yMDS928za/XRfP25qN9A1puioHqN4l SAsxwCC3mT9GJXVXVgivg3MeciqBXoOdnk1hUkP1CTKL3qZ9pSuw8bPlNE7+b1xF7Oce37YH +QRVmBXbGwTxtDTCZ9Js0/IpiUtg9QCfmryB1r/fD0TFb8b9aCBuVeKocWSuX9UXRt7zRGM8 BJwOLvdLdGvV8us1imlBKFLai4L8CPgihuc/s7ZB0r3pgW697hXScWhGHF3OUWbPFVkNyivM xtDcq+9ZlUMrxFbwUEABi8NFwvzwn+YJQqlrPiF4xxsScYpnIlfWEuP6Vpp6Z/u5x+1MNyZb oxNWWaevMVeo3tdRV9F6/YFqucw4JQ9HqlCKQ62sW9+e5SSlxGNlV4j9cchG6a4fAZqxL+pS ks+KitK3ap/R4RUG+nbjLlhCwGJIti8lxvdYAoPqjtwEUmMJv4dIl0/2h1495cwBIi7XeRKZ Rx38TV3G3LCx0J8dFhkyTG5TxUZQFgHjznkIX7bzeSQX72MxT0b/tc38yM71WpAgAY+MlHCT FQRKqIQsH/4MFir+g/oV2uPNGwmg0QEOnv9zZ79JJ/nBmuXC2RwUVTtZgtiZXhaP0afvR0eg WPEzptIZZCSmtBOOYkfsAw== Message-ID: Date: Tue, 16 Jul 2019 13:35:16 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="KSX6iXGQFNfNdA7blUARS5CObGyKZcJbO" Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 17:35:21 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --KSX6iXGQFNfNdA7blUARS5CObGyKZcJbO Content-Type: multipart/mixed; boundary="OEuGpJS4ItRDgvXg95B19FGFmtwCuVHrb"; protected-headers="v1" From: Brian Haberman To: add@ietf.org Message-ID: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? References: <2ab90a6a-dd40-b7a0-b380-4dcbd657c89c@innovationslab.net> <77611009-274c-a900-866b-e543a6d8053c@innovationslab.net> In-Reply-To: --OEuGpJS4ItRDgvXg95B19FGFmtwCuVHrb Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Hi Andy, On 7/10/19 7:50 AM, andrew.fidler@bt.com wrote: > Thanks Barry / Brian for highlighting the dprive-bcp-draft, I agree we = should not have two BCPs from different WGs conflicting with one another.= Let us discuss this in the 15min BoF slot we have allocated for overlap = with existing chartered work in DPRIVE, DOH and DNSOP. >=20 > On the potential topics list for a DoH BCP which areas do you believe a= re already covered in the DPRIVE draft and/or ongoing DPRIVE work? Which= areas do you believe are not covered and should be considered by the ADD= BoF? >=20 =46rom a DoT perspective, I think ADD could focus on: - split DNS - TLS session management - TLS overhead minimization Some of the last two are covered in the DoT spec (https://tools.ietf.org/html/rfc7858#section-5) Regards, Brian > Thanks, >=20 > Andy >=20 > andrew.fidler@bt.com >=20 > This email contains information from BT that might be privileged or con= fidential. And it's only meant for the person above.=C2=A0If that's not y= ou, we're sorry - we must have sent it to you by mistake. Please email us= to let us know, and don't copy or forward it to anyone else. Thanks. > We monitor our email systems and may record all our emails. > British Telecommunications plc > R/O : 81 Newgate Street, London EC1A 7AJ > Registered in England: No 1800000 >=20 > -----Original Message----- > From: Add [mailto:add-bounces@ietf.org] On Behalf Of Brian Haberman > Sent: 08 July 2019 14:22 > To: Barry Greene > Cc: add@ietf.org > Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? >=20 > Hi Barry, >=20 > On 7/5/19 6:07 AM, Barry Greene wrote: >> >> The issues that Andrew is bring up would take that dprive-bcp draft in= a totally different direction. Is this want you want? Would the authors = be open to the change? >> >=20 > My reason for pointing out the dprive BCP is to make sure everyone is a= ware of that document. >=20 > As for the content... It is a dprive WG document, so it is subject to c= onsensus-based changes. Neither I, as dprive co-chair, nor the draft auth= ors have any more influence over the content than any other IETF particip= ant. >=20 > What I don't want is for 2 BCPs from different WGs to conflict with one= another, hence the pointer. >=20 > Regards, > Brian >=20 >>> On Jul 4, 2019, at 9:29 AM, Brian Haberman = wrote: >>> >>> Signed PGP part >>> >>> >>> On 7/3/19 3:41 PM, andrew.fidler@bt.com wrote: >>>> There are many challenges facing enterprise and internet service pro= vider / operator networks that intend to deploy and operate DoH (and DoT)= resolver services. The IETF should consider developing a BCP which docum= ents these concerns and provide appropriate guidance. Some of these issue= s include: >>> >>> Please remember that there is already an operationally-focused BCP=20 >>> draft for DoT. >>> >>> https://datatracker.ietf.org/doc/draft-ietf-dprive-bcp-op/ >>> >>> Regards, >>> Brian >>> >>> >>> >> >=20 --OEuGpJS4ItRDgvXg95B19FGFmtwCuVHrb-- --KSX6iXGQFNfNdA7blUARS5CObGyKZcJbO Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEUZk246qFfyoMW2DGaNY8nFPRi2EFAl0uCtQACgkQaNY8nFPR i2GJbBAAhesoULw/R/muvyaMZSSLJk2qDNRTNQraA+aPJwcH+hm2Wzzbu9RMyMSY VJ9jYVBk9oNMB7dU9GN63CXtMBQzc8BslJ/1XzIJ/AcIKYg1jzysf1Sli01hZCDh S9V5KGjioBd80xp9wczExP/ylpJ7stNZZpxINtfKltUNEhaAkCoTZIbNP7wRzmrh 5/4sSPQHYwfU0ZU6DkPX/mYDy7HWj8EkouOH8r8yd00xluikP/f3mwRVnYGYb3jD 9tWUExcJ4LS0tUzdbKURfB6AshibZduu15fFt5POn4z/q9NiZ38D8D1+4iyoS8Tn vdlZSsxvXjYAltZxnG6G7tklrWKZ5531dX9MXJwjRWQ9+buC0K7MDb3nAatd0BDA DLu4rX094UxG10lgoMPIj55P/9mgOQlJfdWZsL3pJXl/X/9C2psQtkxINvFSpg+l ti3BR/FiDhFkFGCZrzWdVJCur5mghfDaSi4TmssIsWHCXT8GerF5LhXmVv839NBP a6dgEo8EFH5/g7MSj8/zZanr1/MfXouF6p7me1SZOc3v9PUDPa4BUQYC9lzRPWxt RvGhFXqW3qE2RR4JQvl4CSolK7I0jAvufTC7/vXuU/oisPQ4An1uDB6ae01vdedE NeYtmkXFtzLEmr6mVnCT8YKjorChyNwvZFaW/GkJ5IHK2LVthjk= =kIcB -----END PGP SIGNATURE----- --KSX6iXGQFNfNdA7blUARS5CObGyKZcJbO-- From nobody Tue Jul 16 10:35:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43D7D120B1C for ; Tue, 16 Jul 2019 10:35:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jcfAw_D1-G8m for ; Tue, 16 Jul 2019 10:35:42 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1607A120ABE for ; Tue, 16 Jul 2019 10:35:42 -0700 (PDT) Received: from [10.10.206.14] (unknown [161.12.34.245]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 2E3FD2421249; Tue, 16 Jul 2019 17:35:40 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Tue, 16 Jul 2019 18:35:39 +0100 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [Add] Firefox DoH behaviour X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 17:35:43 -0000 > On 16 Jul 2019, at 17:49, Eric Rescorla wrote: >=20 > Firefox will disable DoH entirely if an enterprise policy is in place = but it > doesn't otherwise configure DoH Could you provide more clarification? How will Firefox know if an = enterprise policy is in place or what that policy is? If Firefox = "doesn't otherwise configure DoH", does that mean DoH will always be = disabled by default unless the end user deliberately and intentionally = switches it on? Would DNS/DoH filtering policies at say an ISP or coffee = shop be considered as an enterprise policy? From nobody Tue Jul 16 10:36:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4712B120ACF for ; Tue, 16 Jul 2019 10:36:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r040Zhd8XhDM for ; Tue, 16 Jul 2019 10:36:19 -0700 (PDT) Received: from burnttofu.net (burnttofu.net [IPv6:2607:fc50:1:9d00::9977]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 96804120A6D for ; Tue, 16 Jul 2019 10:36:19 -0700 (PDT) Received: from elwha.brokendns.net (elwha.brokendns.net [IPv6:2607:f2f8:a544:0:0:0:0:2]) by burnttofu.net (8.15.2/8.15.2) with ESMTPS id x6GHaDBI045021 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 16 Jul 2019 13:36:15 -0400 (EDT) (envelope-from michael@brokendns.net) Received: from Michaels-MacBook-Pro.local (50-197-156-42-static.hfc.comcastbusiness.net [50.197.156.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by elwha.brokendns.net (5.65c/IDA-1.4.4/5.63) with ESMTPSA id DAFA45D95B; Tue, 16 Jul 2019 10:36:12 -0700 (PDT) To: Jim Reid Cc: add@ietf.org References: <53A70CFB-4191-41F9-A33E-047E0F092B66@rfc1035.com> From: Michael Sinatra Message-ID: <6cde4bf8-3a64-62fe-cd79-e8af7f2bedb4@brokendns.net> Date: Tue, 16 Jul 2019 10:36:12 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: <53A70CFB-4191-41F9-A33E-047E0F092B66@rfc1035.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.6.2 (burnttofu.net [IPv6:2607:fc50:1:9d00:0:0:0:9977]); Tue, 16 Jul 2019 13:36:18 -0400 (EDT) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 17:36:21 -0000 On 7/16/19 10:25 AM, Jim Reid wrote: > > >> On 16 Jul 2019, at 17:33, Michael Sinatra wrote: >> >> Unless we find ways of making DoH compatible with institutional controls, the banhammer will come down and we will end up in an arguably worse spot (think proxy decryption of all HTTPS, banning of certain browsers, blocking of well-known services, etc.). Personally, I don't want that to happen, but I fear it will if we don't make DoH more flexible by default. > > Obligatory nit-picking: > > What you're actually talking about here is one deployment/application of DoH, not the protocol itself. The basic protocol is fine (pretty much). It's how the protocol gets used that can create problems. DoH doesn't have to or need to become "compatible with institutional controls". It's the applications and services which use DoH might have to do that. > > FWIW, I agree with what you say if "DoH" was replaced with "DoH deployment". Yes, everything I am talking about in this thread is as you say--my intent was "DoH deployment" even though I only said "DoH." Thanks for the opportunity to clarify. The one disagreement I have with DoH as a protocol is that it essentially obfuscates the DNS resolution process, from a network perspective. But that's not under discussion here (and it's basically water under the bridge anyway). michael From nobody Tue Jul 16 10:47:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96D41120BBF for ; Tue, 16 Jul 2019 10:47:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LuAYB65bajzZ for ; Tue, 16 Jul 2019 10:47:08 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1157120BB9 for ; Tue, 16 Jul 2019 10:47:00 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id g20so41277427ioc.12 for ; Tue, 16 Jul 2019 10:47:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=r8QLXzPzIY834fz2GyTcbmfX3tnvxkwaEZpOPT2uRtM=; b=lYyU+bL5p0dMY6IWYhCFNwMR4XhC5CN9FqYT1w1/LwDMrAanfU139ZufOW6Be1wKP0 Uj5+Vy75SPFYnGYQXPnLdlRZsQdxVOXnKgSj9cUCQXhMwjo1QHAnVWSiup8FYSunPu1L qds02Fe6aGXz9mzslbN8q47QHF0+U1RRpds/7roaxmsBie8kmwDhJWDd973NVuZaWW0/ sa5SyjrSgRNTJxqrj9IRnBUCEg353sx/wHz6LQdzMyNPLOBArvw2FmngcO0I0LVlAAsB pXAFUMuxn3xrQySw3yfsS8f+l4pU+nidbsue9COjIbY3EzUCsMTKv4jLjZ/2UiB43d3v wY1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=r8QLXzPzIY834fz2GyTcbmfX3tnvxkwaEZpOPT2uRtM=; b=JEVvHSrBBJ7AZvGeOCT54PN1lN4cCbDiLDnQd5IRhReLz7mCdb8/bpGUypFynb7PVT DuE1B4rKm7eR4GS5jF1QhWpAsfWvk8b08uRo+WMFxZfuZWKhyl5Y0eAhA+lIRCBexnLD WUdVsZeMGbti3L2oiD5K4/xOJduh578VhRKfe+YPRRoYMXKwZE25z16+CGyzlzXHfZkX 8dzsCxoJ8vfCEiCzWGsh2QYHxzkLUiGGuwrczfPgwJRBCdzCan/N9j4zJttyXKL2L/rx oJQDcWyxQNjQWyZxEGRjWnx5OwlHjCPp2UiD6S/G3T6ItIyFVqcUI3AaoDLbACGjPVyF LIng== X-Gm-Message-State: APjAAAVMFyJuJ6olEzpdKx6IyEAYbPoXmA7FyH2nqjUxnKisC0oHqh2I Uu5Twiwd03Ec0yQyoR9ii1tk3y0txD9h8K1CUmM= X-Google-Smtp-Source: APXvYqy+cQqiB/OrrsFGcknmclhWmIdgCUVwy6pPmKPdigBHBYADyXiWUlDWTTyhUJyrI6yMnKLJ4HxgoYusiM6R7EE= X-Received: by 2002:a5e:c00e:: with SMTP id u14mr33550293iol.196.1563299219905; Tue, 16 Jul 2019 10:46:59 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Tue, 16 Jul 2019 10:46:48 -0700 Message-ID: To: Tommy Jensen Cc: Eric Rescorla , "add@ietf.org" , "Dixon, Hugh" , Alec Muffett Content-Type: multipart/alternative; boundary="000000000000ae260c058dcff63a" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 17:47:10 -0000 --000000000000ae260c058dcff63a Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 9:29 AM Tommy Jensen wrote: >> I agree that some companies sell these products, but it doesn't seem like they would work very well. > > Based on what data? The fact that they don't work very well? I actually happen to be a customer of one of the services EKR linked, and I use a VPN to work around their DNS quite often (not for control reasons--I think it just breaks a lot, so I have to). On the other hand, on-device enterprise policies are an effective way to control DNS resolution. thanks, Rob --000000000000ae260c058dcff63a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 16, 2019 at 9:29 AM Tommy Jen= sen <Jensen.Thomas@micros= oft.com> wrote:
>> I agree that some companies sell these p= roducts, but it doesn't seem like they would work very well.
>> Based on what data?

The fact that they don't work very we= ll? I actually happen to be a customer of one of the services EKR linked, a= nd I use a VPN to work around their DNS quite often (not for control reason= s--I think it just breaks a lot, so I have to).

On the other hand, o= n-device enterprise policies are an effective way to control DNS resolution= .

thanks,
Rob

--000000000000ae260c058dcff63a-- From nobody Tue Jul 16 10:56:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4D11120BEA for ; Tue, 16 Jul 2019 10:56:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8JUynBqgkjIe for ; Tue, 16 Jul 2019 10:56:16 -0700 (PDT) Received: from mail-lj1-x233.google.com (mail-lj1-x233.google.com [IPv6:2a00:1450:4864:20::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65E6C120BF1 for ; Tue, 16 Jul 2019 10:55:59 -0700 (PDT) Received: by mail-lj1-x233.google.com with SMTP id v18so20835891ljh.6 for ; Tue, 16 Jul 2019 10:55:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=mgo5ZcT1OjGFoaPzg+DaqdacZKYDDx9krqZ2cXg61EU=; b=JlE7qoTqQDmCSYmKW67t/La+STUoYpaTX3MzrmLNruG6kVWbuBiEj5snW/FwW1PWAA IANJMuY/sHK7N3OI9/v/ipDk3QoPOKbxMADPfCQ/Huz4UJVHpM1so1GANis6O5yHANgI NaJMXo0Cf/rCPzKEUg3aWqrv359VtwqJLsVY+iCSwvjTLHnlLjhPnlF+Is3qAY446vBl xWUlmZaea/yflLHoZfBPD4LyEJ/RJV5WX1n265AWsnt6sV8JgIOpSEOWpN+ebymDtRmK 3YaFNboViu+VViCnNO4Nf1Wd7IIeGKtYSnVc0bKUZYHbx8EGcaXXptRMZZOalEheHkqp LGkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=mgo5ZcT1OjGFoaPzg+DaqdacZKYDDx9krqZ2cXg61EU=; b=o9X6Qfq8+UiD/n+giww4Lfyabr0mD9U0rnJ6KI+IoORBqpfDTfliuXiRuq0LpCSqNf J8njzhFNmS7C8ezpyUDTwCx0NoZ6Z/7GlJeWBgsZPNnHMFos9ufoIn0yQ8JpPM6EFrNN 7vs0daXLGMESZWVK2aNMNNrHkBO5lVV/UpeCr6CHm3/cqqNTjga+PyCW0OdVV5Yadgyh VsJNvgo4/tUDg6PHFTLwEhKTLzCKXVqykIB5uekiE7G4zft4paATS6vXu5ed5lg0URao pRWNOFUG3xAwsqk0EU4/H3IKlLcjrvDJvPYsUYGcgLxXfKyJISlFT/pGuIc4kkhAjgJB 8UlA== X-Gm-Message-State: APjAAAXbfZ3sL0zDfxpwJzITW5e6dXUMk069PPryfIK4AEHLTO6bZHFR M2a3MpSJPJsVp7exBdFovCv+YzSy7PAC8oCk+S0BktUl X-Google-Smtp-Source: APXvYqyFDiV6VjZlk22RFMx1ZruVE5enoykveDHGyYYfIzTGcanKk0zIX2Es6pK0mGEc2yMDIrrh5TSmIvoVqBzhZ9o= X-Received: by 2002:a2e:96d0:: with SMTP id d16mr4439620ljj.14.1563299757496; Tue, 16 Jul 2019 10:55:57 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Tue, 16 Jul 2019 10:55:20 -0700 Message-ID: To: Jim Reid Cc: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000b92f81058dd016ed" Archived-At: Subject: Re: [Add] Firefox DoH behaviour X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 17:56:19 -0000 --000000000000b92f81058dd016ed Content-Type: text/plain; charset="UTF-8" Sorry, this was badly written. Here's an attempt to clarify: if there is an enterprise policy that is set and it configures or enables DoH, then when we will respect that. If there is an enterprise policy set and it says nothing about DoH, then our plan is to disable DoH on the theory that with high probability the enterprise would want DoH off. When I refer to enterprise policy I mean: https://support.mozilla.org/en-US/products/firefox-enterprise/policies-customization-enterprise/policies-overview-enterprise -Ekr On Tue, Jul 16, 2019 at 10:35 AM Jim Reid wrote: > > > > On 16 Jul 2019, at 17:49, Eric Rescorla wrote: > > > > Firefox will disable DoH entirely if an enterprise policy is in place > but it > > doesn't otherwise configure DoH > > Could you provide more clarification? How will Firefox know if an > enterprise policy is in place or what that policy is? If Firefox "doesn't > otherwise configure DoH", does that mean DoH will always be disabled by > default unless the end user deliberately and intentionally switches it on? > Would DNS/DoH filtering policies at say an ISP or coffee shop be considered > as an enterprise policy? > > --000000000000b92f81058dd016ed Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Sorry, this was badly written. Here's an attempt = to clarify:

if there is an enterprise policy that = is set and it configures or enables DoH, then when we will respect that. If= there is an enterprise policy set and it says nothing about DoH, then our = plan is to disable DoH on the theory that with high probability the enterpr= ise would want DoH off.


=
-Ekr


On Tue, Jul 16, 2019 at 10:35 AM Jim Re= id <jim@rfc1035.com> wrote:


> On 16 Jul 2019, at 17:49, Eric Rescorla <ekr@rtfm.com> wrote:
>
> Firefox will disable DoH entirely if an enterprise policy is in place = but it
> doesn't otherwise configure DoH

Could you provide more clarification? How will Firefox know if an enterpris= e policy is in place or what that policy is? If Firefox "doesn't o= therwise configure DoH", does that mean DoH will always be disabled by= default unless the end user deliberately and intentionally switches it on?= Would DNS/DoH filtering policies at say an ISP or coffee shop be considere= d as an enterprise policy?

--000000000000b92f81058dd016ed-- From nobody Tue Jul 16 11:04:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49256120C62 for ; Tue, 16 Jul 2019 11:04:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NLK6YuifxsN1 for ; Tue, 16 Jul 2019 11:04:13 -0700 (PDT) Received: from mail-yw1-xc2c.google.com (mail-yw1-xc2c.google.com [IPv6:2607:f8b0:4864:20::c2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5FEC7120A7F for ; Tue, 16 Jul 2019 11:04:13 -0700 (PDT) Received: by mail-yw1-xc2c.google.com with SMTP id q128so9308612ywc.1 for ; Tue, 16 Jul 2019 11:04:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=X9sFVaIf/UawWG9o4Tay9vcclgVZKjWvr1bESL1ftbo=; b=UMq3qYkvuEr2e3D3J3QSwRJm3olGVzdLs9VM2zc2cKnWdOBk1PnnjapMlz0XLzJmc3 A98xdqTRUJitK0gBTXky8rhClNi/lu+5gA5vUIJM+y+XdoHytYCid7vRVx7ufFJApOnz 610216DSO34a0BR+mW1h/PnNJNV35GP3dtYcOZ1vA7w4WiMVzJkjPqVIbHEbP1eARiz/ ujhbTzOHpokB2kFWgz8dUo8W+jR+PaKBn0GkHUNgvunG18emctEB+MxQX4VFj7cmwUwm ob9Ac0/Mmu56rT+lWSV0pgIkMAez7tMqncQnK5rV5PqGGr96XYT8lTALiDIy0eIhpn0I E1aw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=X9sFVaIf/UawWG9o4Tay9vcclgVZKjWvr1bESL1ftbo=; b=ndnmGlQebawkd+28a9PjWx+msEcfAsJl9XWJaie4FMxpPz0cisq87zGyCH2KH/MHWC zZXN1Ia2KU0t5QhOcf+5iPasS2HtCAKo+qjPtb0glY2zG0J3G5dTz6ADKFeS+e/g3SKn jIb0BWXBrKkU/Phte+S6ZJ9R2QvbEPWXa+VmEiz07txm5PoafN/VIwPImXHS1SlB2UFe fs8cjb5iOepvESuZnc7dgjTK8O6rudICvAkUJsjFlU0Dn5lYnvsMCRoQv230mULLfv66 Hip8UT87sleJLkjUi4S6Z9x9erecbN61FNBBTXNvqJEyaJs7o1lUDNtBAXub4JsjeEpg 98yQ== X-Gm-Message-State: APjAAAXpLlM8HMzWcAC0Le93oHzrViXiEFy6l3/qDt70+5cKQFn7sqWp ld6lHCNcusbonxZDe92egMQd381ma3ZvMl3mdDtAMQ== X-Google-Smtp-Source: APXvYqyNprF8TeQr9cW1MEcmFcrWHOD+jI7APf2jAomqElC1ssav4c+U9EW91zNPyaqUSEI0vFAQup4IvV5t7l26mqw= X-Received: by 2002:a81:a253:: with SMTP id z19mr19533504ywg.13.1563300252265; Tue, 16 Jul 2019 11:04:12 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Alec Muffett Date: Tue, 16 Jul 2019 19:04:02 +0100 Message-ID: To: add@ietf.org Content-Type: multipart/alternative; boundary="00000000000036b25e058dd03487" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 18:04:15 -0000 --00000000000036b25e058dd03487 Content-Type: text/plain; charset="UTF-8" As an aside, I am finding it terribly interesting to consider that any pursuit of "protecting" the user from their installing TorBrowser and using it willy-nilly MUST be client-based... because it is a matter of restricting access to such a browser viewed in its aspect as a chunk of software. Put differently, from the perspective of some of these enterprise controls we are talking about, TorBrowser might be viewed as "malware". Yet: Firefox is literally the foundation of TorBrowser, but somehow when Firefox is resolving DNS addresses via DoH, it suddenly becomes a problem where we are talking about the "necessity" of things which otherwise we dismiss as pervasive monitoring: canary domain names, privacy-busting beacons, and third party enforcement over someone else's ability to connect to their intended destination. Odd, that. -a --00000000000036b25e058dd03487 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
As an aside, I am finding it terribly interesting to cons= ider that any pursuit of "protecting" the user from their install= ing TorBrowser and using it willy-nilly MUST be client-based... because it = is a matter of restricting access to such a browser viewed in its aspect as= a chunk of software.

Put diff= erently, from the perspective of some of these enterprise controls we are t= alking about, TorBrowser might be viewed as "malware".

Yet: Firefox is literally the foun= dation of TorBrowser, but somehow when Firefox is resolving DNS addresses v= ia DoH, it suddenly becomes a problem where we are talking about the "= necessity" of things which otherwise we dismiss as pervasive monitorin= g: canary domain names, privacy-busting beacons, and third party enforcemen= t over someone else's ability to connect to their intended destination.=

Odd, that.

-a

=
--00000000000036b25e058dd03487-- From nobody Tue Jul 16 11:20:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A22F120CC5 for ; Tue, 16 Jul 2019 11:20:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xHGNiRbvFgIp for ; Tue, 16 Jul 2019 11:19:59 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D870120CB8 for ; Tue, 16 Jul 2019 11:19:59 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 09DEC3808A for ; Tue, 16 Jul 2019 14:19:55 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id A9F0CB52 for ; Tue, 16 Jul 2019 14:19:57 -0400 (EDT) From: Michael Richardson To: add@ietf.org In-Reply-To: References: X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 18:20:01 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable > Parental controls and malware detection are usually done on the devic= e. > https://www.apple.com/newsroom/2019/04/the-facts-about-parental-contr= ol-apps/ > https://blog.google/products/chrome/cleaner-safer-web-chrome-cleanup/ I can't speak to parental control systems in general. Only devices locked against the user can implement parental controls in the= device. (In my house, my kid owns his own devices, so controls are implemented in t= he router, and are almost all time-based, not content based) The Cisco "Umbrella" and CIRA "D-Zone Firewall" are two products that I'm a= ware of, which work by denying DNS lookups that result in connections to malware. This is not done in the device. =2D-=20 Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl0uFU0ACgkQgItw+93Q 3WXplwf8DU826Iv27v3PLJsu5Y+VwgdeLEVrGMFEDmyZcZqp3VRWJttrRIlodohN pairTtpSO/RL9xoX3XMWzkhifsK0Oaxfb8mq/mTjxnhacA5uYneq52rr+BaEUD/D Rwnf4HA3M9BH5Hqjf/99j8B+jQIT0VFDuh0rEgug6qqLX8oD1p4Wd4sLlBCyI/jQ UC8bSXtxsWn1961SPA1D3NhLaInQvPxdh9MoCiJZIyqx3yCq2vV34+1LX8dOUk9Z JvL7AbbSjw8gHKmopft/bSQo/kMmev11z/2NBOgORWEunysDNUou/hu8FoukXwXT /2D2MaJ3Kq9dMkhJiXNhxg81Apw0Mg== =rW39 -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Jul 16 11:33:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBEB8120885 for ; Tue, 16 Jul 2019 11:33:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N_E1dM2sldl3 for ; Tue, 16 Jul 2019 11:33:03 -0700 (PDT) Received: from burnttofu.net (burnttofu.net [IPv6:2607:fc50:1:9d00::9977]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9874E120CD5 for ; Tue, 16 Jul 2019 11:33:03 -0700 (PDT) Received: from elwha.brokendns.net (elwha.brokendns.net [206.125.172.202]) by burnttofu.net (8.15.2/8.15.2) with ESMTPS id x6GIWwWp045191 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 16 Jul 2019 14:32:59 -0400 (EDT) (envelope-from michael@brokendns.net) Received: from Michaels-MacBook-Pro.local (50-197-156-42-static.hfc.comcastbusiness.net [50.197.156.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by elwha.brokendns.net (5.65c/IDA-1.4.4/5.63) with ESMTPSA id DD0315D96B; Tue, 16 Jul 2019 11:32:57 -0700 (PDT) To: Alec Muffett , add@ietf.org References: From: Michael Sinatra Message-ID: <734376c2-c7d9-42e2-d26b-d05ce2e1fcbb@brokendns.net> Date: Tue, 16 Jul 2019 11:32:57 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.6.2 (burnttofu.net [162.217.113.18]); Tue, 16 Jul 2019 14:33:00 -0400 (EDT) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 18:33:06 -0000 On 7/16/19 11:04 AM, Alec Muffett wrote: > Yet: Firefox is literally the foundation of TorBrowser, but somehow when > Firefox is resolving DNS addresses via DoH, it suddenly becomes a > problem where we are talking about the "necessity" of things which > otherwise we dismiss as pervasive monitoring: canary domain names, > privacy-busting beacons, and third party enforcement over someone else's > ability to connect to their intended destination. In the case of most enterprise policy enforcement, it's not a third party that's imposing the restrictions, it's the enterprise itself. The enterprise *may* decide to outsource this activity, and it may also be "guided" by a regulatory framework. However, I wouldn't necessarily call that "third party enforcement." As another example, in my home network, I impose DNS filtering restrictions, in conjunction with endpoint management, to restrict the set of destinations that *my software* can contact. I have configured Firefox (for example) to explicitly not use DoH or its TRR list, so that *I* can better control what Firefox does on my network when I am using it. As someone who operates my own resolver on my home network, with QNAME minimization enabled, I am a big supporter of ADoT. DoH (depending on how it is deployed), however, has the potential to complicate my ability to control what my applications do. This is especially the case if applications try to obfuscate or prevent me from disabling their own resolution methods to use mine. Part of my goal in this discussion is therefore to ensure that the applications that *I* use play properly with *my* controls. Finally, since you brought up pervasive monitoring, consider a scenario where I run my own resolver and ADoT is pervasively deployed. Would Firefox sending all of me DNS queries to Cloudflare (a third party, no?) afford me more privacy than what I currently have? michael From nobody Tue Jul 16 11:49:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B67F120DB8 for ; Tue, 16 Jul 2019 11:49:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 86v708GnfhoU for ; Tue, 16 Jul 2019 11:49:48 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1988F120DBC for ; Tue, 16 Jul 2019 11:49:48 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id k8so41731559iot.1 for ; Tue, 16 Jul 2019 11:49:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=BdFDFs1n1jE6xBHJlGy9yD1zv46Y/+H5XyT/B+r3UKw=; b=k8F9dksWMp71w/6iL2/1szeSuv9mQF0e2PE2yerhXNXnBXAPwwsXSopWDeDcdkD63m IQQY7U56JJneSVDHFdLFWs8psQf9uENFduCDPE9aYywCaUtxNCrOmOmsKnj1B92n7DBx eCXPiXGH/bTdxaO1mVwjSdubwzz/fMlZDzUvbUigC4rSLpcru6vfDq4LNfDy8dekkMae Z+Bl6TPT3LuhdbQFVarh0A0dibLyJ9dJMjVxSyiqU15Om9R8V17DGGiL1w1d6R0vs+n0 HFBBu+79PwTDF3nNMvq7lYi+Egb1pnM+bv4I1OzawQXjw6tBnaaN8JIbBQMbz7jF5KO5 JmqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=BdFDFs1n1jE6xBHJlGy9yD1zv46Y/+H5XyT/B+r3UKw=; b=toKwYqdfac/J3Ep+WbRmZRFweX36/kmHk88hIG0UKcPcAF6qXO89wnzbpkrwOiGCJo hUnaYb2coKEDnTpCdcdsXyXH/N+Nx65Uu0j3p+fAL80Iv7fHMFWS1/APyG/nvqmL4+IG o2/0NrhGTl6Dd+nxM/yFBPmVSHe6Z92vUF5KCUk1zDYLBrvVBMhCKL6puDWal9P1J5dX 2lsyHXAaYKmp7s/9Yt3Gyh2vopJ1IHK9y6S3u5pEMYuiQEay6e5Mbr++x27Cm7XTpMxG +jk1Q5mujrOHtYWUP1JOxpnEMKwGPoGXAZHAwd5Z8f+wPIl1YBTpNS/lFGvSJAgNuW6o k9NQ== X-Gm-Message-State: APjAAAXwzS/z19T2JslHq/ZazslISg51oje9J9fTmYF4tpcSkI/NN+gw ONoWDAfsXbv4VFKZICtyLEOMc6LU6LPpUzeynW4= X-Google-Smtp-Source: APXvYqxbQxopXBvMdv/Ndij9S7e455wbYz/7Fb+SOVySTb3yp9edGmH/aeZlVfXiC1T/hmD+eaRmUP5418XG+OJSuK8= X-Received: by 2002:a02:13c3:: with SMTP id 186mr35632214jaz.30.1563302987292; Tue, 16 Jul 2019 11:49:47 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Tue, 16 Jul 2019 11:49:35 -0700 Message-ID: To: Eric Rescorla Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="0000000000003be5ee058dd0d71a" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 18:49:54 -0000 --0000000000003be5ee058dd0d71a Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 10:22 AM Eric Rescorla wrote: > > > On Tue, Jul 16, 2019 at 9:10 AM Rob Sayre wrote: > >> In any case, BCP 188 covers the issue we're describing quite well. >> >> "The same techniques to achieve [Pervasive Monitoring] can be used >> regardless of motivation. Thus, we cannot defend against the most >> nefarious actors while allowing monitoring by other actors no matter how >> benevolent some might consider them to be, since the actions required of >> the attacker are indistinguishable from other attacks." >> >> Pervasive Monitoring Is an Attack >> https://tools.ietf.org/html/rfc7258 >> > > I'm quite familiar with this BCP but given it's emphasis on passive > monitoring and the associated interest in opportunistic security (RFC 7435) > I don't see any conflict here. > I think the conflict is that the BCP states that the perceived benevolence of an application (parental controls, malware blockers, etc) doesn't matter, but that seems to be the case being made here. Aside from that seemingly obvious conflict, it doesn't seem like DNS-based solutions would really work very well for these benevolent applications. It's sort of like using a coffee cup as an umbrella--it will catch some rain, yes. thanks, Rob > > -Ekr > > > >> >> thanks, >> Rob >> >> --0000000000003be5ee058dd0d71a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 10:22 AM Eric= Rescorla <ekr@rtfm.com> wrote:
=


On Tue, Jul 16, 2019 at 9:10 AM Rob Sayre <sayrer@gmail.com> wro= te:
In any case, BCP 188 covers the issue = we're describing quite well.

"The sam= e techniques to achieve [Pervasive Monitoring] can be used regardless of mo= tivation.=C2=A0 Thus, we cannot defend against the most nefarious actors wh= ile allowing monitoring by other actors no matter how benevolent some might= consider them to be, since the actions required of the attacker are indist= inguishable from other attacks."

Pervasive Mo= nitoring Is an Attack

I'm quite familiar with this = BCP but given it's emphasis on passive monitoring and the associated in= terest in opportunistic security (RFC 7435) I don't see any conflict he= re.

I think the confl= ict is that the BCP states that the perceived benevolence of an application= (parental controls, malware blockers, etc) doesn't matter, but that se= ems to be the case being made here.

Aside from tha= t seemingly obvious conflict, it doesn't seem like DNS-based solutions = would really work very well for these benevolent applications. It's sor= t of like using a coffee cup as an umbrella--it will catch some rain, yes.<= /div>

thanks,
Rob

=C2= =A0

-Ekr
<= br>

<= div dir=3D"ltr">


thanks,
Rob

--0000000000003be5ee058dd0d71a-- From nobody Tue Jul 16 11:55:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86EE1120D93 for ; Tue, 16 Jul 2019 11:55:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SumZq7WTgT_C for ; Tue, 16 Jul 2019 11:55:05 -0700 (PDT) Received: from mail-io1-xd42.google.com (mail-io1-xd42.google.com [IPv6:2607:f8b0:4864:20::d42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D065120D91 for ; Tue, 16 Jul 2019 11:55:05 -0700 (PDT) Received: by mail-io1-xd42.google.com with SMTP id q22so41674394iog.4 for ; Tue, 16 Jul 2019 11:55:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hJgIExKHbB95uNNHdDOsXPuN0gcoWnrRYKl7pcXhGDg=; b=JkWxQWmFmrlLFGvambg2xl0sODbu4WRZn/KRd62IaSxAoJVdya58qQFUmobBJGnm1v qAawfAJWmyLUrb4lOtoHrwytjGbzk+BH0LCv7KFyWFx2loTp6uaYfv97wrPnagrVc2e8 GRnYgbnIlR7U1zQ7rMWtzHpdW1EycCzi/sUyYh9SBDUxTD7IklwxxVYpc2d9QlamQO2d WfcOIDIemB5d+x6keHH+YtNpqb65EcKKV3oD71MglCTdyOkvUy4gterilf+EvUWCBcd5 m0E0WcXKaHCUZElZDu/3gzb9P/aN9Dmdeg7YH7jQCkny7BsL95PoBOPLRim7h0SZSn2o TAWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hJgIExKHbB95uNNHdDOsXPuN0gcoWnrRYKl7pcXhGDg=; b=RhE9KRiZ0xB2vwpCCPHWtIe373Hph1yfOmuqLP+AzcX+Np5ndB2j0er1tjje96oaRy eIQdBeJ/reBnN7KYIgUjIk8+IkdWLxtyiMkP/E83zLsDrUijlZ8n0WDPjSB/i6BwoYiw P7bUuHU7yidExFoN+waoRqpoiJ3a3yjGqW40HrvkhseOeP270dcz54fk4xp7ladH/JE+ nS6GPlrQb3pYNcvQnTbr9A+kNXdQ98v1Vu8zlj20FCNvATl4u8z/RIFsu7V8WEWDzcPN tyY6dzRE/LoL8oo4Y63cAOW8Pq3eLnlOGRdAUAF7ZYo4d2QA6K/DdLse4+sP0y8/D6rC DP5w== X-Gm-Message-State: APjAAAXHlbVvuCIna8tBVATaaxO7pxAObXK4CwxLyxkYTC/anldtBQzg dYmEAwFKswlU68DzezGApZeUpWaLM1T/6OQAfPE= X-Google-Smtp-Source: APXvYqwgabSXBoDtClcG4HBr7BJ0RYKO0TbeQCxbewSNtpCp/81gLzeXHsKnIZaGpjDTwWdp9/UZmTEkM7XPAKY7vBE= X-Received: by 2002:a5e:9515:: with SMTP id r21mr32480683ioj.257.1563303304254; Tue, 16 Jul 2019 11:55:04 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Tue, 16 Jul 2019 11:54:52 -0700 Message-ID: To: Eric Rescorla Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="000000000000205c1f058dd0eaf5" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 18:55:08 -0000 --000000000000205c1f058dd0eaf5 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 11:49 AM Rob Sayre wrote: > > > On Tue, Jul 16, 2019 at 10:22 AM Eric Rescorla wrote: > >> >> >> On Tue, Jul 16, 2019 at 9:10 AM Rob Sayre wrote: >> >>> In any case, BCP 188 covers the issue we're describing quite well. >>> >>> "The same techniques to achieve [Pervasive Monitoring] can be used >>> regardless of motivation. Thus, we cannot defend against the most >>> nefarious actors while allowing monitoring by other actors no matter how >>> benevolent some might consider them to be, since the actions required of >>> the attacker are indistinguishable from other attacks." >>> >>> Pervasive Monitoring Is an Attack >>> https://tools.ietf.org/html/rfc7258 >>> >> >> I'm quite familiar with this BCP but given it's emphasis on passive >> monitoring and the associated interest in opportunistic security (RFC 7435) >> I don't see any conflict here. >> > > I think the conflict is that the BCP states that the perceived benevolence > of an application (parental controls, malware blockers, etc) doesn't > matter, but that seems to be the case being made here. > > Aside from that seemingly obvious conflict, it doesn't seem like DNS-based > solutions would really work very well for these benevolent applications. > It's sort of like using a coffee cup as an umbrella--it will catch some > rain, yes. > Oh, also, RFC 7435 is Informational, while RFC 7258 is a BCP. BCPs are the documents that describe what the IETF is supposed to be doing, right? thanks, Rob > > thanks, > Rob > > > >> >> -Ekr >> >> >> >>> >>> thanks, >>> Rob >>> >>> --000000000000205c1f058dd0eaf5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 11:49 AM Rob = Sayre <sayrer@gmail.com> wrot= e:


On Tue, Jul 16, 2019 at 10:22 AM Eric Rescorla <= ;ekr@rtfm.com> wro= te:


On Tue, Jul 16, 2019 at 9:10 AM Rob Sayre <sayrer@gmail.com>= wrote:
In any case, BCP 188 covers the is= sue we're describing quite well.

"The= same techniques to achieve [Pervasive Monitoring] can be used regardless o= f motivation.=C2=A0 Thus, we cannot defend against the most nefarious actor= s while allowing monitoring by other actors no matter how benevolent some m= ight consider them to be, since the actions required of the attacker are in= distinguishable from other attacks."

Pervasiv= e Monitoring Is an Attack

I'm quite familiar with t= his BCP but given it's emphasis on passive monitoring and the associate= d interest in opportunistic security (RFC 7435) I don't see any conflic= t here.

I think the c= onflict is that the BCP states that the perceived benevolence of an applica= tion (parental controls, malware blockers, etc) doesn't matter, but tha= t seems to be the case being made here.

Aside from= that seemingly obvious conflict, it doesn't seem like DNS-based soluti= ons would really work very well for these benevolent applications. It's= sort of like using a coffee cup as an umbrella--it will catch some rain, y= es.

Oh, also, RFC 7435 is= Informational, while RFC 7258 is a BCP. BCPs are the documents that descri= be what the IETF is supposed to be doing, right?

t= hanks,
Rob
=C2=A0

thanks,
Rob

=C2=A0

-Ekr


=


thanks,
Rob

--000000000000205c1f058dd0eaf5-- From nobody Tue Jul 16 11:56:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 091AB1200E0 for ; Tue, 16 Jul 2019 11:56:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lujQ3ZX2JdfE for ; Tue, 16 Jul 2019 11:56:33 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B8B1120071 for ; Tue, 16 Jul 2019 11:56:33 -0700 (PDT) Received: from pps.filterd (m0049465.ppops.net [127.0.0.1]) by mx0b-00176a04.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x6GIqsUp002058 for ; Tue, 16 Jul 2019 14:56:32 -0400 Received: from usushmgip002.mail.tfayd.com ([216.178.109.236]) by mx0b-00176a04.pphosted.com with ESMTP id 2tqajfehm4-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Tue, 16 Jul 2019 14:56:31 -0400 Received: from unknown (HELO potemwp00048.mail.tfayd.com) ([10.40.33.204]) by usushmgip002.mail.tfayd.com with ESMTP; 16 Jul 2019 11:56:30 -0700 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00025.mail.tfayd.com (100.124.56.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Tue, 16 Jul 2019 12:56:29 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Tue, 16 Jul 2019 12:56:29 -0600 From: "Deen, Glenn (NBCUniversal)" To: Eric Rescorla CC: Jim Reid , "add@ietf.org" Thread-Topic: [EXTERNAL] Re: [Add] Firefox DoH behaviour Thread-Index: AQHVO//NilnU2/FvgU2eegw5EZ0O4qbNmFqX Date: Tue, 16 Jul 2019 18:56:29 +0000 Message-ID: References: , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: multipart/alternative; boundary="_000_C587AEA7E9EF42D795D6CAD416F1BF56nbcunicom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-16_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1907160231 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Firefox DoH behaviour X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 18:56:36 -0000 --_000_C587AEA7E9EF42D795D6CAD416F1BF56nbcunicom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi On Jul 16, 2019, at 1:56 PM, Eric Rescorla > wrote: Sorry, this was badly written. Here's an attempt to clarify: if there is an enterprise policy that is set and it configures or enables D= oH, then when we will respect that. If there is an enterprise policy set an= d it says nothing about DoH, then our plan is to disable DoH on the theory = that with high probability the enterprise would want DoH off. When I refer to enterprise policy I mean: https://support.mozilla.org/en-US= /products/firefox-enterprise/policies-customization-enterprise/policies-ove= rview-enterprise Just so I understand, this looks like it only applies to enterprise managed= desktops, or to PCs enrolled in a managed AD environment. Is there a general means for the enterprise to communicate it's policy for = any Firefox instance that runs in its network? -Glenn --_000_C587AEA7E9EF42D795D6CAD416F1BF56nbcunicom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Hi

On Jul 16, 2019, at 1:56 PM, Eric Rescorla <ekr@rtfm.com> wrote:

Sorry, this was badly written. Here's an attempt to clarify:

if there is an enterprise policy that is set and it configures or enab= les DoH, then when we will respect that. If there is an enterprise policy s= et and it says nothing about DoH, then our plan is to disable DoH on the th= eory that with high probability the enterprise would want DoH off.


Just so I understand, this looks like it only applies to enterprise managed= desktops, or to PCs enrolled in a managed AD environment.

Is there a general means for the enterprise to communicate it’s = policy for any Firefox instance that runs in its network?

-Glenn 
--_000_C587AEA7E9EF42D795D6CAD416F1BF56nbcunicom_-- From nobody Tue Jul 16 12:02:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B6D9120CFD for ; Tue, 16 Jul 2019 12:02:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 14lYzytjX0bE for ; Tue, 16 Jul 2019 12:02:19 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF0D9120778 for ; Tue, 16 Jul 2019 12:02:19 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id 89519374009B; Tue, 16 Jul 2019 12:02:19 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id 5DEF4156CDF0; Tue, 16 Jul 2019 13:02:19 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 5CB36156CDEF; Tue, 16 Jul 2019 13:02:19 -0600 (MDT) From: Paul Ebersman To: Rob Sayre cc: Eric Rescorla , add@ietf.org, "Dixon, Hugh" , Alec Muffett In-reply-to: References: Comments: In-reply-to Rob Sayre message dated "Tue, 16 Jul 2019 11:49:35 -0700." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <45414.1563303739.1@fafnir.local> Date: Tue, 16 Jul 2019 13:02:19 -0600 Message-Id: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 19:02:26 -0000 sayrer> I think the conflict is that the BCP states that the perceived sayrer> benevolence of an application (parental controls, malware sayrer> blockers, etc) doesn't matter, but that seems to be the case sayrer> being made here. The point is that the perceived benevolence doesn't matter if there was no user choice. The use case of parental blocking or enterprise security policies is made with user choice and cooperation so this BCP isn't relevant to those use cases. sayrer> Aside from that seemingly obvious conflict, it doesn't seem like sayrer> DNS-based solutions would really work very well for these sayrer> benevolent applications. It's sort of like using a coffee cup as sayrer> an umbrella--it will catch some rain, yes. Please stop saying this. Your own personal dissatisfaction is at odds with literally millions of homes using these parental blocks via DNS and most of the fortune 500 and many other SMBs using DNS RPZ/firewall. Both parental and enterprise use are long standing, effective and popular. Let's move on, please. From nobody Tue Jul 16 12:10:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4245B1201E3 for ; Tue, 16 Jul 2019 12:10:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OTTGrVjN186b for ; Tue, 16 Jul 2019 12:10:55 -0700 (PDT) Received: from mail-io1-xd43.google.com (mail-io1-xd43.google.com [IPv6:2607:f8b0:4864:20::d43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7879B1201D8 for ; Tue, 16 Jul 2019 12:10:55 -0700 (PDT) Received: by mail-io1-xd43.google.com with SMTP id i10so41672494iol.13 for ; Tue, 16 Jul 2019 12:10:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cqjBGUfTqNlw1oJa0XUn0WrlBAr6FeoPFABCrLk8Ap0=; b=NxexvnubSdZ0D/tbzvgy8iljnmNLiMLnvBDUuKzDKlyt6eZE6xAUoyHqPsuPojrk71 MmNB57h1TwGlNsbp+coC/01y8L0L7UgyAvtr4avnD5n+JnzAHbAXKOk9UCocCGqP25Ff I3qg8r3QCc2T6cHVTgDm/okkWlkTY5QFSFDk5l573An5iS+Pf8HW1RfaisoC5uSbuhY0 5DzmlMsaxHOeCtsMkAHNwK23vsf2x5qvGC3bgRogkYck8z/8ELrajP6BjWwo+XCHeavQ LdLpe+f5zcS11/oYtuCjS97KIrHpn5O2TC/6s7Neks9gaz2iuo42w0cfDCq9nkFcTn8h 9iew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cqjBGUfTqNlw1oJa0XUn0WrlBAr6FeoPFABCrLk8Ap0=; b=MPAgz+hKGHvm6WduRzGsLwmquJhQUGgcP5Vj6YnWPmli3N8YH7NGGTH1CSbF4zGRRP sObp4HcLZx/XwhIADkgxIMfVCuvAlDPbNypiYKFfXCYW2a2Be8yDJ2L38Ol7CQnVuL6P aNaIpnCOt/4EMb1wFMtfWWUXaHLMM2qn0h/bfJGuhnOIbmwNl4fZpHIJXMnDLQgtIOQx Zqi53a/lzLD5l11irykLFtH167vo+JGcd6gi9QHyGxtAyxP47jaCoeAYzYnpX0NWCQ4D P7bfCouWNHNo4YPm70ilac7M1EVZt8orpSWXRV/TQgbhHJEQA21x90Qy55wHvdZTBRpv 1TlA== X-Gm-Message-State: APjAAAXEa8QjXERgM0z32/PUOoAASPiM4hXsiyLlFKXulNcP1QKau1fa Py+UtaM+lxiGo7MsDsIWzA5kKxugx5pkkgfcCJU= X-Google-Smtp-Source: APXvYqwIuiNdBdZctE+QizgTr0MwnRCaPppGtx8mA5RY+xp3aKD6ssEKZyemmBgg1t68F/EY3W0EDWokJWaLBwbEbPA= X-Received: by 2002:a02:2245:: with SMTP id o66mr5465509jao.53.1563304254725; Tue, 16 Jul 2019 12:10:54 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> In-Reply-To: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> From: Rob Sayre Date: Tue, 16 Jul 2019 12:10:43 -0700 Message-ID: To: Paul Ebersman Cc: Eric Rescorla , add@ietf.org, "Dixon, Hugh" , Alec Muffett Content-Type: multipart/alternative; boundary="000000000000c76300058dd12210" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 19:10:57 -0000 --000000000000c76300058dd12210 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 12:02 PM Paul Ebersman wrote: > Please stop saying this. Your own personal dissatisfaction is at odds > with literally millions of homes using these parental blocks via DNS and > most of the fortune 500 and many other SMBs using DNS RPZ/firewall. Both > parental and enterprise use are long standing, effective and popular. > I don't dispute that people sell them, but I do dispute that they work well. Whenever encryption is introduced to a protocol, there will be some middlebox vendors that get disintermediated. thanks, Rob --000000000000c76300058dd12210 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 16, 2019 at 12:02 PM Paul Ebe= rsman <list-add@dragon.net>= ; wrote:
Please stop saying this. Your own personal dissatisfaction is at odds
with literally millions of homes using these parental blocks via DNS and most of the fortune 500 and many other SMBs using DNS RPZ/firewall. Both parental and enterprise use are long standing, effective and popular.

I don't dispute that people sell them, b= ut I do dispute that they work well.

Whenever encr= yption is introduced to a protocol, there will be some middlebox vendors th= at get disintermediated.

thanks,
Rob=C2= =A0
--000000000000c76300058dd12210-- From nobody Tue Jul 16 12:19:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 123541200FD for ; Tue, 16 Jul 2019 12:19:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 64KzbRNtZp2x for ; Tue, 16 Jul 2019 12:19:53 -0700 (PDT) Received: from mail-io1-xd43.google.com (mail-io1-xd43.google.com [IPv6:2607:f8b0:4864:20::d43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9771F120047 for ; Tue, 16 Jul 2019 12:19:53 -0700 (PDT) Received: by mail-io1-xd43.google.com with SMTP id e20so11465597iob.9 for ; Tue, 16 Jul 2019 12:19:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=wlsLcm1A7n0BSPrNrxRlbPV4O0LpVS4JOWyF3FEnS1s=; b=sqR5QwRzbLarV9derngX1dYpbOvfXOg8Rm6I7S0FILSjGZdD1wI1Bm36C72p+rJfA6 RSJbBbI2sAXRyI9NLMsbHPgZu7H9YQSkIVldwnlIe6SEEtHeO7VNlE0hW3HQUpvyHSxF ahd9LBIG+FR50r2M/CdYGnv/W7WVpdZKmJoob8W7VI6GelZeNWhT6tL6JRY/Oz2szpHm 1XDdnte20AjvLZRd7YfFMcDMcMbGy6MqYPg0gI1YabbzZ17tEDYDeE+Z42SIEtjsFq8p 0nkrX43l7n34mu8hS45RhjYLQZEJPjJEhUI12hoN24J8ilh97BVn7ofVb5zOB85ao+rZ 0TgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=wlsLcm1A7n0BSPrNrxRlbPV4O0LpVS4JOWyF3FEnS1s=; b=fXF+kyxCLWGDKaPOI//s2dT6aN5JsqIkqAhrQF/zLf3Pt36glx6Q/CsRw8+GXG+6cy fjidrrcBYf1cEKVg/K9ubsinahewE97/aA5e1EyOSs2Wkw9yHdmN301SCPap1m5X1vv2 1WS5DFvhWrRrbIbPrHc1gw26QaLxUXUFCBmnyLvo9LvB0kbq1JIbRbKnDK6cPe828Nu8 p18CDXrASDQtF/gjbENbxmrjq7xyOdCEmodzXJKEVuAQmSZye00J00VhYsJQiODY0Q/w dqPY09zK7qhcS9ijArQFW8PaNTP00uIqxltd2j/wJaaVTHp9Lc4ec7C0nnrTIDKeSPe2 89jw== X-Gm-Message-State: APjAAAUlmp5HOhOKwHXUwPHOqTU27VBTB8cXI7D8xvicoAJzPvAusY7z n+ev2WErv1AdVxxw4XRg61VViMmkxg4fmYG/wKs= X-Google-Smtp-Source: APXvYqwJgpYjnE2Qk790l6zzK0wL0ksJ7lZN90aMvAk+gnXSCEwPBoEXMT1kvmGW4UwPGek/TQXJviTP0CBA9SAJFWY= X-Received: by 2002:a5e:d618:: with SMTP id w24mr32565955iom.73.1563304792880; Tue, 16 Jul 2019 12:19:52 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> In-Reply-To: From: Rob Sayre Date: Tue, 16 Jul 2019 12:19:41 -0700 Message-ID: To: Paul Ebersman Cc: Eric Rescorla , add@ietf.org, "Dixon, Hugh" , Alec Muffett Content-Type: multipart/alternative; boundary="000000000000dafff7058dd142c4" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 19:19:55 -0000 --000000000000dafff7058dd142c4 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 12:10 PM Rob Sayre wrote: > On Tue, Jul 16, 2019 at 12:02 PM Paul Ebersman > wrote: > >> Please stop saying this. Your own personal dissatisfaction is at odds >> with literally millions of homes using these parental blocks via DNS and >> most of the fortune 500 and many other SMBs using DNS RPZ/firewall. Both >> parental and enterprise use are long standing, effective and popular. >> > > I don't dispute that people sell them, but I do dispute that they work > well. > > Whenever encryption is introduced to a protocol, there will be some > middlebox vendors that get disintermediated. > So, to bring a little data to the table, two of the top 100 grossing US iPhone apps are VPNs (Norton Secure VPN - WiFi Proxy, HotspotShield VPN & Wifi Proxy). I haven't used either one, but they are easily installed through the app store and integrated into the iOS network settings app. These would bypass any DNS-based filter policy. You don't need to be hacker to install this stuff, and their position on the grossing charts seems to indicated that they are effective (otherwise people would not pay). thanks, Rob --000000000000dafff7058dd142c4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 12:10 PM Rob = Sayre <sayrer@gmail.com> wrot= e:

<= div>So, to bring a little data to the table, two of the top 100 grossing US= iPhone apps are VPNs (Norton Secure VPN - WiFi Proxy,=C2=A0HotspotShield V= PN & Wifi Proxy).



thanks,

--000000000000dafff7058dd142c4-- From nobody Tue Jul 16 12:23:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62B62120018 for ; Tue, 16 Jul 2019 12:23:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ReU7cZojfHOc for ; Tue, 16 Jul 2019 12:23:29 -0700 (PDT) Received: from mail-lf1-x134.google.com (mail-lf1-x134.google.com [IPv6:2a00:1450:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9E70B1200E6 for ; Tue, 16 Jul 2019 12:23:28 -0700 (PDT) Received: by mail-lf1-x134.google.com with SMTP id c9so14555903lfh.4 for ; Tue, 16 Jul 2019 12:23:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=pxU/NwpY5iHpx95qjGNF0Yv48wnwRnS/g85QT7Dtu2Y=; b=vFO6KUQYIjv94k8rKZ9Ld9nuheUAbFUspYAr7x5xDveeDyoC86X9fOt6qeGp3ijAY1 HrB/c7Tta4n1/20hVwixMj9gyBCg9utcMYb5JcF0ernd6VnU5dbKM4rWt0i/RlMVBj/N vqfsOQ6Lolvr54d9w/CtdtjtmY1B6Nc5Y6gifKWakC+0eaSWhCJ/xZq9uMppqQsdOavE DU4uoNCCVB/rfTltourlnA4bkzmII1w1lbvNG7J7rBsCclV85NIt67JuhHlZGz26ijOM /8WV1bQtMxc8bg1zJmCZVLopfTslqtwzbxqVgWa31Vv8BjV6Te33iXfJNjWPDWFH2nTZ tO+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=pxU/NwpY5iHpx95qjGNF0Yv48wnwRnS/g85QT7Dtu2Y=; b=iCksBC++exz/ErKyAarI4pkKCzx8hVcRnEg4DRn+34U8rg6//gU6WJMIcCc3jGJiU8 H6hIibpESn1xRb6YLd7LdjA6aGF9vyFfoEttTHukkIKOYpGX0XlrpIkb9hM7XopO/3bY AvCVrvr7pf9CWwAdQdIiVXC1C8EZXk1ZMcsb4EU9daPVvUwDrmYe2IlU2S90AkIR169p /rJRnzSsIVcDGgwTzWa0yaDDqiIU+MNazovlIA583bSn0VeYOBfopZJFl+V7OJEQtUCB aXUNMlopm6FCzzA3ySWAps/QYXSmaQkmb9y+SM5BMG1+KOTnM/1xSc02RT6Mu1m1h3nX B4bg== X-Gm-Message-State: APjAAAUA7N1RJwbwgZvtlTvKSwiTiuQuxyAEDi4Oy7OOxPYQ8jv41GkU z8tBnHv9e4KV94KPNpds9PnqQfLvK/yq18h9i6Q= X-Google-Smtp-Source: APXvYqzCIi106vRPqB82hILaZ34X0iStrQDw5GXtKDi+rnUxdKZvPD2xcg5jf9kxZ0ZwobSYbaUrYwql0ocLzKsFkQY= X-Received: by 2002:ac2:51a3:: with SMTP id f3mr14906730lfk.94.1563305006685; Tue, 16 Jul 2019 12:23:26 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Tue, 16 Jul 2019 12:22:49 -0700 Message-ID: To: "Deen, Glenn (NBCUniversal)" Cc: Jim Reid , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000997867058dd14fb6" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Firefox DoH behaviour X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 19:23:31 -0000 --000000000000997867058dd14fb6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 16, 2019 at 11:56 AM Deen, Glenn (NBCUniversal) < Glenn.Deen@nbcuni.com> wrote: > Hi > > On Jul 16, 2019, at 1:56 PM, Eric Rescorla wrote: > > Sorry, this was badly written. Here's an attempt to clarify: > > if there is an enterprise policy that is set and it configures or enables > DoH, then when we will respect that. If there is an enterprise policy set > and it says nothing about DoH, then our plan is to disable DoH on the > theory that with high probability the enterprise would want DoH off. > > When I refer to enterprise policy I mean: > https://support.mozilla.org/en-US/products/firefox-enterprise/policies-cu= stomization-enterprise/policies-overview-enterprise > > > Just so I understand, this looks like it only applies to enterprise > managed desktops, or to PCs enrolled in a managed AD environment. > Yes. > Is there a general means for the enterprise to communicate it=E2=80=99s p= olicy for > any Firefox instance that runs in its network? > Not at present. https://tools.ietf.org/html/draft-grover-add-policy-detection-00 is an exploration of one possible avenue, but as has been discussed somewhat extensively, it's not a secure signal, so we're not sure how useful it is. -Ekr --000000000000997867058dd14fb6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 11:56 AM Deen= , Glenn (NBCUniversal) <Glenn.D= een@nbcuni.com> wrote:
Hi

On Jul 16, 2019, at 1:56 PM, Eric Rescorla <ekr@rtfm.com> wrote:

Sorry, this was badly written. Here's an attempt to clarify:

if there is an enterprise policy that is set and it configures or enab= les DoH, then when we will respect that. If there is an enterprise policy s= et and it says nothing about DoH, then our plan is to disable DoH on the th= eory that with high probability the enterprise would want DoH off.


Just so I understand, this looks like it only applies to enterprise managed= desktops, or to PCs enrolled in a managed AD environment.

Yes.


Is there a general means for the enterprise to communicate it=E2=80=99= s policy for any Firefox instance that runs in its network?

Not at present. https://tools.ietf= .org/html/draft-grover-add-policy-detection-00 is an exploration of one= possible avenue, but as has been discussed somewhat extensively, it's = not a secure signal, so we're not sure how useful it is.

=
-Ekr

--000000000000997867058dd14fb6-- From nobody Tue Jul 16 12:25:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1CB0B120041 for ; Tue, 16 Jul 2019 12:25:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=g001.emailsrvr.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qD3gObGCRq0O for ; Tue, 16 Jul 2019 12:25:16 -0700 (PDT) Received: from smtp121.iad3a.emailsrvr.com (smtp121.iad3a.emailsrvr.com [173.203.187.121]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 99359120018 for ; Tue, 16 Jul 2019 12:25:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=g001.emailsrvr.com; s=20190322-9u7zjiwi; t=1563305115; bh=EoDasrmZd9rhzWdRn1nU3m3ZQRbTQ9RFeeM3wNn9/Wo=; h=From:Subject:Date:To:From; b=Wp6UXoEP2imEWlnmEU5K7dPBb9FB7dhfWjcjeRPaf+X41wRR/zQRbVI8feijiAPQw 6nv/tIZbRRolfu1faTz9J08PXUqWMV3H4pdy9Au/BnCeGSnWSGB5bGe6cUgysUUnrf iQmaULhDf+GdIDosPLpb+vEYQiezjlQg2ij901EU= X-Auth-ID: bgreene@senki.org Received: by smtp16.relay.iad3a.emailsrvr.com (Authenticated sender: bgreene-AT-senki.org) with ESMTPSA id 060D85E07; Tue, 16 Jul 2019 15:25:14 -0400 (EDT) X-Sender-Id: bgreene@senki.org Received: from [10.0.0.244] (c-73-15-67-108.hsd1.ca.comcast.net [73.15.67.108]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384) by 0.0.0.0:587 (trex/5.7.12); Tue, 16 Jul 2019 15:25:15 -0400 From: Barry Greene Message-Id: <8E19A827-337C-473E-9458-378BD1E25411@senki.org> Content-Type: multipart/signed; boundary="Apple-Mail=_24750C32-8A4B-4C8B-BD80-14ABFA4F501A"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 16 Jul 2019 12:25:11 -0700 In-Reply-To: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> Cc: Rob Sayre , Eric Rescorla , add@ietf.org, "Dixon, Hugh" , Alec Muffett To: Paul Ebersman References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 19:25:18 -0000 --Apple-Mail=_24750C32-8A4B-4C8B-BD80-14ABFA4F501A Content-Type: multipart/alternative; boundary="Apple-Mail=_DD3074F5-5F03-4ADE-892A-3B5F21C87D65" --Apple-Mail=_DD3074F5-5F03-4ADE-892A-3B5F21C87D65 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii > On Jul 16, 2019, at 12:02 PM, Paul Ebersman wrote: > > Please stop saying this. Your own personal dissatisfaction is at odds > with literally millions of homes using these parental blocks via DNS and > most of the fortune 500 and many other SMBs using DNS RPZ/firewall. Both > parental and enterprise use are long standing, effective and popular. > > Let's move on, please. +1 --Apple-Mail=_DD3074F5-5F03-4ADE-892A-3B5F21C87D65 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii

On Jul 16, 2019, at 12:02 PM, Paul Ebersman <list-add@dragon.net>= wrote:

Please stop saying this. Your = own personal dissatisfaction is at odds
with literally millions of homes using these parental blocks = via DNS and
most of the = fortune 500 and many other SMBs using DNS RPZ/firewall. Both
parental and enterprise use are = long standing, effective and popular.

Let's move on, please.

+1
= --Apple-Mail=_DD3074F5-5F03-4ADE-892A-3B5F21C87D65-- --Apple-Mail=_24750C32-8A4B-4C8B-BD80-14ABFA4F501A Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEdoGA/YBcwd1ud+j1VW6TcBa/RfMFAl0uJJcACgkQVW6TcBa/ RfNsdgf/VNiU4WzuMmqegm0g5jcouM76n3/woGUrNCMGNKwvwDM6qBoKlwP29HYP CtA+QmdFCB0LZ+KiG7HLIvPSK4CU9NY2RJ7fWuGnLAj5nUPay32C+CipYTeXS9+W JhmQlLOOOuM7HDHzR4FRfY2PyWgoDVAr86vMHVwAXO9uu2hUZsHsjjB/TaJ9QGRP A/rdcTTAW/53jXWo6E9vS9aG+35098nYHX3ql8oHVPACKevhI89gjLspTjKMdEK6 HyWsCijfv1NFH57HZdN64CQpUKJT066jKXxgMBmnyE5o3hBvUtOEVulIoTZYmuHW VecCOtY030CiolxUoJ0ASNDCzUwYlg== =mqWg -----END PGP SIGNATURE----- --Apple-Mail=_24750C32-8A4B-4C8B-BD80-14ABFA4F501A-- From nobody Tue Jul 16 12:28:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E0E912012E for ; Tue, 16 Jul 2019 12:28:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RxpZAtkYtSEW for ; Tue, 16 Jul 2019 12:28:51 -0700 (PDT) Received: from mail-lf1-x134.google.com (mail-lf1-x134.google.com [IPv6:2a00:1450:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14858120041 for ; Tue, 16 Jul 2019 12:28:51 -0700 (PDT) Received: by mail-lf1-x134.google.com with SMTP id x3so14652152lfc.0 for ; Tue, 16 Jul 2019 12:28:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=VBAJJOmho1vuotjOd2eqkVqrfvYiuQU+TcUnH8FZIXw=; b=vFah6Qbc3OUgyjn673vQ75wAGPe80CfX1vpRm5BEswMfWyOeEZUIbz67QSLW9FY0UI +sgvBw07iiprpEO+TGoYmK1eQw0f4MsRoae83dMe3ePYYicW43nmSKpjF+n9+5/orKN/ lnyqv/YD+kGQYPMYae7K17bdqm83IVhsxPNk3MUhm97BLcyfofup46QLhh29wwZtiyb+ BD+po0OFEOn8pvFSdb108QZFJUgE5KWR5lAQaokBt368IrayB8RmfnsoFjoNwE8VFKfD DPjmsDc73/vaxwrr6NpCb+xRAw7cm6FdZgC1NnsJrKypvO5C1mQ1bE2zdEzAX7GfDxNF 5HxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=VBAJJOmho1vuotjOd2eqkVqrfvYiuQU+TcUnH8FZIXw=; b=jyJQkvq3SiZbNH6LRK8100AvhIiOiStMqro0I9K0OSwt8m4TGaKriyb7mts8Ioz3S+ fm6+5+uQuCFnzo5swowJxAx0UmuieE3SpaIo3JpPo6h2lA7y6Ca5c2heW8EmNlXYr/G7 fCqPSzEve+D87lLbcH0DTHVHso7vV65PAarEu5Fh6o+wn5io86/3/sA3xuntJ2+vAyvi 0QMJw0ywmF33t3s5JdSouBCe1MAU8baYN0jwaERw4hENyz+vuyXbt2FojjFiKp7/UYlL HWJPJlnooelQqBMVWxiu2ozPt4KzghNAtZiqE2LzHlzVG1wDDqwTJAsapAJW8IvSeeh9 a7wA== X-Gm-Message-State: APjAAAWimWeto9oqC3fGgPda0UU9mHjLJrO7VIeQ/za/vR0nnaZt/sSz OimbctrWRr/exCgHANiGMtT9ctDQlO8KBex19QI= X-Google-Smtp-Source: APXvYqxK59a+ZcROqPYvVUEHsbv1/R/n/E7RvwkOUvP7e5sCWVXDhTFuJLDGSk442PAzrZ8zov7JJJW90XPkuxPVyEQ= X-Received: by 2002:ac2:51a3:: with SMTP id f3mr14917564lfk.94.1563305329345; Tue, 16 Jul 2019 12:28:49 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Tue, 16 Jul 2019 12:28:13 -0700 Message-ID: To: Rob Sayre Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="000000000000d4d3ab058dd16251" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 19:28:53 -0000 --000000000000d4d3ab058dd16251 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 11:49 AM Rob Sayre wrote: > > > On Tue, Jul 16, 2019 at 10:22 AM Eric Rescorla wrote: > >> >> >> On Tue, Jul 16, 2019 at 9:10 AM Rob Sayre wrote: >> >>> In any case, BCP 188 covers the issue we're describing quite well. >>> >>> "The same techniques to achieve [Pervasive Monitoring] can be used >>> regardless of motivation. Thus, we cannot defend against the most >>> nefarious actors while allowing monitoring by other actors no matter how >>> benevolent some might consider them to be, since the actions required of >>> the attacker are indistinguishable from other attacks." >>> >>> Pervasive Monitoring Is an Attack >>> https://tools.ietf.org/html/rfc7258 >>> >> >> I'm quite familiar with this BCP but given it's emphasis on passive >> monitoring and the associated interest in opportunistic security (RFC 7435) >> I don't see any conflict here. >> > > I think the conflict is that the BCP states that the perceived benevolence > of an application (parental controls, malware blockers, etc) doesn't > matter, but that seems to be the case being made here. > No. I'm not arguing that it's benevolent but that it's something the user of the computer wanted. Aside from that seemingly obvious conflict, it doesn't seem like DNS-based > solutions would really work very well for these benevolent applications. > It's sort of like using a coffee cup as an umbrella--it will catch some > rain, yes. > I'm not sure how relevant this is, but you seem to be assuming that people are actively trying to evade these controls. Obviously that's true in some cases, but if I point my DNS to Quad9, it's because I *want* them to do malware and phishing detection [0], and so I have no interest in evading that. I'm not aware of any inherent reason to believe that would be ineffective. Note that Firefox and Chrome also use a domain-name based technique for anti-phishing. -Ekr [0] The parental control case is more complicated, and so the level of attempted evasion varies. --000000000000d4d3ab058dd16251 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 11:49 AM Rob = Sayre <sayrer@gmail.com> wrot= e:


On Tue, Jul 16, 2019 at 10:22 AM Eric Rescorla <= ;ekr@rtfm.com> wro= te:


On Tue, Jul 16, 2019 at 9:10 AM Rob Sayre <sayrer@gmail.com>= wrote:
In any case, BCP 188 covers the is= sue we're describing quite well.

"The= same techniques to achieve [Pervasive Monitoring] can be used regardless o= f motivation.=C2=A0 Thus, we cannot defend against the most nefarious actor= s while allowing monitoring by other actors no matter how benevolent some m= ight consider them to be, since the actions required of the attacker are in= distinguishable from other attacks."

Pervasiv= e Monitoring Is an Attack

I'm quite familiar with t= his BCP but given it's emphasis on passive monitoring and the associate= d interest in opportunistic security (RFC 7435) I don't see any conflic= t here.

I think the c= onflict is that the BCP states that the perceived benevolence of an applica= tion (parental controls, malware blockers, etc) doesn't matter, but tha= t seems to be the case being made here.
=
No. I'm not arguing that it's benevolent but that it= 's something the user of the computer wanted.

=

Aside from that seemingly= obvious conflict, it doesn't seem like DNS-based solutions would reall= y work very well for these benevolent applications. It's sort of like u= sing a coffee cup as an umbrella--it will catch some rain, yes.
=

I'm not sure how relevant this i= s, but you seem to be assuming that people are actively trying to evade the= se controls. Obviously that's true in some cases, but if I point my DNS= to Quad9, it's because I *want* them to do malware and phishing detect= ion [0], and so I have no interest in evading that. I'm not aware of an= y inherent reason to believe that would be ineffective. Note that Firefox a= nd Chrome also use a domain-name based technique for anti-phishing.

-Ekr

[0] The parental contro= l case is more complicated, and so the level of attempted evasion varies.
--000000000000d4d3ab058dd16251-- From nobody Tue Jul 16 12:30:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 20C1612011B for ; Tue, 16 Jul 2019 12:30:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WYsKhNbv8YOF for ; Tue, 16 Jul 2019 12:30:32 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EEFFA120041 for ; Tue, 16 Jul 2019 12:30:31 -0700 (PDT) Received: from [10.10.206.14] (unknown [161.12.34.244]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 6EEAE242109D; Tue, 16 Jul 2019 19:30:29 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Tue, 16 Jul 2019 20:30:26 +0100 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> To: Rob Sayre X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 19:30:33 -0000 > On 16 Jul 2019, at 20:10, Rob Sayre wrote: >=20 > I don't dispute that people sell them [DNS blocking systems], but I do = dispute that they work well. How is this relevant to the discussion of the above draft?=20 Whether or not these tools/services work well is another issue entirely. = And IMO not something to discuss at the IETF. From nobody Tue Jul 16 12:31:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 535A612067E for ; Tue, 16 Jul 2019 12:31:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2V6XKEi_oyJB for ; Tue, 16 Jul 2019 12:31:47 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C580E1206A1 for ; Tue, 16 Jul 2019 12:31:46 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id t28so21114306lje.9 for ; Tue, 16 Jul 2019 12:31:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=MyBr4Wh6ehXd7q72N/czPhfvDoHKyaWQVuDP+wG/1FM=; b=oEVsbIy5sh1LPqSMH3q06y4ZbhKJ4rbogIc9VzuJOG6STHDaGrLeyONeuu8/T7kEmE flgy63skNJp9rcR1muuJ48Mtr9Kk0pL+hXP9Wz1Le1T1TKUm6xQGuU73sLLhER3Wvq8H U7NJouIh5n5xWqbOCb77SFBP7UyOmEMarA/9Jt2rgYPS7XM7210TW3g/VN2m304zdfyQ JjbK3NIrRnZeTNxf5Jbpwxl2H3r8Pf14X4cZoGifgBgcIi+xZxrrSbMJc97fCUt+xEd1 2AJsXo99Ax5TwG11nHKgnUssCuFGdXGEKbOFUSsvaZJRR1xED4MbdDbbjsGA9QiPDipQ BpmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=MyBr4Wh6ehXd7q72N/czPhfvDoHKyaWQVuDP+wG/1FM=; b=e7J5gm0/Cuuv1gCivaKkjnBmjOdroA73eemI49iKce24ysm1WB6PCKn3jhM+MOd+4O X9CE22SslzyZYqCn/WCGE9aYsDMHUndpfsujqjh3I54Za2ilgvY07nfZ8m2Z3UHN4lRY 31Yu+wSMZNGcfLwY932e/1ZmAv1krVRu74lbtHGg2OX9h4MKPsw0UbJ2e3kD4zcD52st 1P6cgvyjQ3sHg6jf3ccRprka7hAFcBRqUQh2UeVIbiss2Y1eiftnU8Ixma5AQ1aTPqWZ ZVF5RP9s0BNwAm7p2utekQGHA36mqtL804VkbUpcZ6NEgoZv8HFZ+H/EvPb7LdrabKiP 3Pxw== X-Gm-Message-State: APjAAAX74FZaGA7R361IhcWE/9YRZVht485hIdLkWZenji6tdMGWCBRq ObpayO/RM4KXBkJKjbcJ9xWiqz32SNOsJaOFVGc= X-Google-Smtp-Source: APXvYqweDSti9KHKgD2tVXt5suFyZbXwDyApUak16W74GLfWb/zcMch+UCrpEZz0/mptj8Kg4AhgxcM88+UpPj4yb5M= X-Received: by 2002:a2e:9b84:: with SMTP id z4mr1793049lji.75.1563305505092; Tue, 16 Jul 2019 12:31:45 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Tue, 16 Jul 2019 12:31:08 -0700 Message-ID: To: Rob Sayre Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="0000000000004e90c9058dd16d34" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 19:31:56 -0000 --0000000000004e90c9058dd16d34 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 11:55 AM Rob Sayre wrote: > > > On Tue, Jul 16, 2019 at 11:49 AM Rob Sayre wrote: > >> >> >> On Tue, Jul 16, 2019 at 10:22 AM Eric Rescorla wrote: >> >>> >>> >>> On Tue, Jul 16, 2019 at 9:10 AM Rob Sayre wrote: >>> >>>> In any case, BCP 188 covers the issue we're describing quite well. >>>> >>>> "The same techniques to achieve [Pervasive Monitoring] can be used >>>> regardless of motivation. Thus, we cannot defend against the most >>>> nefarious actors while allowing monitoring by other actors no matter how >>>> benevolent some might consider them to be, since the actions required of >>>> the attacker are indistinguishable from other attacks." >>>> >>>> Pervasive Monitoring Is an Attack >>>> https://tools.ietf.org/html/rfc7258 >>>> >>> >>> I'm quite familiar with this BCP but given it's emphasis on passive >>> monitoring and the associated interest in opportunistic security (RFC 7435) >>> I don't see any conflict here. >>> >> >> I think the conflict is that the BCP states that the perceived >> benevolence of an application (parental controls, malware blockers, etc) >> doesn't matter, but that seems to be the case being made here. >> >> Aside from that seemingly obvious conflict, it doesn't seem like >> DNS-based solutions would really work very well for these benevolent >> applications. It's sort of like using a coffee cup as an umbrella--it will >> catch some rain, yes. >> > > Oh, also, RFC 7435 is Informational, while RFC 7258 is a BCP. BCPs are the > documents that describe what the IETF is supposed to be doing, right? > Well, sort of. But in this case, 7435 is a Consensus document, it just doesn't have normative force. Thus, I think it's reasonably strong evidence that opportunistic security isn't inconsistent with 7258. IIRC Stephen Farrell was AD at the time, so perhaps he'd be willing to offer his perspective. -Ekr > thanks, > Rob > > >> >> thanks, >> Rob >> >> >> >>> >>> -Ekr >>> >>> >>> >>>> >>>> thanks, >>>> Rob >>>> >>>> --0000000000004e90c9058dd16d34 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 11:55 AM Rob = Sayre <sayrer@gmail.com> wrot= e:


On Tue, Jul 16, 2019 at 11:49 AM Rob Sayre <sayrer@gmail.com>= wrote:


On Tue, Jul 16, 2019 at 10:22 AM Eric Rescorl= a <ekr@rtfm.com>= ; wrote:

I'm quite familiar w= ith this BCP but given it's emphasis on passive monitoring and the asso= ciated interest in opportunistic security (RFC 7435) I don't see any co= nflict here.

I think = the conflict is that the BCP states that the perceived benevolence of an ap= plication (parental controls, malware blockers, etc) doesn't matter, bu= t that seems to be the case being made here.

Aside= from that seemingly obvious conflict, it doesn't seem like DNS-based s= olutions would really work very well for these benevolent applications. It&= #39;s sort of like using a coffee cup as an umbrella--it will catch some ra= in, yes.

Oh, also, RFC 74= 35 is Informational, while RFC 7258 is a BCP. BCPs are the documents that d= escribe what the IETF is supposed to be doing, right?

Well, sort of. But in this case, 7435 is a Con= sensus document, it just doesn't have normative force. Thus, I think it= 's reasonably strong evidence that opportunistic security isn't inc= onsistent with 7258. IIRC Stephen Farrell was AD at the time, so perhaps he= 'd be willing to offer his perspective.

-E= kr


thanks,
=
Rob
=C2=A0

thank= s,
Rob

=C2=A0

-Ekr




thanks,
Rob
=

--0000000000004e90c9058dd16d34-- From nobody Tue Jul 16 12:37:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC5081200C5 for ; Tue, 16 Jul 2019 12:37:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MmVIfX2dhwe2 for ; Tue, 16 Jul 2019 12:37:52 -0700 (PDT) Received: from mail-io1-xd43.google.com (mail-io1-xd43.google.com [IPv6:2607:f8b0:4864:20::d43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2342212006A for ; Tue, 16 Jul 2019 12:37:52 -0700 (PDT) Received: by mail-io1-xd43.google.com with SMTP id q22so41888622iog.4 for ; Tue, 16 Jul 2019 12:37:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=zeEVL7h7o81cnCWWhlgowB0fDKiTQKp78yh7z+dQyJk=; b=BATwL1apcf4d5nP+JKwO+2h70EqFQL9J53W/qA4ZiixQt5BVP6dU0JHuqbvJd/GJjX S2k6M9RJuQxJICa7dUt4ApKQrpK6d74odAu28XthjxArAzbWITREysIfT5ObGni/Q1iK EWj4UOn2h9OpSopBk1uzsUNvDGypd+10v/6NjFVtV85uhoaeyjAo1n0u2hXihOk81yUp m3NNYIbvvKXom79z/poBZrAYYJhGbGnOWQ3DhbqSyzFui2SWJcnOq3h1bLa/1bOjAcOM qLQ60u/ya7q7h7Qs9/vdky0woF9Mz/meiI+It07J1tRRZyhTP3p0HDUZW7aosJHYufxd gP0w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=zeEVL7h7o81cnCWWhlgowB0fDKiTQKp78yh7z+dQyJk=; b=dZtMFrh/iGbUW8xwU1wET2VKGxAHIHeFPMJHjNuZmcj6t3ykUVCa9jiOiuxykwnfNJ Lf63YR5v5VKD05OkcRECydPf/asKdxVoyq/pqxtyE4P1jtPBuAOPGk/TrDiaEFlIX78d 8FqO1q71PIcCN++cg3QTVUW1EdYkig3OoQSU3tPi3YPTcZc8rolVfi5a34bnEVtaI9Gh P8lSZciU71tbpxzN0WIKyVMJEgp9diAALEsPJNhT95rJWYU6CE8HYg1PEEB+sstuive9 nipb+Rc67FfqQtF/jgo+RCEHLX+WAAFUzLHGpOA0IuxQC4Xj2D1Qe+c9WPo9jNBwWEF5 njIQ== X-Gm-Message-State: APjAAAWdW2ViGaSAFuNKbKgFWVkpyaJqWVHd9B8WypfaRJ2cXbdvrsyg LSFZjsTtKgu4GqQeOyUTDrzyaV2fCKIHaqFKUJw= X-Google-Smtp-Source: APXvYqwbduYVeoKyMRLwnEZAW4FSQYzYFBsHTWg8W/Fk/xv9NNT30GpHZkskPFrSWSCZkMq2xR3shY787sf7v4WC43Q= X-Received: by 2002:a6b:6d07:: with SMTP id a7mr10056094iod.254.1563305871234; Tue, 16 Jul 2019 12:37:51 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Tue, 16 Jul 2019 12:37:39 -0700 Message-ID: To: Eric Rescorla Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="000000000000215c00058dd183e4" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 19:37:54 -0000 --000000000000215c00058dd183e4 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 12:28 PM Eric Rescorla wrote: > > > > Aside from that seemingly obvious conflict, it doesn't seem like DNS-based >> solutions would really work very well for these benevolent applications. >> It's sort of like using a coffee cup as an umbrella--it will catch some >> rain, yes. >> > > I'm not sure how relevant this is, but you seem to be assuming that people > are actively trying to evade these controls. > Well, they are, but your point about voluntary participation is different. > Obviously that's true in some cases, but if I point my DNS to Quad9, it's > because I *want* them to do malware and phishing detection [0], and so I > have no interest in evading that. I'm not aware of any inherent reason to > believe that would be ineffective. > Yeah, I think the question is whether a user would /also/ want that task to be unencrypted. That doesn't make much sense to me. thanks, Rob --000000000000215c00058dd183e4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 12:28 PM Eric= Rescorla <ekr@rtfm.com> wrote:
=


=
Aside from that seemingly obvious conflic= t, it doesn't seem like DNS-based solutions would really work very well= for these benevolent applications. It's sort of like using a coffee cu= p as an umbrella--it will catch some rain, yes.

I'm not sure how relevant this is, but you seem = to be assuming that people are actively trying to evade these controls.

Well, they are, but your po= int about voluntary participation is different.
=C2=A0
Obviously that's true in some cases, but if I point = my DNS to Quad9, it's because I *want* them to do malware and phishing = detection [0], and so I have no interest in evading that. I'm not aware= of any inherent reason to believe that would be ineffective.=C2=A0

Yeah, I think the question is wh= ether a user would /also/ want that task to be unencrypted. That doesn'= t make much sense to me.

thanks,
Rob=C2= =A0
--000000000000215c00058dd183e4-- From nobody Tue Jul 16 12:53:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 274BF12014F for ; Tue, 16 Jul 2019 12:53:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c-dfc2UMgPjE for ; Tue, 16 Jul 2019 12:53:32 -0700 (PDT) Received: from mail-lf1-x12d.google.com (mail-lf1-x12d.google.com [IPv6:2a00:1450:4864:20::12d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B299712024D for ; Tue, 16 Jul 2019 12:53:31 -0700 (PDT) Received: by mail-lf1-x12d.google.com with SMTP id b17so14638417lff.7 for ; Tue, 16 Jul 2019 12:53:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8zwwQvHJ4X/X3gQjct/JOKjfht8dbcpwUS2kueR2eKw=; b=cAwexXGWWCCjuSWOf2/CWNmAGTZ5LoYy+5RDeKkMnPGhAgCG+PEWvU9JwmYTNBmoVE x02iKi26FBOLcrWDHh6EsO061u8LF9Pdqi++gRY+QctGiMI9INYTYarw12emmhvYEi1i 8rKBL3jYOAdYef71bOHFw6tmcMwzB7eXQ78VrBYHYjoAzQbh9TkFfZY9NF3MgnZU3H0B vv8/PGKG1sdr9u6JYU6VBs7CKipc4WnzshjuhjP8I2cvbNsVK7AgRnpGVLuWRhFGkNHi e0V5rL7UlEJy9Pbpo8/IW6sEe42nfuyxtuFoiaJS68ARqek10QjO1NVSArGMRcUl0z09 XjBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8zwwQvHJ4X/X3gQjct/JOKjfht8dbcpwUS2kueR2eKw=; b=YeBlaJ/8OqQ6yvr0qqw5fzQmZws6nKcxEhp2rOmhV/TgGKGDRvb4beodWS9m+EHfQX TzdA77/P2EoTzCSUt1feUg+cuWhQpLaUCpwa2/e4cBMlLiq9x2eBymy/RcX7rl3LnDQE t/lLiNffLQoOPkD0vLpeZvESbtr5u717QPYOzurSjhepn7jTTvszt/j3G4Y9SVOkTZr7 kTNXOzzHTI+xwPlv0QPD1IYm4wgQNeFsemKfQhZ9W7XStQUhPp3GCuZmyE5Cso1hT/p1 cqK8/EVqQ4UD+kQCkThnNGDKSEKrmhdegZ/Rqq4LFlDf4wcAJg3mSZdXk/x9IKyNCHZ0 J8Ow== X-Gm-Message-State: APjAAAW+2NM9Rv/YEl91HXfJkRk1G3pdUxr/wTS0GpeE18mHA3D3eX4p 2w5K72GO5Jajc6pqnWUkG8dlA2b5J3OrDpj/Qkk= X-Google-Smtp-Source: APXvYqwmgj9wU8siU439jpskKhYIB0waYu/dfJRheA3aynvUbQftacIwZpTRY6Hhojoop5cm56577bgjbWF6BW0kXBM= X-Received: by 2002:ac2:5336:: with SMTP id f22mr15161064lfh.180.1563306809967; Tue, 16 Jul 2019 12:53:29 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Tue, 16 Jul 2019 12:52:53 -0700 Message-ID: To: Rob Sayre Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="000000000000155c00058dd1bbd2" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 19:53:40 -0000 --000000000000155c00058dd1bbd2 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 12:37 PM Rob Sayre wrote: > > > On Tue, Jul 16, 2019 at 12:28 PM Eric Rescorla wrote: > >> >> >> >> Aside from that seemingly obvious conflict, it doesn't seem like >>> DNS-based solutions would really work very well for these benevolent >>> applications. It's sort of like using a coffee cup as an umbrella--it will >>> catch some rain, yes. >>> >> >> I'm not sure how relevant this is, but you seem to be assuming that >> people are actively trying to evade these controls. >> > > Well, they are, but your point about voluntary participation is different. > Some people are, some are not. In case it's not clear, my interest here is in providing DoH/TRR for people who have not explicitly decided they want some sort of non-transparent DNS service while avoiding changing the experience of people who have decided they do want some sort of non-transparent/filtered DNS service. What we are trying to do is figure out who is who. > Obviously that's true in some cases, but if I point my DNS to Quad9, it's >> because I *want* them to do malware and phishing detection [0], and so I >> have no interest in evading that. I'm not aware of any inherent reason to >> believe that would be ineffective. >> > > Yeah, I think the question is whether a user would /also/ want that task > to be unencrypted. That doesn't make much sense to me. > Ah, I think we are now converging on the relevant point. Taking a TRR-style system out of the equation for a moment. Suppose that what I want is for all devices on my network to use a filtering resolver. I don't expect any evasion because they're all my devices, it's just a matter of convenience to centrally configure it. So what I do here is I configure my DHCP server to provide the IP address of that resolver. Now, those devices do unencrypted DNS because that's what everyone does. Now, suppose that resolver starts offering DoT. How do my devices learn that information? The resolver could tell them over DNS but then we have a straightforward downgrade attack from anyone on the network. Do you agree with this so far? Do you have a proposed solution? -Ekr > > thanks, > Rob > --000000000000155c00058dd1bbd2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 12:37 PM Rob = Sayre <sayrer@gmail.com> wrot= e:


On Tue, Jul 16, 2019 at 12:28 PM Eric Rescorla <= ;ekr@rtfm.com> wro= te:


<= div>
Aside from that seemingly obvious = conflict, it doesn't seem like DNS-based solutions would really work ve= ry well for these benevolent applications. It's sort of like using a co= ffee cup as an umbrella--it will catch some rain, yes.

I'm not sure how relevant this is, but yo= u seem to be assuming that people are actively trying to evade these contro= ls.

Well, they are, but = your point about voluntary participation is different.

Some people are, some are not. In case it'= ;s not clear, my interest here is in providing DoH/TRR for people who have = not explicitly decided they want some sort of non-transparent DNS service w= hile avoiding changing the experience of people who have decided they do wa= nt some sort of non-transparent/filtered DNS service. What we are trying to= do is figure out who is who.

=C2=A0
Obviously that's true in some = cases, but if I point my DNS to Quad9, it's because I *want* them to do= malware and phishing detection [0], and so I have no interest in evading t= hat. I'm not aware of any inherent reason to believe that would be inef= fective.=C2=A0

Yeah, I th= ink the question is whether a user would /also/ want that task to be unencr= ypted. That doesn't make much sense to me.

Ah, I think we are now converging on the relevant poi= nt.

Taking a TRR-style system out of the equation = for a moment. Suppose that what I want is for all devices on my network to = use a filtering resolver. I don't expect any evasion because they'r= e all my devices, it's just a matter of convenience to centrally config= ure it. So what I do here is I configure my DHCP server to provide the IP a= ddress of that resolver. Now, those devices do unencrypted DNS because that= 's what everyone does. Now, suppose that resolver starts offering DoT. = How do my devices learn that information? The resolver could tell them over= DNS but then we have a straightforward downgrade attack from anyone on the= network. Do you agree with this so far? Do you have a proposed solution?

-Ekr


= =C2=A0

thanks,
Rob=C2= =A0
--000000000000155c00058dd1bbd2-- From nobody Tue Jul 16 13:02:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC626120096 for ; Tue, 16 Jul 2019 13:02:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xzWV21sWJZHs for ; Tue, 16 Jul 2019 13:02:30 -0700 (PDT) Received: from mail-io1-xd43.google.com (mail-io1-xd43.google.com [IPv6:2607:f8b0:4864:20::d43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C794C120041 for ; Tue, 16 Jul 2019 13:02:30 -0700 (PDT) Received: by mail-io1-xd43.google.com with SMTP id g20so41962554ioc.12 for ; Tue, 16 Jul 2019 13:02:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=l2mZgiJfQExL5wAUdH1dghvdI834Gn/Hdxh3lhUOZvs=; b=JZWR9pmwhM2XNfT56AkCIXvqR3u31e8nDnhrhVX6Dl3Q9atVqnWmVKymcqkZJA9+5P Yv5z139bYmKk4PrSt5qV5k0xfSqF/wCJgFCjJL7nysgP6incyWskN9437qQRvcfU2iZR FR/gfIXuQGzXAmB81O5+ZeUfKL0yvya125tYm9ucYgWeeNOWJaE76EoH3KHTHUgZh8BR Zo5kxPMFj6yM5qkCxuKUDzoLdr99G5MCDKnIu3XJvHeF9JYepCTcjpPy+AaEytUANwP6 RinuLLHpqe1DdW0TGnZ1IB0LSTVsv52qJaXTVk0r/JEQ0XKKvwJiyF60MCWC/KCjDNwK d86A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=l2mZgiJfQExL5wAUdH1dghvdI834Gn/Hdxh3lhUOZvs=; b=Vxzw7m97bf/+Y3wj8eWXdrr/+phacU0RQYNsYGDPe/THbrDVi0aJiq6aRJqNQw/VAt +RgEkmCM1igrqWnGVEk96UbqfEeA8IZKQ5FuhUsGNG7RKwaRl51ZLXZIsyfNbhZkRElJ svDwOBdbCQA6xDAC0rjcPBTPnw6FJQVFUSPzU6gnlyLG0BWyFWAfkPvObvfOEzpT/G5T Tp6M5MQNrUDlptiFJJU7X7WsAwrAAhjAy/onLAErgVRCNRvCeXoGo3p7tAHLD048a4Iz e75TNVdYvFzbskZT1J2qspFbgNrSYO1lvJ/sVkoBBCfWEGZ0YibkY2Ho45aFeOstips6 0VPQ== X-Gm-Message-State: APjAAAWoIyXJ+IljIHYwU0I9JHP5sbY5EPSxsg4jijJqhYryvXYbtTUf 4znZngY2oGlWbjcTxgaAcUgDVuww9tFbZCt9IDE= X-Google-Smtp-Source: APXvYqz5MoHlwpEEovyOQxeRZXXeDYbzHyQSFf973V/b/OTM/7RpGM6sNa4CP4K7vdn+fPL36ir/wZUcgv1BpniH4bM= X-Received: by 2002:a5e:c00e:: with SMTP id u14mr34180500iol.196.1563307349963; Tue, 16 Jul 2019 13:02:29 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Tue, 16 Jul 2019 13:02:18 -0700 Message-ID: To: Eric Rescorla Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="00000000000044fca2058dd1db04" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 20:02:33 -0000 --00000000000044fca2058dd1db04 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 12:53 PM Eric Rescorla wrote: > > Taking a TRR-style system out of the equation for a moment. Suppose that > what I want is for all devices on my network to use a filtering resolver. I > don't expect any evasion because they're all my devices, it's just a matter > of convenience to centrally configure it. So what I do here is I configure > my DHCP server to provide the IP address of that resolver. Now, those > devices do unencrypted DNS because that's what everyone does. Now, suppose > that resolver starts offering DoT. How do my devices learn that > information? The resolver could tell them over DNS but then we have a > straightforward downgrade attack from anyone on the network. Do you agree > with this so far? Do you have a proposed solution? > In fairness, I'm not sure I quite follow. But, if I worked at a browser vendor, I would be worried about DoH rollout too. I think I'd gradually ratchet up the security signals in the location bar with the end result of marking sites insecure if their IP was fetched over DNS in the clear. This is distinct from choosing a DNS vendor. thanks, Rob --00000000000044fca2058dd1db04 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 12:53 PM Eric= Rescorla <ekr@rtfm.com> wrote:

Taking a TRR-style system out of= the equation for a moment. Suppose that what I want is for all devices on = my network to use a filtering resolver. I don't expect any evasion beca= use they're all my devices, it's just a matter of convenience to ce= ntrally configure it. So what I do here is I configure my DHCP server to pr= ovide the IP address of that resolver. Now, those devices do unencrypted DN= S because that's what everyone does. Now, suppose that resolver starts = offering DoT. How do my devices learn that information? The resolver could = tell them over DNS but then we have a straightforward downgrade attack from= anyone on the network. Do you agree with this so far? Do you have a propos= ed solution?

In fairness,= I'm not sure I quite follow. But, if I worked at a browser vendor, I w= ould be worried about DoH rollout too. I think I'd gradually ratchet up= the security signals in the location bar with the end result of marking si= tes insecure if their IP was fetched over DNS in the clear. This is distinc= t from choosing a DNS vendor.

thanks,
Ro= b



--00000000000044fca2058dd1db04-- From nobody Tue Jul 16 13:11:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B29931200C4 for ; Tue, 16 Jul 2019 13:11:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kCwa3GWdsevF for ; Tue, 16 Jul 2019 13:11:32 -0700 (PDT) Received: from mail-lf1-x136.google.com (mail-lf1-x136.google.com [IPv6:2a00:1450:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6959B120041 for ; Tue, 16 Jul 2019 13:11:32 -0700 (PDT) Received: by mail-lf1-x136.google.com with SMTP id 62so9779432lfa.8 for ; Tue, 16 Jul 2019 13:11:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=mczw8xe2IrQg00vo8mnOpwT+nCXKcWx/QBuLj9ongjM=; b=VFdPBSupixYIFaGfomJ2OhqmMYoWxqoNaLvIw1S8ILFQFA5mgFA7+KmhyDI+DXmmT8 G6F0LpjgLgEjRDOPqQ4EQQm5aqUq9LvE53ugRvrjFqq8xn1fkjwwxaz3+2nly5vOxxDy n22YNgVTCLdDKVuM2seSaZ/ltjJLBOPi5V3plGp8x2HYfpO6zzT1CE2aOyobj7YCS9F6 1eR028SVcUtekFWzUf+ggYmPDjIycmv5JijtcX51/4idkxZ5z36NBxQ5Fw0Z1gAW5eWv WZIGGDhOE8q7pu26My3SltRyEzyiV9dvZZjyViINxjtoXxO/EMRqAwBGYRAhF8glNqt4 Go1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=mczw8xe2IrQg00vo8mnOpwT+nCXKcWx/QBuLj9ongjM=; b=PtepdVzkEJQX0gD3ZUYUYDqgDz3MvOhFqZu+Bq0lAyRfEF6aeSAYQWFxyA3TKar2Hq rxCCjDcBxrDdUmOWbX4BXkIU33I6MoOGwXNQxztjyyv9RJftpr8CA3sl/Va/U51C96TR MiCCq+B0rR2gApiSll0whlOdxmfIjleVsP0YuXpjkhhuOIwFyHGaVrTY+c7Sna89JjgD ovO3WjfFreZtyzos9uI0ftVzUTjbIIslB641NEpJLyL/Y0AzhGaELBdixj+tE6nbTPhE jwBKZOcnHKXvH0RRFDY9THIhGfYxciSILIV0hGQhpqQ/K+D5gr/KTEBTRADa57O/b+ZW pjrA== X-Gm-Message-State: APjAAAXxrAOYunHBZwzsuEZsX6CuOpG7DPCnn7/azlLX/Bcx9ocC8Q7O u0k7PQVLyBZO5U8X7cspes5cv8nIRmKl4RxBJ64= X-Google-Smtp-Source: APXvYqwJ93MfPvvB2iRGWWsQxSJCCWKrY5k/SCljhVNSD0N6t7Pf8G59GuvzE2uE3woi5uUi0bySgruGKKtyFxJeUDc= X-Received: by 2002:ac2:528e:: with SMTP id q14mr14699864lfm.17.1563307890626; Tue, 16 Jul 2019 13:11:30 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Tue, 16 Jul 2019 13:10:53 -0700 Message-ID: To: Rob Sayre Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="0000000000007ee5b5058dd1fb09" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 20:11:35 -0000 --0000000000007ee5b5058dd1fb09 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 1:02 PM Rob Sayre wrote: > > > On Tue, Jul 16, 2019 at 12:53 PM Eric Rescorla wrote: > >> >> Taking a TRR-style system out of the equation for a moment. Suppose that >> what I want is for all devices on my network to use a filtering resolver. I >> don't expect any evasion because they're all my devices, it's just a matter >> of convenience to centrally configure it. So what I do here is I configure >> my DHCP server to provide the IP address of that resolver. Now, those >> devices do unencrypted DNS because that's what everyone does. Now, suppose >> that resolver starts offering DoT. How do my devices learn that >> information? The resolver could tell them over DNS but then we have a >> straightforward downgrade attack from anyone on the network. Do you agree >> with this so far? Do you have a proposed solution? >> > > In fairness, I'm not sure I quite follow. But, if I worked at a browser > vendor, I would be worried about DoH rollout too. I think I'd gradually > ratchet up the security signals in the location bar with the end result of > marking sites insecure if their IP was fetched over DNS in the clear. > Ignoring the UI question, let me push a bit on "in the clear". Currently, resolvers are configured by IP address, not domain name. So absent mechanisms such as TRR, how does the DNS client form a secure connection to the resolver? What domain name is in the certificate and how does the client learn that domain name? -Ekr > This is distinct from choosing a DNS vendor. > > thanks, > Rob > > > > --0000000000007ee5b5058dd1fb09 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 1:02 PM Rob S= ayre <sayrer@gmail.com> wrote= :


On Tue, Jul 16, 2019 at 12:53 PM Eric Rescorla <= ekr@rtfm.com> wrot= e:
=

Taking a TRR-style system ou= t of the equation for a moment. Suppose that what I want is for all devices= on my network to use a filtering resolver. I don't expect any evasion = because they're all my devices, it's just a matter of convenience t= o centrally configure it. So what I do here is I configure my DHCP server t= o provide the IP address of that resolver. Now, those devices do unencrypte= d DNS because that's what everyone does. Now, suppose that resolver sta= rts offering DoT. How do my devices learn that information? The resolver co= uld tell them over DNS but then we have a straightforward downgrade attack = from anyone on the network. Do you agree with this so far? Do you have a pr= oposed solution?

In fairn= ess, I'm not sure I quite follow. But, if I worked at a browser vendor,= I would be worried about DoH rollout too. I think I'd gradually ratche= t up the security signals in the location bar with the end result of markin= g sites insecure if their IP was fetched over DNS in the clear.

Ignoring the UI question, let me pu= sh a bit on "in the clear".

Currently, r= esolvers are configured by IP address, not domain name. So absent mechanism= s such as TRR, how does the DNS client form a secure connection to the reso= lver? What domain name is in the certificate and how does the client learn = that domain name?

-Ekr


=C2=A0
This is distinct from = choosing a DNS vendor.

thanks,
Rob
=



--0000000000007ee5b5058dd1fb09-- From nobody Tue Jul 16 13:17:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11383120113 for ; Tue, 16 Jul 2019 13:17:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E0c55XwZppBk for ; Tue, 16 Jul 2019 13:17:22 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA80D120041 for ; Tue, 16 Jul 2019 13:17:21 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 8827DBE51; Tue, 16 Jul 2019 21:17:19 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zLUnNYuiyx9O; Tue, 16 Jul 2019 21:17:18 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id CA08ABDCF; Tue, 16 Jul 2019 21:17:17 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1563308238; bh=tnPGTUcVAkvpcSwIYWMyD+33sxmT1dL6KlEeQY2TDVw=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=dxf5hh6ddqCjwUv8B1EnpsAvaKeOXgMsFipq+wKuutDDs+4McYOiE2BUpYmdiLMM4 k5SapGy67Iv2EhYC8hiGhnLoJrhyS+eYl5BWwUKyUivFZBQRak3bJASK+afVZnO4it UMcjxB+0JfSrHqEo2R/0u3yBdC9aXuyg+6hkEU8U= To: Eric Rescorla , Rob Sayre Cc: add@ietf.org, "Dixon, Hugh" , Alec Muffett References: From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Tue, 16 Jul 2019 21:17:12 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="uHOWaCWqeYS8j0JCBT76l9HlOgjKgbsj0" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 20:17:24 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --uHOWaCWqeYS8j0JCBT76l9HlOgjKgbsj0 Content-Type: multipart/mixed; boundary="wHnLZXmJjScM9Thi7lKfekYEWd11uT93D"; protected-headers="v1" From: Stephen Farrell To: Eric Rescorla , Rob Sayre Cc: add@ietf.org, "Dixon, Hugh" , Alec Muffett Message-ID: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 References: In-Reply-To: --wHnLZXmJjScM9Thi7lKfekYEWd11uT93D Content-Type: multipart/mixed; boundary="------------01026124DD3E30E731758D96" Content-Language: en-GB This is a multi-part message in MIME format. --------------01026124DD3E30E731758D96 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable And there was me trying to stay out of this for a bit:-) On 16/07/2019 20:31, Eric Rescorla wrote: > Well, sort of. But in this case, 7435 is a Consensus document, it just > doesn't have normative force. Thus, I think it's reasonably strong evid= ence > that opportunistic security isn't inconsistent with 7258. IIRC Stephen > Farrell was AD at the time, so perhaps he'd be willing to offer his > perspective. First, having been the AD at the time isn't IMO significant, but I was involved in the discussions yes. I don't think there's any contradiction between 7435 and 7258. Different people do have different opinions when it comes to opportunistic security, but I think many of the competing arguments have some merit. Opportunistic security, for me, is generally a step on the road to stricter security and is most useful where it's not practical to move from little/no-security to strict security. I guess the canonical argument for the utility of that relates to SMTP/TLS between MTAs. In terms of ADD, I guess there could be some scope for handling signals as to the (non)-existence of a relevant policy in an opportunistic manner, I'm not sure. But I don't see how that might apply with the draft in the subject line, where an NXDOMAIN indicates a policy exists somewhere between the stub and the root zone. Cheers, S. --------------01026124DD3E30E731758D96 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------01026124DD3E30E731758D96-- --wHnLZXmJjScM9Thi7lKfekYEWd11uT93D-- --uHOWaCWqeYS8j0JCBT76l9HlOgjKgbsj0 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0uMMgACgkQWrL68XsX K+pydhAAzSH32i7cxT0lKbkacuMlTajpcPluyKv5weycR+t2JqNTzEAV6SHczS9m 1fNpUmsdO/V2HHQPJd3AbWnXA7Scy5VxxXnXnYJRUuIALrOKe8AEYcvFUglz+JAR JI4WqyLU2k835YZWFE3FMBcLTgL8zqyO3RNWcuYVoFDJL/zgAlYohGUyZTbAJQ1w yoMuUyDp/NK9mao/5z0oe5fRDT3+XWiKgYH8Kg/MczJtnAIwWpOPmKe4x37pJGTN cBEYwNEqqMzOZSBHY9JB5RRfDnp4QI/zVvrZSJKGiGIOySwHKdWdSgzIHiYCNDYM KFQ/FUJjogIADs0cvcZBW2XWl2S1bOYkkG9ukUGo9nCYZq6ijesPvaYD6jtfeHYK aQnwj0n86xv4YKdleQIa0Gk41XbKII8s66MlzMuKZ0M2KW9BTLm8zyE5c/JVeuNH Jauq3h6fSHhQrUNAwUL4cvA29PHSSKwHzvtgiunSKzK0fHSWtt/9ZexM1HijCL47 cQg8em/o09wqyaRbaaEksIms+CKcA6cnawPvKd5Dhdg4msMxHITcyLKqq+2RSD88 g+wCLeuYXy6zARIv7NiGkKkhwINpv0VOJdCYbYaMmVWCQMNtARo4d+HErjHIAbpG CP++zSPXhNLgT0cd/TjyyDGfhXsR/Wv724zCE2dRhdq/QuPrWs8= =yayz -----END PGP SIGNATURE----- --uHOWaCWqeYS8j0JCBT76l9HlOgjKgbsj0-- From nobody Tue Jul 16 13:17:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5327120113 for ; Tue, 16 Jul 2019 13:17:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vp1za80Bq5au for ; Tue, 16 Jul 2019 13:17:40 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 27FC81200C4 for ; Tue, 16 Jul 2019 13:17:40 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id e20so11755477iob.9 for ; Tue, 16 Jul 2019 13:17:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ChKsr30kysNVlGPRZJFvZo6mAgmR+ZtZY7BwJhqZyj8=; b=A7Nul13k1OpF1R0wepbrE+gnD3Lw42NB/KaB6p1mODcE3SZ6fJHB68ZV6+Uk1fHV4W PDTha8DDCL5fv2bouiETnLlpksctiMgWez7p02GJgc3k3SUwX2+MO5G2o8I5Rlu9Qop3 0LZxlek9xaN9ZTqmnYJP64QKRwezpXJdUmDEgOLPkYjfcTQEMXtePl1NbFk6XSdGoE41 HBTWUX6ZVgHUijrq6k9wSX/zY8gv9SOEG8VA1aU8RuXKEVWIaNvcmxK4tCgjzNYZPi2a hdIlAl/uv7tadLP0eNV7Bx44ZTzdwW9ykB3JhnZmBdidwGnlOwo9xkNOsz9oz8U1guE8 plpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ChKsr30kysNVlGPRZJFvZo6mAgmR+ZtZY7BwJhqZyj8=; b=bjZrE6iDsbAtYvoaWHyH2yOwQioZpjtBnhnj8/uMckz3kfqCLhx69g5HBKu5OWfPuj f4IqvpEbcvYJ6XTsmL0b1L3n/GlbDv30J3PvhpSKpLgijQpAHTZ5M06rid4mpt0oP+Ll WCYrSqvWt4eJajMjzvLLxT4UY92dum8RMEpYnAfF94xG+ZZj2tDzm110ASJLeVU5kcoS tzGBcK3ry9IFp3KEzPUkR8cuu2KilXu3/KtCuV6h8jAGZNWLUcVANXoaXYB/nISPYuYt 2U/d1Qcqd+HVuRD+1dklR8pH/STr+TvmVDxSXyVzJRZOImMLnuNZ5HhhWgNz07qd6ED9 TIJA== X-Gm-Message-State: APjAAAW802IM2ZXkpef5D4HwYIJWcT6XQD/vsAMNokkIkSPPxwjzhb2K +0LE1HS5whAVa56h2ggf32VB7AcDlwoiRBRnZRY= X-Google-Smtp-Source: APXvYqzGVnEfqL0xcC5SZNdI+LzBksrYAqXnBa3rEV43EnzWSRFwGOYdIJwtSqFvBufFywUkxF155ZC8DxUWeD6fDko= X-Received: by 2002:a6b:6d07:: with SMTP id a7mr10237838iod.254.1563308259326; Tue, 16 Jul 2019 13:17:39 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Tue, 16 Jul 2019 13:17:28 -0700 Message-ID: To: Eric Rescorla Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="00000000000078c100058dd211b7" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 20:17:42 -0000 --00000000000078c100058dd211b7 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 1:11 PM Eric Rescorla wrote: > >> In fairness, I'm not sure I quite follow. But, if I worked at a browser >> vendor, I would be worried about DoH rollout too. I think I'd gradually >> ratchet up the security signals in the location bar with the end result of >> marking sites insecure if their IP was fetched over DNS in the clear. >> > > Ignoring the UI question, let me push a bit on "in the clear". > Sure, but I don't you should ignore the UI question. Having been on the receiving end of a few "why is the lock broken on our site?" emails from a CEO, I can tell you it is really effective. > > Currently, resolvers are configured by IP address, not domain name. > This is true, so companies go for stuff like 1.1.1.1 and 8.8.8.8. > So absent mechanisms such as TRR, how does the DNS client form a secure > connection to the resolver? What domain name is in the certificate and how > does the client learn that domain name? > I agree that there's a bootstrapping problem, but I don't think this draft helps with that. thanks, Rob > > -Ekr > > > > >> This is distinct from choosing a DNS vendor. >> >> thanks, >> Rob >> >> >> >> --00000000000078c100058dd211b7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 16, 2019 at 1:11 PM Eric Resc= orla <ekr@rtfm.com> wrote:
In fairness, I'm not sure I quite follow. But, if I worked= at a browser vendor, I would be worried about DoH rollout too. I think I&#= 39;d gradually ratchet up the security signals in the location bar with the= end result of marking sites insecure if their IP was fetched over DNS in t= he clear.

Ignoring the U= I question, let me push a bit on "in the clear".

Sure, but I don't you should ignore t= he UI question. Having been on the receiving end of a few "why is the = lock broken on our site?" emails from a CEO, I can tell you it is real= ly effective.
=C2=A0

= Currently, resolvers are configured by IP address, not domain name.

This is true, so companies go fo= r stuff like 1.1.1.1 and 8.8.8.8.

=C2=A0
So absent mechanisms such as TRR, how does the DNS cl= ient form a secure connection to the resolver? What domain name is in the c= ertificate and how does the client learn that domain name?
<= /div>

I agree that there's a bootstrapp= ing problem, but I don't think this draft helps with that.
thanks,
Rob

=C2=A0

-Ekr


=C2=A0
This is distinct from= choosing a DNS vendor.

thanks,
Rob



--00000000000078c100058dd211b7-- From nobody Tue Jul 16 13:23:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B674120602 for ; Tue, 16 Jul 2019 13:23:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yOrGN2ymeQ5x for ; Tue, 16 Jul 2019 13:23:32 -0700 (PDT) Received: from mail-lj1-x22d.google.com (mail-lj1-x22d.google.com [IPv6:2a00:1450:4864:20::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E64FF120120 for ; Tue, 16 Jul 2019 13:23:31 -0700 (PDT) Received: by mail-lj1-x22d.google.com with SMTP id p17so21297470ljg.1 for ; Tue, 16 Jul 2019 13:23:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=VB6sYIxQNxi0ASp5Km9dn963gxUith+FbVmIgZ94SiI=; b=tlc6aDLa9DBEj6WJoTmqFcsODZTAnmpwa+3a3KL88iD1gfNOPkXIpoVLGeCn4Z+Bou 3myn1bc2dnuhISLGhNn2IEm54Xj9C/wmxEyTAzdJ8QhgmEyuUZBalFJIoDEC/52SCn2V O9P/bUqz63G6kYL3ALiT4wJteOuVlblo0l0NToRILy0nF5QepC2kNkw35f44xRZ6zEyj usBzN9ZVeLtFVHO3mDZJfL6Ma4CYulS0T1UDEVMkOew1OaH79CXZSodK+S/DmFlYfOGN 6g8+pjZx5l5mlsVpJfPQXWGH12UNLPrAHb6AOJNZp85ozM9gx0kn2s2jdCmxVDIFE1LW 3xXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=VB6sYIxQNxi0ASp5Km9dn963gxUith+FbVmIgZ94SiI=; b=R+S1Zhy/6VfmL1na57hV9gZPeJlheiALYxz44EEyko5FANXG/knaEwqVUk0UwHboWW KSNRw4qTK2AFf/ytUb6SNuCgdvn0CNSY4tIWuWx3fjWWk1+tEPrVA+ex1gPNFsq1Svr5 QpW/d8dtM5uvLO9TMwFeyBOSUeAcIcQEBwBZmkeFtdBAve3hHiRlaQNdcD/bA+lZBym/ tQROkZaOgM/5U4ilcbNjbpQIdwtyiFncaKOaQf1/avc1CcwLg0m+wSxwAOS4688CS3c2 cxsn7kNPnwePqCQ5Rg0XbaDmzJIqOrWrz4wwoOjj8chooQwOfI15KI61oanRLri8KbF4 82SA== X-Gm-Message-State: APjAAAU1LiarJwvIPFnAjxZr3HtrvNgdbrRjKqBEP4k1u1I7RY5BiVDw 8d4HxzTULma/hHtH6otSdpjTAxJ2WZiUf/1wALo= X-Google-Smtp-Source: APXvYqwdc+Iy17jMkHI27Vys1OKHjS7l+OAyR1YtqRygBHdKdSXuOhe+UbBguFrVnCLKzR0VTK9HpRQKkEd8meZ0qq4= X-Received: by 2002:a2e:3008:: with SMTP id w8mr18994925ljw.13.1563308610163; Tue, 16 Jul 2019 13:23:30 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Tue, 16 Jul 2019 13:22:53 -0700 Message-ID: To: Rob Sayre Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="000000000000622c36058dd2269a" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 20:23:40 -0000 --000000000000622c36058dd2269a Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 1:17 PM Rob Sayre wrote: > On Tue, Jul 16, 2019 at 1:11 PM Eric Rescorla wrote: > >> >>> In fairness, I'm not sure I quite follow. But, if I worked at a browser >>> vendor, I would be worried about DoH rollout too. I think I'd gradually >>> ratchet up the security signals in the location bar with the end result of >>> marking sites insecure if their IP was fetched over DNS in the clear. >>> >> >> Ignoring the UI question, let me push a bit on "in the clear". >> > > Sure, but I don't you should ignore the UI question. Having been on the > receiving end of a few "why is the lock broken on our site?" emails from a > CEO, I can tell you it is really effective. > > >> >> Currently, resolvers are configured by IP address, not domain name. >> > > This is true, so companies go for stuff like 1.1.1.1 and 8.8.8.8. > Right, but if you're getting that out of DHCP, that doesn't help, because you can't trust that. > >> So absent mechanisms such as TRR, how does the DNS client form a secure >> connection to the resolver? What domain name is in the certificate and how >> does the client learn that domain name? >> > > I agree that there's a bootstrapping problem, but I don't think this draft > helps with that. > I'm not saying it does. I'm just trying to work through the entire problem. What I'm arguing here is that absent external configuration (e.g., DoH/TRR), there's no real way to get encrypted DNS that is secure against active attack. -Ekr > thanks, > Rob > > > >> >> -Ekr >> >> >> >> >>> This is distinct from choosing a DNS vendor. >>> >>> thanks, >>> Rob >>> >>> >>> >>> --000000000000622c36058dd2269a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 1:17 PM Rob S= ayre <sayrer@gmail.com> wrote= :
On Tue, Jul 16, 2019 at 1:11 PM Eric Rescorla <ekr@rtfm.com> wrote:
<= div>
In fairness, I'm not sure I quite follow. But, if I = worked at a browser vendor, I would be worried about DoH rollout too. I thi= nk I'd gradually ratchet up the security signals in the location bar wi= th the end result of marking sites insecure if their IP was fetched over DN= S in the clear.

Ignoring= the UI question, let me push a bit on "in the clear".

Sure, but I don't you should ig= nore the UI question. Having been on the receiving end of a few "why i= s the lock broken on our site?" emails from a CEO, I can tell you it i= s really effective.
=C2=A0

Currently, resolvers are configured by IP address, not domain name.

This is true, so companies= go for stuff like 1.1.1.1 and 8.8.8.8.
=
Right, but if you're getting that out of DHCP, that does= n't help, because you can't trust that.

=C2=A0
So absent mecha= nisms such as TRR, how does the DNS client form a secure connection to the = resolver? What domain name is in the certificate and how does the client le= arn that domain name?

I agree that there's a bootstrapping problem, but I don't think th= is draft helps with that.

I'm not saying it does. I'm just trying to work through the entire= problem. What I'm arguing here is that absent external configuration (= e.g., DoH/TRR), there's no real way to get encrypted DNS that is secure= against active attack.

-Ekr



thanks,
Rob

=C2=A0

-Ekr


=C2=A0
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">
This is distinct from choosing a DNS vendor.

thanks,
Rob


=

--000000000000622c36058dd2269a-- From nobody Tue Jul 16 13:37:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07BD312006A for ; Tue, 16 Jul 2019 13:37:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.249 X-Spam-Level: X-Spam-Status: No, score=-9.249 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=loon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 973jAaoekDms for ; Tue, 16 Jul 2019 13:37:30 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A22A120120 for ; Tue, 16 Jul 2019 13:37:30 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id m24so42222301ioo.2 for ; Tue, 16 Jul 2019 13:37:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=loon.com; s=google; h=mime-version:references:in-reply-to:reply-to:from:date:message-id :subject:to:cc; bh=QJX5YYdzMrT0KceuWfSshSthk2g2kcoj+th26sGCs0E=; b=K3z6aX0RJw/kFtcacQq4rHdqR04His4hYX8BPYyIuCfwdYW7NNSFP5GSBv9oIgWOTO XnofX2pF2zddDqtUAo1Qvc+4JAUzl4ZFk1yW07Vz6OLit6lH/U/AP1f0ITBCwXWPsSB1 dyPT/lMnzYFYe8nAL94lc3qYZOkekYNzkCckw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:reply-to :from:date:message-id:subject:to:cc; bh=QJX5YYdzMrT0KceuWfSshSthk2g2kcoj+th26sGCs0E=; b=BUflbyjiiVGXb+dnb9Oxfis1/43rKQ7NmwK8FNbtNT8gVVVPSkN8uteuihqy4B6CrS CTgVsqecL3elNMYkErYRpprpBDEtKVSfna3eTR9aBJ6dKSl2JoYhzyYLF/w5Jd1qzSr1 mhkIcg9lcvSa15epjcglcxmn/5q5sjYiE2pK6uO+P2R+BGDCawxhlYc/T2yk6juDQHuZ vJNSTyf9A7l+m8hGDe2CriYbQEMvZiYShjBtKXEnEWsxZfZnSQ6vaF+3MGlRvC8+OP06 c2BhuZyDLQTG2qDu3A80xNj/9OXRQopOLvq5xfJO1mFONmXvbwRD9OFR1AVLob4O5uuF /yfA== X-Gm-Message-State: APjAAAUGyWeKH5r9hELV24LMBQNUaaoUoZnbMOm5fEBkjAcr3woIDKAd lxKxsVHT/a2lpMRtdZD5WlJXoXJp1JBjCdoO78j81A== X-Google-Smtp-Source: APXvYqyWYlfkPXHGd68PGwAGwZObWZZCKKaPsvfQm6EP+WpyJWjBDue4O6iWX7dSFPLf1Zv0LYd/p9jAXQm97q3FhNY= X-Received: by 2002:a6b:4f0d:: with SMTP id d13mr35234768iob.170.1563309448935; Tue, 16 Jul 2019 13:37:28 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: Reply-To: ek@loon.com From: Erik Kline Date: Tue, 16 Jul 2019 13:37:16 -0700 Message-ID: To: Eric Rescorla Cc: Rob Sayre , add@ietf.org, "Dixon, Hugh" , Alec Muffett Content-Type: multipart/alternative; boundary="000000000000617b31058dd258b1" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 20:37:32 -0000 --000000000000617b31058dd258b1 Content-Type: text/plain; charset="UTF-8" On Tue, 16 Jul 2019 at 13:24, Eric Rescorla wrote: > > > On Tue, Jul 16, 2019 at 1:17 PM Rob Sayre wrote: > >> On Tue, Jul 16, 2019 at 1:11 PM Eric Rescorla wrote: >> >>> >>>> In fairness, I'm not sure I quite follow. But, if I worked at a browser >>>> vendor, I would be worried about DoH rollout too. I think I'd gradually >>>> ratchet up the security signals in the location bar with the end result of >>>> marking sites insecure if their IP was fetched over DNS in the clear. >>>> >>> >>> Ignoring the UI question, let me push a bit on "in the clear". >>> >> >> Sure, but I don't you should ignore the UI question. Having been on the >> receiving end of a few "why is the lock broken on our site?" emails from a >> CEO, I can tell you it is really effective. >> >> >>> >>> Currently, resolvers are configured by IP address, not domain name. >>> >> >> This is true, so companies go for stuff like 1.1.1.1 and 8.8.8.8. >> > > Right, but if you're getting that out of DHCP, that doesn't help, because > you can't trust that. > > >> >>> So absent mechanisms such as TRR, how does the DNS client form a secure >>> connection to the resolver? What domain name is in the certificate and how >>> does the client learn that domain name? >>> >> >> I agree that there's a bootstrapping problem, but I don't think this >> draft helps with that. >> > > I'm not saying it does. I'm just trying to work through the entire > problem. What I'm arguing here is that absent external configuration (e.g., > DoH/TRR), there's no real way to get encrypted DNS that is secure against > active attack. > When we did the DNS-over-TLS config for Android we chose it be hostname-based, on the theory that you could bootstrap using the network-provided nameservers, DNSSEC (which, admittedly, Android didn't support), and TLS (including optional browser security measures on top, perhaps cert pinning, etc.) I couldn't see how to make it much better than that. -Ekr > > > >> thanks, >> Rob >> >> >> >>> >>> -Ekr >>> >>> >>> >>> >>>> This is distinct from choosing a DNS vendor. >>>> >>>> thanks, >>>> Rob >>>> >>>> >>>> >>>> -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000617b31058dd258b1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, 16 Jul 2019 at 13:24, Eric Re= scorla <ekr@rtfm.com> wrote:
<= /div>


On Tue, Jul 16, 2019 at 1:17 PM Rob Sayre <sayrer@gmail.com> wrote:<= br>
On Tue, Jul 16, 2019 at 1:11 PM Eric Rescorla <ekr@rtfm.com> wrote:
<= /div>
=
In fairness, I'm not sure I quite follow. But, if I work= ed at a browser vendor, I would be worried about DoH rollout too. I think I= 'd gradually ratchet up the security signals in the location bar with t= he end result of marking sites insecure if their IP was fetched over DNS in= the clear.

Ignoring the= UI question, let me push a bit on "in the clear".

Sure, but I don't you should ignore= the UI question. Having been on the receiving end of a few "why is th= e lock broken on our site?" emails from a CEO, I can tell you it is re= ally effective.
=C2=A0

Currently, resolvers are configured by IP address, not domain name.
=

This is true, so companies go = for stuff like 1.1.1.1 and 8.8.8.8.

=
Right, but if you're getting that out of DHCP, that doesn= 9;t help, because you can't trust that.

=C2=A0
So absent mechanisms = such as TRR, how does the DNS client form a secure connection to the resolv= er? What domain name is in the certificate and how does the client learn th= at domain name?

I agr= ee that there's a bootstrapping problem, but I don't think this dra= ft helps with that.

I'= ;m not saying it does. I'm just trying to work through the entire probl= em. What I'm arguing here is that absent external configuration (e.g., = DoH/TRR), there's no real way to get encrypted DNS that is secure again= st active attack.

When we= did the DNS-over-TLS config for Android we chose it be hostname-based, on = the theory that you could bootstrap using the network-provided nameservers,= DNSSEC (which, admittedly, Android didn't support), and TLS (including= optional browser security measures on top, perhaps cert pinning, etc.)

I couldn't see how to make it much better than th= at.

<= div dir=3D"ltr">
-Ekr



thanks,
Rob<= /div>

=C2=A0
-Ekr


=C2=A0
This is distinct from choosing a DNS vendor.
thanks,
Rob


=
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000617b31058dd258b1-- From nobody Tue Jul 16 13:48:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A121C120133 for ; Tue, 16 Jul 2019 13:48:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q7YhUMMMB1H8 for ; Tue, 16 Jul 2019 13:48:27 -0700 (PDT) Received: from mail-lj1-x229.google.com (mail-lj1-x229.google.com [IPv6:2a00:1450:4864:20::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A67B112012B for ; Tue, 16 Jul 2019 13:48:26 -0700 (PDT) Received: by mail-lj1-x229.google.com with SMTP id k18so21331574ljc.11 for ; Tue, 16 Jul 2019 13:48:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=7RnWkt5d6VyjX7Wu9jwKpLKv+Tkgrv5ecH92q2tld7w=; b=EHTwBfhFTW3gR+9nXx4RdTsCWT/98MQZQNtkw0h7X4OUwKso1gfk3J4w4iWRbBDPvh FoDk/8AggqeDsgSqHu32Bii4kaOfpmcVDYCsavUn3A4kStRIaaLEVE9wjptK4asHY+RK wE6dfzEdrmZ46LStNzLjEbjOfO59yIWYqW/4L/oXaeRdOq+zXmo3gkENTMwBNbJYFR4l mlZs0sSv402Jh6H4fdFfz1OVu4Y+/O9lNzlM+FhmR3Ox7vCPX+vTfggR3w4DQSi1KMQ1 hmPx2hb4lEA0bySL/YZp6k4h5PZld66dPnT/UbxOfqP+iu7Lm/B9JcdESO/sm+/i/29m EN/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=7RnWkt5d6VyjX7Wu9jwKpLKv+Tkgrv5ecH92q2tld7w=; b=EPXwmdbpORAnXUDI/MWUlrJv9leGpPIp/8SbT4tNU9yew7DrQWjGa6BZg1xipBIbii 1kWTaelg+U8/BjJ9ZPys+U01Gzlmd5toEyDlnmpfkGI1F3B2S96dTx+PIhtJEza/T9FV oEVs1+GXod1tMFymGq1zftNY7Q8XnVdEWMz++stoyLfdjBlRDFFgYqmOaVcPnWZd+YAu djdlNC3ZOW387ONNUS81q4SlHYXIpJ6YhO6xrRCkeDgkkhFVWJ/n/s0JZtaKfHhlXvEi ZgQv5/bFgSOtU96GzDhRcK7BIrEC0EP7EdQWVOvIaeGrgTYuGUh5SZ0iAR8CL+3IigoF 3wPQ== X-Gm-Message-State: APjAAAWi6mjRRUQigBJNAdxeEHLjznw1MxxbzIR3b2+ImSTAyWWqft45 1iYHjGfTZMsFvi9WPNHPKNKN69r1A6KNCfM8PNI= X-Google-Smtp-Source: APXvYqyRcNFcV24RszV3O8mXbU3rzj9kKfM0YnGgVjlKU2y7FYzDhHSHXkVcTdrkK9LqZqo5RgesPxZA7uVWb6CxL4o= X-Received: by 2002:a2e:3008:: with SMTP id w8mr19052010ljw.13.1563310104963; Tue, 16 Jul 2019 13:48:24 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Tue, 16 Jul 2019 13:47:48 -0700 Message-ID: To: ek@loon.com Cc: Rob Sayre , add@ietf.org, "Dixon, Hugh" , Alec Muffett Content-Type: multipart/alternative; boundary="0000000000007afa03058dd27fbe" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 20:48:30 -0000 --0000000000007afa03058dd27fbe Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 1:37 PM Erik Kline wrote: > > > On Tue, 16 Jul 2019 at 13:24, Eric Rescorla wrote: > >> >> >> On Tue, Jul 16, 2019 at 1:17 PM Rob Sayre wrote: >> >>> On Tue, Jul 16, 2019 at 1:11 PM Eric Rescorla wrote: >>> >>>> >>>>> In fairness, I'm not sure I quite follow. But, if I worked at a >>>>> browser vendor, I would be worried about DoH rollout too. I think I'd >>>>> gradually ratchet up the security signals in the location bar with the end >>>>> result of marking sites insecure if their IP was fetched over DNS in the >>>>> clear. >>>>> >>>> >>>> Ignoring the UI question, let me push a bit on "in the clear". >>>> >>> >>> Sure, but I don't you should ignore the UI question. Having been on the >>> receiving end of a few "why is the lock broken on our site?" emails from a >>> CEO, I can tell you it is really effective. >>> >>> >>>> >>>> Currently, resolvers are configured by IP address, not domain name. >>>> >>> >>> This is true, so companies go for stuff like 1.1.1.1 and 8.8.8.8. >>> >> >> Right, but if you're getting that out of DHCP, that doesn't help, because >> you can't trust that. >> >> >>> >>>> So absent mechanisms such as TRR, how does the DNS client form a secure >>>> connection to the resolver? What domain name is in the certificate and how >>>> does the client learn that domain name? >>>> >>> >>> I agree that there's a bootstrapping problem, but I don't think this >>> draft helps with that. >>> >> >> I'm not saying it does. I'm just trying to work through the entire >> problem. What I'm arguing here is that absent external configuration (e.g., >> DoH/TRR), there's no real way to get encrypted DNS that is secure against >> active attack. >> > > When we did the DNS-over-TLS config for Android we chose it be > hostname-based, on the theory that you could bootstrap using the > network-provided nameservers, DNSSEC (which, admittedly, Android didn't > support), and TLS (including optional browser security measures on top, > perhaps cert pinning, etc.) > > I couldn't see how to make it much better than that. > Yes, this is how Firefox works as well, but that requires someone to supply Fx with the hostname. -Ekr > -Ekr >> >> >> >>> thanks, >>> Rob >>> >>> >>> >>>> >>>> -Ekr >>>> >>>> >>>> >>>> >>>>> This is distinct from choosing a DNS vendor. >>>>> >>>>> thanks, >>>>> Rob >>>>> >>>>> >>>>> >>>>> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > --0000000000007afa03058dd27fbe Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 1:37 PM Erik = Kline <ek@loon.com> wrote:


On Tue, 16 Jul 2019 at 13:24, Eric Rescorla <ekr@rtfm.com> wrote:


On Tue, Jul 16, 2019 at 1:17 PM Rob Sayre <sayrer@gmail.com> wrote:
<= div dir=3D"ltr">On Tue, Jul 16, 2019 at 1:11 PM Eric Rescorla <ekr@rtfm.com> wrote:
<= /div>
=
In fairness, I'm not sure I quite follow. But, if I work= ed at a browser vendor, I would be worried about DoH rollout too. I think I= 'd gradually ratchet up the security signals in the location bar with t= he end result of marking sites insecure if their IP was fetched over DNS in= the clear.

Ignoring the= UI question, let me push a bit on "in the clear".

Sure, but I don't you should ignore= the UI question. Having been on the receiving end of a few "why is th= e lock broken on our site?" emails from a CEO, I can tell you it is re= ally effective.
=C2=A0

Currently, resolvers are configured by IP address, not domain name.
=

This is true, so companies go = for stuff like 1.1.1.1 and 8.8.8.8.

=
Right, but if you're getting that out of DHCP, that doesn= 9;t help, because you can't trust that.

=C2=A0
So absent mechanisms = such as TRR, how does the DNS client form a secure connection to the resolv= er? What domain name is in the certificate and how does the client learn th= at domain name?

I agr= ee that there's a bootstrapping problem, but I don't think this dra= ft helps with that.

I'= ;m not saying it does. I'm just trying to work through the entire probl= em. What I'm arguing here is that absent external configuration (e.g., = DoH/TRR), there's no real way to get encrypted DNS that is secure again= st active attack.

When we= did the DNS-over-TLS config for Android we chose it be hostname-based, on = the theory that you could bootstrap using the network-provided nameservers,= DNSSEC (which, admittedly, Android didn't support), and TLS (including= optional browser security measures on top, perhaps cert pinning, etc.)

I couldn't see how to make it much better than th= at.

Yes, this is how Fire= fox works as well, but that requires someone to supply Fx with the hostname= .

-Ekr


-Ekr

<= div class=3D"gmail_quote">

thanks,
Rob

=C2=A0

=
-Ekr


=C2=A0
This is distinct from choosing a DNS vendor.

thanks,
Rob



--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000007afa03058dd27fbe-- From nobody Tue Jul 16 13:54:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9DE01200F9 for ; Tue, 16 Jul 2019 13:54:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 02htG69zfbDD for ; Tue, 16 Jul 2019 13:54:15 -0700 (PDT) Received: from mail-io1-xd42.google.com (mail-io1-xd42.google.com [IPv6:2607:f8b0:4864:20::d42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D4201200C1 for ; Tue, 16 Jul 2019 13:54:15 -0700 (PDT) Received: by mail-io1-xd42.google.com with SMTP id i10so42176743iol.13 for ; Tue, 16 Jul 2019 13:54:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=zr4jV+4myDLA/A3SFFn82CQqPPxVadG+ikcrH5rb7r4=; b=qXxQQe4D/Ia9M4/Q6vmMuhn8aBN47CLOh3gFqLeDBnTiRn4Rm0i5DTEdhIZFNXNyOf uMKkglGcFlrB8xVbt+XZNwbpLcBx5lRxxRKLL2Ip0k+Czv9sM1Dbn4Gj75EBO+uOcuj4 OhW4igRKPWbxc8FSnxaBwGmZm/X8D/8kHVMxmNYSPaURF0lQUU3u0e3GLyJDklXCVjrq g38+nTwCe7ffklZEG0t4G/zcwJrQXOlBlRt8s9JwGU5EHCPk/c9pbwgKtUGZIByLBxyb yjXa9tapC6Q7cRBYglGKq9KS6/AE5nM4vVpWVNOmNtrzKbKJyEopebBm+PIKH8N/zvNz x7Dw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=zr4jV+4myDLA/A3SFFn82CQqPPxVadG+ikcrH5rb7r4=; b=WeUkpEYN87gaPn/MibJbGTGJXslzk+mL5p7kSfVpnVwo4ZAu7jrv21NwcgP6Dl7hbc 17cdzW7fvbI5eiOQIzPFo0NYr4Y3VPD2ynDYMebV2T44w5WjTCW4DUCDR7P2n6ij0Ah+ Ls8f9huzUOYkOl48BiTYwwTbM+x8/Nzc7qBz9K6u54sMq2ItldpQuH/bIHc558ZfPnJl pG47KfLERd7orU+ScQhcbPLxkbzJSLnIMQRH8ap0RinJftpt+I/vAa6T9nGhRPIpaebA 7K83lsQ8r3iv03H0r4+67J+fR4/3r6CMH/Rzyzp0f8dNCWABKg5oNVJwWMLrzVrT6dRT vcRA== X-Gm-Message-State: APjAAAVCXS3XpEn3WHueWVgbWQwj1SISWHdfiD/ARHNa6FIKjMe9Yhwh lKWuoU8FSjPEoGDOAGKZgoShzEnqFg/wILyu2dQ= X-Google-Smtp-Source: APXvYqwVo4113DemUruwBKTADZAqQpXCGrcLKDes9YPRbjgvKNwbUysk4ZzzVzj4GvQAzZMr4r3MkUt+0e0M6167/dA= X-Received: by 2002:a5e:d618:: with SMTP id w24mr32992626iom.73.1563310454227; Tue, 16 Jul 2019 13:54:14 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Tue, 16 Jul 2019 13:54:02 -0700 Message-ID: To: Eric Rescorla Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" Content-Type: multipart/alternative; boundary="0000000000004c4a9d058dd294c7" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 20:54:17 -0000 --0000000000004c4a9d058dd294c7 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 1:23 PM Eric Rescorla wrote: > > I'm not saying it does. I'm just trying to work through the entire > problem. What I'm arguing here is that absent external configuration (e.g., > DoH/TRR), there's no real way to get encrypted DNS that is secure against > active attack. > I'm not arguing against DoH--it's great. I think browsers should enable it, and then gradually start enforcing its use. I'm not sure what the best way to solve the bootstrapping problem is, but installing some initial name servers doesn't seem so bad. After all, it's already required that autocomplete resolves to the right search engine, the update server is the right one, etc. Of course, companies should be able install their own, etc. I can't square that with a feature that automatically disables DoH in the clear, as proposed. Bootstrapping secure DNS does change the power dynamics of the internet a little bit (but not really that much... see VPNs etc), so some people might get angry. thanks, Rob --0000000000004c4a9d058dd294c7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 16, 2019 at 1:23 PM Eric = Rescorla <ekr@rtfm.com= > wrote:

I'm not say= ing it does. I'm just trying to work through the entire problem. What I= 'm arguing here is that absent external configuration (e.g., DoH/TRR), = there's no real way to get encrypted DNS that is secure against active = attack.

I'm not argui= ng against DoH--it's great. I think browsers should enable it, and then= gradually start enforcing its use. I'm not sure what the best way to s= olve the bootstrapping problem is, but installing some initial name servers= doesn't seem so bad. After all, it's already required that autocom= plete resolves to the right search engine, the update server is the right o= ne, etc. Of course, companies should be able install their own, etc.
<= div>
I can't square that with a feature that automaticall= y disables DoH in the clear, as proposed. Bootstrapping secure DNS does cha= nge the power dynamics of the internet a little bit (but not really that mu= ch... see VPNs etc), so some people might get angry.

thanks,
Rob
--0000000000004c4a9d058dd294c7-- From nobody Tue Jul 16 13:59:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE2391200C1 for ; Tue, 16 Jul 2019 13:59:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1Fn_5PxiAjkQ for ; Tue, 16 Jul 2019 13:59:39 -0700 (PDT) Received: from burnttofu.net (burnttofu.net [IPv6:2607:fc50:1:9d00::9977]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A1F7120096 for ; Tue, 16 Jul 2019 13:59:39 -0700 (PDT) Received: from elwha.brokendns.net (elwha.brokendns.net [206.125.172.202]) by burnttofu.net (8.15.2/8.15.2) with ESMTPS id x6GKxXWL045610 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 16 Jul 2019 16:59:34 -0400 (EDT) (envelope-from michael@brokendns.net) Received: from Michaels-MacBook-Pro.local (50-197-156-42-static.hfc.comcastbusiness.net [50.197.156.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by elwha.brokendns.net (5.65c/IDA-1.4.4/5.63) with ESMTPSA id A85A45D999; Tue, 16 Jul 2019 13:59:31 -0700 (PDT) To: Eric Rescorla , ek@loon.com Cc: Alec Muffett , add@ietf.org, "Dixon, Hugh" , Rob Sayre References: From: Michael Sinatra Message-ID: <84403e83-572e-06d3-2e9a-a98ff98d3f5a@brokendns.net> Date: Tue, 16 Jul 2019 13:59:29 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.6.2 (burnttofu.net [162.217.113.18]); Tue, 16 Jul 2019 16:59:36 -0400 (EDT) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 20:59:41 -0000 On 7/16/19 1:47 PM, Eric Rescorla wrote: > When we did the DNS-over-TLS config for Android we chose it be > hostname-based, on the theory that you could bootstrap using the > network-provided nameservers, DNSSEC (which, admittedly, Android > didn't support), and TLS (including optional browser security > measures on top, perhaps cert pinning, etc.) > > I couldn't see how to make it much better than that. > > > Yes, this is how Firefox works as well, but that requires someone to > supply Fx with the hostname.. This may be getting into the weeds, but unbound (for example) has mechanisms for tagging a hostname to the forwarder IP address for cert-validation purposes. Basically, the problem is solved in a similar way for DoT as in DoH. The format of the TRR is just a bit different... michael From nobody Tue Jul 16 15:59:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3694F1200A4 for ; Tue, 16 Jul 2019 15:59:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.249 X-Spam-Level: X-Spam-Status: No, score=-9.249 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=loon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xv_ALAolswmS for ; Tue, 16 Jul 2019 15:59:25 -0700 (PDT) Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 435C312013E for ; Tue, 16 Jul 2019 15:59:25 -0700 (PDT) Received: by mail-io1-xd34.google.com with SMTP id h6so42684735iom.7 for ; Tue, 16 Jul 2019 15:59:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=loon.com; s=google; h=mime-version:references:in-reply-to:reply-to:from:date:message-id :subject:to:cc; bh=Bm9sXJS78KPj8f1LkgRs65cNGRTpMogcNGuexrLOllc=; b=blGMEl1oHisOrk3TMOM01dljsSo79YEsM9Wm4cqF2v26/z9G3J/S7LBsl7RncnKYVN e4azYwKd/gmLlmMmkFqn7sPj0rmOdIdchHx9vqpdgVboQenH9s2nkJc9RopjYi9nsY7r pMaBD6//0gytYBwbQTcf93BOVxsE4nt146F/g= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:reply-to :from:date:message-id:subject:to:cc; bh=Bm9sXJS78KPj8f1LkgRs65cNGRTpMogcNGuexrLOllc=; b=rdvs+CqyWtzFvKBV5RQtA7+FuedfoOPgl50LLBkY01gGOFP7G46oFHG7ysZnvq9bje 58gQJC1xOOoHMdiBtVd6VwnP2AYYWJHgYbT2LfWLWAqONOhXXsdGBDmzBVPatyXH2Ra4 Ym8KCgOYYMjVHnfzG7vTdnBDiR9jODX4LcHBMd1yWSiODdctRnFXmVwPKB5F1W8W+gOQ eUz14fg+pgZ2kmw0fKcGHqjbWR7tds4KpT45E8dTT7gHbfQv9u1VqXtXWjPU6pr2AEBv svmMlYubaVDQGAu1l99BniI7CmukNcb3bvIRGPGxTTxax3KLhTj4YpA9mpT8t35tkRfH 7lYA== X-Gm-Message-State: APjAAAX9+DRCMMau2OaM/yGzs/7j7dxsDqjL5l6ce5yLXjdvfn7L80RD ZjSUWA6i4ishfmxmvNDP4Lnxxt7YP6youcSWaiun2g== X-Google-Smtp-Source: APXvYqya2KwUYATWUnbweNDeYVAKBMzTqizJwWmX5xWv+FZqEhSfHuY+SeN3rx7KPCPXiMMtN4hleeYBUXcFaTmdUCc= X-Received: by 2002:a02:c90d:: with SMTP id t13mr36476194jao.62.1563317964160; Tue, 16 Jul 2019 15:59:24 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: Reply-To: ek@loon.com From: Erik Kline Date: Tue, 16 Jul 2019 15:59:12 -0700 Message-ID: To: Eric Rescorla Cc: "Deen, Glenn (NBCUniversal)" , Jim Reid , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000ed6ce2058dd45357" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Firefox DoH behaviour X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 22:59:27 -0000 --000000000000ed6ce2058dd45357 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 16 Jul 2019 at 12:23, Eric Rescorla wrote: > > > On Tue, Jul 16, 2019 at 11:56 AM Deen, Glenn (NBCUniversal) < > Glenn.Deen@nbcuni.com> wrote: > >> Hi >> >> On Jul 16, 2019, at 1:56 PM, Eric Rescorla wrote: >> >> Sorry, this was badly written. Here's an attempt to clarify: >> >> if there is an enterprise policy that is set and it configures or enable= s >> DoH, then when we will respect that. If there is an enterprise policy se= t >> and it says nothing about DoH, then our plan is to disable DoH on the >> theory that with high probability the enterprise would want DoH off. >> >> When I refer to enterprise policy I mean: >> https://support.mozilla.org/en-US/products/firefox-enterprise/policies-c= ustomization-enterprise/policies-overview-enterprise >> >> >> Just so I understand, this looks like it only applies to enterprise >> managed desktops, or to PCs enrolled in a managed AD environment. >> > > Yes. > > >> Is there a general means for the enterprise to communicate it=E2=80=99s = policy >> for any Firefox instance that runs in its network? >> > > Not at present. > https://tools.ietf..org/html/draft-grover-add-policy-detection-00 > is an > exploration of one possible avenue, but as has been discussed somewhat > extensively, it's not a secure signal, so we're not sure how useful it is= . > I was wondering about the possibility of having a signal in the intarea PVD additional info JSON. Simplest: a boolean that says "our DNS servers do/do not filter". Compliant apps/OSes can observe and choose to comply. Slightly more complicated: a field that contains a list of resolvers that do filtering. Again, compliant OSes/apps can know to use those. --000000000000ed6ce2058dd45357 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, 16 Jul 2019 at 12:23, Eric Re= scorla <ekr@rtfm.com> wrote:


On Tue, Jul 16, 2019 at 11:56 AM Deen, = Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:
Hi

On Jul 16, 2019, at 1:56 PM, Eric Rescorla <ekr@rtfm.com> wrote:

Sorry, this was badly written. Here's an attempt to clarify:

if there is an enterprise policy that is set and it configures or enab= les DoH, then when we will respect that. If there is an enterprise policy s= et and it says nothing about DoH, then our plan is to disable DoH on the th= eory that with high probability the enterprise would want DoH off.


Just so I understand, this looks like it only applies to enterprise managed= desktops, or to PCs enrolled in a managed AD environment.

Yes.


Is there a general means for the enterprise to communicate it=E2=80=99= s policy for any Firefox instance that runs in its network?

Not at present. = https://tools.ietf..org/html/draft-grover-add-policy-detection-00 is an= exploration of one possible avenue, but as has been discussed somewhat ext= ensively, it's not a secure signal, so we're not sure how useful it= is.

I was wondering abou= t the possibility of having a signal in the intarea PVD a= dditional info JSON.

Simplest: a boolean that = says "our DNS servers do/do not filter". Compliant apps/OSes can = observe and choose to comply.

Slightly more compli= cated: a field that contains a list of resolvers that do filtering.=C2=A0 A= gain, compliant OSes/apps can know to use those.

= --000000000000ed6ce2058dd45357-- From nobody Tue Jul 16 22:01:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A76F1200B7 for ; Tue, 16 Jul 2019 22:01:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MbLYLr0b7x_Q for ; Tue, 16 Jul 2019 22:01:25 -0700 (PDT) Received: from mail-io1-xd36.google.com (mail-io1-xd36.google.com [IPv6:2607:f8b0:4864:20::d36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6322512000F for ; Tue, 16 Jul 2019 22:01:25 -0700 (PDT) Received: by mail-io1-xd36.google.com with SMTP id g20so43710435ioc.12 for ; Tue, 16 Jul 2019 22:01:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2fk/k8vLWwjZEtRui6RthVJVI9lQqqHikAF/52CkUeQ=; b=nFP1PvS03uLOXoZ+LABWCjPdW4WVzW084BeAdJifMbq42QWvdOxT1CzSjfvnTL5Dg5 RawCUjVi5KrnDZogbJNvv+qj7CfUp0Dlm9cZt4bWwoYT5ZMwWiwrUr9hV9hd8PhF0993 QNI1iykEPFahRlXL4hZopxzTSKG224H8Dz5tDS/YRetix24ik3NC8wjBeIJDdvjnYdo/ a3mXWqC+Onm11ioclLZQ2Bf1AgJazML1wbS530n+CTblWXz7VyHygkY6tijl53nXh923 GzEgm7WqYkF+yJ6UT7Y/aPcPCjArx2hUjrCqvtGg67+vTyFEB81vmXqGWcky6lmvTVA5 2yTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2fk/k8vLWwjZEtRui6RthVJVI9lQqqHikAF/52CkUeQ=; b=bK5eJ8TQO9LiLEd1wWMCZHte3emgPApV3PfmhnLJGKyXv5vgzaEKQk5UhvJBASUj1f 6h7x4lSKzVMzD51b3JF0bpAELa1CJ0NQvC5GXv+OK+JLaWn1s9UTnp/eiYjPTxKBonQm WsdMU8g9UZoeqte0ML/gOcg7KvZbPWJpRF+1RoMbC5pdzXBFXnmkrQW+ul4hBFoHLDAY WaEiFyfdElmZXrTpU7qWZ23gN28cjdUabvguLQWJT+lOb+mLaOcPjOEyvASAyMaV59c1 S8o6yVh37Ajp80PVobCV0u4GwlobF7HnTNY0WPCPDLPjMU10iuvBaWGHvzKNxctaaVHO egmw== X-Gm-Message-State: APjAAAXQs4MSxrEa27vpuZUMoKOTEVeKvcctuhBtJ0I9qAh07TxgIuu0 d9aLf/Cbq2Lvo8PPFmB9rcjLSwxbI+HnQs/L+ElBk0Kw4mpzUg== X-Google-Smtp-Source: APXvYqxlJrnZR5kw+AkYjQPSMRkfqvgz2lpaMFPmTNE8e26zFF0wFzl3b01rtSDZlvHG4qeoDEdrrBT5YGFhT6PgUSM= X-Received: by 2002:a02:5a02:: with SMTP id v2mr38095544jaa.124.1563339684532; Tue, 16 Jul 2019 22:01:24 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> In-Reply-To: <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> From: Rob Sayre Date: Tue, 16 Jul 2019 22:01:11 -0700 Message-ID: To: Jim Reid Cc: add@ietf.org Content-Type: multipart/alternative; boundary="0000000000008f57d2058dd96206" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 05:01:27 -0000 --0000000000008f57d2058dd96206 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 16, 2019 at 12:30 PM Jim Reid wrote: > > Whether or not these tools/services work well is another issue entirely. > And IMO not something to discuss at the IETF. > Hi Jim, I thought about this email a lot today. I think the problem with its sentiment is that whether or not tools/services work on the Internet might be fairly called "engineering", and this is the Internet Engineering Task Force, right? thanks, Rob --0000000000008f57d2058dd96206 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 16, 2019 at 12:30 PM Jim Reid= <jim@rfc1035.com> wrote:
<= /div>

Whether or not these tools/services work well is another issue entirely. An= d IMO not something to discuss at the IETF.

=
Hi Jim,

I thought about this email a lot today.

I think = the problem with its sentiment is that whether or not tools/services work o= n the Internet might be fairly called "engineering", and this is = the Internet Engineering Task Force, right?

th= anks,
Rob
=C2=A0
--0000000000008f57d2058dd96206-- From nobody Wed Jul 17 01:06:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A1701201D0 for ; Wed, 17 Jul 2019 01:06:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9wltsfZRqR4d for ; Wed, 17 Jul 2019 01:06:45 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37E9C12009C for ; Wed, 17 Jul 2019 01:06:44 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 99B796A3B5; Wed, 17 Jul 2019 10:06:42 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563350802; bh=XBLSnvgAuq9QaXdf///1B8LMXTXk+rwd9K+Vwnum7tI=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=eLjAXx01etmzy/CYYgPIgGXHIHeVieTKrRtL+9hrW4Oyz+nG2BYz2qR7kmI8aT0Gv rO3evErf8lKaKPJ+oDNpz0IhClVRELmYRcl7P6hP0neCzVM+fb8ZkdOvecSgeHbJ4i YEmnPdVju/a/kF9R/w652mOnTnFuP3WobRLfNs37qQjmMvdio+onvMzST09YJFwPlp 6QDJ4ZDfh05t+f2sCPsfa7qlvkVW8XUpVpttmfLwNGPzOyZrLIPopPqHNtzHU5Jopd mERhftYInhSGiK5bmvQPWXqJyVnZxMKcMNbbuQbS6depjfH9nSizngJpIh+r2v4cyJ TLWzxcuzUSNFQ== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 8D8333C036E; Wed, 17 Jul 2019 10:06:42 +0200 (CEST) Date: Wed, 17 Jul 2019 10:06:42 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Rob Sayre Cc: add@ietf.org Message-ID: <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev8 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 08:06:47 -0000

Il 17 luglio 2019 07:01 Rob Sayre <sayrer@gmail.com> ha scritto:


On Tue, Jul 16, 2019 at 12:30 PM Jim Reid < jim@rfc1035.com> wrote:

Whether or not these tools/services work well is another issue entirely. And IMO not something to discuss at the IETF.

Hi Jim,

I thought about this email a lot today.

I think the problem with its sentiment is that whether or not tools/services work on the Internet might be fairly called "engineering", and this is the Internet Engineering Task Force, right?
But if you have tools that work well enough that millions of people rely on them and that they are encouraged or even mandated in many countries, and you decide to develop and implement technologies to prevent them from working, this (the decision, not the development and implementation) might fairly be called "policy", and this is not the Internet Policy Task Force.

This is why, when you move outside of this organization to other circles - policy, political, business and security circles that do not belong here -, there is a sentiment that ranges from surprise to outrage when they discover that the IETF is implementing a policy decision of significant global impact in which no one but the IETF was involved.

So it would be good if we could just have a productive discussion to advance the user's privacy and security for all use cases while keeping everyone's needs together, rather than repeatedly discussing whether the needs of the others are legitimate.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
From nobody Wed Jul 17 01:35:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 613E4120250 for ; Wed, 17 Jul 2019 01:35:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UOU9yCB_K9co for ; Wed, 17 Jul 2019 01:35:36 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 021EB12023D for ; Wed, 17 Jul 2019 01:35:36 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id e20so14118098iob.9 for ; Wed, 17 Jul 2019 01:35:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=GmBIhUWStGPMocJrM56uxQ6q0uNcqDyT3pUMAkmgh2Q=; b=VHPAwwB97ve5N40NKHOcwE36+BSW2d+JJrDSg1jXRqCXesoK10zLbDlZjTPLLY02pQ Y79MCD0XwzNy7bYYtjsmvL185nVqFJ0P+Y3JgJeMqLUrc/n13GgRK0nwtLU5EIVsokRD q6oZ6ldPn9ydRBCeZk6oVdM9UXFLSKjZpQO/vDCHGGRzLWZSrIhmNoZ+iVZ42K2prWc+ 2zFkMW8b3GHBbjWKnwIZzYprm+XGoCvfqkiYIbpyvnfrNU2XpHjH2NIVinryGE/aAZ0D /JPT1O3+WaD/7KRDuZ8MPVkeriGTJ8Sy1rND1OYOx8xzZvwl28GBkgZ8vPhNDn4NCl7j S5nQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=GmBIhUWStGPMocJrM56uxQ6q0uNcqDyT3pUMAkmgh2Q=; b=UrErqu9ka1FUqgbir8GBBdVW9c5i7YictD5Pm9/eID3Imd26e5BTv8IKMYoLEqUd2S dgSc/uz+CNJNw8ucPHm7K6fDBuP+xzDdU1E4HAc36WwXLCzd5m+JpPubJCTi7xHePswN jsYO5id/JW3M+xfcqUW0Q0dgkg2QI8ngk/VXRrAwSCUPqnmCSe5aoMnbqD4Yy7J1tS84 sqy+201JusNZTYFs4W1YlDa6R3LhHUSCgQC3rTKt4mVv+WFyqFvw4Qpo0mwviTiWBKEI jeDydX6Y1QRpLB8zSWMlbRvQwP+xw7clzBZznrhEq/BKR7SiPS8yyKwpVpPDBZIOcVYU LE7w== X-Gm-Message-State: APjAAAWbodBR59JGNcancQg8IS/TiHxsb2EdQfpjX7P/D/RoZZrwtwVJ EJwD71HEjodTqpDIXkWN7APuLjepChRWDBy1dR7SKwyvcLkbmw== X-Google-Smtp-Source: APXvYqyo8YroLvgMVl+fnqiOUvvup8QJr/kNRf8gfYOaZWPmJKtNU7po7RStUiqEBOpPf6EGggGP1M/UbGgkFhiChp0= X-Received: by 2002:a05:6638:303:: with SMTP id w3mr27953994jap.103.1563352535214; Wed, 17 Jul 2019 01:35:35 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> From: Rob Sayre Date: Wed, 17 Jul 2019 01:35:23 -0700 Message-ID: To: Vittorio Bertola Cc: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000852ff2058ddc6036" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 08:35:37 -0000 --000000000000852ff2058ddc6036 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 1:06 AM Vittorio Bertola < vittorio.bertola@open-xchange.com> wrote: > But if you have tools that work well enough that millions of people rely > on them and that they are encouraged or even mandated in many countries, > and you decide to develop and implement technologies to prevent them from > working, this (the decision, not the development and implementation) might > fairly be called "policy", and this is not the Internet Policy Task Force. > That's a great point. Can't argue with that. thanks, Rob --000000000000852ff2058ddc6036 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 17, 2019 at 1:06 AM Vittorio = Bertola <vittorio.bertola@open-xchange.com> wrote:
But if you have tools that work well enough that millions of people rely= on them and that they are encouraged or even mandated in many countries, a= nd you decide to develop and implement technologies to prevent them from wo= rking, this (the decision, not the development and implementation) might fa= irly be called "policy", and this is not the Internet Policy Task= Force.=C2=A0

That's a = great point. Can't argue with that.

thanks,
Rob=C2=A0
--000000000000852ff2058ddc6036-- From nobody Wed Jul 17 07:05:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87056120410 for ; Wed, 17 Jul 2019 07:05:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mtyeLaEaTuB7 for ; Wed, 17 Jul 2019 07:05:37 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3546A120074 for ; Wed, 17 Jul 2019 07:05:37 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id z3so45960928iog.0 for ; Wed, 17 Jul 2019 07:05:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9I8kDbi039TYjZ0aOL9iLRPq5s/1lPcPkoV5rOL8M6k=; b=o1L6A1Zd+bt/d69hho75ENHjTZ8WJg/B2cAYsjvZzrRKT9+ucS2vVecSf3zLeLxXnj /9YGJMoHe7OgfRcUgVe/Bx+PRqmxTT1y2wd9WwV+jC+t8OBGHVJSW/Q+4FccB3AgaQVT M5xu/FCdviWWbU2aBMf6qh/yQ3bFeRZ7tI6kjZFjet4zTKl5tyEf57VJ96DiS9TsUNWn YkJILHJeibrCQEA2yi6jk0sDUkOOJ5Ka8yuIhysneRWb3NYkDD78yIPB4W9Bng/ZJKsg davs3GqHNq4W9XXLKrTDDWR6Sa3JkI6iMp0UnoAnaswcduZ71pMsjhhhlVJ/tTkZLdpe GFkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9I8kDbi039TYjZ0aOL9iLRPq5s/1lPcPkoV5rOL8M6k=; b=ADO5MPNflloI8HzlWsHQntoSCm2s1v/eVdo86ZVRVjvQ5d12a4ZBtOll7G1A37OzAJ DMlNJyI+w2Lnocz4JxXy8fg5u6LjAQTQZmyrb25SRkdRjnA0JE12E4EaONTgT1KBrpbN mfz7HjhmrCR6r5L1kOqasjDb5my9Blk2ne30Cv0CIE8I0U+wESDrmR31ADWw+/N2I8ey 5AepMwMry3bW0jduup8zCVho3lNTJsmb1M2WU3TH5I4sM3Y9I9Hi/Yhwiq0MlDqe3b/M 10yoTJPnxyQWKrDFx7nOsxibM3zc/MllJvhDU2itAJzVPjAYMycMcb5W0TfdaMjwZ+vp HVgQ== X-Gm-Message-State: APjAAAXt5zn18Nif8eKF6dxxDNbIbVEjr8uaVl0S8AhWOQPB/aeupZyb XbWg5typ251OMAevL4QqKxPCBJTidRtFlvQxE2Q= X-Google-Smtp-Source: APXvYqxaW5vJf9SlIv2KpMTLQ3x/2bLiypKweUrP/0sJiR6UkorkCCccWndJDtiq4hFuS5VlU+GqUtNVLQMc6mjOu60= X-Received: by 2002:a6b:6f06:: with SMTP id k6mr28977312ioc.32.1563372336514; Wed, 17 Jul 2019 07:05:36 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: tirumal reddy Date: Wed, 17 Jul 2019 19:35:24 +0530 Message-ID: To: Eric Rescorla Cc: Rob Sayre , ADD Mailing list , "Dixon, Hugh" , Alec Muffett Content-Type: multipart/alternative; boundary="000000000000c50daa058de0fcee" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 14:05:39 -0000 --000000000000c50daa058de0fcee Content-Type: text/plain; charset="UTF-8" On Wed, 17 Jul 2019 at 01:41, Eric Rescorla wrote: > > > On Tue, Jul 16, 2019 at 1:02 PM Rob Sayre wrote: > >> >> >> On Tue, Jul 16, 2019 at 12:53 PM Eric Rescorla wrote: >> >>> >>> Taking a TRR-style system out of the equation for a moment. Suppose that >>> what I want is for all devices on my network to use a filtering resolver. I >>> don't expect any evasion because they're all my devices, it's just a matter >>> of convenience to centrally configure it. So what I do here is I configure >>> my DHCP server to provide the IP address of that resolver. Now, those >>> devices do unencrypted DNS because that's what everyone does. Now, suppose >>> that resolver starts offering DoT. How do my devices learn that >>> information? The resolver could tell them over DNS but then we have a >>> straightforward downgrade attack from anyone on the network. Do you agree >>> with this so far? Do you have a proposed solution? >>> >> >> In fairness, I'm not sure I quite follow. But, if I worked at a browser >> vendor, I would be worried about DoH rollout too. I think I'd gradually >> ratchet up the security signals in the location bar with the end result of >> marking sites insecure if their IP was fetched over DNS in the clear. >> > > Ignoring the UI question, let me push a bit on "in the clear". > > Currently, resolvers are configured by IP address, not domain name. So > absent mechanisms such as TRR, how does the DNS client form a secure > connection to the resolver? What domain name is in the certificate and how > does the client learn that domain name? > https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-04 discusses mechanism to automatically bootstrap endpoints to discover and authenticate DoT/DoH servers provided by a local network. The client securely learns the domain name and DNS server certificate. Cheers, -Tiru > > -Ekr > > > > >> This is distinct from choosing a DNS vendor. >> >> thanks, >> Rob >> >> >> >> -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000c50daa058de0fcee Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Wed, 17 Jul 2019 at 01:41, Eric Rescor= la <ekr@rtfm.com> wrote:


On Tue, Jul 16, 2019 at 1:02 PM Rob Sayre <sayrer@gmail.com> wrote:
<= div dir=3D"ltr">

On Tue, Jul 16, 2019 at 12:53 PM Eric Rescorla <ekr@rtfm.com> wrote:

Taking a TRR-style system out of= the equation for a moment. Suppose that what I want is for all devices on = my network to use a filtering resolver. I don't expect any evasion beca= use they're all my devices, it's just a matter of convenience to ce= ntrally configure it. So what I do here is I configure my DHCP server to pr= ovide the IP address of that resolver. Now, those devices do unencrypted DN= S because that's what everyone does. Now, suppose that resolver starts = offering DoT. How do my devices learn that information? The resolver could = tell them over DNS but then we have a straightforward downgrade attack from= anyone on the network. Do you agree with this so far? Do you have a propos= ed solution?

In fairness,= I'm not sure I quite follow. But, if I worked at a browser vendor, I w= ould be worried about DoH rollout too. I think I'd gradually ratchet up= the security signals in the location bar with the end result of marking si= tes insecure if their IP was fetched over DNS in the clear.

Ignoring the UI question, let me push a= bit on "in the clear".

Currently, resol= vers are configured by IP address, not domain name. So absent mechanisms su= ch as TRR, how does the DNS client form a secure connection to the resolver= ? What domain name is in the certificate and how does the client learn that= domain name?

https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-04= =C2=A0discusses mechanism to automatically bootstrap endpoints to discover = and authenticate DoT/DoH servers provided by a local network. The client se= curely learns the domain name and DNS server certificate.
Cheers,
-Tiru
=C2=A0

-Ekr


=C2=A0
This is distinct from choosing a D= NS vendor.

thanks,
Rob



--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000c50daa058de0fcee-- From nobody Wed Jul 17 08:25:49 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FD701207FA for ; Wed, 17 Jul 2019 08:25:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yMDvngYMgBtd for ; Wed, 17 Jul 2019 08:25:45 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BBE5120794 for ; Wed, 17 Jul 2019 08:25:45 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id k8so46445698iot.1 for ; Wed, 17 Jul 2019 08:25:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jtK3cbx/mmTxb8KjlJuOCFEQ4BD09NNXVf7ZgPqmvDQ=; b=tcDpxRHmRoX7A6xqtT17F2OJ/uw1OR7a/sCxrizKGU9VbnkZXoJ7R7TpWwlhOPpTpi A3G95WVqpyxzr1rmpE6hDJw/182Vqomuas/2lFJVW/vOp5Eb8iKxGfKu/2/71KDSdjSl O9TOaabA5bEPwJTkCL/1YvEc0qViOPdZKBt2MSnk7T8qD/GVmYjNfmBJZBry42lpzilT ivHQ+kYzOr7Co9lbIefRibMkcI34MZrLm4D0FaLuZwYsDj2U89/xz4NiCwceulizNdCT gU0MmHGkhJMR1RorQ2odK3Xvn+XxaPPTMrANUgaEnkY06ptVtEcKADt5t+xB6Ue8j8W+ aV8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jtK3cbx/mmTxb8KjlJuOCFEQ4BD09NNXVf7ZgPqmvDQ=; b=iNv6NlGCskIMXbNwp7vTSZgKSAH5mp28FYE9ZjtN3+ZO8sTXoige31LEBSYQBoZ0ux IGSx2zc3gmqbolgcXQJOpK/ysJOAFEs1GPdrORyTs1ApihBlzMDyBreZ4R1pJ94hz6zU UWzeNuhJ504B5doR1Lryjd2jMM2Z8zfnTrSQ1s2X0g32sXNoL6/kBhc3JAAAjjkrKSmV MRpSeyeZQnPH62jrgdQb29G6EYdajgzGN1RruxPhNg/FSIMt/PpwZ/ozfKksGdsBlWzz NbaXD4xR89RYBV0USN09g5eNYLJVpKcYwHeBV/aq1We0hb0y443XbCJTNEYOOy+zV3eG 7ESw== X-Gm-Message-State: APjAAAWkyzMz1kNkHS/PZ3q77r+Di0rN3lIwT9w6LxXQuX8RTbmdsJ9s jN0KcPMAFozRFlI6SyeLiJwZu5MuB3XleD7cbhI= X-Google-Smtp-Source: APXvYqzJ/wTCVpQkEMAai20wWXgbCC64zIvvs3Zhe1S614N12GYbxRo1pFvIzgMjUUwa2Rp1+TMO/4Te5xVsreBfaWs= X-Received: by 2002:a5d:8e08:: with SMTP id e8mr39679462iod.139.1563377144744; Wed, 17 Jul 2019 08:25:44 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> From: Ted Hardie Date: Wed, 17 Jul 2019 08:25:17 -0700 Message-ID: To: Vittorio Bertola Cc: Rob Sayre , add@ietf.org Content-Type: multipart/alternative; boundary="0000000000005cce9c058de21bfb" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 15:25:47 -0000 --0000000000005cce9c058de21bfb Content-Type: text/plain; charset="UTF-8" Hi Vittorio, On Wed, Jul 17, 2019 at 1:06 AM Vittorio Bertola wrote: > > Il 17 luglio 2019 07:01 Rob Sayre ha scritto: > > > On Tue, Jul 16, 2019 at 12:30 PM Jim Reid < jim@rfc1035.com> wrote: > > > Whether or not these tools/services work well is another issue entirely. > And IMO not something to discuss at the IETF. > > > Hi Jim, > > I thought about this email a lot today. > > I think the problem with its sentiment is that whether or not > tools/services work on the Internet might be fairly called "engineering", > and this is the Internet Engineering Task Force, right? > > But if you have tools that work well enough that millions of people rely > on them and that they are encouraged or even mandated in many countries, > and you decide to develop and implement technologies to prevent them from > working > The IETF builds building blocks that meet specific needs. In building DNS over TLS, DNS over DTLS, and DNS over HTTPS, it was adding the protocol functionality to make DNS queries confidential from inspection by network observers. The energy for that work was the reaction to pervasive surveillance, but it is clear that other attackers had been gathering data for some time. The IETF was not building these protocols to stop the use of the DNS as a policy enforcement mechanism and it is entirely possible to integrate them into a system which does this by offering the policy enforcing resolver over one of these confidential protocols. But, and this is the crux of the matter, that integration requires the cooperation of the endpoint or its control by an organization's system administrators. If you do not have their cooperation or the right to manage them by tools like those Eric mentions, it is difficult for the endpoint to distinguish a network-level interception by a mandated policy engine and by an attacker. Rather than falling back to the state where the endpoint simple accepts that its traffic is visible to all and possibly intercepted, this new work is an effort to make it easier for you to gain the cooperation required. I hope you can see that this is in both the interest of policy enforcement bodies and the end users. best regards, Ted --0000000000005cce9c058de21bfb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Vittorio,

On Wed, Jul 17, 2019 at 1= :06 AM Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:
=20 =20 =20





--0000000000005cce9c058de21bfb-- From nobody Wed Jul 17 08:38:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C2449120105 for ; Wed, 17 Jul 2019 08:38:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RWrHeXTwlDPg for ; Wed, 17 Jul 2019 08:38:51 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B73B12008A for ; Wed, 17 Jul 2019 08:38:51 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id E8C886A3B4; Wed, 17 Jul 2019 17:38:48 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563377928; bh=qaIsKN3aocgVJiVTTwpFkywsg10NwBvFDa0cAdG+qe4=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=vIRElPLbz+vj/t8kNPJrHZ+z9xyzedguojsk+EgjWrUZgxJ+bcao/JaLk4gY48V9S RXXBb9ldhPol5wTMf42JV4IIPnPHOJaInqH6bDOPxyqRslDbraLO4a17uiPklkJwWJ 1DoJ213vlYC+F4F4O/8gXh6KRk/SEsgLiNxDRgwYMxYxfVnBjq7dKyIrcqtFirs2rr Q+R94xjMn6PQtElrEBGCwBN5imB9iDT1HrRUQpiUit0aOUiR67biUodXfentAg6cCd NVdyEPcYk7NhdRH5q95QUEUjYxGtcHw3wYCIP6t07qvIwYU/FgWqGdVyC6Y6CTpGuJ Qkf3FP8E9Gvuw== Received: from [10.242.2.29] (unknown [10.242.2.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 4BAFC3C0101; Wed, 17 Jul 2019 17:38:48 +0200 (CEST) From: Neil Cook Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_B06E432F-C5A5-4491-8708-014353C1D1C3" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 17 Jul 2019 16:38:46 +0100 In-Reply-To: Cc: Vittorio Bertola , add@ietf.org, Rob Sayre To: Ted Hardie References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 15:38:55 -0000 --Apple-Mail=_B06E432F-C5A5-4491-8708-014353C1D1C3 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Ted, > But, and this is the crux of the matter, that integration requires the = cooperation of the endpoint or its control by an organization's system = administrators. If you do not have their cooperation or the right to = manage them by tools like those Eric mentions, it is difficult for the = endpoint to distinguish a network-level interception by a mandated = policy engine and by an attacker. =20 >=20 > Rather than falling back to the state where the endpoint simple = accepts that its traffic is visible to all and possibly intercepted, = this new work is an effort to make it easier for you to gain the = cooperation required. I hope you can see that this is in both the = interest of policy enforcement bodies and the end users. So I use DNS filtering in my own house (along with millions of other = people as already stated on this thread), provided by my network = operator (but it doesn=E2=80=99t have to be - I used to use OpenDNS for = example, and I have the capability to run my own resolver if I so = desired). I have malware filtering as well as parental controls enabled. = I am the de-facto network administrator in my house, but I don=E2=80=99t = have the tools or software that enterprises use so I won=E2=80=99t = benefit from the work being done to help enterprises control this. I = also have other people coming into my house and using my network, and I = also like to control what they can access when they are in my home. All = of this works very well for me today. It doesn=E2=80=99t work for me = when applications/endpoints start deciding that my network is an = attacker because it does filtering, and bypassing that filtering "in the = interest of end-users". > I hope you can see that this is in both the interest of policy = enforcement bodies and the end users. I=E2=80=99d like to ask, ask an end-user, how is this in my interests? Neil > On 17 Jul 2019, at 16:25, Ted Hardie wrote: >=20 > Hi Vittorio, >=20 > On Wed, Jul 17, 2019 at 1:06 AM Vittorio Bertola = > wrote: >=20 >> Il 17 luglio 2019 07:01 Rob Sayre > ha scritto: >>=20 >>=20 >> On Tue, Jul 16, 2019 at 12:30 PM Jim Reid < jim@rfc1035.com = > wrote:=20 >>=20 >> Whether or not these tools/services work well is another issue = entirely. And IMO not something to discuss at the IETF.=20 >>=20 >> Hi Jim,=20 >>=20 >> I thought about this email a lot today.=20 >>=20 >> I think the problem with its sentiment is that whether or not = tools/services work on the Internet might be fairly called = "engineering", and this is the Internet Engineering Task Force, right? > But if you have tools that work well enough that millions of people = rely on them and that they are encouraged or even mandated in many = countries, and you decide to develop and implement technologies to = prevent them from working >=20 > The IETF builds building blocks that meet specific needs. In building = DNS over TLS, DNS over DTLS, and DNS over HTTPS, it was adding the = protocol functionality to make DNS queries confidential from inspection = by network observers. The energy for that work was the reaction to = pervasive surveillance, but it is clear that other attackers had been = gathering data for some time. The IETF was not building these protocols = to stop the use of the DNS as a policy enforcement mechanism and it is = entirely possible to integrate them into a system which does this by = offering the policy enforcing resolver over one of these confidential = protocols. =20 >=20 > But, and this is the crux of the matter, that integration requires the = cooperation of the endpoint or its control by an organization's system = administrators. If you do not have their cooperation or the right to = manage them by tools like those Eric mentions, it is difficult for the = endpoint to distinguish a network-level interception by a mandated = policy engine and by an attacker. =20 >=20 > Rather than falling back to the state where the endpoint simple = accepts that its traffic is visible to all and possibly intercepted, = this new work is an effort to make it easier for you to gain the = cooperation required. I hope you can see that this is in both the = interest of policy enforcement bodies and the end users. >=20 > best regards, >=20 > Ted >=20 >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add = Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_B06E432F-C5A5-4491-8708-014353C1D1C3 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Ted,

But, and this = is the crux of the matter, that integration requires the cooperation of = the endpoint or its control by an organization's system = administrators.  If you do not have their cooperation or the right = to manage them by tools like those Eric mentions, it is difficult for = the endpoint to distinguish a network-level interception by a mandated = policy engine and by an attacker.  

Rather than falling back = to the state where the endpoint simple accepts that its traffic is = visible to all and possibly intercepted, this new work is an effort to = make it easier for you to gain the cooperation required.  I hope = you can see that this is in both the interest of policy enforcement = bodies and the end users.

So I use DNS filtering in my own house (along with millions = of other people as already stated on this thread), provided by my = network operator (but it doesn=E2=80=99t have to be - I used to use = OpenDNS for example, and I have the capability to run my own resolver if = I so desired). I have malware filtering as well as parental controls = enabled. I am the de-facto network administrator in my house,  but = I don=E2=80=99t have the tools or software that enterprises use so I = won=E2=80=99t benefit from the work being done to help enterprises = control this. I also have other people coming into my house and using my = network, and I also like to control what they can access when they are = in my home. All of this works very well for me today. It doesn=E2=80=99t = work for me when applications/endpoints start deciding that my network = is an attacker because it does filtering, and bypassing that filtering = "in the interest of end-users".

I = hope you can see that this is in both the interest of policy enforcement = bodies and the end users.

I=E2=80=99d like to ask, ask an = end-user, how is this in my interests?

Neil

On 17 Jul 2019, at 16:25, Ted Hardie <ted.ietf@gmail.com> = wrote:

Hi Vittorio,

On Wed, Jul 17, 2019 at 1:06 AM = Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:

Il = 17 luglio 2019 07:01 Rob Sayre <sayrer@gmail.com> ha = scritto:


On Tue, Jul 16, 2019 at 12:30 PM Jim Reid < jim@rfc1035.com> wrote: 

Whether or = not these tools/services work well is another issue entirely. And IMO = not something to discuss at the IETF. 

Hi Jim, 

I thought about this email a lot today. 

I think the problem with its sentiment is that whether or not = tools/services work on the Internet might be fairly called = "engineering", and this is the Internet Engineering Task Force, = right?
But if you have = tools that work well enough that millions of people rely on them and = that they are encouraged or even mandated in many countries, and you = decide to develop and implement technologies to prevent them from = working

The IETF builds building blocks that = meet specific needs.  In building DNS over TLS, DNS over DTLS, and = DNS over HTTPS, it was adding the protocol functionality to make DNS = queries confidential from inspection by network observers.  The = energy for that work was the reaction to pervasive surveillance, but it = is clear that other attackers had been gathering data for some = time.  The IETF was not building these protocols to stop the use of = the DNS as a policy enforcement mechanism and it is entirely possible to = integrate them into a system which does this by offering the policy = enforcing resolver over one of these confidential protocols.  

But, and this is the = crux of the matter, that integration requires the cooperation of the = endpoint or its control by an organization's system = administrators.  If you do not have their cooperation or the right = to manage them by tools like those Eric mentions, it is difficult for = the endpoint to distinguish a network-level interception by a mandated = policy engine and by an attacker.  

Rather than falling back = to the state where the endpoint simple accepts that its traffic is = visible to all and possibly intercepted, this new work is an effort to = make it easier for you to gain the cooperation required.  I hope = you can see that this is in both the interest of policy enforcement = bodies and the end users.

best regards,

Ted


-- 
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_B06E432F-C5A5-4491-8708-014353C1D1C3-- From nobody Wed Jul 17 08:54:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D59F512081F for ; Wed, 17 Jul 2019 08:54:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JlI9bhTnhCOy for ; Wed, 17 Jul 2019 08:54:26 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8C58E12080E for ; Wed, 17 Jul 2019 08:54:12 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id A663EBE47; Wed, 17 Jul 2019 16:54:10 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U6JGj7p_eHoK; Wed, 17 Jul 2019 16:54:09 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 1E75ABE7B; Wed, 17 Jul 2019 16:54:09 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1563378849; bh=hoT03yqWKQfvmqtHD7ChplGxbCG+oJ+M1f8N15djEb4=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=SIJloaAba032Tum3jISm7ev/Ix0VkOzPyUE910YyV4poTf0lBylCGyx2rkC7tyPDJ rWw5egaFQUV9KOqNLrUok7a4kpya12I65CZe8xVzUmN6kY9aIzgiuRnxoz+cqE/6ps shliTMQaavp5sOe1dFTSHDE75Wjl58vqUe/21fOQ= To: Neil Cook , Ted Hardie Cc: Vittorio Bertola , add@ietf.org, Rob Sayre References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <253de125-ff1c-31e6-6ca7-e7cb81d1206b@cs.tcd.ie> Date: Wed, 17 Jul 2019 16:54:07 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="ARv41OxTK7ZbbiyP5qRyG97ukvRbskHIN" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 15:54:29 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ARv41OxTK7ZbbiyP5qRyG97ukvRbskHIN Content-Type: multipart/mixed; boundary="1yplJdp3wXniBGjzTMt3JzOKHx888FqLC"; protected-headers="v1" From: Stephen Farrell To: Neil Cook , Ted Hardie Cc: Vittorio Bertola , add@ietf.org, Rob Sayre Message-ID: <253de125-ff1c-31e6-6ca7-e7cb81d1206b@cs.tcd.ie> Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: --1yplJdp3wXniBGjzTMt3JzOKHx888FqLC Content-Type: multipart/mixed; boundary="------------37973DF6A0C31C05EF90F409" Content-Language: en-GB This is a multi-part message in MIME format. --------------37973DF6A0C31C05EF90F409 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 17/07/2019 16:38, Neil Cook wrote: > So I use DNS filtering in my own house (along with millions of other > people as already stated on this thread), provided by my network > operator (but it doesn=E2=80=99t have to be - I used to use OpenDNS for= > example, and I have the capability to run my own resolver if I so > desired). I have malware filtering as well as parental controls > enabled. I am the de-facto network administrator in my house, but I > don=E2=80=99t have the tools or software that enterprises use so I won=E2= =80=99t > benefit from the work being done to help enterprises control this. I > also have other people coming into my house and using my network, and > I also like to control what they can access when they are in my home. > All of this works very well for me today. It doesn=E2=80=99t work for m= e when > applications/endpoints start deciding that my network is an attacker > because it does filtering, and bypassing that filtering "in the > interest of end-users". I don't question your right to do as you do, but as an (I hope) equally valid single data point, I don't do the above and would be fine if visitors to my home network used DoH with an external service without being under my control. Going further, were I to enforce my DNS policy choices on visitors to my home network without explaining those, (which is mostly impractical), I would consider myself to be potentially attacking visitors to my home, which is IMO inhospitable. There are multiple valid conflicting setups here and the issue I think is that the application doing DNS can't detect which are in play, so the application developer has to try pick a safe default I guess. Not an easy task. S. --------------37973DF6A0C31C05EF90F409 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------37973DF6A0C31C05EF90F409-- --1yplJdp3wXniBGjzTMt3JzOKHx888FqLC-- --ARv41OxTK7ZbbiyP5qRyG97ukvRbskHIN Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0vRJ8ACgkQWrL68XsX K+pjshAAu+C6v9nu2zUfTRpv2IM57Q0Su/2PnohkiC7J5aQlCLUKOzqrvH79JsEK n8YWgWDGOCp4bGKVs6BcgYUhmsP3pgjXigP0D35NShmg9mHfHdVwUbl4+9biWC20 kuZe6Q8ScWwn8J/p5HEftd5uAB/+d7asG6tZL/ruJKatg5as+A9rJg8tHAB2lwZf wwfJACVbp1qw2jeFBWy6u48yuz6J97KvTC0ONqVonHX/xykaC2UzYQ4h1ggUkC8s LLMesblTZhh2wsHLeeUppzkJQtdeQUCZnMW8M7Yf2ibZnb2pTQFfLaz69lJO4pso PDzL4XSKKKjVr3ZbB9bIkbBQ7d5ReVfe6xVp8DyC5Kk6mZDjyvRibeQ6WVXZJSDx a+NHluXJ5NPEVOxxO14D5w03f10K09bfyVfJ84XwnI/ySgDlCFmkD+N8h0Aq4oaN vx0GOIl8FB0ClV5XKoeVNi5AWxt9iXP5+UkDtnrkLp09rUrcfbBOVc0j96FQuY/c w93ddHGIqD6tQ/zhTYtQQcqgLhot5GGf5l0iYJkDuVsIFXpcZVoKdqQ8WmnoIWYB 7EQeorjQdIP97m0Xw1rJ5moBAipGqgQ+3OhfkMaJPF5CeY/iJtrYB1SLTDsOAJGv tyPHSO7X79C2VDqf56lBekvFJFy2yoYpFUdZzcC2HAZ/ErmQnQo= =ZlnC -----END PGP SIGNATURE----- --ARv41OxTK7ZbbiyP5qRyG97ukvRbskHIN-- From nobody Wed Jul 17 08:58:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54E6B1203CF for ; Wed, 17 Jul 2019 08:58:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eCvSzTFUuXIb for ; Wed, 17 Jul 2019 08:58:09 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E589712019C for ; Wed, 17 Jul 2019 08:58:07 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id z3so46598094iog.0 for ; Wed, 17 Jul 2019 08:58:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=PCUA4mb10vQBx4L8KDewvPFCtNb0WPZXjo6Rwskd4Hw=; b=MK7zVLkWMeZ/t/GPQgMKBZUmaynii42C26+iC+iTygpXlm7ikVZe3MsKRHoHtLwFCn PYqqKY3443bATu81hG34eWuV8Z7PovpXznAiHqgWuZK7y3i93Fe9InMEAf+hohEw1iHz UHHhEx0WSJ2vLbPrz/u/mjdshir5K90/njaKVBOs3nTKFfQSRdTCT62Ma9QgdoKGv/F3 MsNytpjeYzpsQWr+oFBG/p/qxEtxtrrgZKASSzrv/O7dQvhKr0prLcsviWSg9cPudNAf ZfMsDDWTH8l/9R9Es9LX2HtlpYQhl66gRD0wxBnRPuhUQPF8ymLO38k+peyuKDlJeQS9 8QWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=PCUA4mb10vQBx4L8KDewvPFCtNb0WPZXjo6Rwskd4Hw=; b=AF1aL7NONxIZimhesHjZbHEKobqhqmFYJSKS6wf1EPCeSNxq5aE9PimnXMYjgyop4n wrlkEg6SVqPhm2HNdxdSQQ5pCiAmkYtfceWL19gz1kdA74d8RR1AZLNv8Qa046esp8hT EfJlpK7ZnuAVw38nNjFzSsCpPPVCFw9gc+mmVgk7TVxAnsMShe0Q7JRZAj1qspums3wg /thReFVJY4Di6jo04jmZ+FgBemDX/4b7s/4URfFFGpvc9b5M7RnHYsXfLITf7cKzqNKC 3yy4rDqdzo+dCKz54HcGJdyDOdqYir6w1kXFOe5PPn1FY5qSFWuyd4WctIxXZleJ5hXo 4CuA== X-Gm-Message-State: APjAAAVUvxvjOT3RHF06cB1yhIVIdg7DTFiRtP3Z+3rG3qdJKymTc+U9 h9nFtgm0KQzzo+wJ1ahC8glXdqARuKLiVzkkmGU= X-Google-Smtp-Source: APXvYqzXV5Qmgn0bgXUXxxYGFFpiDOHCJEUZFnOV23r6yGU65e4wz8KqN32qswpQay7irbym0bPUwDMznfUyr4afHN4= X-Received: by 2002:a6b:7017:: with SMTP id l23mr36162719ioc.159.1563379087047; Wed, 17 Jul 2019 08:58:07 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: From: Ted Hardie Date: Wed, 17 Jul 2019 08:57:39 -0700 Message-ID: To: Neil Cook Cc: Vittorio Bertola , add@ietf.org, Rob Sayre Content-Type: multipart/alternative; boundary="0000000000002206d5058de28f85" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 15:58:12 -0000 --0000000000002206d5058de28f85 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Neil, On Wed, Jul 17, 2019 at 8:38 AM Neil Cook wrote: > Hi Ted, > > But, and this is the crux of the matter, that integration requires the > cooperation of the endpoint or its control by an organization's system > administrators. If you do not have their cooperation or the right to > manage them by tools like those Eric mentions, it is difficult for the > endpoint to distinguish a network-level interception by a mandated policy > engine and by an attacker. > > Rather than falling back to the state where the endpoint simple accepts > that its traffic is visible to all and possibly intercepted, this new wor= k > is an effort to make it easier for you to gain the cooperation required. = I > hope you can see that this is in both the interest of policy enforcement > bodies and the end users. > > > So I use DNS filtering in my own house (along with millions of other people > as already stated on this thread), provided by my network operator (but i= t > doesn=E2=80=99t have to be - I used to use OpenDNS for example, and I hav= e the > capability to run my own resolver if I so desired). I have malware > filtering as well as parental controls enabled. I am the de-facto network > administrator in my house, but I don=E2=80=99t have the tools or softwar= e that > enterprises use so I won=E2=80=99t benefit from the work being done to he= lp > enterprises control this. I also have other people coming into my house a= nd > using my network, and I also like to control what they can access when th= ey > are in my home. All of this works very well for me today. It doesn=E2=80= =99t work > for me when applications/endpoints start deciding that my network is an > attacker because it does filtering, and bypassing that filtering "in the > interest of end-users". > > I hope you can see that this is in both the interest of policy enforcemen= t > bodies and the end users. > > > I=E2=80=99d like to ask, ask an end-user, how is this in my interests? > > I am sorry if I was not clear, The point of the draft is to enable the network operator to signal this: If the user agent can check for the presence of a policy, this could be used as a signal that the network operator wishes its resolver to be used as a condition of using the network, and that DoH or DoT should be disabled. That permits your guests to know of your network policy and to abide by it if they choose; presumably you would not provide network access if they chose not to. regards, Ted Hardie Neil > > On 17 Jul 2019, at 16:25, Ted Hardie wrote: > > Hi Vittorio, > > On Wed, Jul 17, 2019 at 1:06 AM Vittorio Bertola 40open-xchange.com@dmarc.ietf.org> wrote: > >> >> Il 17 luglio 2019 07:01 Rob Sayre ha scritto: >> >> >> On Tue, Jul 16, 2019 at 12:30 PM Jim Reid < jim@rfc1035.com> wrote: >> >> >> Whether or not these tools/services work well is another issue entirely. >> And IMO not something to discuss at the IETF. >> >> >> Hi Jim, >> >> I thought about this email a lot today. >> >> I think the problem with its sentiment is that whether or not >> tools/services work on the Internet might be fairly called "engineering"= , >> and this is the Internet Engineering Task Force, right? >> >> But if you have tools that work well enough that millions of people rely >> on them and that they are encouraged or even mandated in many countries, >> and you decide to develop and implement technologies to prevent them fro= m >> working >> > > The IETF builds building blocks that meet specific needs. In building DN= S > over TLS, DNS over DTLS, and DNS over HTTPS, it was adding the protocol > functionality to make DNS queries confidential from inspection by network > observers. The energy for that work was the reaction to pervasive > surveillance, but it is clear that other attackers had been gathering dat= a > for some time. The IETF was not building these protocols to stop the use > of the DNS as a policy enforcement mechanism and it is entirely possible = to > integrate them into a system which does this by offering the policy > enforcing resolver over one of these confidential protocols. > > But, and this is the crux of the matter, that integration requires the > cooperation of the endpoint or its control by an organization's system > administrators. If you do not have their cooperation or the right to > manage them by tools like those Eric mentions, it is difficult for the > endpoint to distinguish a network-level interception by a mandated policy > engine and by an attacker. > > Rather than falling back to the state where the endpoint simple accepts > that its traffic is visible to all and possibly intercepted, this new wor= k > is an effort to make it easier for you to gain the cooperation required. = I > hope you can see that this is in both the interest of policy enforcement > bodies and the end users. > > best regards, > > Ted > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > > Neil Cook > neil.cook@open-xchange.com > > > -------------------------------------------------------------------------= ------------ > Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court > Nuremberg HRB 24738 > Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael > Knapstein, Stephan Martin > Chairman of the Board: Richard Seibt > > European Office: > Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District > Court Siegen, HRB 8718 > Managing Director: Frank Hoberg > > US Office: > Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA > > -------------------------------------------------------------------------= ------------ > > --0000000000002206d5058de28f85 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Neil,

On Wed, Jul 17, 2019 at 8:38 = AM Neil Cook <neil.cook@op= en-xchange.com> wrote:
Hi Ted,

But, and this is the crux of the matter, that integration requires = the cooperation of the endpoint or its control by an organization's sys= tem administrators.=C2=A0 If you do not have their cooperation or the right= to manage them by tools like those Eric mentions, it is difficult for the = endpoint to distinguish a network-level interception by a mandated policy e= ngine and by an attacker.=C2=A0=C2=A0

Rather t= han falling back to the state where the endpoint simple accepts that its tr= affic is visible to all and possibly intercepted, this new work is an effor= t to make it easier for you to gain the cooperation required.=C2=A0 I hope = you can see that this is in both the interest of policy enforcement bodies = and the end users.
=C2=A0
So I use DNS filtering in my own house (along with mill= ions of other people as already stated on this thread), provided by my netw= ork operator (but it doesn=E2=80=99t have to be - I used to use OpenDNS for= example, and I have the capability to run my own resolver if I so desired)= . I have malware filtering as well as parental controls enabled. I am the d= e-facto network administrator in my house, =C2=A0but I don=E2=80=99t have t= he tools or software that enterprises use so I won=E2=80=99t benefit from t= he work being done to help enterprises control this. I also have other peop= le coming into my house and using my network, and I also like to control wh= at they can access when they are in my home. All of this works very well fo= r me today. It doesn=E2=80=99t work for me when applications/endpoints star= t deciding that my network is an attacker because it does filtering, and by= passing that filtering "in the interest of end-users".
=
I hope you can see that this is in both the interest of poli= cy enforcement bodies and the end users.

=
I=E2=80=99d like to ask, ask an end-user, how is this in my inte= rests?

=
I am sorry if I was not clear,=C2=A0 The point of the draft = is to enable the network operator to signal this:
   If the user agent can check for the presence of a policy=
, this could be
   used as a signal that the network operator wishes its resolver to be
   used as a condition of using the network, and that DoH or DoT should
   be disabled.
That permits your guests to know of your ne= twork policy and to abide by it if they choose; presumably you would not pr= ovide network access if they chose not to.

re= gards,

Ted Hardie

<= div>Neil

On 17 Jul 2019, at 16:25, Ted Hardie <ted.ietf@gmail.com> wrote:

Hi Vittorio,

On Wed, Jul 17, 2019 at= 1:06 AM Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.= org> wrote:

Il 17 luglio 2= 019 07:01 Rob Sayre <sayrer@gmail.com> ha scritto:


=
On Tue, Jul 16, 2019 at 12:30 PM Jim Reid= <=C2= =A0jim@rfc1035.= com> wrote:=C2=A0

= Whether or not these tools/services work well is another issue entirely. An= d IMO not something to discuss at the IETF.=C2=A0

Hi Jim,=C2=A0

I thought about this email a lot today.=C2=A0
=
I think the problem with its sentiment is that whether or not tools/ser= vices work on the Internet might be fairly called "engineering", = and this is the Internet Engineering Task Force, right?
But if you have tools that work well enough that millions o= f people rely on them and that they are encouraged or even mandated in many= countries, and you decide to develop and implement technologies to prevent= them from working

The IETF= builds building blocks that meet specific needs.=C2=A0 In building DNS ove= r TLS, DNS over DTLS, and DNS over HTTPS, it was adding the protocol functi= onality to make DNS queries confidential from inspection by network observe= rs.=C2=A0 The energy for that work was the reaction to pervasive surveillan= ce, but it is clear that other attackers had been gathering data for some t= ime.=C2=A0 The IETF was not building these protocols to stop the use of the= DNS as a policy enforcement mechanism and it is entirely possible to integ= rate them into a system which does this by offering the policy enforcing re= solver over one of these confidential protocols.=C2=A0=C2=A0
But, and this is the crux of the matter, that integration requ= ires the cooperation of the endpoint or its control by an organization'= s system administrators.=C2=A0 If you do not have their cooperation or the = right to manage them by tools like those Eric mentions, it is difficult for= the endpoint to distinguish a network-level interception by a mandated pol= icy engine and by an attacker.=C2=A0=C2=A0

Rathe= r than falling back to the state where the endpoint simple accepts that its= traffic is visible to all and possibly intercepted, this new work is an ef= fort to make it easier for you to gain the cooperation required.=C2=A0 I ho= pe you can see that this is in both the interest of policy enforcement bodi= es and the end users.

best regards,

=
Ted


--=C2=A0
Add mailing list
Add@ietf.org<= br style=3D"font-family:Helvetica;font-size:13px;font-style:normal;font-var= iant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;= text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;tex= t-decoration:none">https://www.ietf.org/mailman/listinfo/add


Neil Cook
neil.cook@open-xchange= .com

--------------------------------------------= -----------------------------------------
Open-Xchange AG, Rollnerstr. 1= 4, 90408=C2=A0Nuremberg, District Court Nuremberg=C2=A0HRB 24738
Managin= g Board: Rafael Laguna de la=C2=A0Vera, Carsten Dirks, Michael Knapstein,= =C2=A0Stephan Martin=C2=A0
Chairman of the Board: Richard Seibt

E= uropean Office:=C2=A0
Open-Xchange GmbH, Olper Huette 5f,=C2=A0D-57462 O= lpe, Germany, District Court=C2=A0Siegen, HRB 8718=C2=A0
Managing Direct= or: Frank Hoberg

US Office:=C2=A0
Open-Xchange. Inc., 530 Lytton = Avenue,=C2=A0Palo Alto, CA 94301, USA=C2=A0
----------------------------= ---------------------------------------------------------

--0000000000002206d5058de28f85-- From nobody Wed Jul 17 09:10:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C9B412086B for ; Wed, 17 Jul 2019 09:10:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eOnvEqi3O2b0 for ; Wed, 17 Jul 2019 09:10:33 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F098120405 for ; Wed, 17 Jul 2019 09:10:33 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id D64BF6A3B5; Wed, 17 Jul 2019 18:10:29 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563379829; bh=Hiq6TWrYXuOjMh3GeTJiLV4GhRdA0F8sLFaQAMHboVE=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=jDpkHsdecbuCNt6mQoZB1cd8WL2BLBdPyFlKuywxq2Ps71+BCFiLfAVcXAiAJPMCR z68R2ipMvm8ad+oxcRDfW8m3+xTSXhXzrjj9X33Jzf+veyojMu65NwU2PKUxBs5pNe D4/0GeFaM25vb7cjEhBuxMaSkOtn2nbxtVg7yWKFEtR90vbq0LIZ4lk/8v+xgSO10Q lHGy5WDnG6gvkW/sQM/deoUlhJ5Q2F5Bjvfl0pi8PKPT+0h9e1PnvBFmSnrBiDjMvh HjbqCs5a8IcHJQqyOzGhXEIud8UxZDIHRRziXbJfsuwkoJJXB977IjrPGmTfE1GEZ+ ZqFZuWqDRV5Rg== Received: from [10.242.2.29] (unknown [10.242.2.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id EDCF13C0101; Wed, 17 Jul 2019 18:10:28 +0200 (CEST) From: Neil Cook Message-Id: <39359BFE-231A-4621-8648-E9D424A31342@open-xchange.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_3C6CE891-E254-4ED1-A8CD-7436B644D146" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 17 Jul 2019 17:10:27 +0100 In-Reply-To: Cc: Vittorio Bertola , add@ietf.org, Rob Sayre To: Ted Hardie References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 16:10:36 -0000 --Apple-Mail=_3C6CE891-E254-4ED1-A8CD-7436B644D146 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi Ted, Thanks, I guess I misunderstood what you were trying to say regarding = the draft, Neil > On 17 Jul 2019, at 16:57, Ted Hardie wrote: >=20 > Hi Neil, >=20 > I am sorry if I was not clear, The point of the draft is to enable = the network operator to signal this: > If the user agent can check for the presence of a policy, this = could be > used as a signal that the network operator wishes its resolver to = be > used as a condition of using the network, and that DoH or DoT = should > be disabled. > That permits your guests to know of your network policy and to abide = by it if they choose; presumably you would not provide network access if = they chose not to.=20 >=20 > regards, >=20 > Ted Hardie >=20 > Neil >=20 >> On 17 Jul 2019, at 16:25, Ted Hardie > wrote: >>=20 >> Hi Vittorio, >>=20 >> On Wed, Jul 17, 2019 at 1:06 AM Vittorio Bertola = > wrote: >>=20 >>> Il 17 luglio 2019 07:01 Rob Sayre > ha scritto: >>>=20 >>>=20 >>> On Tue, Jul 16, 2019 at 12:30 PM Jim Reid < jim@rfc1035.com = > wrote:=20 >>>=20 >>> Whether or not these tools/services work well is another issue = entirely. And IMO not something to discuss at the IETF.=20 >>>=20 >>> Hi Jim,=20 >>>=20 >>> I thought about this email a lot today.=20 >>>=20 >>> I think the problem with its sentiment is that whether or not = tools/services work on the Internet might be fairly called = "engineering", and this is the Internet Engineering Task Force, right? >> But if you have tools that work well enough that millions of people = rely on them and that they are encouraged or even mandated in many = countries, and you decide to develop and implement technologies to = prevent them from working >>=20 >> The IETF builds building blocks that meet specific needs. In = building DNS over TLS, DNS over DTLS, and DNS over HTTPS, it was adding = the protocol functionality to make DNS queries confidential from = inspection by network observers. The energy for that work was the = reaction to pervasive surveillance, but it is clear that other attackers = had been gathering data for some time. The IETF was not building these = protocols to stop the use of the DNS as a policy enforcement mechanism = and it is entirely possible to integrate them into a system which does = this by offering the policy enforcing resolver over one of these = confidential protocols. =20 >>=20 >> But, and this is the crux of the matter, that integration requires = the cooperation of the endpoint or its control by an organization's = system administrators. If you do not have their cooperation or the = right to manage them by tools like those Eric mentions, it is difficult = for the endpoint to distinguish a network-level interception by a = mandated policy engine and by an attacker. =20 >>=20 >> Rather than falling back to the state where the endpoint simple = accepts that its traffic is visible to all and possibly intercepted, = this new work is an effort to make it easier for you to gain the = cooperation required. I hope you can see that this is in both the = interest of policy enforcement bodies and the end users. >>=20 >> best regards, >>=20 >> Ted >>=20 >>=20 >> --=20 >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add = >=20 > Neil Cook > neil.cook@open-xchange.com >=20 > = --------------------------------------------------------------------------= ----------- > Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 > Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 > Chairman of the Board: Richard Seibt >=20 > European Office:=20 > Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 > Managing Director: Frank Hoberg >=20 > US Office:=20 > Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 > = --------------------------------------------------------------------------= ----------- Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_3C6CE891-E254-4ED1-A8CD-7436B644D146 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi = Ted,

Thanks, I guess = I misunderstood what you were trying to say regarding the = draft,

Neil

On 17 Jul 2019, at 16:57, Ted Hardie <ted.ietf@gmail.com> = wrote:

Hi Neil,

I am sorry if I was not clear,  The point of the draft = is to enable the network operator to signal this:
   If the user agent =
can check for the presence of a policy, this could be
   used as a signal that the network operator wishes its resolver to be
   used as a condition of using the network, and that DoH or DoT should
   be disabled.
That permits your guests to = know of your network policy and to abide by it if they choose; = presumably you would not provide network access if they chose not = to. 

regards,

Ted Hardie

Neil

On 17 Jul 2019, at 16:25, Ted Hardie <ted.ietf@gmail.com> wrote:

Hi = Vittorio,

On Wed, Jul = 17, 2019 at 1:06 AM Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:

Il = 17 luglio 2019 07:01 Rob Sayre <sayrer@gmail.com> ha = scritto:


On Tue, Jul 16, 2019 at 12:30 PM Jim Reid < <= a href=3D"mailto:jim@rfc1035.com" target=3D"_blank" = class=3D"">jim@rfc1035.com> wrote: <= br class=3D"">

Whether or not these tools/services work well is another = issue entirely. And IMO not something to discuss at the IETF. <= br class=3D"">

Hi Jim, <= br class=3D"">
I thought about this email a lot = today. <= br class=3D"">
I think the problem with its sentiment is = that whether or not tools/services work on the Internet might be fairly = called "engineering", and this is the Internet Engineering Task Force, = right?
But if you have = tools that work well enough that millions of people rely on them and = that they are encouraged or even mandated in many countries, and you = decide to develop and implement technologies to prevent them from = working

The IETF builds building blocks that = meet specific needs.  In building DNS over TLS, DNS over DTLS, and = DNS over HTTPS, it was adding the protocol functionality to make DNS = queries confidential from inspection by network observers.  The = energy for that work was the reaction to pervasive surveillance, but it = is clear that other attackers had been gathering data for some = time.  The IETF was not building these protocols to stop the use of = the DNS as a policy enforcement mechanism and it is entirely possible to = integrate them into a system which does this by offering the policy = enforcing resolver over one of these confidential protocols.  <= br class=3D"">

But, and this is the crux of the matter, that integration = requires the cooperation of the endpoint or its control by an = organization's system administrators.  If you do not have their = cooperation or the right to manage them by tools like those Eric = mentions, it is difficult for the endpoint to distinguish a = network-level interception by a mandated policy engine and by an = attacker.  <= br class=3D"">

Rather than falling back to the state where the endpoint = simple accepts that its traffic is visible to all and possibly = intercepted, this new work is an effort to make it easier for you to = gain the cooperation required.  I hope you can see that this is in = both the interest of policy enforcement bodies and the end = users.

best = regards,

Ted


-- <= /span>
Add = mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------


Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_3C6CE891-E254-4ED1-A8CD-7436B644D146-- From nobody Wed Jul 17 09:18:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFB95120872 for ; Wed, 17 Jul 2019 09:17:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id coYnco4i2Hew for ; Wed, 17 Jul 2019 09:17:51 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D3A3B1208A4 for ; Wed, 17 Jul 2019 09:17:50 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 2A3D86A3B8; Wed, 17 Jul 2019 18:17:49 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563380269; bh=JMNndFYE4P3FPFpzD2kIqkoKiwrrffpNzNcFbHS/N+Q=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=LKo+RC9qO3yxTyg22XUdzSfPm0b5U6ZabWgp76wRzM0/p4TR0tcL6mYkuJTZ5FEBE 33s+ywCAByQOAffruUuyJP4SqDIIdM1th4dfdehETAPCQMwyy69JBER2VLmToJc6U/ NfLz+DHzFyJ7SN1/ab/yW80Ojpny+QlaDwtV5XgdeuSlqysNmZ/IEFUzRTL/HOz1Db T+7C9F/k3iiwikWxuBwQkDvcjqxhZ0sh72ZBfeI3bKhLAYZyyzejIBeOw9sNMtNVW/ Ayzi+Vy6Pa4htlu/if+HKbt2r+PNxCkNcUQhaVg9p5/UJgYL1W3pAwlaFmJHa7g8yG OsR5ptqv70fPg== Received: from [10.242.2.29] (unknown [10.242.2.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 5D2F53C0101; Wed, 17 Jul 2019 18:17:48 +0200 (CEST) From: Neil Cook Message-Id: <1DF13B9E-D0A2-4F4B-8E61-1C14464EA64B@open-xchange.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F1FB6BF5-26E9-4A40-84EB-A0317292F675" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 17 Jul 2019 17:17:46 +0100 In-Reply-To: <253de125-ff1c-31e6-6ca7-e7cb81d1206b@cs.tcd.ie> Cc: Neil Cook , Ted Hardie , Vittorio Bertola , add@ietf.org, Rob Sayre To: Stephen Farrell References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> <253de125-ff1c-31e6-6ca7-e7cb81d1206b@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 16:18:01 -0000 --Apple-Mail=_F1FB6BF5-26E9-4A40-84EB-A0317292F675 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Stephen, > On 17 Jul 2019, at 16:54, Stephen Farrell = wrote: > I don't question your right to do as you do, but as an (I hope) > equally valid single data point, I don't do the above and would > be fine if visitors to my home network used DoH with an external > service without being under my control. Going further, were I to > enforce my DNS policy choices on visitors to my home network > without explaining those, (which is mostly impractical), I would > consider myself to be potentially attacking visitors to my home, > which is IMO inhospitable. Indeed, everyone has the right to their own viewpoint, and we should = consider as many as possible when designing protocols, particularly when = they differ from our own. >=20 > There are multiple valid conflicting setups here and the issue I > think is that the application doing DNS can't detect which are in > play, so the application developer has to try pick a safe default > I guess. Not an easy task. >=20 Well I guess the draft under discussion is trying to make it such that = cooperating endpoint don=E2=80=99t have to just pick a safe default (in = a user population of two, at least one of us will be unhappy with that = default!), and can ideally make a more informed decision. > S. > <0x5AB2FAF17B172BEA.asc>--=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_F1FB6BF5-26E9-4A40-84EB-A0317292F675 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Stephen,

On 17 Jul 2019, at 16:54, Stephen Farrell = <stephen.farrell@cs.tcd.ie> wrote:
I don't question your right to do as you do, = but as an (I hope)
equally valid single data point, I = don't do the above and would
be fine if visitors to my = home network used DoH with an external
service without = being under my control. Going further, were I to
enforce = my DNS policy choices on visitors to my home network
without= explaining those, (which is mostly impractical), I would
consider myself to be potentially attacking visitors to my = home,
which is IMO inhospitable.

Indeed, = everyone has the right to their own viewpoint, and we should consider as = many as possible when designing protocols, particularly when they differ = from our own.


There are = multiple valid conflicting setups here and the issue I
think= is that the application doing DNS can't detect which are in
play, so the application developer has to try pick a safe = default
I guess. Not an easy task.


Well = I guess the draft under discussion is trying to make it such that = cooperating endpoint don=E2=80=99t have to just pick a safe default (in = a user population of two, at least one of us will be unhappy with that = default!), and can ideally make a more informed decision.

S.
<0x5AB= 2FAF17B172BEA.asc>--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_F1FB6BF5-26E9-4A40-84EB-A0317292F675-- From nobody Wed Jul 17 10:00:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA1FA120754 for ; Wed, 17 Jul 2019 10:00:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2q4zTtpwtV9k for ; Wed, 17 Jul 2019 10:00:44 -0700 (PDT) Received: from mail-yb1-xb31.google.com (mail-yb1-xb31.google.com [IPv6:2607:f8b0:4864:20::b31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6969E120704 for ; Wed, 17 Jul 2019 10:00:38 -0700 (PDT) Received: by mail-yb1-xb31.google.com with SMTP id x32so9967989ybh.1 for ; Wed, 17 Jul 2019 10:00:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4AqvdhO8QzNLevvD2xLl+OtN4D2lmGLu2IuMDzQztao=; b=Hn7fK0Kh6Be+jd2F1fYEjCBDY1l6Dl/BY/+1lP/mFiQc4mjauKbvIhIeSn8BtvwpEW Vjh1O28jvHN0OqC5Lj+SJmScfKqfHsG/DWaSYQll1FjjsR5GTSH5cGxgVkr1qzMgWs4m sBpupvCNoaxdcNg1fYiMApBDxq6zX2HX2OcNCYDqHBq88LmEVuptpO09KISycMEhY1DU X3uPrh7q0QDZ2zNfx980ualXlAwGI5Xl4HbQaLYqpz8r2oh2fNQUqBxPlaZIY6wUEGkE 3+qyAOdGJ2SC2TnU8HV8A3QWkRVWzcaTb3iYzTnxuOwGwDbVv8V1BKT4TTlSMGYugBaI XLEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4AqvdhO8QzNLevvD2xLl+OtN4D2lmGLu2IuMDzQztao=; b=NjeExCRrm6r0ir1bEQRTyNpcCFgCTwjY3msu+vmHavsxK1lI0a8aLPxfN/9WysC4wE MkbAyeFiAZwroSi76poCAzuX3d8+oDJiREnoiQGJmaxWs02H737GjTxQJmEnQv9lZj+3 mKwXDzbyjcVf59MNMIj3kuJyJk2BP5Jiyekjk8ZNSJqY/F0cpP5IVcEh5pWFObvh5p2b /aK2m8b9UJyTR9dLnAsxVVd60vcEPFTyNGOMIIlXqNj1fAaLeYlMsruFnPGw796tZpO4 v4C6qEzfL42JvtOHYyK8frxi/t0ENhsjR1P4ZJ7EZk26EYcrJ3izMxyHuh/e3ahVgKhY xTbA== X-Gm-Message-State: APjAAAVZ18G4d1P9cBEaOQI4p8ThGtpKF619/06mLm4YO9hnGLeLFX6V L0I9QP0Mn1y+ZeHfz85phuVWlKMBI7tido5Vicsfyj9E X-Google-Smtp-Source: APXvYqyFNxbV6T3di2wXT8qwrDAVyA6e1jPSOXa9cT1R95XcgeCLa7s7ndT+vQ4wMMxShI3WlSltNuk8En4czR9mb5M= X-Received: by 2002:a25:1b43:: with SMTP id b64mr22702852ybb.501.1563382837332; Wed, 17 Jul 2019 10:00:37 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: From: Alec Muffett Date: Wed, 17 Jul 2019 18:00:28 +0100 Message-ID: To: Ted Hardie Cc: Neil Cook , Vittorio Bertola , add@ietf.org, Rob Sayre Content-Type: multipart/alternative; boundary="000000000000aadd48058de36e91" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 17:00:46 -0000 --000000000000aadd48058de36e91 Content-Type: text/plain; charset="UTF-8" On Wed, 17 Jul 2019, 16:58 Ted Hardie, wrote: > > That permits your guests to know of your network policy and to abide by it > if they choose; presumably you would not provide network access if they > chose not to. > "Hello, my name is Totalitarian Dictator, welcome to my house, make yourself comfortable - you may be here for some time. Feel free to use the wifi, the password is on the fridge. Can I fix you a drink?" - alec :-) --000000000000aadd48058de36e91 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Wed, 17 Jul 2019, 16:58 Ted Hardie, <ted.ietf@gmail.com> wrote:

That permits your guests to know of you= r network policy and to abide by it if they choose; presumably you would no= t provide network access if they chose not to.=C2=A0


"Hello, my name is Totalitarian Dictator, welcome to my h= ouse, make yourself comfortable - you may be here for some time. Feel free = to use the wifi, the password is on the fridge. Can I fix you a drink?"= ;=C2=A0

- alec :-)
=


--000000000000aadd48058de36e91-- From nobody Wed Jul 17 10:08:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B1462120791 for ; Wed, 17 Jul 2019 10:08:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QznqNDi7soCb for ; Wed, 17 Jul 2019 10:08:37 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 700AE12072D for ; Wed, 17 Jul 2019 10:08:37 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 4CA7E6A31A; Wed, 17 Jul 2019 19:08:35 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563383315; bh=r+EJRd9P3SW6IcJuHU/PdP9GormNK+nNS6pyIOdai+0=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=UEOTQt1ggejYY5ilWgJoOntSKTKc5GUc0aKNg/9BcV9cpSnKGn06yOEIxVwRBWTst UdpIsb69XgQwP6wW5h9pkPeU2Zyy7Rq9WgRxdoS6UdM2LgxUwqPg3Da/vzpD6sN8qS YzsNYDd9pbNeuz/xds/fSbEK3hEfMG+ABfRVTlu3JNlQzjlmanWSjYaJNyOW6lPdEh RYgODBF0tWVUhavKsLQqI7MFMyM2slsE9UmA3sx1UHaml68igVHHukusPnyg6ilcgY qS0BQkwJdsFuZx3KdEpnGyUDERU99wAMIsmP+16LU6WhrSSB+bMu369DlzTgqbb46e Il0m0bPX9GTXw== Received: from [10.242.2.29] (unknown [10.242.2.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id A75BF3C0101; Wed, 17 Jul 2019 19:08:34 +0200 (CEST) From: Neil Cook Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_823099C3-1D12-45B5-A837-8B8245580C7F" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 17 Jul 2019 18:08:32 +0100 In-Reply-To: Cc: Ted Hardie , Vittorio Bertola , add@ietf.org, Rob Sayre To: Alec Muffett References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 17:08:40 -0000 --Apple-Mail=_823099C3-1D12-45B5-A837-8B8245580C7F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Well you say Totalitarian Dictator, bu usually my children call me dad = :) Neil > On 17 Jul 2019, at 18:00, Alec Muffett wrote: >=20 >=20 >=20 > On Wed, 17 Jul 2019, 16:58 Ted Hardie, > wrote: >=20 > That permits your guests to know of your network policy and to abide = by it if they choose; presumably you would not provide network access if = they chose not to.=20 >=20 >=20 > "Hello, my name is Totalitarian Dictator, welcome to my house, make = yourself comfortable - you may be here for some time. Feel free to use = the wifi, the password is on the fridge. Can I fix you a drink?"=20 >=20 > - alec :-) >=20 >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_823099C3-1D12-45B5-A837-8B8245580C7F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Well = you say Totalitarian Dictator, bu usually my children call me dad :)

Neil

On 17 Jul 2019, at 18:00, Alec Muffett <alec.muffett@gmail.com> wrote:



On Wed, 17 Jul 2019, = 16:58 Ted Hardie, <ted.ietf@gmail.com> wrote:

That permits your guests to know = of your network policy and to abide by it if they choose; presumably you = would not provide network access if they chose not = to. 


"Hello, my name is = Totalitarian Dictator, welcome to my house, make yourself comfortable - = you may be here for some time. Feel free to use the wifi, the password = is on the fridge. Can I fix you a drink?" 

- alec = :-)


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_823099C3-1D12-45B5-A837-8B8245580C7F-- From nobody Wed Jul 17 10:24:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E7881207E4 for ; Wed, 17 Jul 2019 10:24:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IbfmrG80XI9t for ; Wed, 17 Jul 2019 10:24:52 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 197DA12079D for ; Wed, 17 Jul 2019 10:24:52 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id x25so24459054ljh.2 for ; Wed, 17 Jul 2019 10:24:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YN+m5XyhgsbqqlHs+tj0cbEy5sBHlokfdQo75dnAwyE=; b=xI92f7fbtqo8O9/8zFTPu4j+V1CJkY/GDtMD9Ivtooc7LqlBOjzr8kcYuz1h7CuMcH RkBduAaHSMewWsSrXzKWML+MMx/qOMNfQZ+GayCM5lw7yXFIWyv6bKrr938xMr+gvWtH JDeFrHJvu0lyBpgFLWcEyKmxzE+4Apm1r8wOTauQPu26Kh5wp+FTmEoEmWI/p3tk108f p4CIa4hf8Yypt1Ih+FV5AYXE7XehkDmtuTtPhKf96WwLOcNL8PWYo5nURKRUg34KIkFx v/49GzYa3/Dr6q5RWF72lvOxWDVNUMLfJtzkCmgQ3p4eivD6lm0BJsG8b93IJLdlJUoH Z1DA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YN+m5XyhgsbqqlHs+tj0cbEy5sBHlokfdQo75dnAwyE=; b=CctjzaECPLe5+y1fAv/YgpobGoIS/9tNlwkI2TVv+t2+wkSySyWPoPRHShaUJy/qHz tiM6zVaRy2rA3AqjLSbn47sgr+DZn3a8T0u2XbcTsGG+/me3Uzu2PJKfsrMHsPuHAATr fmBqVwn3og6sBmhVaKAASxEgJJXaVSJYfv2nPpFXeGrEBcT2vi56IQjb9ze/EGA6INgJ lDgSUefij1vUvLgI/7L7o4mLnHP0yQZ+TdM+F9jpLFdl6CZqQ7FzObV+1qvvHabneTWH bHtPjr6GYTrBDm42ILA4QJU7Z9xJNimWXhUrdaUq4puxKmhoNpNcuJBLxdg4UDR/FGw2 5mLQ== X-Gm-Message-State: APjAAAXH7dWTYlDC4IA5u4P6h+GueH95+2T8aPx0n+REGHl6jS4ejigK Nc6IjEL5P7HepAVaixLqLxI0tJdFGE7T2f0TvpI= X-Google-Smtp-Source: APXvYqwnKqButlVr0VuJ/Uev/nxoLqqTNuBNAnRJ9KuaVxYMOiEIWW/RfyMqccJsPpOUvTPC99Os4231q7piZO8A9h0= X-Received: by 2002:a2e:96d0:: with SMTP id d16mr7751987ljj.14.1563384290434; Wed, 17 Jul 2019 10:24:50 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Wed, 17 Jul 2019 10:24:11 -0700 Message-ID: To: tirumal reddy Cc: Rob Sayre , ADD Mailing list , "Dixon, Hugh" , Alec Muffett Content-Type: multipart/alternative; boundary="000000000000477541058de3c54b" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 17:24:55 -0000 --000000000000477541058de3c54b Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 7:05 AM tirumal reddy wrote: > > On Wed, 17 Jul 2019 at 01:41, Eric Rescorla wrote: > >> >> >> On Tue, Jul 16, 2019 at 1:02 PM Rob Sayre wrote: >> >>> >>> >>> On Tue, Jul 16, 2019 at 12:53 PM Eric Rescorla wrote: >>> >>>> >>>> Taking a TRR-style system out of the equation for a moment. Suppose >>>> that what I want is for all devices on my network to use a filtering >>>> resolver. I don't expect any evasion because they're all my devices, it's >>>> just a matter of convenience to centrally configure it. So what I do here >>>> is I configure my DHCP server to provide the IP address of that resolver. >>>> Now, those devices do unencrypted DNS because that's what everyone does. >>>> Now, suppose that resolver starts offering DoT. How do my devices learn >>>> that information? The resolver could tell them over DNS but then we have a >>>> straightforward downgrade attack from anyone on the network. Do you agree >>>> with this so far? Do you have a proposed solution? >>>> >>> >>> In fairness, I'm not sure I quite follow. But, if I worked at a browser >>> vendor, I would be worried about DoH rollout too. I think I'd gradually >>> ratchet up the security signals in the location bar with the end result of >>> marking sites insecure if their IP was fetched over DNS in the clear. >>> >> >> Ignoring the UI question, let me push a bit on "in the clear". >> >> Currently, resolvers are configured by IP address, not domain name. So >> absent mechanisms such as TRR, how does the DNS client form a secure >> connection to the resolver? What domain name is in the certificate and how >> does the client learn that domain name? >> > > https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-04 discusses > mechanism to automatically bootstrap endpoints to discover and authenticate > DoT/DoH servers provided by a local network. The client securely learns the > domain name and DNS server certificate. > This draft does not seem like it has the general applicability that would be required in the scenarios that browsers often face. -Ekr > Cheers, > -Tiru > > >> >> -Ekr >> >> >> >> >>> This is distinct from choosing a DNS vendor. >>> >>> thanks, >>> Rob >>> >>> >>> >>> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > --000000000000477541058de3c54b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 17, 2019 at 7:05 AM tirum= al reddy <kondtir@gmail.com>= wrote:

On Wed, 17 Jul 2019 at 01:41, Eric Rescorla <<= a href=3D"mailto:ekr@rtfm.com" target=3D"_blank">ekr@rtfm.com> wrote= :


On Tue, Jul 16, 2019 at 1:02 PM Rob Sayre <sayrer@gmail.com> w= rote:


On Tue, Jul 16, 2019 at 12:53 PM Eric Rescorl= a <ekr@rtfm.com>= ; wrote:

Taking a TRR-style sys= tem out of the equation for a moment. Suppose that what I want is for all d= evices on my network to use a filtering resolver. I don't expect any ev= asion because they're all my devices, it's just a matter of conveni= ence to centrally configure it. So what I do here is I configure my DHCP se= rver to provide the IP address of that resolver. Now, those devices do unen= crypted DNS because that's what everyone does. Now, suppose that resolv= er starts offering DoT. How do my devices learn that information? The resol= ver could tell them over DNS but then we have a straightforward downgrade a= ttack from anyone on the network. Do you agree with this so far? Do you hav= e a proposed solution?

In= fairness, I'm not sure I quite follow. But, if I worked at a browser v= endor, I would be worried about DoH rollout too. I think I'd gradually = ratchet up the security signals in the location bar with the end result of = marking sites insecure if their IP was fetched over DNS in the clear.

Ignoring the UI question, let= me push a bit on "in the clear".

Curren= tly, resolvers are configured by IP address, not domain name. So absent mec= hanisms such as TRR, how does the DNS client form a secure connection to th= e resolver? What domain name is in the certificate and how does the client = learn that domain name?

https://tools.ietf.org/html/draft-reddy-dprive= -bootstrap-dns-server-04=C2=A0discusses mechanism to automatically boot= strap endpoints to discover and authenticate DoT/DoH servers provided by a = local network. The client securely learns the domain name and DNS server ce= rtificate.

This draft= does not seem like it has the general applicability that would be required= in the scenarios that browsers often face.

-E= kr


Cheers,
-Tiru
=C2=A0

-Ekr


<= div>=C2=A0
This is distinct from choosing a D= NS vendor.

thanks,
Rob



--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000477541058de3c54b-- From nobody Wed Jul 17 10:28:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F30312080C for ; Wed, 17 Jul 2019 10:28:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5XS-iOvZ3jbN for ; Wed, 17 Jul 2019 10:28:16 -0700 (PDT) Received: from mail-yb1-xb32.google.com (mail-yb1-xb32.google.com [IPv6:2607:f8b0:4864:20::b32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 444321207E7 for ; Wed, 17 Jul 2019 10:28:16 -0700 (PDT) Received: by mail-yb1-xb32.google.com with SMTP id x188so5378833yba.8 for ; Wed, 17 Jul 2019 10:28:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9REM2/9ZGSzfIKNqhNNR/hTn9PC08AzYCum5ziN5Wsg=; b=amrP/7T+EwmvprV1lAooY5viFvaqprdcsjtkXZNZS7Hqzhd++gd573LKXDaObet+Uz t3i3a+qbggUTAr++X9ImRDqrDX8fOTE9GRPoAzkJJv3HT0UoX0gFIerrLe46BtSaopd/ Pfvu78GKlOG+bniAFYI+E0ykQAc9Ok+fHLgVhQNi2pngJHa3TI5C64apRbM6s//biShN 4650oswxPrSUheR8BGrY5rJKKARKKsoql3oOf1jGa+9FELIU5wtMkJxZ3iUmplpID1mr aC8nNMFUcuv+rATTYhU1ryw0yiRk73bK2zQ6G+GmcvwHgJ5xUYCD2JfJZ19stPajoFjR NEzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9REM2/9ZGSzfIKNqhNNR/hTn9PC08AzYCum5ziN5Wsg=; b=QBCjP12Xy9pKJxbsewZlm+SaBDTd4SnRQ2U5eTsA1VXAfnz2oBn1vkes3aUPV2WFtQ wRiiBv8Nq2ePmVzrW1XD1bL0s4xlnKmNiz9ZCG0ADB3cl/w/jy/KpECk6ZjPWeWvRSCB dd5U4KLO69LY4kjq1O9sEvnoU4MBmabvgHGgijF7K5EFUTBFxuPIEhsCI5TC3BZG+grs lsw0iI+VJgSqr/dBYCd4UMhSmo5ZMSy9y4OdyLpJYsQIrMQzz9B9R8UrN/X66Z8GVQFJ 3JVK3tnBfhoucgfaiDHi4IRc5XNiJkEBOQR3xcfcmE7oZwUv8XvW+7uvBoFBOAaiFRbh PuHw== X-Gm-Message-State: APjAAAWqmaTYjn1iYRhwu27CC3/5MljQIoMPc9mzdl2f3X2YKR+eol6B 3M040ph/+l6Q6VD0FJzhWydhatq26p3PxDRX2zQ= X-Google-Smtp-Source: APXvYqwvB0XMRBGqRfas5CL0gEhO0E0bvTVj0MeGk9cHDqn3qa1VRdaBx8heLYbiwcakw89kt6Oq2CyKf0Kryovujuo= X-Received: by 2002:a25:aac4:: with SMTP id t62mr26335355ybi.70.1563384495380; Wed, 17 Jul 2019 10:28:15 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: From: Alec Muffett Date: Wed, 17 Jul 2019 18:28:05 +0100 Message-ID: To: Neil Cook Cc: Ted Hardie , Vittorio Bertola , add@ietf.org, Rob Sayre Content-Type: multipart/alternative; boundary="0000000000007ea04b058de3d14a" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 17:28:18 -0000 --0000000000007ea04b058de3d14a Content-Type: text/plain; charset="UTF-8" On Wed, 17 Jul 2019, 18:08 Neil Cook, wrote: > Well you say Totalitarian Dictator, bu usually my children call me dad :) > > Neil > ...and there's the rub; of the two/more problem spaces, I see more implementation opportunities in parental benificient oversight, than for escape to a free web for oppressed peoples. Put differently: you are a parent or guardian and you care for a small population of children. Dictators oppress thousands to millions. A utilitarian approach suggests that the latter are more important to enable, than would be the cost of mildly inconveniencing or requiring the former to change their protective approach. - alec --0000000000007ea04b058de3d14a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Wed, 17 Jul 2019, 18:08 Neil Cook, <neil.cook@open-xchange.com> wrote:=
Well you say Totalitarian Dictator, bu usual= ly my children call me dad :)

Neil

...and there&#= 39;s the rub; of the two/more problem spaces, I see more implementation opp= ortunities in parental benificient oversight, than for escape to a free web= for oppressed peoples.

= Put differently: you are a parent or guardian and you care for a small popu= lation of children. Dictators oppress thousands to millions. A utilitarian = approach suggests that the latter are more important to enable, than would = be the cost of mildly inconveniencing or requiring the former to change the= ir protective approach.

= - alec


--0000000000007ea04b058de3d14a-- From nobody Wed Jul 17 11:25:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13495120873 for ; Wed, 17 Jul 2019 11:25:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.899 X-Spam-Level: X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fMWBcquPReG7 for ; Wed, 17 Jul 2019 11:25:48 -0700 (PDT) Received: from mx.pao1.isc.org (mx.pao1.isc.org [149.20.64.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0F4D12085E for ; Wed, 17 Jul 2019 11:25:48 -0700 (PDT) Received: from bikeshed.isc.org (bikeshed2.isc.org [IPv6:2001:4f8:1:f::88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx.pao1.isc.org (Postfix) with ESMTPS id 3AC733AB00C; Wed, 17 Jul 2019 18:25:45 +0000 (UTC) Received: by bikeshed.isc.org (Postfix, from userid 10292) id 05181495E7; Wed, 17 Jul 2019 18:25:45 +0000 (UTC) Date: Wed, 17 Jul 2019 18:25:45 +0000 From: Evan Hunt To: Alec Muffett Cc: Neil Cook , Ted Hardie , add@ietf.org, Vittorio Bertola , Rob Sayre Message-ID: <20190717182544.GA39700@isc.org> References: <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.11.4 (2019-03-13) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 18:25:50 -0000 On Wed, Jul 17, 2019 at 06:28:05PM +0100, Alec Muffett wrote: > Put differently: you are a parent or guardian and you care for a small > population of children. Dictators oppress thousands to millions. A > utilitarian approach suggests that the latter are more important to enable, > than would be the cost of mildly inconveniencing or requiring the former to > change their protective approach. On the other hand there are millions of parents, so the strict utilitarian analysis might not be so clear-cut. But I'm not sure why we get hung up on parental filtering per se. My worries are about botnet C&C and data exfiltration, and that's an issue that applies to every network, with or without kids, and probably more to businesses and governments than to families. -- Evan Hunt -- each@isc.org Internet Systems Consortium, Inc. From nobody Wed Jul 17 11:31:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B44B812085E for ; Wed, 17 Jul 2019 11:31:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5EwU2XW4pHqd for ; Wed, 17 Jul 2019 11:31:18 -0700 (PDT) Received: from mail-io1-xd44.google.com (mail-io1-xd44.google.com [IPv6:2607:f8b0:4864:20::d44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1407120626 for ; Wed, 17 Jul 2019 11:31:18 -0700 (PDT) Received: by mail-io1-xd44.google.com with SMTP id e20so16988670iob.9 for ; Wed, 17 Jul 2019 11:31:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=o+mkK7cvuK6EiimM+De/cOzyG0Qt/KC30/yYmQFiHWY=; b=VknSm2Jl+kFSqJQWnK3mFqNT4Bw30i/NA+IuZ1zTVunOJQP5ov3upNrG0Rwyl67YTU Zt2We+Rcf/XPM+6hrLAgG+gb3P0OAInn/7fLAIlo9z4xuqDBhiWOHXRubEUGi5m4d+Oy DyvUEAaFrIPUhUa7y3h19rdgVyipMKf0FnD6UhVJEvfuMilr4PVbfkOkThCmCfcjGYoD x1jWpCEyh69/BkembYGBnWnfm23bRXw3bQlEgB84vXL0YyVUUFvvxG1QVVuOb1NFOUek qQcuwleVGAfnKYzxlE0bDn5nRvKbUJqMo0gf6d64iIsWcc9OWCR6r/19GWmg08iO3FVD tXjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=o+mkK7cvuK6EiimM+De/cOzyG0Qt/KC30/yYmQFiHWY=; b=rVIEGP6wP44V/bXiOVHk9jERCT/DUo/zuwCA5VztRrTDVNTJUn/86dwtvkgDBnUoGD THBWDWMXX2OpP61AwgcUS5m7i1aMiIEUrwJvP/Y8aof9fBYVEadxiSR/tm77kixWwYr/ l5s1MDspLNZFe4iqJwXGR3I48iGXePqPFpu1aIJO7pF2KRxWEBM5Rg7GGVxuVXwpTvn8 5o/I7sWfve4zVPspGoHLbGJhNbBg6d56BAekB6CmSP5DT0VdbfCzUibRqX9PqGaUF/w0 B1627hsO79702PrFc4tYvZLLGSvuEbetw7LM7VVlw1wf4BbI9DCwyWggrMZL3OnkEO6A einQ== X-Gm-Message-State: APjAAAXCPkpUy2uaOY9pi/IU1AEXjGR5iCKHPn+bAn/1Dk0LP+zW/set jowmbRImLdJ6RlBbyad7bAOGGYz0mm+itZwe+do= X-Google-Smtp-Source: APXvYqw5gRN86SwuUhQIGmxx1XgJToruD1M5s8xoPjch8B6QWl4KbT3QstCPL3bATIvLWq1EOaN+1i9UsP92xyTFTP4= X-Received: by 2002:a02:13c3:: with SMTP id 186mr42378418jaz.30.1563388277859; Wed, 17 Jul 2019 11:31:17 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: From: Rob Sayre Date: Wed, 17 Jul 2019 11:31:04 -0700 Message-ID: To: Neil Cook Cc: Alec Muffett , Ted Hardie , Vittorio Bertola , add@ietf.org Content-Type: multipart/alternative; boundary="000000000000f2ad1f058de4b26e" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 18:31:21 -0000 --000000000000f2ad1f058de4b26e Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 10:08 AM Neil Cook wrote: > Well you say Totalitarian Dictator, bu usually my children call me dad :) > The thing is, your DNS policy won't actually work. It's security theater. You'd really want a feature along the lines of https://www.apple.com/families/ That way, the policy still applies if they use a cellular connection, or the neighbor's wifi, or whatever. thanks, Rob > > Neil > > On 17 Jul 2019, at 18:00, Alec Muffett wrote: > > > > On Wed, 17 Jul 2019, 16:58 Ted Hardie, wrote: > >> >> That permits your guests to know of your network policy and to abide by >> it if they choose; presumably you would not provide network access if they >> chose not to. >> > > > "Hello, my name is Totalitarian Dictator, welcome to my house, make > yourself comfortable - you may be here for some time. Feel free to use the > wifi, the password is on the fridge. Can I fix you a drink?" > > - alec :-) > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > > Neil Cook > neil.cook@open-xchange.com > > > ------------------------------------------------------------------------------------- > Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court > Nuremberg HRB 24738 > Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael > Knapstein, Stephan Martin > Chairman of the Board: Richard Seibt > > European Office: > Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District > Court Siegen, HRB 8718 > Managing Director: Frank Hoberg > > US Office: > Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA > > ------------------------------------------------------------------------------------- > > --000000000000f2ad1f058de4b26e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 17, 2019 at 10:08 AM Neil Coo= k <neil.cook@open-xchange.= com> wrote:
Wel= l you say Totalitarian Dictator, bu usually my children call me dad :)

The thing is, your DNS policy won't a= ctually work. It's security theater.

You'd= really want a feature along the lines of


That way, the policy still applies if they use a= cellular connection, or the neighbor's wifi, or whatever.
thanks,
Rob

=C2=A0

Neil

On 17 Jul 2019, at 18:00, Alec Muffett <alec.muffett@gmail.com> wrote:


On Wed, 17 Jul 2019, 16:58 Ted Hardie, <ted.ietf@gmail.com> wrote:

Th= at permits your guests to know of your network policy and to abide by it if= they choose; presumably you would not provide network access if they chose= not to.=C2=A0


"Hello, my name is T= otalitarian Dictator, welcome to my house, make yourself comfortable - you = may be here for some time. Feel free to use the wifi, the password is on th= e fridge. Can I fix you a drink?"=C2=A0

- alec :-)


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
<= /blockquote>


Neil Cook
neil.cook@open-xchange= .com

--------------------------------------------= -----------------------------------------
Open-Xchange AG, Rollnerstr. 1= 4, 90408=C2=A0Nuremberg, District Court Nuremberg=C2=A0HRB 24738
Managin= g Board: Rafael Laguna de la=C2=A0Vera, Carsten Dirks, Michael Knapstein,= =C2=A0Stephan Martin=C2=A0
Chairman of the Board: Richard Seibt

E= uropean Office:=C2=A0
Open-Xchange GmbH, Olper Huette 5f,=C2=A0D-57462 O= lpe, Germany, District Court=C2=A0Siegen, HRB 8718=C2=A0
Managing Direct= or: Frank Hoberg

US Office:=C2=A0
Open-Xchange. Inc., 530 Lytton = Avenue,=C2=A0Palo Alto, CA 94301, USA=C2=A0
----------------------------= ---------------------------------------------------------

--000000000000f2ad1f058de4b26e-- From nobody Wed Jul 17 11:34:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78C5E120923 for ; Wed, 17 Jul 2019 11:34:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5d1nh9vTKfiO for ; Wed, 17 Jul 2019 11:34:10 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 319E91208D0 for ; Wed, 17 Jul 2019 11:34:10 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id DFFE1374009B; Wed, 17 Jul 2019 11:34:09 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id 5DCFF1578536; Wed, 17 Jul 2019 12:34:09 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 571A31578535; Wed, 17 Jul 2019 12:34:09 -0600 (MDT) From: Paul Ebersman To: Evan Hunt cc: add@ietf.org In-reply-to: <20190717182544.GA39700@isc.org> References: <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> <20190717182544.GA39700@isc.org> Comments: In-reply-to Evan Hunt message dated "Wed, 17 Jul 2019 18:25:45 -0000." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <65549.1563388449.1@fafnir.local> Date: Wed, 17 Jul 2019 12:34:09 -0600 Message-Id: <20190717183409.5DCFF1578536@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 18:34:14 -0000 each> But I'm not sure why we get hung up on parental filtering per se. each> My worries are about botnet C&C and data exfiltration, and that's each> an issue that applies to every network, with or without kids, and each> probably more to businesses and governments than to families. Indeed. We seem to be spinning. Can we agree that: - there are multiple use cases where end users (or their employer) want to have and control DNS filtering - some of these use cases are not enterprises with an IT infrastructure that can do things like group policy, control of user apps, etc. If that's the case, we either need solutions or verbage explaining how close to this we can get and what won't be technically possible. From nobody Wed Jul 17 11:37:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6ECCF12085E for ; Wed, 17 Jul 2019 11:37:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yNzBw2Xl_wS2 for ; Wed, 17 Jul 2019 11:37:14 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D99A01201DC for ; Wed, 17 Jul 2019 11:37:14 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id CA44F374009B; Wed, 17 Jul 2019 11:37:13 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id 9C074157858C; Wed, 17 Jul 2019 12:37:13 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 9429E157858B; Wed, 17 Jul 2019 12:37:13 -0600 (MDT) From: Paul Ebersman To: Rob Sayre cc: add@ietf.org In-reply-to: References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <15138 17825.9983.1563350802523@appsuite-gw1.open-xchange.com> Comments: In-reply-to Rob Sayre message dated "Wed, 17 Jul 2019 11:31:04 -0700." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <65648.1563388633.1@fafnir.local> Date: Wed, 17 Jul 2019 12:37:13 -0600 Message-Id: <20190717183713.9C074157858C@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 18:37:17 -0000 sayrer> The thing is, your DNS policy won't actually work. It's security sayrer> theater. No. It's not. It's not 100% effective for all forms of badness but that doesn't make it security theatre. sayrer> You'd really want a feature along the lines of sayrer> [[https://www.apple.com/families/]] And I could call this security theatre if I'm not an apple owner but I won't because that isn't true either. But it's also not effective for everyone. I would think our goal here is to make security tools that help enough people to be worth doing and realize that security in depth and with multiple techniques and use cases is as good as we can do right now. From nobody Wed Jul 17 11:40:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56BDD12085E for ; Wed, 17 Jul 2019 11:40:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oh74fX2aiPA1 for ; Wed, 17 Jul 2019 11:40:47 -0700 (PDT) Received: from mail-vk1-xa30.google.com (mail-vk1-xa30.google.com [IPv6:2607:f8b0:4864:20::a30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13D261201DC for ; Wed, 17 Jul 2019 11:40:47 -0700 (PDT) Received: by mail-vk1-xa30.google.com with SMTP id v68so1479912vkd.1 for ; Wed, 17 Jul 2019 11:40:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=rJKljxFIvy+FwBlAZW/5ybOG/wFquIiNCyS4TPDYSjA=; b=dw8CK15qkFdffr5Lj71gU4o04jZOlRJt1HFYmH9DTg7TmkkK9vdshKK2RFJj1/nt36 +m26osAH79f080PtmDL92e6vDLzYPLTmY+Hswhle4d5VZDNHBKOLz8qxVQ7xrR2gPk7a wL96gwttUf7L5opItqlYqyYh+oqXjPH9QHfzh4cMbdLuuYMj9/ZyCxYOaOeqoeAX5jvU m2njQ9hqFyVCZQ4lLleShzQGfo+PUS2BhY2VLl29HXuAcDl46all+VD91LK3b9JN05XK Gx3bNjzkQKY2B2AXTZ/0DqNNFMK/MVbHPNC62PG3t5HBlJt+E8jozwo5mTa0dN6viaCI Lrpw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=rJKljxFIvy+FwBlAZW/5ybOG/wFquIiNCyS4TPDYSjA=; b=lAXV8Xe1YBvgfq8zu/557MAt4DvMk1gnpPcvzhssraeVlSxe2BQg7svYL2lgelVrym 5vxguJ+Fv/IVYVf9tfebw0g02S3NhMHKY28p9qbBgnxAaMQ0EgCy4SD9cMa2KhT1WIyZ 40FaIyZCsvVV6kcAZmbOwL+etnSWVoTnIXBGA39BVpsMW+mZ8bS7+0BmpIrNVgiU17tv pmhtbcvIs82qhBPlpnv41BJ7wno9ae5TLT7EZXedp6c9tLGDBDFS0klGHqYTCc+W64XG VrvkBTvXfnjNINTeq2wIZkogukeN5ckH54QaidAn5s8FLzxRxbHI5wqq9dwKSn5f+bJD Ixtg== X-Gm-Message-State: APjAAAW+toLU9ZGgKVqRWdKC68xFYe/gWMxXYfgunHjbnHibtARUzNP+ zDKSGVQ5uitjDXUnKYQf0GTPEj3hv3fngtfmJQo= X-Google-Smtp-Source: APXvYqzt9rwDY3dWil6dF+ZSoHJCtVvW1LCCyrAjAyqbQrOINn+JJuD6ZvDv6G6TZOOcZFuvbOXWWpG6Hoz9Y08ODKE= X-Received: by 2002:a1f:9ecc:: with SMTP id h195mr9804043vke.72.1563388846045; Wed, 17 Jul 2019 11:40:46 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: From: Brian Dickson Date: Wed, 17 Jul 2019 11:40:34 -0700 Message-ID: To: Ted Hardie Cc: Neil Cook , Vittorio Bertola , add@ietf.org, Rob Sayre Content-Type: multipart/alternative; boundary="000000000000d07d86058de4d4a2" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 18:40:50 -0000 --000000000000d07d86058de4d4a2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 17, 2019 at 8:58 AM Ted Hardie wrote: > Hi Neil, > > On Wed, Jul 17, 2019 at 8:38 AM Neil Cook > wrote: > >> Hi Ted, >> >> But, and this is the crux of the matter, that integration requires the >> cooperation of the endpoint or its control by an organization's system >> administrators. If you do not have their cooperation or the right to >> manage them by tools like those Eric mentions, it is difficult for the >> endpoint to distinguish a network-level interception by a mandated polic= y >> engine and by an attacker. >> >> Rather than falling back to the state where the endpoint simple accepts >> that its traffic is visible to all and possibly intercepted, this new wo= rk >> is an effort to make it easier for you to gain the cooperation required.= I >> hope you can see that this is in both the interest of policy enforcement >> bodies and the end users. >> >> >> > So I use DNS filtering in my own house (along with millions of other >> people as already stated on this thread), provided by my network operato= r >> (but it doesn=E2=80=99t have to be - I used to use OpenDNS for example, = and I have >> the capability to run my own resolver if I so desired).. I have malware >> filtering as well as parental controls enabled. I am the de-facto networ= k >> administrator in my house, but I don=E2=80=99t have the tools or softwa= re that >> enterprises use so I won=E2=80=99t benefit from the work being done to h= elp >> enterprises control this. I also have other people coming into my house = and >> using my network, and I also like to control what they can access when t= hey >> are in my home. All of this works very well for me today. It doesn=E2=80= =99t work >> for me when applications/endpoints start deciding that my network is an >> attacker because it does filtering, and bypassing that filtering "in the >> interest of end-users". >> >> I hope you can see that this is in both the interest of policy >> enforcement bodies and the end users. >> >> >> I=E2=80=99d like to ask, ask an end-user, how is this in my interests? >> >> > I am sorry if I was not clear, The point of the draft is to enable the > network operator to signal this: > > If the user agent can check for the presence of a policy, this could b= e > used as a signal that the network operator wishes its resolver to be > used as a condition of using the network, and that DoH or DoT should > be disabled. > > That permits your guests to know of your network policy and to abide by i= t > if they choose; presumably you would not provide network access if they > chose not to. > > So, as far as I can tell, there are some minor problems with the DoH deployment scheme proposed by various vendors (on the client in an "applications doing DNS" manner), which this draft is fundamentally unable to overcome. This draft would probably work just as well, with a bit of work, and without those fundamental issues, for DoT. The root of the problem is visible in "if they chose not to". The nature of DoH, is that the network operator (regardless of who they are) is unable either detect or prevent guests (or users or BYOD or whoever) from not complying with your network policy. In the current unencrypted DNS world, in some specific environments (enterprise, etc), non-compliance is enforced at a port/protocol level (ACLs denying port 53). A similar model that enabled both discovery and enforcement, and if appropriate bypass of enforcements, would look roughly like: client -> obtain policy -> (comply with visibility into compliance by network, e.g. via DoT port/protocol) | (no-comply with visibility and blocking -> obtain explicit information about risks and informed consent from user -> violate/bypass e.g. via DoH) When only DoH is used, if there is no informed consent, this short circuits completely to client-> obtain policy -> comply or no-comply. This breaks all of the existing detection and enforcement for network-level tools applicable to DNS-based systems. Given that DoT provides everything that DoH provides, from a privacy perspective, so long as DoT isn't blocked and/or so long as any existing DNS resolver(s) have an upgrade to DoT, and so long as relevant clients (system or application) have the corresponding upgrade for DoT, I don't understand the non-use of DoT. Reminder: DoT clients have to build wire-format DNS queries, and then send them over TLS sessions. DoH clients haveh to build wire-format DNS queries, encode them, add HTTP headers, and send them over TLS sessions. DoH ALREADY, by definition, has all the necessary code paths to build the wire-format DNS queries required by DoT. Adding DoT to a resolver involves duplicating the DoH bits, and then removing the HTTP-handling bits, i.e. almost entirely removing code. I think the fundamental asymmetry, where the guest can know the network's policy but the network cannot detect or enforce its own policy, is easy to see and understand. And, I think the issue where this asymmetry is fundamental to DoH, but is not an attribute of DoT, is also clear to anyone who looks. This is why many of us are advocating for replacing DoH with DoT. The harm that DoH does in an intractable fashion, far outweighs (by many orders of magnitude) the benefits to an admittedly important set of users and use cases. I may have said it before, but I think it bears repeating: the DoH bypassing of network policy, SHOULD be restricted via several important safeguards (in widely distributed software systems): Disable DoH by default; restrict enabling DoH to admin-level accounts; restrict DoH usage to certain modes (e.g. incognito or equivalent); restrict DoH usage to the lifespan of a browser tab; restrict DoH usage/enabling via "informed consent" that may be very complex to implement, but which is nonetheless needed to ensure users are informed about their specific, concrete, literal risks (e.g. company policy violations, geopolitical environments, operator terms/conditions, etc.). Brian --000000000000d07d86058de4d4a2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 17, 2019 at 8:58 AM Ted H= ardie <ted.ietf@gmail.com> = wrote:
Hi Neil,

=
On Wed, Jul 17, 2019 at 8:38 AM Neil = Cook <ne= il.cook@open-xchange.com> wrote:
Hi Ted,

But, and this is th= e crux of the matter, that integration requires the cooperation of the endp= oint or its control by an organization's system administrators.=C2=A0 I= f you do not have their cooperation or the right to manage them by tools li= ke those Eric mentions, it is difficult for the endpoint to distinguish a n= etwork-level interception by a mandated policy engine and by an attacker.= =C2=A0=C2=A0

Rather than falling back to the s= tate where the endpoint simple accepts that its traffic is visible to all a= nd possibly intercepted, this new work is an effort to make it easier for y= ou to gain the cooperation required.=C2=A0 I hope you can see that this is = in both the interest of policy enforcement bodies and the end users.
<= /div>
=C2=A0
So I use DNS filtering in my own house (al= ong with millions of other people as already stated on this thread), provid= ed by my network operator (but it doesn=E2=80=99t have to be - I used to us= e OpenDNS for example, and I have the capability to run my own resolver if = I so desired).. I have malware filtering as well as parental controls enabl= ed. I am the de-facto network administrator in my house, =C2=A0but I don=E2= =80=99t have the tools or software that enterprises use so I won=E2=80=99t = benefit from the work being done to help enterprises control this. I also h= ave other people coming into my house and using my network, and I also like= to control what they can access when they are in my home. All of this work= s very well for me today. It doesn=E2=80=99t work for me when applications/= endpoints start deciding that my network is an attacker because it does fil= tering, and bypassing that filtering "in the interest of end-users&quo= t;.

I hope you can see that this is in both the in= terest of policy enforcement bodies and the end users.

I=E2=80=99d like to ask, ask an end-user, how is t= his in my interests?


I am sorry if I was not clear,=C2=A0 The point= of the draft is to enable the network operator to signal this:
   If the user agent can check for the presence of a policy=
, this could be
   used as a signal that the network operator wishes its resolver to be
   used as a condition of using the network, and that DoH or DoT should
   be disabled.
That permits your guests to know of your ne= twork policy and to abide by it if they choose; presumably you would not pr= ovide network access if they chose not to.

<= /div>

So, as far as I can tell, there are s= ome minor problems with the DoH deployment scheme proposed by various vendo= rs (on the client in an "applications doing DNS" manner), which t= his draft is fundamentally unable to overcome.

Thi= s draft would probably work just as well, with a bit of work, and without t= hose fundamental issues, for DoT.

The root of the = problem is visible in "if they chose not to". The nature of DoH, = is that the network operator (regardless of who they are) is unable either = detect or prevent guests (or users or BYOD or whoever) from not complying w= ith your network policy.

In the current unencrypte= d DNS world, in some specific environments (enterprise, etc), non-complianc= e is enforced at a port/protocol level (ACLs denying port 53).
A similar model that enabled both discovery and enforcement, a= nd if appropriate bypass of enforcements, would look roughly like:
client -> obtain policy -> (comply with visibility into compliance = by network, e.g. via DoT port/protocol) | (no-comply with visibility and bl= ocking -> obtain explicit information about risks and informed consent f= rom user -> violate/bypass e.g. via DoH)

When o= nly DoH is used, if there is no informed consent, this short circuits compl= etely to client-> obtain policy -> comply or no-comply.
This breaks all of the existing detection and enforcement for n= etwork-level tools applicable to DNS-based systems.

Given that DoT provides everything that DoH provides, from a privacy pers= pective, so long as DoT isn't blocked and/or so long as any existing DN= S resolver(s) have an upgrade to DoT, and so long as relevant clients (syst= em or application) have the corresponding upgrade for DoT, I don't unde= rstand the non-use of DoT.

Reminder: DoT clients h= ave to build wire-format DNS queries, and then send them over TLS sessions.= DoH clients haveh to build wire-format DNS queries, encode them, add HTTP = headers, and send them over TLS sessions. DoH ALREADY, by definition, has a= ll the necessary code paths to build the wire-format DNS queries required b= y DoT. Adding DoT to a resolver involves duplicating the DoH bits, and then= removing the HTTP-handling bits, i.e. almost entirely removing code.
=

I think the fundamental asymmetry, where the guest can = know the network's policy but the network cannot detect or enforce its = own policy, is easy to see and understand.

And, I = think the issue where this asymmetry is fundamental to DoH, but is not an a= ttribute of DoT, is also clear to anyone who looks.

This is why many of us are advocating for replacing DoH with DoT.
The harm that DoH does in an intractable fashion, far out= weighs (by many orders of magnitude) the benefits to an admittedly importan= t set of users and use cases.

I may have said it b= efore, but I think it bears repeating: the DoH bypassing of network policy,= SHOULD be restricted via several important safeguards (in widely distribut= ed software systems): Disable DoH by default; restrict enabling DoH to admi= n-level accounts; restrict DoH usage to certain modes (e.g. incognito or eq= uivalent); restrict DoH usage to the lifespan of a browser tab; restrict Do= H usage/enabling via "informed consent" that may be very complex = to implement, but which is nonetheless needed to ensure users are informed = about their specific, concrete, literal risks (e.g. company policy violatio= ns, geopolitical environments, operator terms/conditions, etc.).
=
Brian
--000000000000d07d86058de4d4a2-- From nobody Wed Jul 17 11:43:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C174112085E for ; Wed, 17 Jul 2019 11:43:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WcPLvxUyA5Pd for ; Wed, 17 Jul 2019 11:43:10 -0700 (PDT) Received: from mail-io1-xd36.google.com (mail-io1-xd36.google.com [IPv6:2607:f8b0:4864:20::d36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D5FE1201DC for ; Wed, 17 Jul 2019 11:43:10 -0700 (PDT) Received: by mail-io1-xd36.google.com with SMTP id z3so47438917iog.0 for ; Wed, 17 Jul 2019 11:43:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jj9r/Eo8XnHrr5VjQg4cuPTsrru0jHBctU+A4onuwOw=; b=rNkKD6fFqylqenaNSLPUKnOhxaTrQmbPA+KE/W3uRr+veWqum+oSTlc6F7z3Zjfrqz nt74qApgHo1SByR2x0Kd6qJOEcNSHExloHQEjPVRyRABuF+7kElqYIQvjoOAAwHS2zwA n5NTcIK71kRZvzO1QToEc1u4FnAPiO8FI0L/Ip0xmBgu2N2LF9epnHHpFU1aXhRohzqb +H7wJbJhDVYGvczq4211SClxlPQHoS6T3sHdlrwmzgYEZoqzrvuzwMmG5exVCJbr2cFj CM7T0B9gbk1TaJrCYHVPD0D8Z0+rkP7TtSCRdL2KC6RKD7Cu3bYPoF7QQSMKPb2Sn8qe 68Gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jj9r/Eo8XnHrr5VjQg4cuPTsrru0jHBctU+A4onuwOw=; b=kX6PMQCM4l2rww/eFWFwl98TkJhslmLmQN1dZ2WyWKD9XDXt20Exq4hgaK7OV6amc/ 1pAewEhGApcASFpZsvAOtQOousTeF3b+c/K5LPctzPevpACx7IJcGRliSqTvJNGVOXdJ SKZnKaWeNk4WcE8xdZVAlFO8UbAakx20ToYNAbya8qAWlff8Vaaj7MWc+NAMQ93KN50I Hxdc//DeY40qKnxBn7ubhhhbjhQeqnjph772q46xWctVvCgNkoy/s+JCQcPJmLmvUE5j +/D6c0C7gIOfFWBJ7keENChtZjqR6f7bu4j6BQ/ze2aaDcAocprR9Ep/vLaEDd302mfh SQ1Q== X-Gm-Message-State: APjAAAU72iaQji7Zk3f4ohf6FrhyV1V2vWH1uSPtYDFynddxGaPANJ6P hjCTT5I/AsdGrY4du2cOifRQxiZLCUP/xdXPiWc= X-Google-Smtp-Source: APXvYqxwwllcpYLqLKC3Ri/c69LAtOOlCQNfe+SeoX3qy5zUxzFgDAOnJZVa9Ef32UxSFmAWGi1oaleXfgpEVN2j+BA= X-Received: by 2002:a02:1a86:: with SMTP id 128mr43776988jai.95.1563388989771; Wed, 17 Jul 2019 11:43:09 -0700 (PDT) MIME-Version: 1.0 References: <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> <20190717182544.GA39700@isc.org> <20190717183409.5DCFF1578536@fafnir.remote.dragon.net> In-Reply-To: <20190717183409.5DCFF1578536@fafnir.remote.dragon.net> From: Rob Sayre Date: Wed, 17 Jul 2019 11:42:57 -0700 Message-ID: To: Paul Ebersman Cc: Evan Hunt , add@ietf.org Content-Type: multipart/alternative; boundary="00000000000061966f058de4dd8a" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 18:43:12 -0000 --00000000000061966f058de4dd8a Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 11:34 AM Paul Ebersman wrote: > Indeed. We seem to be spinning. Can we agree that: > > - there are multiple use cases where end users (or their employer) > want to have and control DNS filtering > Yes, they can install whatever software they want. - some of these use cases are not enterprises with an IT > infrastructure that can do things like group policy, control of user > apps, etc. > No. That's just a downgrade attack. No different than a clipper chip. thanks, Rob --00000000000061966f058de4dd8a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 17, 2019 at 11:34 AM Paul Ebe= rsman <list-add@dragon.net>= ; wrote:
Indeed. We seem to be spinning. Can we agree that:

=C2=A0 - there are multiple use cases where end users (or their employer) =C2=A0 =C2=A0 want to have and control DNS filtering
<= br>
Yes, they can install whatever software they want.
=
=C2=A0 - some of these use cases are not enterprises with an IT
=C2=A0 =C2=A0 infrastructure that can do things like group policy, control = of user
=C2=A0 =C2=A0 apps, etc.

No. That's= just a downgrade attack. No different than a clipper chip.

<= /div>
thanks,
Rob=C2=A0
--00000000000061966f058de4dd8a-- From nobody Wed Jul 17 11:44:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7477B1202F3 for ; Wed, 17 Jul 2019 11:44:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dUoUm7HivgHX for ; Wed, 17 Jul 2019 11:44:51 -0700 (PDT) Received: from mail-yw1-xc30.google.com (mail-yw1-xc30.google.com [IPv6:2607:f8b0:4864:20::c30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 628AF1201CF for ; Wed, 17 Jul 2019 11:44:51 -0700 (PDT) Received: by mail-yw1-xc30.google.com with SMTP id z63so11132066ywz.9 for ; Wed, 17 Jul 2019 11:44:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=WAY03+srfyXAlZTdj2Uw0R6uVleavzV0l/Ftv6Iq/hQ=; b=IFZoPxH2BfVleY04ilscoLG01NIYZKOmdNGleONJf08VtsWe+fe2tFj13niuOag3kl 0zRufDIZv5zobJtodZRd7tNK/7qYRNjkYvkRBeAjjp+23DagGTW2z4r+RlCoM3DQgFlM nApGO81TSSXARAu0nbMNDo7OUfc6WitEWyBmIzxMzYZvu03As0EZx25TYnzNTmB6MKsN skHKOMj86fClJ5b3dA1EUvTnNREKdD9osCZlsJRmzEfadTUkMY7OqOxsg/uvENpYtl+B /TMjflK+rHRiNZh+QtHLOavBH6SKq3YEx5PXxi3SojVWdObBtmelTgOyHhoF9PM3CRrA 37GA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=WAY03+srfyXAlZTdj2Uw0R6uVleavzV0l/Ftv6Iq/hQ=; b=sqyoTv7PLhKluMZDEJ0H0aEbh3+bBj2vlwLLmciQ3X5WQm57amxeNxGqvq4JNL0qdK oggqX6++SQs2K+M7BMN4v0+Xix0cOr5ZosRRzK/mv56JKrQdA4Az4cy29smpo4vwRiyI C+zIOu1lHb/j2KkbVvMB/25t2AVaJqy4E5qrNqYV2AHGtP9gJxrE5MfHINQGnE8z1/iL t9syh1ciR90YfZziTZ/GGQMjo1V0l7YmI3eqbL7ApbmoOSGGnmf5lujKKHYuxGvN9COX bzSD06kwzGvOgAN0AXyrurwfrfLbwwetrZ7mADNJYsZ6zOKFIn5Sg45WZBI8nhFTig7o Ei0g== X-Gm-Message-State: APjAAAVVQe8OV+bPjPhRBplQz6koqn1YI94/r9w2GXRT3kEMSb58MUq6 uNjN5ikvUpMnyisARJtfPF0mQlWKPwrGXf3KNqgjLA== X-Google-Smtp-Source: APXvYqxBfRBjTj0TvhDTYBSyR+eA4aUBqfloW2oCkxk94ccU5vHhtr9EYy51ykARgVRJ1CIzwemGtN3z0jTxTMaC9rI= X-Received: by 2002:a81:a253:: with SMTP id z19mr23373539ywg.13.1563389090049; Wed, 17 Jul 2019 11:44:50 -0700 (PDT) MIME-Version: 1.0 References: <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> <20190717182544.GA39700@isc.org> In-Reply-To: <20190717182544.GA39700@isc.org> From: Alec Muffett Date: Wed, 17 Jul 2019 19:44:36 +0100 Message-ID: To: add@ietf.org Content-Type: multipart/alternative; boundary="0000000000005bb38f058de4e346" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 18:44:54 -0000 --0000000000005bb38f058de4e346 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 17 Jul 2019, 19:25 Evan Hunt, wrote: > On the other hand there are millions of parents, so the strict utilitaria= n > analysis might not be so clear-cut. > That's true, fair point. Would you care to run some numbers, or shall I? But I'm not sure why we get hung up on parental filtering per se. My > worries are about botnet C&C and data exfiltration, and that's an issue > that applies to every network, with or without kids, and probably more to > businesses and governments than to families. > That's okay; the botnets are all innovating in the network space and will gradually bother less with / be impeded by, with censorable men in the middle such as DNS. The new hotness in malware C2 is rendezvous communications over existing[1] social network channels, such as pop-star Instagram comments =E2=80=94 not = to mention old workhorses like Tor, or even raw (horrors!) IP addresses. Albeit there _have_ been some botnets which have been stopped by _creating_ a domain name, and then reinvigorated[2] when that domain name was blocked. This is not an absolute statement; I freely admit that some malware C2 will be stopped by DNS filters; but it is increasingly less relevant because DNS bypass for C2 is a profitable evolutionary niche; so it is human beings who will benefit from - or will suffer - DNS filters most of all. [1] https://www.businessinsider.com/russian-hackers-turla-communicate-malware-b= ritney-spears-instagram-comment-2017-6 [2] https://www.theguardian.com/technology/2017/may/13/accidental-hero-finds-ki= ll-switch-to-stop-spread-of-ransomware-cyber-attack Glossary: C2 =3D "command and control" --0000000000005bb38f058de4e346 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, 17 Jul 2019, 19:25 Evan Hunt, <each@isc.org> wrote:
On the other hand there are millions of parents, so the strict utilitarian<= br> analysis might not be so clear-cut.

That's true, fair point.=C2=A0
=

Would you care to run some nu= mbers, or shall I?


<= /div>
But I'm not sure why we get hung up on parental filtering per se.=C2=A0= My
worries are about botnet C&C and data exfiltration, and that's an i= ssue
that applies to every network, with or without kids, and probably more to businesses and governments than to families.

That's okay; the botnets ar= e all innovating in the network space and will gradually bother less with /= be impeded by, with censorable men in the middle such as DNS.

The new hotness in malware C2 is ren= dezvous communications over existing[1] social network channels, such as po= p-star Instagram comments =E2=80=94 not to mention old workhorses like Tor,= or even raw (horrors!) IP addresses.

Albeit there _have_ been some botnets which have been stopped= by _creating_ a domain name, and then reinvigorated[2] when that domain na= me was blocked.

This is = not an absolute statement; I freely admit that some malware C2 will be stop= ped by DNS filters; but it is increasingly less relevant because DNS bypass= for C2 is a profitable evolutionary niche; so it is=C2=A0human beings who will benefit from - or will suffer -= DNS filters most of all.



Glossary: C2 =3D "command a= nd control"



--0000000000005bb38f058de4e346-- From nobody Wed Jul 17 11:49:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6743F120873 for ; Wed, 17 Jul 2019 11:49:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r8L1K0db0OO5 for ; Wed, 17 Jul 2019 11:49:34 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1AB7B1206ED for ; Wed, 17 Jul 2019 11:49:34 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id DABD4374009B; Wed, 17 Jul 2019 11:49:33 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id A5AA715786C0; Wed, 17 Jul 2019 12:49:33 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 9D65315786BF; Wed, 17 Jul 2019 12:49:33 -0600 (MDT) From: Paul Ebersman To: Rob Sayre cc: add@ietf.org In-reply-to: References: <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> <20190717182544.GA39700@isc.org> <20190717183409.5DCFF1578536@fafnir.remote.dragon.net> Comments: In-reply-to Rob Sayre message dated "Wed, 17 Jul 2019 11:42:57 -0700." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <66061.1563389373.1@fafnir.local> Date: Wed, 17 Jul 2019 12:49:33 -0600 Message-Id: <20190717184933.A5AA715786C0@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 18:49:36 -0000 ebersman> - some of these use cases are not enterprises with an IT ebersman> infrastructure that can do things like group policy, control ebersman> of user sayrer> No. That's just a downgrade attack. No different than a clipper sayrer> chip. If a home or small business isn't setting up a firefox or AD group policy to control browsers on their network, that's a downgrade attack? An attack on what? Their network? By whom? Expain. This makes zero sense. From nobody Wed Jul 17 11:56:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24C871208C4 for ; Wed, 17 Jul 2019 11:56:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mcTKzXd0agQO for ; Wed, 17 Jul 2019 11:56:30 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 68E461208C1 for ; Wed, 17 Jul 2019 11:56:30 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id s7so47349687iob.11 for ; Wed, 17 Jul 2019 11:56:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NbcgnzeiwF+Ce4211ZqN5ryqf4YS/FV/LPf/rl2SCK0=; b=iOPMksoE8Gw4YCgsz9DJZw7MSgUSB8eU2i0QhcGzxp3SIXuDOxeokOlfwW6ZazHq5V ygQ9LnhC4F3a6To1f61Qx//MbM33T9Yh/sVX9z3RSgTjGSvvkA8cC2X0sD/4nQAJzz2m imx1eV58eEmyJfzMyRxSk9+s2B6Rz10k3dR2WGf+vluCmfmqEsHagEJdekZIbzF4E1u1 in9cJHtNbuTY/WC9caJEB2OE39iecr5hNAdKoojgUh6q30aY+JZzmTpBt5zl5GwOvCq5 ULj+5F+4nD7YLmzSlonYrCpsHF+19hg2NHdJOJc+p944Dglfw/msBl6slRTxJGnhLkij r2Vg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NbcgnzeiwF+Ce4211ZqN5ryqf4YS/FV/LPf/rl2SCK0=; b=hEKh/rhajvwUqJGc/W3/Yct7sFZGzKh1q3w8Dgb3cKvvJzztAEM3r6SSDxNUJ8GAxU iahrSzNZSN1S3qxn/dyJXEMnH2YjbzwCvhPkKlgKoiUDGy9VeoWgEP3TPDp2zMT4fG2J cawVFSdbZim8d5SnZeN2Nt0JyPW72IYIeQsv6flK46UrRzU7erGkvEMsOiC2MmeJtUNg amwIExHrdFcczjtYaEcDVoUAr625DocDL/4i/d5DY/tYBJZwqSrddhbUEv0/is8Opb/4 Um0WOW8wdEi7Tox2qBO0U0XNlgfI3w2NvM6BPLu+C7w7Kk3m6DmoPVL3K6RYV3ztZW/K yu2w== X-Gm-Message-State: APjAAAXSya2ER/ZarHfFlG5Ge3LsbAnoCZxWrci6kI/LO3vPvHp6fk5r QteQCwHgwiZj23/CuCuqOkek3Bblsib2V2rjL9Y= X-Google-Smtp-Source: APXvYqyGXdVSXa9RiT0vmr7Peaj20Pz3ZW/0q0qrLTqMN1N1CpEewS89b3j32D7vr6eMioPloCOhYULDpXG0zGV9Fh8= X-Received: by 2002:a02:b883:: with SMTP id p3mr44991466jam.79.1563389789560; Wed, 17 Jul 2019 11:56:29 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: From: Ted Hardie Date: Wed, 17 Jul 2019 11:56:02 -0700 Message-ID: To: Brian Dickson Cc: Neil Cook , Vittorio Bertola , add@ietf.org, Rob Sayre Content-Type: multipart/alternative; boundary="0000000000000d61c6058de50dc4" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 18:56:32 -0000 --0000000000000d61c6058de50dc4 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 11:40 AM Brian Dickson < brian.peter.dickson@gmail.com> wrote: > > The root of the problem is visible in "if they chose not to". The nature > of DoH, is that the network operator (regardless of who they are) is unable > either detect or prevent guests (or users or BYOD or whoever) from not > complying with your network policy. > > I disagree. It forces the existence of the network policy to be visible, but it is entirely possible to deny network access to a system which is non-compliant. It is not as simple as blocking or intercepting all port 53 traffic, but that method never addressed the reality that cleartext traffic on that port was available to an observer. To get both confidentiality and policy enforcement via this means, practice will need to change. It will need to be visible to the system consuming the DNS (be it a browser, an OS, or some other application), and the enforcement mechanism will have to be better integrated into reachability mechanics. That is definitely new code for most people, but it is not impossible. regards, Ted Hardie --0000000000000d61c6058de50dc4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 17, 2019 at 11:40 AM Brian Di= ckson <brian.peter.dick= son@gmail.com> wrote:

The root of the problem is visible in "if they chose= not to". The nature of DoH, is that the network operator (regardless = of who they are) is unable either detect or prevent guests (or users or BYO= D or whoever) from not complying with your network policy.


I disagree.=C2=A0 It force= s the existence of the network policy to be visible, but it is entirely pos= sible to deny network access to a system which is non-compliant.=C2=A0 It i= s not as simple as blocking or intercepting all port 53 traffic, but that m= ethod never addressed the reality that cleartext traffic on that port was a= vailable to an observer.=C2=A0 To get both confidentiality and policy enfor= cement via this means, practice will need to change.=C2=A0 It will need to = be visible to the system consuming the DNS (be it a browser, an OS, or some= other application), and the enforcement mechanism will have to be better i= ntegrated into reachability mechanics.=C2=A0 That is definitely new code fo= r most people, but it is not impossible.

regards,<= /div>

Ted Hardie
=C2=A0
--0000000000000d61c6058de50dc4-- From nobody Wed Jul 17 12:17:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2EB181208CB for ; Wed, 17 Jul 2019 12:17:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xoGUmOu6IkYE for ; Wed, 17 Jul 2019 12:17:37 -0700 (PDT) Received: from mail-io1-xd42.google.com (mail-io1-xd42.google.com [IPv6:2607:f8b0:4864:20::d42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D2E9C1208C9 for ; Wed, 17 Jul 2019 12:17:37 -0700 (PDT) Received: by mail-io1-xd42.google.com with SMTP id f4so47557531ioh.6 for ; Wed, 17 Jul 2019 12:17:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ujxDB+uPaQxgMm2pUwXw4PtAPoA+jmP9VXpMvcgrDDY=; b=ECCArZOamcZXsuRsMXbR7LIPOCEWYFmUv0SGU7w2X+Gm89MNU6+bXtKQiBc7m13EW1 ccM2HMc+AfPQQa/CkRMG7i/ZqGoPArF4seryMnsbKS1VJddDtMDhsEdsjCHltDlZTUSr w+rU7T9I1vLphXa8UFTh4dBLKcWTuEDT79W+yEDz4bjj7M1Vdy/gd88KXefj9xQLALJk 5a7FiEKJwxmsPSrog35PiDv+TdCY5ezBFP+NuBmfx65xyI685qxZ05fyD2HRaOM80+Ec jP7KvUUqAlmq2yJNSEOYLcOfZ8avgupnLtypzlmBlast85fnt7BVB2h9yS3BEq+tcYY+ 1E/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ujxDB+uPaQxgMm2pUwXw4PtAPoA+jmP9VXpMvcgrDDY=; b=j1FwMa909TYeSkqFHzcD9hK18IwS8we2sEYwO6yIEk6y0UYBPq+fR/GsHFHP0/PbOR rzWuWohIx7xqgPjcPSAvkX0mIB8qGWJ4n0xJzGjz/E/eYijqalVuJGx6lnA9bebG48f1 yWIMTmu1jL8Ca6UZS2tQOd9cERFn2gUHbIshDUxuNJxX0hzG6m+kgzOdt/G35RSIgwMK /dMvzep3L8OTEWwDW5DkRKDGbHhIkb1DNYrtrcH26Mvt/ggVMDyj84xb8RsnOgNdg3UL GKaHf+ZR9O93ymaDk2JX1FNKvxJBMoVuWhYHWHeUtnsp/4KY3x/Fw/m3wWighCrkJEWX 1EMg== X-Gm-Message-State: APjAAAVEvyYdiMmdW6B89Jn0iHnm/Z90s8bLi+64bF+BWI6enT51Gg2S uEO0ynP5kUG2IQYN7yOs5pvjCCGu3kU/7DOYMxM= X-Google-Smtp-Source: APXvYqwo1OKRXJNYBmlYaWJJqr9ZtZwrT+EiRoEozndfvwmr/6MYHQY3Z/rO+ZjVK540NoPUOwzY6nwzkYvioNWahLc= X-Received: by 2002:a02:1087:: with SMTP id 129mr45429420jay.131.1563391057035; Wed, 17 Jul 2019 12:17:37 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: From: Rob Sayre Date: Wed, 17 Jul 2019 12:17:25 -0700 Message-ID: To: Ted Hardie Cc: Brian Dickson , Neil Cook , Vittorio Bertola , add@ietf.org Content-Type: multipart/alternative; boundary="0000000000009987ab058de55876" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 19:17:39 -0000 --0000000000009987ab058de55876 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 11:56 AM Ted Hardie wrote: > On Wed, Jul 17, 2019 at 11:40 AM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > >> >> The root of the problem is visible in "if they chose not to". The nature >> of DoH, is that the network operator (regardless of who they are) is unable >> either detect or prevent guests (or users or BYOD or whoever) from not >> complying with your network policy. >> > So, I thought we were designing the Internet here. There's no network policy. People are perfectly welcome to have a policy for their house or their company, but the IETF is not required to design for that purpose. It doesn't make sense to call it "BYOD", use the word "policy", and insist on insecure traffic. thanks, Rob --0000000000009987ab058de55876 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 17, 2019 at 11:56 AM Ted Hard= ie <ted.ietf@gmail.com> wro= te:
On Wed, Jul 17, 2019 at 11= :40 AM Brian Dickson <brian.peter.dickson@gmail.com> wrote:

The root of the problem = is visible in "if they chose not to". The nature of DoH, is that = the network operator (regardless of who they are) is unable either detect o= r prevent guests (or users or BYOD or whoever) from not complying with your= network policy.

So, I thought we were designing the Internet here. There&#= 39;s no network policy. People are perfectly welcome to have a policy for t= heir house or their company, but the IETF is not required to design for tha= t=C2=A0purpose.

It doesn't make sense to call = it "BYOD", use the word "policy", and insist on insecur= e traffic.

thanks,
Rob
--0000000000009987ab058de55876-- From nobody Wed Jul 17 12:46:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53ACC1200CD for ; Wed, 17 Jul 2019 12:46:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SJQFED_9U8Tk for ; Wed, 17 Jul 2019 12:46:49 -0700 (PDT) Received: from mail-ua1-x943.google.com (mail-ua1-x943.google.com [IPv6:2607:f8b0:4864:20::943]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E6DA120071 for ; Wed, 17 Jul 2019 12:46:49 -0700 (PDT) Received: by mail-ua1-x943.google.com with SMTP id j21so10134303uap.2 for ; Wed, 17 Jul 2019 12:46:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ygCING+RrUaEbUs6MxU8SPIOBhRUhT95oKZMX1Su8gc=; b=nASGlzILMDULzpJuRhv2sp9Bs9EHfwVXCbpckhhINKaKHe1tzA9indYysihHrtaUOp PYs+1sCKm4HOiN9zvQ+2thTB+Q5m2saTcxZpwz3wdJYm12DyEBP43QJ15/za4YMqwsDH EcwHPLdM4T/AKlpBlwiIZTDUyMuB3+S/zgRujEKhfrgnrta/vxM2PuX8IrpjtNjzxV99 2klElgrHtcb4Z2h+mpq7Klcf9qxA1rYh4+X8IRLzY7z7dbuNT9+C1jWFJKkKkI9ZyG89 Dj6LcIpAYgJF/MMsSQ4xMf5shgnY2rXDk2wqgFXdSpMQMLtqdzcEAXcXtUPI7V5U61+G vAXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ygCING+RrUaEbUs6MxU8SPIOBhRUhT95oKZMX1Su8gc=; b=mhnDOPnYfG5RGYGt625tt50a3R0cxIME8pXIiy/H3iGfK98sqr/YrHHS06Ppp+wOwZ fa+qwRpJqaNWueHNaIMypFUuUgma9j46MF0ug2+qkSy8/tfeI0LZUlppTy4QOdCrrDoY 3iDpw7ipsxwOuD3CKzKdusKPMJhqvYNQWoLay/tcF1Dy2UpEe9ZIvgpMuhOzQhcNHl3E 792uEYsKrU4fMk5mtq7jGu4At9abnEs4wQsKoCUQwScGXIyKBWc3MH+nMELoq6OQACyF mNOwWw/sdNFrMQLBzz2D+NjzAecn+a2YLiU4nDh2UnEqAOqXjAmxFiQ0yauLiPNZwQl5 onqw== X-Gm-Message-State: APjAAAUDc27EBTcTaiMOz4WxLOiDNZlZy11LLgyBPZe6o58t40P9/o6E 64nds3YJTTYtEFn1LEasAYdMepdsTIE35BZFsZ8= X-Google-Smtp-Source: APXvYqyuaBiQE0p+5m2h0AuWMi6rG23kRMb5xeEG4uzoySCxtV3E8GYt2uuy+zJOzOcvo5u6KrfVYHSo8WUwrEkL0CQ= X-Received: by 2002:ab0:2994:: with SMTP id u20mr23842727uap.114.1563392808264; Wed, 17 Jul 2019 12:46:48 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: From: Brian Dickson Date: Wed, 17 Jul 2019 12:46:36 -0700 Message-ID: To: Ted Hardie Cc: Neil Cook , Vittorio Bertola , add@ietf.org, Rob Sayre Content-Type: multipart/alternative; boundary="000000000000fb2a2d058de5c091" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 19:46:52 -0000 --000000000000fb2a2d058de5c091 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 11:56 AM Ted Hardie wrote: > On Wed, Jul 17, 2019 at 11:40 AM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > >> >> The root of the problem is visible in "if they chose not to". The nature >> of DoH, is that the network operator (regardless of who they are) is unable >> either detect or prevent guests (or users or BYOD or whoever) from not >> complying with your network policy. >> >> > I disagree. It forces the existence of the network policy to be visible, > but it is entirely possible to deny network access to a system which is > non-compliant. It is not as simple as blocking or intercepting all port 53 > traffic, but that method never addressed the reality that cleartext traffic > on that port was available to an observer. To get both confidentiality and > policy enforcement via this means, practice will need to change. It will > need to be visible to the system consuming the DNS (be it a browser, an OS, > or some other application), and the enforcement mechanism will have to be > better integrated into reachability mechanics. That is definitely new code > for most people, but it is not impossible. > So, I'd like to use a fairly simple existence proof (i.e. demonstrate a proof-of-concept model that would scale and work) on re-implementing the port-53 model, using DoT. Client attempts to contact random DoT server. Network monitoring systems see new DoT traffic between new pair of hosts (on port 853), alerts if not blocked, or perhaps the network already blocks such random connections on port 853 (check.) Client attempts to contact well-known DoT server (e.g. Quad9, CloudFlare, Google, or similar). Network policy permits this (check). Or, network policy does not permit this (check). Client attempts to contact local DoT server (e.g. server on IP handed out by DHCP or equivalent, or locally configured). Network policy permits this (check). Network surveillance of DNS queries performed on local DoT server (check). Client attempts to contact random DNS/53 server. (Either allowed or denied, i.e. same as today, including monitoring elements if allowed). No change (check). Yes, network surveillance of DNS queries on DoT requires operation of a DoT server to facilitate that. Use of DoT, exclusively, allows the enforcement of that policy at a network level (ACLs with respect to port 853). The end result is a network policy of, "use our DNS service, or none at all, or don't use our network". None of the above *requires* host-level changes. The above certainly plays nice with any host-level augmentations on other explicit ways of publishing and consuming policy. I don't see any way of achieving the same policy enforcement result, without implementing strict host-level validation mechanisms, which is a change over the DoT-only scheme above. In the DoT world, the policy is inherently visible. If you try to use a particular DoT provider, you know immediately whether that is possible or not. The issue of whether a particular DoT server is or is not providing a certain level of privacy, is perhaps something that could be signaled, but I don't see any way of validating that signaling beyond, at best, some kind of contractual enforcement. I.e. if you want to be sure the party you are talking to is or is not doing what they say they are doing, pretty much the only way to be sure requires the involvement of law enforcement and/or lawyers. The difference between DoT and DoH are whether host-level mechanisms are required, to achieve any meaningful assessment of compliance. Host-level compromise defeats host-level mechanisms, so other than secure ways of proving host non-compromise (like TPM things), it is provably less secure than adding network-based detection/enforcement. (None of the above applies to malware that does its own communication to C&C systems, but it does apply to malware that leverages browser-based DoH capabilities to make use of DNS for any of C&C, exfiltration, payload acquisition, etc.) Brian --000000000000fb2a2d058de5c091 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 17, 2019 at 11:56 AM Ted = Hardie <ted.ietf@gmail.com>= wrote:
On Wed, Jul 17, 2019 at 11:40 AM Brian Dickson &l= t;brian.= peter.dickson@gmail.com> wrote:
=

The root of the problem is visible in "if = they chose not to". The nature of DoH, is that the network operator (r= egardless of who they are) is unable either detect or prevent guests (or us= ers or BYOD or whoever) from not complying with your network policy.
<= div>

I disagree.=C2= =A0 It forces the existence of the network policy to be visible, but it is = entirely possible to deny network access to a system which is non-compliant= .=C2=A0 It is not as simple as blocking or intercepting all port 53 traffic= , but that method never addressed the reality that cleartext traffic on tha= t port was available to an observer.=C2=A0 To get both confidentiality and = policy enforcement via this means, practice will need to change.=C2=A0 It w= ill need to be visible to the system consuming the DNS (be it a browser, an= OS, or some other application), and the enforcement mechanism will have to= be better integrated into reachability mechanics.=C2=A0 That is definitely= new code for most people, but it is not impossible.

So, I'd like to use a fairly simple existen= ce proof (i.e. demonstrate a proof-of-concept model that would scale and wo= rk) on re-implementing the port-53 model, using DoT.

Client attempts to contact random DoT server. Network monitoring systems= see new DoT traffic between new pair of hosts (on port 853), alerts if not= blocked, or perhaps the network already blocks such random connections on = port 853 (check.)
Client attempts to contact well-known DoT serve= r (e.g. Quad9, CloudFlare, Google, or similar). Network policy permits this= (check). Or, network policy does not permit this (check).=C2=A0
= Client attempts to contact local DoT server (e.g. server on IP handed out b= y DHCP or equivalent, or locally configured). Network policy permits this (= check). Network surveillance of DNS queries performed on local DoT server (= check).
Client attempts to contact random DNS/53 server. (Either = allowed or denied, i.e. same as today, including monitoring elements if all= owed). No change (check).
Yes, network surveillance of DNS querie= s on DoT requires operation of a DoT server to facilitate that.
U= se of DoT, exclusively, allows the enforcement of that policy at a network = level (ACLs with respect to port 853). The end result is a network policy o= f, "use our DNS service, or none at all, or don't use our network&= quot;.

None of the above requires host-leve= l changes. The above certainly plays nice with any host-level augmentations= on other explicit ways of publishing and consuming policy.

<= /div>
I don't see any way of achieving the same policy enforcement = result, without implementing strict host-level validation mechanisms, which= is a change over the DoT-only scheme above.

In th= e DoT world, the policy is inherently visible. If you try to use a particul= ar DoT provider, you know immediately whether that is possible or not.

The issue of whether a particular DoT server is or is = not providing a certain level of privacy, is perhaps something that could b= e signaled, but I don't see any way of validating that signaling beyond= , at best, some kind of contractual enforcement.
I.e. if you want= to be sure the party you are talking to is or is not doing what they say t= hey are doing, pretty much the only way to be sure requires the involvement= of law enforcement and/or lawyers.

The difference= between DoT and DoH are whether host-level mechanisms are required, to ach= ieve any meaningful assessment of compliance.
Host-level compromi= se defeats host-level mechanisms, so other than secure ways of proving host= non-compromise (like TPM things), it is provably less secure than adding n= etwork-based detection/enforcement.

(None of the a= bove applies to malware that does its own communication to C&C systems,= but it does apply to malware that leverages browser-based DoH capabilities= to make use of DNS for any of C&C, exfiltration, payload acquisition, = etc.)

Brian
--000000000000fb2a2d058de5c091-- From nobody Wed Jul 17 13:49:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B1151200FD for ; Wed, 17 Jul 2019 13:49:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ptfYsI8YyqjR for ; Wed, 17 Jul 2019 13:49:07 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4ED181200C5 for ; Wed, 17 Jul 2019 13:49:07 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id j5so43774152ioj.8 for ; Wed, 17 Jul 2019 13:49:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=WkRt+UDTpTbac/lQCF8G/5lLTIPb9sX5ffhz/5iQADc=; b=a4XehZkgtsftz1RN0imEhUvb6WkxZSYPgk/DLaeSDD2nj42aFDX160tI8ouNVMA0pP BJTqNtVvx/k6C69WRKuY8fzi3ToP9Va4Czf8eO/3mkSLW2eUTQdgmvMqibzDSEnZ4qCq skSLIvP+Fe/R0mBp6ekRUDonavGXlTgzBEsCTuhy2cZJ213wY2ID15d9FhFpCeJ/zf+F ulv9x+1aVBH+gJ3FMBYHNHaw1SqKey1cEZWVQ8CFm45djidh1D9vp7m5Su2Q88vOBW8X n+RaLkjMAeMaFfknV47DNemN4+VZKm7ctmpFqA3MGS0BKkXBTZBT6uzivk5Bpg2nuhse f7AQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=WkRt+UDTpTbac/lQCF8G/5lLTIPb9sX5ffhz/5iQADc=; b=Fj4BpxFp/jTxS60VKu9cH2K1vuTZPrtomn6t3LUWPj4smpuE3w/iQzcTZIKPLwQfDZ HclHCW5ZJjdRp2sGwjuKmi6uB8lLQkAcgdfHULAn5nK1RToZqiZttk1vUrax5LBHyK/O lSk07kDMXsOVBU06Yr8OVF55WDbBn85/9Mx1P30ncLWQz5Qha+I3bp9jvdYMK8cXOol1 tw5pLshnw8afi5lsGwONtUar1FZm/emeqj38voH7OJWXTb4ekI0nG3zsWkEJ3wcU/IqD ABiFzX5r/szoYZc1ubuhVhNeDWuFE7o2L+eV/l+yzIJEIjk2TAPw5R1MO+fNjUWhIuZB dbZw== X-Gm-Message-State: APjAAAVjFF9UB/V0hcnR+M43/DRqeN4ozrnzGtbKY0M8QxLjLD6GgveQ fvqX9q0U0EFYL9j0YVJO+1OTXgvhhsswK5X0UWw= X-Google-Smtp-Source: APXvYqwXsw5msjg9nV/8DOtyqmK9nEDJNMEYFK/x2kJoJHTATNFZlcJmg1kknd4k1bsWmUtpdSH4+Aqxix2no0Pq0jw= X-Received: by 2002:a02:5ec3:: with SMTP id h186mr46470816jab.110.1563396546351; Wed, 17 Jul 2019 13:49:06 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: From: Ted Hardie Date: Wed, 17 Jul 2019 13:48:38 -0700 Message-ID: To: Brian Dickson Cc: Neil Cook , Vittorio Bertola , add@ietf.org, Rob Sayre Content-Type: multipart/alternative; boundary="000000000000c9dcb9058de69f7b" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 20:49:11 -0000 --000000000000c9dcb9058de69f7b Content-Type: text/plain; charset="UTF-8" Hi Brian, Some comments in-line. On Wed, Jul 17, 2019 at 12:46 PM Brian Dickson < brian.peter.dickson@gmail.com> wrote: > > > On Wed, Jul 17, 2019 at 11:56 AM Ted Hardie wrote: > >> On Wed, Jul 17, 2019 at 11:40 AM Brian Dickson < >> brian.peter.dickson@gmail.com> wrote: >> >>> >>> The root of the problem is visible in "if they chose not to". The nature >>> of DoH, is that the network operator (regardless of who they are) is unable >>> either detect or prevent guests (or users or BYOD or whoever) from not >>> complying with your network policy. >>> >>> >> I disagree. It forces the existence of the network policy to be visible, >> but it is entirely possible to deny network access to a system which is >> non-compliant. It is not as simple as blocking or intercepting all port 53 >> traffic, but that method never addressed the reality that cleartext traffic >> on that port was available to an observer. To get both confidentiality and >> policy enforcement via this means, practice will need to change. It will >> need to be visible to the system consuming the DNS (be it a browser, an OS, >> or some other application), and the enforcement mechanism will have to be >> better integrated into reachability mechanics. That is definitely new code >> for most people, but it is not impossible. >> > > So, I'd like to use a fairly simple existence proof (i.e. demonstrate a > proof-of-concept model that would scale and work) on re-implementing the > port-53 model, using DoT. > > Client attempts to contact random DoT server. Network monitoring systems > see new DoT traffic between new pair of hosts (on port 853), alerts if not > blocked, or perhaps the network already blocks such random connections on > port 853 (check.) > If blocked, the client is dead in the water without an application or host configuration change. Client attempts to contact well-known DoT server (e.g. Quad9, CloudFlare, > Google, or similar). Network policy permits this (check). Or, network > policy does not permit this (check). > If blocked, the client is dead in the water without an application or host configuration change, as above. > > Client attempts to contact local DoT server (e.g. server on IP handed out > by DHCP or equivalent, or locally configured). Network policy permits this > (check). Network surveillance of DNS queries performed on local DoT server > (check). > Note that the client is not aware in this scenario of whether the local DOT server is or is not blocking traffic, observing traffic, or anything else. Your premise is apparently that by agreeing to use the local resolver they have agreed to whatever is being done. In fact, there are existing scenarios (coffee shop with a portal page being the most prominent) where the local system will permit specific names to go to the local resolver to solicit those pages, but will forbid anything else. So some more subtle scenarios already exist. > Client attempts to contact random DNS/53 server. (Either allowed or > denied, i.e. same as today, including monitoring elements if allowed). No > change (check). > And subject to observation or interference by on-path attackers, as has been discussed. Yes, network surveillance of DNS queries on DoT requires operation of a DoT > server to facilitate that. > If you run a local DoH service and the client attaches to it, the situations are parallel. > Use of DoT, exclusively, allows the enforcement of that policy at a > network level (ACLs with respect to port 853). The end result is a network > policy of, "use our DNS service, or none at all, or don't use our network". > > If you mean "only DoT allows this", then I continue to disagree. If you mean that only using DoT within this context allows this, I agree. > None of the above *requires* host-level changes. The above certainly > plays nice with any host-level augmentations on other explicit ways of > publishing and consuming policy. > > I don't see any way of achieving the same policy enforcement result, > without implementing strict host-level validation mechanisms, which is a > change over the DoT-only scheme above. > > The theory that would go with this draft runs something like this: * put up a signal that hosts and applications can check to see if non-local DNS is permitted (and possibly, provide data on where the local secure DNS resolver is, if provided). * link the dns resolver to the reachability management system (e.g. a firewall) and permit traffic to exit the network only to destinations which have been resolved via the local DNS and which have passed whatever checks you have instituted. A non-compliant visitor will then only be able to reach destinations which have already been whitelisted by previous resolutions; that means that they likely will be able to reach various CDNs, popular services, and so on, but won't be able to reach random hosts that have not already been vetted by the checks you instituted. Is this new code? Absolutely. But it is not a host-level change, and it permits more without host re-configuration than the pure blocking mechanism you outlined.* > In the DoT world, the policy is inherently visible. If you try to use a > particular DoT provider, you know immediately whether that is possible or > not. > > It cannot distinguish between this policy imposition, a reachability failure, and a service failure. As a signal, it is pretty ambiguous. > The issue of whether a particular DoT server is or is not providing a > certain level of privacy, is perhaps something that could be signaled, but > I don't see any way of validating that signaling beyond, at best, some kind > of contractual enforcement. > I.e. if you want to be sure the party you are talking to is or is not > doing what they say they are doing, pretty much the only way to be sure > requires the involvement of law enforcement and/or lawyers. > > The difference between DoT and DoH are whether host-level mechanisms are > required, to achieve any meaningful assessment of compliance. > Host-level compromise defeats host-level mechanisms, so other than secure > ways of proving host non-compromise (like TPM things), it is provably less > secure than adding network-based detection/enforcement. > > (None of the above applies to malware that does its own communication to > C&C systems, but it does apply to malware that leverages browser-based DoH > capabilities to make use of DNS for any of C&C, exfiltration, payload > acquisition, etc.) > > I'm afraid I must continue to disagree with your premise. I have no issue at all with increased deployments of DoT, but I do not agree that this rules out the use of DoH. regards, Ted *For those that outsource this, it may also require a new service that allows the topology decisions and the resolution services to be linked. There are several ways to accomplish this by using remote configuration, by taking traffic out of the network to a service provider quarantine via VPN, or by some combination of the two. Again, this is new. But it is not impossible, as very similar systems have been built by organization which centralize these operations; it requires that these be made available to new customers. > Brian > --000000000000c9dcb9058de69f7b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Brian,

<= div>Some comments in-line.

On Wed, Jul 17, 2019 at 12:46 PM Brian = Dickson <brian.peter.di= ckson@gmail.com> wrote:


On Wed, Jul 17, 2019= at 11:56 AM Ted Hardie <ted.ietf@gmail.com> wrote:
On Wed, Jul 17= , 2019 at 11:40 AM Brian Dickson <brian.peter.dickson@gmail.com> wrote:

The root of= the problem is visible in "if they chose not to". The nature of = DoH, is that the network operator (regardless of who they are) is unable ei= ther detect or prevent guests (or users or BYOD or whoever) from not comply= ing with your network policy.

=

I disagree.=C2=A0 It forces the existence of the networ= k policy to be visible, but it is entirely possible to deny network access = to a system which is non-compliant.=C2=A0 It is not as simple as blocking o= r intercepting all port 53 traffic, but that method never addressed the rea= lity that cleartext traffic on that port was available to an observer.=C2= =A0 To get both confidentiality and policy enforcement via this means, prac= tice will need to change.=C2=A0 It will need to be visible to the system co= nsuming the DNS (be it a browser, an OS, or some other application), and th= e enforcement mechanism will have to be better integrated into reachability= mechanics.=C2=A0 That is definitely new code for most people, but it is no= t impossible.

So, I'd= like to use a fairly simple existence proof (i.e. demonstrate a proof-of-c= oncept model that would scale and work) on re-implementing the port-53 mode= l, using DoT.

Client attempts to contact random Do= T server. Network monitoring systems see new DoT traffic between new pair o= f hosts (on port 853), alerts if not blocked, or perhaps the network alread= y blocks such random connections on port 853 (check.)

If blocked, the client is dead in the water wi= thout an application or=20 host configuration change.

Client attempts= to contact well-known DoT server (e.g. Quad9, CloudFlare, Google, or simil= ar). Network policy permits this (check). Or, network policy does not permi= t this (check).

If blocke= d, the client is dead in the water without an application or=20 host configuration change, as above.
=C2=A0
=C2=A0
Client attempts to contact local DoT server (e= .g. server on IP handed out by DHCP or equivalent, or locally configured). = Network policy permits this (check). Network surveillance of DNS queries pe= rformed on local DoT server (check).
Note that the client is not aware in this scenario of whether t= he local DOT server is or is not blocking traffic, observing traffic, or an= ything else.=C2=A0 Your premise is apparently that by agreeing to use the l= ocal resolver they have agreed to whatever is being done.=C2=A0 In fact, th= ere are existing scenarios (coffee shop with a portal page being the most p= rominent) where the local system will permit specific names to go to the lo= cal resolver to solicit those pages, but will forbid anything else.=C2=A0 S= o some more subtle scenarios already exist.
=C2=A0
Client attempts to contact random DNS/53 server. (Either= allowed or denied, i.e. same as today, including monitoring elements if al= lowed). No change (check).

And subject to observation or interference by on-path attackers, as has b= een discussed.

Yes, network su= rveillance of DNS queries on DoT requires operation of a DoT server to faci= litate that.

If you run a= local DoH service and the client attaches to it, the situations are parall= el.
=C2=A0
Use of DoT, exclusive= ly, allows the enforcement of that policy at a network level (ACLs with res= pect to port 853). The end result is a network policy of, "use our DNS= service, or none at all, or don't use our network".
If you mean "only DoT allows this= ", then I continue to disagree.=C2=A0 If you mean that only using DoT = within this context allows this, I agree.
=C2=A0
None of the above requires host-level ch= anges. The above certainly plays nice with any host-level augmentations on = other explicit ways of publishing and consuming policy.

I don't see any way of achieving the same policy enforcement resu= lt, without implementing strict host-level validation mechanisms, which is = a change over the DoT-only scheme above.


The theory that would go with this draft run= s something like this:=C2=A0

* put up a signa= l that hosts and applications can check to see if non-local DNS is permitte= d (and possibly, provide data on where the local secure DNS resolver is, if= provided).

* link the dns resolver to the reachab= ility management system (e.g. a firewall) and permit traffic to exit the ne= twork only to destinations which have been resolved via the local DNS and w= hich have passed whatever checks you have instituted.

A non-compliant visitor will then only be able to reach destination= s which have already been whitelisted by previous resolutions; that means t= hat they likely will be able to reach various CDNs, popular services, and s= o on, but won't be able to reach random hosts that have not already bee= n vetted by the checks you instituted.=C2=A0

= Is this new code?=C2=A0 Absolutely.=C2=A0 But it is not a host-level change= , and it permits more without host re-configuration than the pure blocking = mechanism you outlined.*
=C2=A0
=
In the DoT world, the policy is inherently visible. If you try t= o use a particular DoT provider, you know immediately whether that is possi= ble or not.


It cannot distinguish between this policy imposition, a reachability fail= ure, and a service failure.=C2=A0 As a signal, it is pretty ambiguous.
<= /div>
=C2=A0
The issue of wheth= er a particular DoT server is or is not providing a certain level of privac= y, is perhaps something that could be signaled, but I don't see any way= of validating that signaling beyond, at best, some kind of contractual enf= orcement.
I.e. if you want to be sure the party you are talking t= o is or is not doing what they say they are doing, pretty much the only way= to be sure requires the involvement of law enforcement and/or lawyers.

The difference between DoT and DoH are whether host-l= evel mechanisms are required, to achieve any meaningful assessment of compl= iance.
Host-level compromise defeats host-level mechanisms, so ot= her than secure ways of proving host non-compromise (like TPM things), it i= s provably less secure than adding network-based detection/enforcement.

(None of the above applies to malware that does its o= wn communication to C&C systems, but it does apply to malware that leve= rages browser-based DoH capabilities to make use of DNS for any of C&C,= exfiltration, payload acquisition, etc.)

<= /blockquote>

I'm afraid I must continue to disagree = with your premise.=C2=A0 I have no issue at all with increased deployments = of DoT, but I do not agree that this rules out the use of DoH.
regards,

Ted

=
*For those that outsource this, it may also require a new service that= allows the topology decisions and the resolution services to be linked.=C2= =A0 There are several ways to accomplish this by using remote configuration= , by taking traffic out of the network to a service provider quarantine via= VPN, or by some combination of the two.=C2=A0 Again, this is new.=C2=A0 Bu= t it is not impossible, as very similar systems have been built by organiza= tion which centralize these operations; it requires that these be made avai= lable to new customers.
=C2=A0
<= /div>
Brian
--000000000000c9dcb9058de69f7b-- From nobody Wed Jul 17 14:35:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4228120116 for ; Wed, 17 Jul 2019 14:35:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V8MPMlOHjqf8 for ; Wed, 17 Jul 2019 14:35:30 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8D82212011A for ; Wed, 17 Jul 2019 14:35:30 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 1115D6A3AF; Wed, 17 Jul 2019 23:35:27 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563399327; bh=5XaR1t2GMsj/omPu3Qyg5zC2gKa2bg6QTuqbCahjuPM=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=Qcx+aIuYNUlK8z8+C+RWUpaPH/A4AqZpO4woJWAZ2neCeDVCnhFaV+HSX93rmNgQk mOVzkWWL8PguJH8DDBCuggOe91iSLeSGcfTBr6B2oHYnRCmTjlKZswi1RO7dVZvIrE 8m/5krdpzqtkpvGj/PE+q557hF6Cm0S6Hv+v7mq5ktAfOzNBLqU1ESYzUyYkfrsdnG nb2I+pb4JpCOa1wo0Uxw6ijigiyNvvMOZ82ayRdZj8ezfQSlXZe9hSLnuDZbBuWXlJ +sYYzEnnedMpsIzstDPkxXKDP2h+crVldcTrjH6a/twBe7hKn4VYavGo+pNK+aWa62 OUksh/6mwWMDw== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 030AE3C0101; Wed, 17 Jul 2019 23:35:27 +0200 (CEST) Date: Wed, 17 Jul 2019 23:35:26 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Ted Hardie Cc: add@ietf.org Message-ID: <845753479.11838.1563399326950@appsuite-gw1.open-xchange.com> In-Reply-To: References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev8 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 21:35:33 -0000

Il 17 luglio 2019 17:25 Ted Hardie <ted.ietf@gmail.com> ha scritto:

The IETF was not building these protocols to stop the use of the DNS as a policy enforcement mechanism and it is entirely possible to integrate them into a system which does this by offering the policy enforcing resolver over one of these confidential protocols. 
I agree on the second part of your sentence, but I do not fully agree on the first one. In late 2017, several people - including one author of RFC 8484 and one member of the IAB - went on record saying that DoH was being developed exactly to stop the use of DNS as a policy enforcement mechanism. See for example the "DOH" section in this article:


Of course these were not statements made on behalf of "the IETF", nor they represent the objectives of everyone who took part in the work, yet the fact that the whole organization got DoH standardized so quickly is hard to interpret differently than a sign of support both for the technology and for its explicit purpose above.

Now, arguing over this is not very useful, but I wanted to show that the concerns over the IETF's past approach to this matter have some reasons, even if I concede that most issues derive from deployment choices and not from the standard in itself. But if the people making the deployment choices are the same people that wrote and approved the standard, drawing a line is almost impossible.
Rather than falling back to the state where the endpoint simple accepts that its traffic is visible to all and possibly intercepted, this new work is an effort to make it easier for you to gain the cooperation required.  I hope you can see that this is in both the interest of policy enforcement bodies and the end users.
Yes, and this is why I was actually defending the spirit of the draft against claims that it would just facilitate downgrade attacks. I think this draft is a step forward, and in general Mozilla appear to be much more receptive to the concerns than they were months ago, and this goes to their merit. I see progress in this discussion and I am happy to continue it.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
From nobody Wed Jul 17 14:42:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B43012012E for ; Wed, 17 Jul 2019 14:42:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sc5GxnjJmPOl for ; Wed, 17 Jul 2019 14:42:18 -0700 (PDT) Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E0F09120116 for ; Wed, 17 Jul 2019 14:42:17 -0700 (PDT) Received: by mail-io1-xd2e.google.com with SMTP id s7so48084151iob.11 for ; Wed, 17 Jul 2019 14:42:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=dqgMiP58qSbfDHlxcHu9QfrEH9xCtUw+c1oAvNkfbqo=; b=A52AhM7qb7dZm0h47mOXox3j+lrquKRu4JyZIwMgq2bZZQxEcEbtLWZ3Jg0XSNgFj4 fwbo6q579ueSdzrSZAltfQ7XA6x/5nKI4J6dPdM5PbC1035PCIzoOp8jHyMN4DgVmc5p ve+ALOGvDfmFbAFg2lMOetOegy76od8jWCjYZ1tur6ORxNIqLuL5hbQiUXmSwnKwfCDw l2dhuUjzc51Ij+pVZDyioSbKBjsTcej8dfoefzFgPB6FjeE6I2gi/aE/VXM00yUqPp5Z rAQaxNSXrS49FhXIao5Nvk1zzVywzy5HffavQiFcBmY7yZUL+DTuuTCZMkpBG7xhLrfC POpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=dqgMiP58qSbfDHlxcHu9QfrEH9xCtUw+c1oAvNkfbqo=; b=MySWwLwBFj1hlaooTn/IrUuNVVUQ3wCXoRlYVPhf/8pInkJiJAE701CenTFZSipBUy B5X+9kQ8Vm58CvnBnn/EB9RqmOqL3KYeLszS4C4CLNE0Tvtp1laDiJRt/YxPHjxGib/9 rRRygxkUKFlX2n0IiPtLnLLuOuEX3e5fQkuWqWYcMoBh3Fx+z1wynroWvlpnSBdF/GeW guIHIS6G5hYPZERFwSzffJsw0/EIcEmQEm4fW6rdopouGhxAz4HWtEt52EeUlYq8Ynrc gnka/tgG+gssBeANtlqMVRgGun9u51vqSAj5UtcWchQuJNFnpIxJtoggkL1oQk9otNf9 gfVw== X-Gm-Message-State: APjAAAU7g4Y0qqXrT861304YY18xxlRe3lEireJgvOmXHovpRWt9yx8f W1llXiICctqj0yWAjxg/6vFqq7k4kOjFI7nMQ/c= X-Google-Smtp-Source: APXvYqygdUbFmsGr1sxD1WoB/8H1vMGxWGctpvvP+N7T8pzQXKf7fuJG8waC09h3UzHgJcfC8hnJEJC7pcE1tCqBtgs= X-Received: by 2002:a6b:b602:: with SMTP id g2mr38818257iof.54.1563399737123; Wed, 17 Jul 2019 14:42:17 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> <845753479.11838.1563399326950@appsuite-gw1.open-xchange.com> In-Reply-To: <845753479.11838.1563399326950@appsuite-gw1.open-xchange.com> From: Rob Sayre Date: Wed, 17 Jul 2019 14:42:05 -0700 Message-ID: To: Vittorio Bertola Cc: Ted Hardie , add@ietf.org Content-Type: multipart/alternative; boundary="000000000000f92802058de75df3" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 21:42:19 -0000 --000000000000f92802058de75df3 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 2:35 PM Vittorio Bertola wrote: > Yes, and this is why I was actually defending the spirit of the draft > against claims that it would just facilitate downgrade attacks. > Isn't that exactly what it does? It turns off DoH over clear text, and thus doesn't comply with BCP 61 or BCP 188. thanks, Rob --000000000000f92802058de75df3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 17, 2019 at 2:35 PM Vittorio = Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:
<= blockquote type=3D"cite">
Yes, and this is why I was actually defending the spirit of the draft ag= ainst claims that it would just facilitate downgrade attacks.

Isn't that exactly what it does? It turn= s off DoH over clear text, and thus doesn't comply with BCP 61 or BCP 1= 88.

thanks,
Rob
=C2=A0
--000000000000f92802058de75df3-- From nobody Wed Jul 17 14:54:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72B4212014E for ; Wed, 17 Jul 2019 14:54:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WIhpwd4dJBaH for ; Wed, 17 Jul 2019 14:54:06 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DE3C12012B for ; Wed, 17 Jul 2019 14:54:06 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 8418B6A290; Wed, 17 Jul 2019 23:54:04 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563400444; bh=foFJoxdIbPQ0DXL7jeZbEd2CCzy8e/wzpBPrNVCY2HA=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=e47fJPkOAx//mF3OK80CoBn0mh4TfczvjEUrJCxnmt/p/OrFbjM9S9hHTlUFJIGFR P0/pApZ/lQX8I9u4aGQxjx3YAZOBd6DTvvu2hY0V3VJqx5VGYd2humLvIoCeddSUi6 3NvYXJtpQbERiuvvoQhG8+SMCpygBR2y92MmvCFilHA2MCj+4DnZUSKX81awy6egKY TQ5OE55YdJ2+YIfQyRGGNW174w8Zccjo5fXZZ4k2ACS29Hwxx2Uqw3/YXqguEHfkc3 JSub9mrKayZ7crdDsCsQLYsNRnqYBnSSa1RNNwuw5sYHoUCURmL3mqKsx/VZG83949 bfyncRclBxzAA== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 767E73C0101; Wed, 17 Jul 2019 23:54:04 +0200 (CEST) Date: Wed, 17 Jul 2019 23:54:04 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Alec Muffett Cc: add@ietf.org Message-ID: <1702868587.11849.1563400444426@appsuite-gw1.open-xchange.com> In-Reply-To: References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev8 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 21:54:09 -0000

Il 17 luglio 2019 19:28 Alec Muffett <alec.muffett@gmail.com> ha scritto:

...and there's the rub; of the two/more problem spaces, I see more implementation opportunities in parental benificient oversight, than for escape to a free web for oppressed peoples.

Put differently: you are a parent or guardian and you care for a small population of children. Dictators oppress thousands to millions. A utilitarian approach suggests that the latter are more important to enable, than would be the cost of mildly inconveniencing or requiring the former to change their protective approach.
Can I just ask you whether you really think that DoH makes a real difference to the proverbial dissident under a dictatorship? If I were one, I'd already be using stuff like Tor and VPNs. Encrypting the DNS query is nice, but if then there are packets going from my computer straight to the forbidden destination, it's also not very useful - and if there aren't, then I am possibly already using technologies that could transport my DNS queries securely as well.

I think that DoH is much more of value for people that do not need to hide their traces completely, but just don't want their DNS traffic tracked and monetized.

Also, this idea that the Internet will export democracy by providing "escape to a free web for oppressed peoples" is... so 90's. In most countries that have been mentioned as examples of dictatorships throughout this discussion, most people are actually quite happy about their regime and often even happy not to live in a Western democracy (though that's partly because of propaganda, but often it is also because of different cultural values). It takes much more to subvert an authoritarian system than the ability to connect to some websites. It's still worth providing people in these countries with additional protections, but the depiction of a sad, oppressed world that is just waiting for DoH to bloom into democracy is a bit too much :-)

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
From nobody Wed Jul 17 15:00:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 050791200E7 for ; Wed, 17 Jul 2019 15:00:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SVVveBZx2oAp for ; Wed, 17 Jul 2019 15:00:01 -0700 (PDT) Received: from mail-vs1-xe34.google.com (mail-vs1-xe34.google.com [IPv6:2607:f8b0:4864:20::e34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D78912006A for ; Wed, 17 Jul 2019 15:00:01 -0700 (PDT) Received: by mail-vs1-xe34.google.com with SMTP id y16so17645313vsc.3 for ; Wed, 17 Jul 2019 15:00:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9tLT6Zkc4TpGXl64SfHf7yciswb+QDvGkAklYkJvjN4=; b=IbOgiL5DnWFq+WciKeBeaAl4V8q3fbXMMUw7KiEtTkoapsbVIf52r1SMlgddDYwmWe hTfk1hgfKXtQ5gTRgaYUggb2YxrPY29uAHZRVAeSzsdf7q1e7m/xe+XkdK2UYF0U5m39 OPlsLR/Vw3UEIsdHNErKMjYZQNOF6Vf1dVAdtNsRxqpxyUU6m7Hj0jDR6kInzFxIOUOJ XLavAgJsXJiruaGB2pbrowlXthvS2L39mgRwnpnbzR0azq7VV94JDZIUi038M49RA6HC N7bH64/du7k55Pj3tuAn09OjrPXkhQz0sm6jfA6nqnFPZLgtA3c5EbmvNuu0o7J0nlgL jLLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9tLT6Zkc4TpGXl64SfHf7yciswb+QDvGkAklYkJvjN4=; b=AMzwst3r707V+azenbLYE8SBQpeJaBfqdX2JIkphxtkwv8+oFcRo4kNNiMSV/Nq6/G 7R4DgfgJYV5rin1rPLFAaliMCLGBvtCyJ1R1rx/zWQ2krPrE0LqITV/9vXHI0XwEuhYg bnSWgpoSjPOXbU+YOdqcSlp94YcfTuQa+SRQfYsKGpOXLdlyMN5hOmaiF3miC8YtxhdU I8ZqRm1N1H9Wv76y60TEFanVjG5JmG32ZBCy+IKv6ASW+jGCSA0FEQjHja9xZwupfcoT JCNPk9gP9fo8VbnGp3oA2Rl06sHvNhGXHHDOmKkjHk83nI4HPKeT6/3/K093UFEesTcw r/0A== X-Gm-Message-State: APjAAAUreZVb8jlqBZfCxUgsdqtNueL2LphQELbx9QTuk3pX9D6V412V AN8nqSOYjrEW+G/J6orRxONO7Qh3zn6EH1IBEVA= X-Google-Smtp-Source: APXvYqwKv/0MFmEutt+JxrEkRUVUCiiWvNqSJO/5XlVD/TQCBHMH7DknDV3szhmQlPhFl3c5yn6uZR2mcmoREEQYxLk= X-Received: by 2002:a67:edcf:: with SMTP id e15mr26896986vsp.75.1563400799790; Wed, 17 Jul 2019 14:59:59 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: From: Brian Dickson Date: Wed, 17 Jul 2019 14:59:47 -0700 Message-ID: To: Ted Hardie Cc: Neil Cook , Vittorio Bertola , add@ietf.org, Rob Sayre Content-Type: multipart/alternative; boundary="000000000000502b17058de79d77" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 22:00:05 -0000 --000000000000502b17058de79d77 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 1:49 PM Ted Hardie wrote: > Hi Brian, > > Some comments in-line. > > On Wed, Jul 17, 2019 at 12:46 PM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > >> >> >> On Wed, Jul 17, 2019 at 11:56 AM Ted Hardie wrote: >> >>> On Wed, Jul 17, 2019 at 11:40 AM Brian Dickson < >>> brian.peter.dickson@gmail.com> wrote: >>> >>>> >>>> The root of the problem is visible in "if they chose not to". The >>>> nature of DoH, is that the network operator (regardless of who they are) is >>>> unable either detect or prevent guests (or users or BYOD or whoever) from >>>> not complying with your network policy. >>>> >>>> >>> I disagree. It forces the existence of the network policy to be >>> visible, but it is entirely possible to deny network access to a system >>> which is non-compliant. It is not as simple as blocking or intercepting >>> all port 53 traffic, but that method never addressed the reality that >>> cleartext traffic on that port was available to an observer. To get both >>> confidentiality and policy enforcement via this means, practice will need >>> to change. It will need to be visible to the system consuming the DNS (be >>> it a browser, an OS, or some other application), and the enforcement >>> mechanism will have to be better integrated into reachability mechanics. >>> That is definitely new code for most people, but it is not impossible. >>> >> >> So, I'd like to use a fairly simple existence proof (i.e. demonstrate a >> proof-of-concept model that would scale and work) on re-implementing the >> port-53 model, using DoT. >> >> Client attempts to contact random DoT server. Network monitoring systems >> see new DoT traffic between new pair of hosts (on port 853), alerts if not >> blocked, or perhaps the network already blocks such random connections on >> port 853 (check.) >> > > If blocked, the client is dead in the water without an application or host > configuration change. > > Client attempts to contact well-known DoT server (e.g. Quad9, CloudFlare, >> Google, or similar). Network policy permits this (check). Or, network >> policy does not permit this (check). >> > > If blocked, the client is dead in the water without an application or host > configuration change, as above. > The "dead in the water" mode presumes a specific deployment model on both the operator of DNS services, and on the implementer of the client. Even the current "beta" deployments of DoH have configurations for "fall-back" to other choices of protocol and/or server. The "dead in the water" issue can very easily be handled via an informational or BCP RFC, on how to deploy and/or migrate to DoT. This very much looks like the deployment of IPv6, including the "happy eyeballs" stuff. > > >> >> Client attempts to contact local DoT server (e.g. server on IP handed out >> by DHCP or equivalent, or locally configured). Network policy permits this >> (check). Network surveillance of DNS queries performed on local DoT server >> (check). >> > > Note that the client is not aware in this scenario of whether the local > DOT server is or is not blocking traffic, observing traffic, or anything > else. Your premise is apparently that by agreeing to use the local > resolver they have agreed to whatever is being done. In fact, there are > existing scenarios (coffee shop with a portal page being the most > prominent) where the local system will permit specific names to go to the > local resolver to solicit those pages, but will forbid anything else. So > some more subtle scenarios already exist. > > >> Client attempts to contact random DNS/53 server. (Either allowed or >> denied, i.e. same as today, including monitoring elements if allowed). No >> change (check). >> > > And subject to observation or interference by on-path attackers, as has > been discussed. > > Yes, network surveillance of DNS queries on DoT requires operation of a >> DoT server to facilitate that. >> > > If you run a local DoH service and the client attaches to it, the > situations are parallel. > > >> Use of DoT, exclusively, allows the enforcement of that policy at a >> network level (ACLs with respect to port 853). The end result is a network >> policy of, "use our DNS service, or none at all, or don't use our network". >> >> If you mean "only DoT allows this", then I continue to disagree. If you > mean that only using DoT within this context allows this, I agree. > I don't understand how you can disagree on this. Compare two scenarios: - client connects (or attempts to connect) to a random DoT server (on port 853). - client connects (or attempts to connect) to a random DoH server (on port 443 at a specified URL). Since DoT uses 853 exclusively, detecting and blocking are possible (and I assert, trivial). How would either detection or prevention of *just* DoH be possible, as distinct from random HTTPS traffic? There are plenty of scenarios where a random host standing up a DoH service (e.g. on a shared hosting site via any feasible attack vector) becomes an undetectable DNS vector (for anything value of "bad"). This is the poster child case, IMHO. > > >> None of the above *requires* host-level changes. The above certainly >> plays nice with any host-level augmentations on other explicit ways of >> publishing and consuming policy. >> >> I don't see any way of achieving the same policy enforcement result, >> without implementing strict host-level validation mechanisms, which is a >> change over the DoT-only scheme above. >> >> > The theory that would go with this draft runs something like this: > > * put up a signal that hosts and applications can check to see if > non-local DNS is permitted (and possibly, provide data on where the local > secure DNS resolver is, if provided). > > * link the dns resolver to the reachability management system (e.g. a > firewall) and permit traffic to exit the network only to destinations which > have been resolved via the local DNS and which have passed whatever checks > you have instituted. > > A non-compliant visitor will then only be able to reach destinations which > have already been whitelisted by previous resolutions; that means that they > likely will be able to reach various CDNs, popular services, and so on, but > won't be able to reach random hosts that have not already been vetted by > the checks you instituted. > I would go further, and suggest some comments: - A lot of the perceived demand for DoX is in fact demand for public resolver availability, to handle the problem of "hotel/cafe DNS shenanigans". - Many of the common issues between "shenanigans" and DoX usage, would benefit from client-side DNSSEC validation. In particular, the behavior of DNSSEC validation failure (returning SERVFAIL) works well with the use of multiple resolver and protocol "lists" (hierarchical structures). E.g. try local port 53 server obtained by DHCP, with (one or more) DoT server(s) (regardless of DoT server choice(s)) as a more-secure fall-back. If DNSSEC is not available, fall back to something better. If DNSSEC is available, validate. Upon validation failures (including rewritten NXDOMAIN), fall back to something better. Performance on valid responses may be faster. As long as some resolver answers with DNSSEC-valid responses, correct responses are guaranteed. For privacy-first, reverse the order of fallback, trying DoT first. Possibly fail hard if no DoT answers are available. > > Is this new code? Absolutely. But it is not a host-level change, and it > permits more without host re-configuration than the pure blocking mechanism > you outlined.* > > >> In the DoT world, the policy is inherently visible. If you try to use a >> particular DoT provider, you know immediately whether that is possible or >> not. >> >> > It cannot distinguish between this policy imposition, a reachability > failure, and a service failure. As a signal, it is pretty ambiguous. > I agree. By itself it is insufficient. I am not proposing *not* doing some kind of publication of policy. I am proposing doing so via DoT, and preferably also with DNSSEC client validation. And perhaps DANE needs to be included in the discussion, particularly on the secure bootstrap process. (For DANE to work, you need DNSSEC, but you don't need privacy, and you don't need any CAs. You need names, and signed zones for those names, and TLSA records, but that's reasonably straightforward, IMHO.) Brian > >> The issue of whether a particular DoT server is or is not providing a >> certain level of privacy, is perhaps something that could be signaled, but >> I don't see any way of validating that signaling beyond, at best, some kind >> of contractual enforcement. >> I.e. if you want to be sure the party you are talking to is or is not >> doing what they say they are doing, pretty much the only way to be sure >> requires the involvement of law enforcement and/or lawyers. >> >> The difference between DoT and DoH are whether host-level mechanisms are >> required, to achieve any meaningful assessment of compliance. >> Host-level compromise defeats host-level mechanisms, so other than secure >> ways of proving host non-compromise (like TPM things), it is provably less >> secure than adding network-based detection/enforcement. >> >> (None of the above applies to malware that does its own communication to >> C&C systems, but it does apply to malware that leverages browser-based DoH >> capabilities to make use of DNS for any of C&C, exfiltration, payload >> acquisition, etc.) >> >> > I'm afraid I must continue to disagree with your premise. I have no issue > at all with increased deployments of DoT, but I do not agree that this > rules out the use of DoH. > > regards, > > Ted > > *For those that outsource this, it may also require a new service that > allows the topology decisions and the resolution services to be linked. > There are several ways to accomplish this by using remote configuration, by > taking traffic out of the network to a service provider quarantine via VPN, > or by some combination of the two. Again, this is new. But it is not > impossible, as very similar systems have been built by organization which > centralize these operations; it requires that these be made available to > new customers. > > >> Brian >> > --000000000000502b17058de79d77 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 17, 2019 at 1:49 PM Ted H= ardie <ted.ietf@gmail.com> = wrote:
Hi Brian,

Some= comments in-line.

On Wed, Jul 17, 2019 at 12:46 PM Brian Dickso= n <br= ian.peter.dickson@gmail.com> wrote:


=
On Wed, Ju= l 17, 2019 at 11:56 AM Ted Hardie <ted.ietf@gmail.com> wrote:
On W= ed, Jul 17, 2019 at 11:40 AM Brian Dickson <brian.peter.dickson@gmail.com>= ; wrote:

Th= e root of the problem is visible in "if they chose not to". The n= ature of DoH, is that the network operator (regardless of who they are) is = unable either detect or prevent guests (or users or BYOD or whoever) from n= ot complying with your network policy.


I disagree.=C2=A0 It forces the existence of t= he network policy to be visible, but it is entirely possible to deny networ= k access to a system which is non-compliant.=C2=A0 It is not as simple as b= locking or intercepting all port 53 traffic, but that method never addresse= d the reality that cleartext traffic on that port was available to an obser= ver.=C2=A0 To get both confidentiality and policy enforcement via this mean= s, practice will need to change.=C2=A0 It will need to be visible to the sy= stem consuming the DNS (be it a browser, an OS, or some other application),= and the enforcement mechanism will have to be better integrated into reach= ability mechanics.=C2=A0 That is definitely new code for most people, but i= t is not impossible.

So, = I'd like to use a fairly simple existence proof (i.e. demonstrate a pro= of-of-concept model that would scale and work) on re-implementing the port-= 53 model, using DoT.

Client attempts to contact ra= ndom DoT server. Network monitoring systems see new DoT traffic between new= pair of hosts (on port 853), alerts if not blocked, or perhaps the network= already blocks such random connections on port 853 (check.)

If blocked, the client is dead in the w= ater without an application or=20 host configuration change.

Client attempts= to contact well-known DoT server (e.g. Quad9, CloudFlare, Google, or simil= ar). Network policy permits this (check). Or, network policy does not permi= t this (check).

If blocke= d, the client is dead in the water without an application or=20 host configuration change, as above.

The "dead in the water" mode presumes a specific = deployment model on both the operator of DNS services, and on the implement= er of the client.

Even the current "beta"= ; deployments of DoH have configurations for "fall-back" to other= choices of protocol and/or server.

The "dead= in the water" issue can very easily be handled via an informational o= r BCP RFC, on how to deploy and/or migrate to DoT.

This very much looks like the deployment of IPv6, including the "happ= y eyeballs" stuff.
=C2=A0
= =C2=A0
=C2=A0
Client attempts = to contact local DoT server (e.g. server on IP handed out by DHCP or equiva= lent, or locally configured). Network policy permits this (check). Network = surveillance of DNS queries performed on local DoT server (check).

Note that the client is not aware= in this scenario of whether the local DOT server is or is not blocking tra= ffic, observing traffic, or anything else.=C2=A0 Your premise is apparently= that by agreeing to use the local resolver they have agreed to whatever is= being done.=C2=A0 In fact, there are existing scenarios (coffee shop with = a portal page being the most prominent) where the local system will permit = specific names to go to the local resolver to solicit those pages, but will= forbid anything else.=C2=A0 So some more subtle scenarios already exist.
=C2=A0
=
Client attempts to contact= random DNS/53 server. (Either allowed or denied, i.e. same as today, inclu= ding monitoring elements if allowed). No change (check).
<= /blockquote>

And subject to observation or interference = by on-path attackers, as has been discussed.

Yes, network surveillance of DNS queries on DoT requires ope= ration of a DoT server to facilitate that.

If you run a local DoH service and the client attaches to= it, the situations are parallel.
=C2=A0
Use of DoT, exclusively, allows the enforcement of that policy at = a network level (ACLs with respect to port 853). The end result is a networ= k policy of, "use our DNS service, or none at all, or don't use ou= r network".

If you m= ean "only DoT allows this", then I continue to disagree.=C2=A0 If= you mean that only using DoT within this context allows this, I agree.
=

I don't understand h= ow you can disagree on this.

Compare two scenarios= :
- client connects (or attempts to connect) to a random DoT serv= er (on port 853).
- client connects (or attempts to connect) to a= random DoH server (on port 443 at a specified URL).

Since DoT uses 853 exclusively, detecting and blocking are possible (and= I assert, trivial).

How would either detection or= prevention of *just* DoH be possible, as distinct from random HTTPS traffi= c?
There are plenty of scenarios where a random host standing up = a DoH service (e.g. on a shared hosting site via any feasible attack vector= ) becomes an undetectable DNS vector (for anything value of "bad"= ).

This is the poster child case, IMHO.
=
=C2=A0
=C2=A0
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">
None of the above requires host-le= vel changes. The above certainly plays nice with any host-level augmentatio= ns on other explicit ways of publishing and consuming policy.
I don't see any way of achieving the same policy enforcemen= t result, without implementing strict host-level validation mechanisms, whi= ch is a change over the DoT-only scheme above.


The theory that would go with this dra= ft runs something like this:=C2=A0

* put up a= signal that hosts and applications can check to see if non-local DNS is pe= rmitted (and possibly, provide data on where the local secure DNS resolver = is, if provided).

* link the dns resolver to the r= eachability management system (e.g. a firewall) and permit traffic to exit = the network only to destinations which have been resolved via the local DNS= and which have passed whatever checks you have instituted.
<= br>
A non-compliant visitor will then only be able to reach desti= nations which have already been whitelisted by previous resolutions; that m= eans that they likely will be able to reach various CDNs, popular services,= and so on, but won't be able to reach random hosts that have not alrea= dy been vetted by the checks you instituted.=C2=A0

I would go further, and suggest some comment= s:
  • A lot of the perceived demand for DoX is in fact deman= d for public resolver availability, to handle the problem of "hotel/ca= fe DNS shenanigans".
  • Many of the common issues between "s= henanigans" and DoX usage, would benefit from client-side DNSSEC valid= ation.
In particular, the behavior of DNSSEC validation failu= re (returning SERVFAIL) works well with the use of multiple resolver and pr= otocol "lists" (hierarchical structures).
E.g. tr= y local port 53 server obtained by DHCP, with (one or more) DoT server(s) (= regardless of DoT server choice(s)) as a more-secure fall-back.
I= f DNSSEC is not available, fall back to something better.
If DNSS= EC is available, validate.=C2=A0
Upon validation failures (includ= ing rewritten NXDOMAIN), fall back to something better.
Performan= ce on valid responses may be faster.
As long as some resolver ans= wers with DNSSEC-valid responses, correct responses are guaranteed.

For privacy-first, reverse the order of fallback, trying = DoT first. Possibly fail hard if no DoT answers are available.
= =C2=A0

Is this new c= ode?=C2=A0 Absolutely.=C2=A0 But it is not a host-level change, and it perm= its more without host re-configuration than the pure blocking mechanism you= outlined.*
=C2=A0
In= the DoT world, the policy is inherently visible. If you try to use a parti= cular DoT provider, you know immediately whether that is possible or not.


It cannot d= istinguish between this policy imposition, a reachability failure, and a se= rvice failure.=C2=A0 As a signal, it is pretty ambiguous.

I agree. By itself it is insufficient.= I am not proposing *not* doing some kind of publication of policy. I am pr= oposing doing so via DoT, and preferably also with DNSSEC client validation= .

And perhaps DANE needs to be included in the dis= cussion, particularly on the secure bootstrap process.
(For DANE = to work, you need DNSSEC, but you don't need privacy, and you don't= need any CAs. You need names, and signed zones for those names, and TLSA r= ecords, but that's reasonably straightforward, IMHO.)
=C2=A0<= /div>
Brian

=C2= =A0
The issue of whether a particul= ar DoT server is or is not providing a certain level of privacy, is perhaps= something that could be signaled, but I don't see any way of validatin= g that signaling beyond, at best, some kind of contractual enforcement.
I.e. if you want to be sure the party you are talking to is or is no= t doing what they say they are doing, pretty much the only way to be sure r= equires the involvement of law enforcement and/or lawyers.

The difference between DoT and DoH are whether host-level mechanis= ms are required, to achieve any meaningful assessment of compliance.
<= div>Host-level compromise defeats host-level mechanisms, so other than secu= re ways of proving host non-compromise (like TPM things), it is provably le= ss secure than adding network-based detection/enforcement.

(None of the above applies to malware that does its own communicat= ion to C&C systems, but it does apply to malware that leverages browser= -based DoH capabilities to make use of DNS for any of C&C, exfiltration= , payload acquisition, etc.)

<= div>
I'm afraid I must continue to disagree with your pre= mise.=C2=A0 I have no issue at all with increased deployments of DoT, but I= do not agree that this rules out the use of DoH.

= regards,

Ted

*For tho= se that outsource this, it may also require a new service that allows the t= opology decisions and the resolution services to be linked.=C2=A0 There are= several ways to accomplish this by using remote configuration, by taking t= raffic out of the network to a service provider quarantine via VPN, or by s= ome combination of the two.=C2=A0 Again, this is new.=C2=A0 But it is not i= mpossible, as very similar systems have been built by organization which ce= ntralize these operations; it requires that these be made available to new = customers.
=C2=A0
Bri= an
--000000000000502b17058de79d77-- From nobody Wed Jul 17 15:01:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D247B1200F9 for ; Wed, 17 Jul 2019 15:00:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZToiZ3vnRsEp for ; Wed, 17 Jul 2019 15:00:57 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4464D1200E7 for ; Wed, 17 Jul 2019 15:00:57 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id z3so48308864iog.0 for ; Wed, 17 Jul 2019 15:00:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=oUBl2FfwUAG+mYUGxTuoXP8VHuEcbi6+vSXKo7SyZnw=; b=jEU2F9ToPg8oS8hQTnhPRm1N/Vew8Qa9YgnSFNw0SDaBpk0JaQT4Es1WlM55nyH5Qm siOUyqP/TNe16ox9e2jEcJ2/Ct6/a+HnFwp5iXfXpjNWGuKMEDb/fMofaelXTPJbvqnl 6MGHELqmG06ITAVDJ9c5PArDLHtzfTlmv7kjBadaz5ti8meFhunHxg7mOi4/yDKOAOH7 zdGwwcKo/tGQzNmHjcjceq4YsdN8sYsYlP5jiWg3J7JEQnB1TExc3QDR7W1D83Q+CtF+ VzbDxDajDZFLAw/dYONFbwUwJgn2clnw/owz2unt8pMrCXMq7hd/TU4tbuttR8IrKUBu wzVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=oUBl2FfwUAG+mYUGxTuoXP8VHuEcbi6+vSXKo7SyZnw=; b=b/ljJbsOLUcpRYhgRLhqupz8yPI3KxuBBH7X8t0PEpSrXSCKRCnOC986WQpavzg9yI UjjPyYcsjbj/cgM0obyXVCa5SRt2WUMcU8gdaabOdehOdeNy6jjtNlyiWOWsTYaAE7QM oh6jLPrFK4Y9pR2NTAwfAtJaH6TM3TMX2xFF/VktcDyL1if9FT1AbzxNj+oYzQFBFi16 QSQhiOkIKpq/4yNGZIYde8NTJWM68Y+6BHiFF+gXRrLZBAs6jR29t5hadx8ZJnj+hDZp 4ZJT5QHD3+baNC5kpmStASIixVXHP6FgQzwIbF8M/irXGF0jDCKGoO3ipE2gj+ZTqii9 qK4A== X-Gm-Message-State: APjAAAXAIwlI1Sivwa0UbXLCL3zvXinQMTL7TMPRM/pb5F0MVModQoCZ uYMY0Z5bS9oZHoRg0nY9pt0jc4YFmNBlysOqbIo= X-Google-Smtp-Source: APXvYqweil98cSry82O2U//vO7DnfQbxzKn9Kt668CrRZdwz7DkCd9hcLf3gsiuKArmEq+OGUTlctGsrs5qolrk8pXc= X-Received: by 2002:a02:1087:: with SMTP id 129mr46316438jay.131.1563400856407; Wed, 17 Jul 2019 15:00:56 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> <1702868587.11849.1563400444426@appsuite-gw1.open-xchange.com> In-Reply-To: <1702868587.11849.1563400444426@appsuite-gw1.open-xchange.com> From: Rob Sayre Date: Wed, 17 Jul 2019 15:00:44 -0700 Message-ID: To: Vittorio Bertola Cc: Alec Muffett , add@ietf.org Content-Type: multipart/alternative; boundary="000000000000b01b8d058de7a0b7" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 22:01:00 -0000 --000000000000b01b8d058de7a0b7 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 2:54 PM Vittorio Bertola wrote: > most people are actually quite happy about their regime and often even > happy not to live in a Western democracy > Oh, interesting assertion. It doesn't seem relevant, though. It's not like DoH will prevent or enable oppression from a government. thanks, Rob --000000000000b01b8d058de7a0b7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 17, 2019 at 2:54 PM Vittorio = Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:
=20 =20 =20
most people are actually quite happy about their regime and often ev= en happy not to live in a Western democracy
Oh, interesting assertion.

It doesn&#= 39;t seem relevant, though. It's not like DoH will prevent or enable op= pression from a government.

thanks,
Rob<= /div>

=C2=A0
--000000000000b01b8d058de7a0b7-- From nobody Wed Jul 17 15:13:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 768DE12016A for ; Wed, 17 Jul 2019 15:13:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sUonOas3Ji2P for ; Wed, 17 Jul 2019 15:13:06 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A178712011B for ; Wed, 17 Jul 2019 15:13:06 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 2DACCBE77; Wed, 17 Jul 2019 23:13:04 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MJn7YmNywEt4; Wed, 17 Jul 2019 23:13:02 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id B44B1BE6F; Wed, 17 Jul 2019 23:13:02 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1563401582; bh=P5LbKCzTa4KTh0LfGjl2pTFv9dmCxGYiTzGj9v8WoNc=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=UdUKXLhuYNEUeNFFyZiWN+m4aB4WakAC+CjcyUuNUOumNrueSfqLf3kSwH0SXVOk7 VKbpfRJEEAkL1HVdEOgzUT0kkAeixkGeRNONhiu9nUH8ohQZwQ9PcdMbm5snuObxcr WnQpvKt4HDwr0Ypa8GrDBS02EO9djo8tEtX6a39M= To: Vittorio Bertola , Alec Muffett Cc: add@ietf.org References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> <1702868587.11849.1563400444426@appsuite-gw1.open-xchange.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 17 Jul 2019 23:13:01 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <1702868587.11849.1563400444426@appsuite-gw1.open-xchange.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="t7riRyqGTu14ns22CLjfVwUQRMzKX7RFk" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 22:13:10 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --t7riRyqGTu14ns22CLjfVwUQRMzKX7RFk Content-Type: multipart/mixed; boundary="YhI6ZHjnMzAIDvBsmkESQcSwie9DNWSVR"; protected-headers="v1" From: Stephen Farrell To: Vittorio Bertola , Alec Muffett Cc: add@ietf.org Message-ID: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> <1702868587.11849.1563400444426@appsuite-gw1.open-xchange.com> In-Reply-To: <1702868587.11849.1563400444426@appsuite-gw1.open-xchange.com> --YhI6ZHjnMzAIDvBsmkESQcSwie9DNWSVR Content-Type: multipart/mixed; boundary="------------AAC2DC0F8FA4C1AE8B1DADA0" Content-Language: en-GB This is a multi-part message in MIME format. --------------AAC2DC0F8FA4C1AE8B1DADA0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 17/07/2019 22:54, Vittorio Bertola wrote: > Also, this idea that the Internet will export democracy by providing "e= scape to=20 > a free web for oppressed peoples" is... so 90's. In most countries that= have=20 > been mentioned as examples of dictatorships throughout this discussion,= most=20 > people are actually quite happy about their regime and often even happy= not to=20 > live in a Western democracy (though that's partly because of propaganda= , but=20 > often it is also because of different cultural values). It takes much m= ore to=20 > subvert an authoritarian system than the ability to connect to some web= sites.=20 > It's still worth providing people in these countries with additional=20 > protections, but the depiction of a sad, oppressed world that is just w= aiting=20 > for DoH to bloom into democracy is a bit too much :-) I don't think I've seen such a spectacularly off-topic (frankly inappropriate) strawman proposed in many a year. That's just not an argument for an IETF list IMO. S. --------------AAC2DC0F8FA4C1AE8B1DADA0 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------AAC2DC0F8FA4C1AE8B1DADA0-- --YhI6ZHjnMzAIDvBsmkESQcSwie9DNWSVR-- --t7riRyqGTu14ns22CLjfVwUQRMzKX7RFk Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0vnW4ACgkQWrL68XsX K+oPNRAAguOpnu62sOH4mXHWcDrz9ODm3fj4P0AW6RJtgN1IAOKPpQckEvc3xec/ P0WJPPeRmc+EEViYHmDvSJmeRtdKc+lxNZnTC2Lk1Yj9l6BGp0tLuYGaG/6+TeEm tcJGPF7lzAZ1r/DQGGJJH7y3Cc6otHZ7dKCUCaytqKPYiWhyCEl9yMrxsB7LwRCt djtu4b8n7CzeubeeDcOXzCltpjcA/Y+pYWZPf7X/Gmz/U/1msgUWsEsNG74ZCSfe xGwCmIiT7pgWPNO7pDBc6dhl22B8evWxuGnbGP0X+k9MdBr1mDsXcV4SyaoQFmWW +v8yUdwg9QEO9lIW9zrACv3KsdgCLyRE6jbQdGYp1s9X6pYRcvJS72f6HJ0OqSif yoYPLQ7E3a15CxSbROvnis2Iqvv68qoL4baR+65mTi/3SQYy/pG2HBgrGYTrmq8l ADtyuT29721Id2KX2mR7K8q2G1R0PL4o4sjTj2oDh1hrRfSngh88GlvBkymA1/e/ rsoU58iz4V89YxIiQT5F3oQMida0CZ2y4RK2VSzHXe3ctc09eVP7ISpgcDSAdlnC Hk1fDkQl3+7Gq+Owi+8ts1RnKLo1kkP3MgMok1Jl+y8fFaUNy08lT14oTKkv26t6 QkMjqoR6OaZLi3yfDj4pRR7QEFdJD8Qz0CbO82YrpZCRdwv0pk8= =CbVx -----END PGP SIGNATURE----- --t7riRyqGTu14ns22CLjfVwUQRMzKX7RFk-- From nobody Wed Jul 17 16:33:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB0BD120170 for ; Wed, 17 Jul 2019 16:33:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T_f1vh1RxHFZ for ; Wed, 17 Jul 2019 16:33:08 -0700 (PDT) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-eopbgr780121.outbound.protection.outlook.com [40.107.78.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16B98120169 for ; Wed, 17 Jul 2019 16:33:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Qe1s9GBSYT0fUJDhQzRO1YsPjujzbaVG4BYUNcFcHHnp/QU9SbpQE2UQL5D/wgaCw4XW0ucR+8Ho2H4LT/8eJ4dL+c2P8GG4zvsKsxOX0auwkui6S+4eVPEg85/5fQHXL2I1cp9GfbrHJ3E1PsOc/pb0qtQ4VXoLa4QJRKRIKZbqaSavvvo5EdzGfxDRs3lgh36cbLU7iAKOHGZOh+CknXIzGDP32qv7OAWesekiwCVxJ/5rf/R86Kk+Q73Kyys27fR40k+Crh+4Da3/rps0/T9Kjr2yanRNYAKaq/5D8I7i4vq+nvycJOSaDDW6t8Ro3TXKhaXJrMOOTvByXnGe1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/3RhXF7/0Cl/jH0cAoHJXRo0wHjPtLrae01jM/sNXr8=; b=cykrFcv3SNeN+b996FihOOl0w+Wm4myhdLOhbXDI/3fSE0na/1Wpn01KMed8NO8ZQk58E+oxvBL40bySEfwDkpFXGaSb6dWnAdYYB8wveJe/fPESV6Qra8fZXMAYhA7liLrk3nMiatQE6Qe+AK5zM9qrbl14GqFgg2XsvgpqaFTbAzYT/x+9GHG8FLz1RJbkxzlaKatswnCxR/altUZ75IeDKt8S9wQBM6O4w0CT6krZeHpvf5/tCA3CW2eJC6AZqnWCayBfMRLvzmM9g7l7WjuGmMGbhhQWgdXh9DP85uDO4uOL4CHqsv8pqVVhz57mc6/dbMNAiaFT+iy7RS129Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/3RhXF7/0Cl/jH0cAoHJXRo0wHjPtLrae01jM/sNXr8=; b=nbVVESh/U+Ayb4sG37Wrekje10Wonr0PTVBoyDdhXuLZMsr/Egnhu0jMWBqdWyRFi+q+/kxIvnfOwPBMfxiYO86pRA/TQ3dWAlwO2zUzaGDX5wnHP38KVZM8tvGijFSvBDyJnFkGzvGX62r5Q6ERu9IkHgbyL9OzpzvubSCAz4o= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (20.179.20.141) by MN2PR21MB1166.namprd21.prod.outlook.com (20.178.255.159) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.1; Wed, 17 Jul 2019 23:33:06 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::57a:a9b5:cc01:d573]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::57a:a9b5:cc01:d573%3]) with mapi id 15.20.2115.003; Wed, 17 Jul 2019 23:33:06 +0000 From: Tommy Jensen To: Ralf Weber , Andy Grover CC: "add@ietf.org" Thread-Topic: [Add] new draft: draft-grover-add-policy-detection-00 Thread-Index: AQHVNbsadupgnCnVZESBdjNzgALzQqbBN9GAgA46z7w= Date: Wed, 17 Jul 2019 23:33:06 +0000 Message-ID: References: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [131.107.147.46] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 31d5b632-ebda-4b54-aa56-08d70b0f1f0e x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MN2PR21MB1166; x-ms-traffictypediagnostic: MN2PR21MB1166: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 01018CB5B3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(39860400002)(376002)(346002)(396003)(366004)(136003)(189003)(199004)(26005)(74316002)(66476007)(11346002)(14444005)(76116006)(66556008)(316002)(66946007)(64756008)(66446008)(105004)(446003)(66066001)(476003)(110136005)(186003)(81156014)(81166006)(486006)(8936002)(86362001)(256004)(7696005)(99286004)(76176011)(68736007)(22452003)(71200400001)(7736002)(71190400001)(6506007)(102836004)(229853002)(10290500003)(53936002)(2906002)(8676002)(478600001)(606006)(33656002)(4326008)(10090500001)(53546011)(91956017)(6246003)(8990500004)(14454004)(54896002)(55016002)(236005)(9686003)(966005)(6306002)(52536014)(19627405001)(3846002)(6116002)(5660300002)(25786009)(6436002); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1166; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: +mNpIyi1WfOZ3Z6YjMOiThIZA1sKRwJ1+3ozYPSH1Bzuz9W3OvJfcmpgdxKWLmdJ9euwqERJaZ8VsWWDIS/tGr8zPXaLTQEMy1qXzGhj3EsFB0N34Hh1HwgHix6zLIg7kT9dBauw0XhEP1UIHlmoXr+H0Ng8gCnlJSo3LLv386FZOBa7ynJ2Glh6kD5sgfzF83wQmtgq2sQnkXXCuKp5SX8rU7GTqJWuQjRnodMJoUhfZo4tHXIr86YTkaHRUifD2SatOuNlv9vpLBjEstIH0y1yLzm77kPz12bZCqfC56TfTG1kcLRfHwnjyhvWlRWS6yELd4XjyVRW24zdJYSXnCYgz0KbrDuUiVuYt+j0KFf41Y7/Xy/XtLJfjmICdR+326mfgVvpE8XNKaAaRXmL9+ksKV6o45lW2CBeEjLzpSc= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR21MB1213C09DAD5D71E7B0722481FAC90MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 31d5b632-ebda-4b54-aa56-08d70b0f1f0e X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Jul 2019 23:33:06.8534 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tojens@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1166 Archived-At: Subject: Re: [Add] new draft: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 23:33:11 -0000 --_000_MN2PR21MB1213C09DAD5D71E7B0722481FAC90MN2PR21MB1213namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I appreciate the intent behind this draft to allow DNS-capable apps to dete= ct if configured DNS resolvers need to be deferred to. However, I agree wit= h Ralf that NXDOMAIN is the wrong way to signal that. What about defining a new TXT record format to signal the presence of polic= ies? This has the benefits of 1) not overloading the interpretation of whet= her the domain exists or not as well as 2) giving room for future flexibili= ty beyond the binary "resolver (does|does not) have DNS policies in place y= ou shouldn't bypass" signal. Thanks, Tommy ________________________________ From: Add on behalf of Ralf Weber Sent: Monday, July 8, 2019 2:10 PM To: Andy Grover Cc: add@ietf.org Subject: Re: [Add] new draft: draft-grover-add-policy-detection-00 Moin! On 8 Jul 2019, at 20:29, Andy Grover wrote: > We've posted an initial draft of draft-grover-add-policy-detection, > which proposes a method of identifying if content filtering or other > policy is implemented on the local resolver, so applications doing DNS > resolution can adjust their behavior. In what way? While there are lots of MUST in the draft for DNS elements I did not find a single word on what applications then do with that information. To get more detailed on the DNS side 5.5 is not how DNS works. Authoritative DNS servers reply with REFUSED or referrals to stuff they don=92t know. The can only answer NXDomain if they are authoritative for the domain. 5.4 and 5.6 together are contradictory as a DNS server operator for sure runs a Caching DNS server, but one is MUST (the server software) and one is SHOULD (the server operator). Why, and why does the application description (5.2) doesn=92t have any normative language? So long -Ralf =97-- Ralf Weber -- Add mailing list Add@ietf.org https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.iet= f.org%2Fmailman%2Flistinfo%2Fadd&data=3D02%7C01%7CJensen.Thomas%40micro= soft.com%7Ccc63ddd828e040943c2008d703e8ced1%7C72f988bf86f141af91ab2d7cd011d= b47%7C1%7C0%7C636982170753293139&sdata=3DUex9ZlO2OiBLqKzkVwDgX6Ewf%2B6F= vd1gUAioDOGBnA4%3D&reserved=3D0 --_000_MN2PR21MB1213C09DAD5D71E7B0722481FAC90MN2PR21MB1213namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
I appreciate the intent behind this draft to allow DNS-capable apps to dete= ct if configured DNS resolvers need to be deferred to. However, I agree wit= h Ralf that NXDOMAIN is the wrong way to signal that.

What about defining a new TXT record format to signal the presence of polic= ies? This has the benefits of 1) not overloading the interpretati= on of whether the domain exists or not as well as 2) giving room for future flexibility beyond the binary &qu= ot;resolver (does|does not) have DNS policies in place you shouldn't bypass= " signal.

Thanks,
Tommy
<= /div>

From: Add <add-bounces= @ietf.org> on behalf of Ralf Weber <dns@fl1ger.de>
Sent: Monday, July 8, 2019 2:10 PM
To: Andy Grover <andy@pmtu.dev>
Cc: add@ietf.org <add@ietf.org>
Subject: Re: [Add] new draft: draft-grover-add-policy-detection-00
 
Moin!

On 8 Jul 2019, at 20:29, Andy Grover wrote:
> We've posted an initial draft of draft-grover-add-policy-detection, > which proposes a method of identifying if content filtering or other > policy is implemented on the local resolver, so applications doing DNS=
> resolution can adjust their behavior.
In what way? While there are lots of MUST in the draft for DNS elements
I did not find a single word on what applications then do with that
information.

To get more detailed on the DNS side 5.5 is not how DNS works.
Authoritative DNS servers reply with REFUSED or referrals to stuff they
don=92t know. The can only answer NXDomain if they are authoritative for the domain.

5.4 and 5.6 together are contradictory as a DNS server operator for
sure runs a Caching DNS server, but one is MUST (the server software)
and one is SHOULD (the server operator). Why, and why does the
application description (5.2) doesn=92t have any normative language?

So long
-Ralf
=97--
Ralf Weber

--
Add mailing list
Add@ietf.org
http= s://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.or= g%2Fmailman%2Flistinfo%2Fadd&amp;data=3D02%7C01%7CJensen.Thomas%40micro= soft.com%7Ccc63ddd828e040943c2008d703e8ced1%7C72f988bf86f141af91ab2d7cd011d= b47%7C1%7C0%7C636982170753293139&amp;sdata=3DUex9ZlO2OiBLqKzkVwDgX6Ewf%= 2B6Fvd1gUAioDOGBnA4%3D&amp;reserved=3D0
--_000_MN2PR21MB1213C09DAD5D71E7B0722481FAC90MN2PR21MB1213namp_-- From nobody Wed Jul 17 16:44:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72888120170 for ; Wed, 17 Jul 2019 16:44:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZO9S4gDExqkV for ; Wed, 17 Jul 2019 16:44:06 -0700 (PDT) Received: from mail.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F1DEE120173 for ; Wed, 17 Jul 2019 16:44:05 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 17 Jul 2019 16:44:03 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Wed, 17 Jul 2019 16:44:03 -0700 From: Paul Hoffman To: Tommy Jensen CC: "add@ietf.org" Thread-Topic: [Ext] [Add] new draft: draft-grover-add-policy-detection-00 Thread-Index: AQHVPPgEi4IopOVQKUu24mlK3prgQ6bP7m+A Date: Wed, 17 Jul 2019 23:44:03 +0000 Message-ID: References: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [Ext] new draft: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 23:44:09 -0000 On Jul 17, 2019, at 4:33 PM, Tommy Jensen wrote: >=20 > I appreciate the intent behind this draft to allow DNS-capable apps to de= tect if configured DNS resolvers need to be deferred to. However, I agree w= ith Ralf that NXDOMAIN is the wrong way to signal that. >=20 > What about defining a new TXT record format to signal the presence of pol= icies? This has the benefits of 1) not overloading the interpretation of wh= ether the domain exists or not as well as 2) giving room for future flexibi= lity beyond the binary "resolver (does|does not) have DNS policies in place= you shouldn't bypass" signal. Please see for a proposal that is being discussed in the DNSOP WG. It proposes a me= ssage format (JSON) and two transports (DNS and HTTPS) that can be used by = a resolver for lots of things, including the policy ideas in the draft that= this thread is about. Discussion of draft-sah-resolver-information should be on the DNSOP list. T= here will be a slot in the meeting next week to discuss it. --Paul Hoffman= From nobody Wed Jul 17 16:57:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66D451203CF; Wed, 17 Jul 2019 16:57:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h2Byg0k9GYk0; Wed, 17 Jul 2019 16:57:12 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8AF18120408; Wed, 17 Jul 2019 16:57:12 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id h6so48584454iom.7; Wed, 17 Jul 2019 16:57:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=lD7xulmjWQIHDXn6F/f1CsfjyEuJmhFZvumBo1YduAQ=; b=U0zmReiGYOJ+YP5yuyfJvAD7VrLuzP2wh0gDGvxqiYieIrReaaloFEbNr7sLFgUNsS PNdp5ZfEoMYTvCwSU9YPnAs1lrL/5uttb6msZ2lQKtMRRezai+XswlLjQTy6YEcBaya5 oLOXfIHTRSr+S4+cGpVqJCp1GBPJIr9ZFDhiX/aCz/4rEhRRhYB4xhKE63j4cY4FuyZ3 yq5HhJYZN3S8pyZcLsAC/usj/QD+rCdiirqKqs1GnYUeXYrXFvqp09tj+Lu8f3wAy0LW KbZFNcDbZUJjZftIV+eAeuVqRK6c2uPxB0+3GAFR/PBUMI8iaTfkrummqhnShH067WtF kNiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=lD7xulmjWQIHDXn6F/f1CsfjyEuJmhFZvumBo1YduAQ=; b=Uw0NWDaJl46qHimvtLGoGipcenY/vj4HKOfxi5KVjB0i0VB7iGnmk1js4XT3PNcwLm HXUdbGFQp17jJGwPEHXcWCimRbgzLE9BeIsN1fw9SN1zLfYx+wA8/2e7nEBeRzagrXJW POb0QDb+SoGRziWfPMoUlH4gLaPYYW3cL2p6kXrptWzkl9jOYBnzigYPSCPGCQSIIQhW qbrFnd2CId/C5SAcqRcUhdKos5uOoO+3ybR04RAz9M3v8QrwgTvj4aubnz1UIOIJseCP sM2xvatkTDS0JmtC5NrFhVwniG8o0vDzP33c4C8N7SpbkkKN5afmneU+GBAVePye1HBs PWmQ== X-Gm-Message-State: APjAAAXkfSC0JpyA3QTbbkqI+tkJwslYihQRpWwm1HvuJ0NLa3MVx+o5 ORaY0ffLulpX4/81MFGEcifiAD5Dap7A+C2H02M= X-Google-Smtp-Source: APXvYqwarEQW84hYGC7bt8x7fdwt9B8/wFYHj/PYuVT7N47YATK8uJ/+F9v2END6ssbFUBsIt7ww0HjMgY3JmfkHj9c= X-Received: by 2002:a6b:bc42:: with SMTP id m63mr26256917iof.189.1563407831765; Wed, 17 Jul 2019 16:57:11 -0700 (PDT) MIME-Version: 1.0 References: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> In-Reply-To: From: Rob Sayre Date: Wed, 17 Jul 2019 16:57:00 -0700 Message-ID: To: Paul Hoffman Cc: Tommy Jensen , "add@ietf.org" , dnsop WG Content-Type: multipart/alternative; boundary="000000000000739a05058de9406c" Archived-At: Subject: Re: [Add] [Ext] new draft: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 23:57:15 -0000 --000000000000739a05058de9406c Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 4:44 PM Paul Hoffman wrote: > On Jul 17, 2019, at 4:33 PM, Tommy Jensen 40microsoft.com@dmarc.ietf.org> wrote: > > > > I appreciate the intent behind this draft to allow DNS-capable apps to > detect if configured DNS resolvers need to be deferred to. However, I agree > with Ralf that NXDOMAIN is the wrong way to signal that. > > > > What about defining a new TXT record format to signal the presence of > policies? This has the benefits of 1) not overloading the interpretation of > whether the domain exists or not as well as 2) giving room for future > flexibility beyond the binary "resolver (does|does not) have DNS policies > in place you shouldn't bypass" signal. > > Please see < > https://datatracker.ietf.org/doc/draft-sah-resolver-information/> for a > proposal that is being discussed in the DNSOP WG. It proposes a message > format (JSON) and two transports (DNS and HTTPS) that can be used by a > resolver for lots of things, including the policy ideas in the draft that > this thread is about. Is there a good definition of the term "policy ideas"? thanks, Rob --000000000000739a05058de9406c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 17, 2019 at 4:44 PM Paul = Hoffman <paul.hoffman@icann.or= g> wrote:
On Jul 17, 2019, at 4:33 PM, Tommy Jensen <Jensen.Thomas=3D40microsoft.com@dma= rc.ietf.org> wrote:
>
> I appreciate the intent behind this draft to allow DNS-capable apps to= detect if configured DNS resolvers need to be deferred to. However, I agre= e with Ralf that NXDOMAIN is the wrong way to signal that.
>
> What about defining a new TXT record format to signal the presence of = policies? This has the benefits of 1) not overloading the interpretation of= whether the domain exists or not as well as 2) giving room for future flex= ibility beyond the binary "resolver (does|does not) have DNS policies = in place you shouldn't bypass" signal.

Please see <https://datatracker.i= etf.org/doc/draft-sah-resolver-information/> for a proposal that is = being discussed in the DNSOP WG. It proposes a message format (JSON) and tw= o transports (DNS and HTTPS) that can be used by a resolver for lots of thi= ngs, including the policy ideas in the draft that this thread is about.
=C2=A0
Is there a good definition of the term "= ;policy ideas"?

thanks,
Rob
--000000000000739a05058de9406c-- From nobody Wed Jul 17 17:01:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02C2C12015C for ; Wed, 17 Jul 2019 17:01:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gg5V5_2hzJel for ; Wed, 17 Jul 2019 17:01:30 -0700 (PDT) Received: from mail-yw1-xc30.google.com (mail-yw1-xc30.google.com [IPv6:2607:f8b0:4864:20::c30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA2FB12023E for ; Wed, 17 Jul 2019 17:01:29 -0700 (PDT) Received: by mail-yw1-xc30.google.com with SMTP id g19so10922890ywe.2 for ; Wed, 17 Jul 2019 17:01:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5/OPqvLpO43MSgy0u9l4rktGuy8FTLagYiwpMd91VLQ=; b=FyRc5Z5Cdx1aC6RpnwByDc+jZhQRpJQj9asSLMSfOx5eGV8c49xzdz/hLKRSi6b9br VpPberb5iAFshOu91fHzT3dvN78UB54CHoYPH32jaIsg1EY2mp2Nn4kC0LWrI3gu/ODi u+ZBB1Fyp18XSmBrRcyij4wRQDnP60F2G2y6klKpu79cU4bFUF/knvY0jaad2+C2VDgL amkBQZ8wnNZfBVnXNJZdLpkrYkbNrcIZxVZo6vnQeHIbrgw7iisxrlkWqyuU8IopzF3V LwGIGhZoMJ+ab5JDAgrrQjr+VVfL3uMB3Lfp7crKFvzRz4b9mkNlw6WdhMrfCzvTc2Ge 2l8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5/OPqvLpO43MSgy0u9l4rktGuy8FTLagYiwpMd91VLQ=; b=d3eOUtjkkD6A+WXyPyIEyhu+0pgvVKgi5IJYAyro0FnjhOqbzl19YqFYdSBm4xWMrA AN0i0yt48YoDv+Ed4NAyq0KqRE2JcAIP0wpXSiPoMVuAV9AEfgovlJO4nYeJmfYVsQq1 kR5RVXQ6v9CPKOROv4duIxQIrLMKEVpz21hiZ0SBd76wmbMCedxMpGGZGrzWqpF3DY// QBqu5YMYJS7bP3yuOC9tASV2j8vDk9tFLlLZE0wVbCz5w/EIno6XFxnyy7RrW6QHqkd/ xfKU7NQ5PtkvBGpDxI3PhJbeZoO2vSjhy/UaIppPHmCprGon93/Ym5xGwSmAgl2kfEs+ 3JFQ== X-Gm-Message-State: APjAAAW/6HcN7FVOD1OvE86/qx12IU/5XzYf2xBv0OXHI9Sa1Z5bRq8D iTWuidCe5ycVCYHnX5FiNP/bW3d9JrpbALLVb8s= X-Google-Smtp-Source: APXvYqz2z44gATuDIMQzZ3JH0X+FyR1EGAO6h/EaNeV7Q5UoP9bgRhkMAgdXrqaEMQT10fv5lrMfakABr/Nl3gyi37I= X-Received: by 2002:a81:a1d7:: with SMTP id y206mr26494526ywg.7.1563408088668; Wed, 17 Jul 2019 17:01:28 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> <1702868587.11849.1563400444426@appsuite-gw1.open-xchange.com> In-Reply-To: <1702868587.11849.1563400444426@appsuite-gw1.open-xchange.com> From: Alec Muffett Date: Thu, 18 Jul 2019 01:00:51 +0100 Message-ID: To: Vittorio Bertola Cc: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000c39f59058de94fbe" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 00:01:33 -0000 --000000000000c39f59058de94fbe Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 17 Jul 2019 at 22:54, Vittorio Bertola < vittorio.bertola@open-xchange.com> wrote: > > Can I just ask you whether you really think that DoH makes a real > difference to the proverbial dissident under a dictatorship? > Since this is a personal question, I shall answer in the first person. Yes I do, because my 25+ years experience of trying to get people to use advanced security tools =E2=80=94 Signal, Tor, Briar, SSH, PGP =E2=80=94 ha= s led me to the conclusion that although such tools have their place, the world is best served by maximising the {privacy, tamperproofness, blocking-resistance} which is available as-default to the absolute maximum number of people. This perspective led, in part, why I was chosen as the lead engineer for adding end-to-end encryption to Facebook Messenger: https://www.wired.co.uk/article/messenger-secret-messages-end-to-end-encryp= tion ...and in the process of which I had to defend the creation of the same against the counterarguments made by proponents of the monitoring-and-safety viewpoint: https://parentzone.org.uk/secret-conversations-everything-you-need-know-abo= ut-facebooks-new-feature If I were one, I'd already be using stuff like Tor and VPNs. > I am familiar with that perspective; to venture off-topic for a moment, there is in the United Kingdom some legislation arriving, soon, which will require everyone to verify that they are over 18 before viewing pornography= : https://www.openrightsgroup.org/campaigns/digital-economy-bill-hub/age-veri= fication/ This regulation requires the collection of data which did not need to be collected before, and ties it to real-world identities; unsurprisingly the "geek" world falls into two camps, those who say "People should just use Tor and VPNs" =E2=80=94 which is true, but unhelpful at scale and which bri= ngs its own risks of complicit VPN providers, etc =E2=80=94 but also there are erud= ite essays such as this one, extract: https://www.girlonthenet.com/2016/10/17/get-round-a-porn-block/ *Do you know how to get round a porn block? If your immediate thought here > involved something like a VPN or Tor, then congratulations: it sounds lik= e > should your government implement a porn block you=E2=80=99ll have a reaso= nable idea > how to circumvent it. However, can I ask that you please please please st= op > telling me on Twitter that you how to get around a porn block? Allow me t= o > explain why.* ...which goes on to explore the theme more usefully than I can in this email. Also, I can strongly recommend that you invest a few days of your life attempting to lecture/teach "security tools" to actual dissidents, or even just members of the public; to do so is a life-changing experience. I can recommend "CryptoParties" as a starter in this space: https://www.cryptoparty.in > Encrypting the DNS query is nice, but if then there are packets going fro= m > my computer straight to the forbidden destination, it's also not very > useful - and if there aren't, then I am possibly already using technologi= es > that could transport my DNS queries securely as well. > Indeed - I am a (possibly the only?) proponent of DNS-over-HTTPS-over-Onion= : https://github.com/alecmuffett/test-dns-https-onion ...but I am not foolish enough to believe that that will ever benefit more than a few thousand / tens-of-thousands of people, once implemented. Whereas in my previous job I literally enabled secure communications for more than 1 billion people =E2=80=94 if they so choose, and I am not convin= ced that enough of them chose. Hence why I welcome seeing Facebook embrace E2E more broadly ( https://www.theverge.com/2019/1/25/18197222/facebook-messenger-instagram-en= d-to-end-encryption-feature-zuckerberg) and also why I believe that DOH-BY-DEFAULT-ON-FIREFOX-AND-CHROME is the only useful route forwards towards adoption and impact. I think that DoH is much more of value for people that do not need to hide > their traces completely, but just don't want their DNS traffic tracked an= d > monetized. > Good security technology seeks to lift all boats: https://medium.com/@alecmuffett/how-to-help-dissidents-with-technology-lift= -all-boats-e6fcb72d0da1 Tor is good =E2=80=94 I launched the Onion sites for both Facebook & the Ne= w York Times =E2=80=94 but it is not "at scale". Firefox and Chrome, together, are "at scale" and present a tremendous opportunity to "shift the needle" back towards privacy-and-integrity-and-assurance-by-default. Also, this idea that the Internet will export democracy by providing > "escape to a free web for oppressed peoples" is... so 90's. > That's a strawman. I am not trying to "export democracy". I am, as Whitfield Diffie puts it, merely attempting to restore to people the ability for people to have a private conversation, even with a foreign webserver. However, it has to be said that repressive regimes =E2=80=94 and the safety= -focused =E2=80=94 are communities both which have issues with that goal. Alec Muffett Formerly Facebook Security Infrastructure Engineering Member: Board of Directors, Open Rights Group Member: Cybersecurity Executive of the British Computer Society Co-Author, RFC7686 Avid cyclist and chef Have a good evening, everyone. Hugs. --=20 http://dropsafe.crypticide.com/aboutalecm --000000000000c39f59058de94fbe Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, 17 Jul 2019 at 22:54, Vittorio= Bertola <vittorio.= bertola@open-xchange.com> wrote:
=20 =20 =20

Can I just ask you whether you really think that DoH makes a real di= fference to the proverbial dissident under a dictatorship?

Since this is a personal question, I shall answ= er in the first person.

Yes I do, because my 25+ y= ears experience of trying to get people to use advanced security tools =E2= =80=94 Signal, Tor, Briar, SSH, PGP =E2=80=94 has led me to the conclusion = that although such tools have their place, the world is best served by maxi= mising the {privacy, tamperproofness, blocking-resistance} which is availab= le as-default to the absolute maximum number of people.

This perspective led, in part, why I was chosen as the lead engineer = for adding end-to-end encryption to Facebook Messenger:


...and in the process of which I had to defend t= he creation of the same against the counterarguments made by proponents of = the monitoring-and-safety viewpoint:



=
If I were one, I'd already be using stuff like Tor and VPNs. =

I am familiar with that perspe= ctive; to venture off-topic for a moment, there is in the United Kingdom so= me legislation arriving, soon, which will require everyone to verify that t= hey are over 18 before viewing pornography:


This regulation requires the collection of dat= a which did not need to be collected before, and ties it to real-world iden= tities; unsurprisingly the "geek" world falls into two camps, tho= se who say "People should just use Tor and VPNs" =E2=80=94 which = is true, but unhelpful at scale and which brings its own risks of complicit= VPN providers, etc =E2=80=94 but also there are erudite essays such as thi= s one, extract:


Do you know how = to get round a porn block? If your immediate thought here involved somethin= g like a VPN or Tor, then congratulations: it sounds like should your gover= nment implement a porn block you=E2=80=99ll have a reasonable idea how to c= ircumvent it. However, can I ask that you please please please stop telling= me on Twitter that you how to get around a porn block? Allow me to explain= why.

...which goes on to exp= lore the theme more usefully than I can in this email.

=
Also, I can strongly recommend that you invest a few days of your life= attempting to lecture/teach "security tools" to actual dissident= s, or even just members of the public; to do so is a life-changing experien= ce. =C2=A0

I can recommend "CryptoParties&quo= t; as a starter in this space:=C2=A0<= a href=3D"https://www.cryptoparty.in">https://www.cryptoparty.in= =C2=A0

=C2=A0
Encr= ypting the DNS query is nice, but if then there are packets going from my c= omputer straight to the forbidden destination, it's also not very usefu= l - and if there aren't, then I am possibly already using technologies = that could transport my DNS queries securely as well.

Indeed - I am a (possibly the = only?) proponent of DNS-over-HTTPS-over-Onion:


...but I am not foolish enough to = believe that that will ever benefit more than a few thousand / tens-of-thou= sands of people, once implemented.

Whereas in my p= revious job I literally enabled secure communications for more than 1 billi= on people =E2=80=94 if they so choose, and I am not convinced that enough o= f them chose.

Hence why I welcome seeing Facebook = embrace E2E more broadly (https://www.theverge.com/2019/1/25/= 18197222/facebook-messenger-instagram-end-to-end-encryption-feature-zuckerb= erg) and also why I believe that DOH-BY-DEFAULT-ON-FIREFOX-AND-C= HROME is the only useful route forwards towards adoption and impact.
<= div>

I think that DoH is= much more of value for people that do not need to hide their traces comple= tely, but just don't want their DNS traffic tracked and monetized.=C2= =A0


Tor is good =E2=80=94 I launched the Onion sites for both F= acebook & the New York Times =E2=80=94 but it is not "at scale&quo= t;.

Firefox and Chrome, together, are "at sca= le" and present a tremendous opportunity to "shift the needle&quo= t; back towards privacy-and-integrity-and-assurance-by-default.
<= br>

Also, this idea that the Internet will export democracy by providing= "escape to a free web for oppressed peoples" is... so 90's.<= /div>

That's a strawman.=C2=A0 I = am not trying to "export democracy". =C2=A0

<= div>I am, as Whitfield Diffie puts it, merely attempting to restore to peop= le the ability for people to have a private conversation, even with a forei= gn webserver.

However, it has to be said that repr= essive regimes =E2=80=94 and the safety-focused =E2=80=94 are communities b= oth which have issues with that goal.
=C2=A0
Alec Muffe= tt
Formerly Facebook Security Infrastructure Engineering
Member: Board of Directors, Open Rights Group
Member: Cyb= ersecurity Executive of the British Computer Society
Co-Author, R= FC7686
Avid cyclist and chef
Have a good evening, every= one. Hugs.

--
http://dropsafe.crypticide.com/aboutalecm
--000000000000c39f59058de94fbe-- From nobody Wed Jul 17 17:08:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C957120108; Wed, 17 Jul 2019 17:08:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YrkflfMx2ILN; Wed, 17 Jul 2019 17:08:38 -0700 (PDT) Received: from mail.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1496812003E; Wed, 17 Jul 2019 17:08:38 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 17 Jul 2019 17:08:36 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Wed, 17 Jul 2019 17:08:36 -0700 From: Paul Hoffman To: Rob Sayre CC: dnsop WG , "add@ietf.org" Thread-Topic: [DNSOP] [Add] [Ext] new draft: draft-grover-add-policy-detection-00 Thread-Index: AQHVPPtgWHoELFubd0C9JFh6suLZFKbP9UUA Date: Thu, 18 Jul 2019 00:08:36 +0000 Message-ID: References: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [DNSOP] [Ext] new draft: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 00:08:39 -0000 On Jul 17, 2019, at 4:57 PM, Rob Sayre wrote: > Is there a good definition of the term "policy ideas"? No, but you already knew that. Most specifications of policy ever created i= n the IETF have been dissatisfying to some people for various (good) reason= s. That's one of the reasons why the spec in draft-sah-resolver-information= allow anyone to create their own temporary specs before standardization. --Paul Hoffman= From nobody Wed Jul 17 17:12:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C26F812015C; Wed, 17 Jul 2019 17:12:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MAJV6_Ydc3tT; Wed, 17 Jul 2019 17:12:22 -0700 (PDT) Received: from mail-io1-xd29.google.com (mail-io1-xd29.google.com [IPv6:2607:f8b0:4864:20::d29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01D2B12003E; Wed, 17 Jul 2019 17:12:22 -0700 (PDT) Received: by mail-io1-xd29.google.com with SMTP id k20so48630969ios.10; Wed, 17 Jul 2019 17:12:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=38aDzHzM8lyen1GSo49M8zKLC1Go1nQAy0OxIenV1Y8=; b=J40Oh2FeDR5pCFHQ61WNbfRatQO9Eg0HDW18retjk5845ZzwkqG3xn+eRJJ+vVC9tS 8yo+nXzYQwfqxmJzcS+HmDfoFrMQ3zpbB3VhEd8LPrpN36WnoJDFroCmuvgHyX6hqP0O agTJ2m2AFC5B4DZpGxgW4oUKjqgEZP43dvTFxgjTQQuVa8puN5SrnfqIUtj24ivtQkUv lgKzfSst14W5OtquDGyD16qIUDGAYa/cIh6VF21hotlfS6ksVffA53FgWqsBHTAvhAC9 bXm0elBTNSjoX2lrV0e05XBsOK255iRlvxr/R9tY1hHz6+qrR0k0IEPHFKINcsBB4XS/ EMaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=38aDzHzM8lyen1GSo49M8zKLC1Go1nQAy0OxIenV1Y8=; b=eMohZcVcHjN9HfggGu4PDW1n6IUm1u0L+jCiilBumvEtoFpjwrnxQW/CZEkQY+V49J vI0XAyEkdkucr8jth1Ar9dNEf6jteD6VGzdUMhq7twlPvVs4779Jv+eW+50mW7+fRNHi ANkr0g3XYWGut1IpDmZWTYZP8pD8znqSOBSV9SG+kUKPp7h81w0fdRDk2gxCgb2X9z+y JuQkELXcoTKA3GowQO+N2zFoSJtHW+1e7Y/UXS83qV7XTjww1W/FVRF3pK2RF1t+HYSR B1wdA1AeBMmvzxQIZH4Kx8ImUYNFL1XNgKoUVaGoqfSkcAQcaQAmSNdnLMFvt8/cYCHm tk2A== X-Gm-Message-State: APjAAAXdf0rS2cm1HAPj/25BwOUqI2sQvxQGWU4HNmVqQ2iONkDJkhFv sXsZt9ScUWftqA9lBaXT9vuJTjU41xeFM1ZZytg= X-Google-Smtp-Source: APXvYqytbMK2HiNjcdUznv91xl6WQEclL4GHMTbyOlU5rVAhaHfsqQiAaouk9iQ5DBTAHDa7ooDv3sful6uMyr6JDu8= X-Received: by 2002:a02:1a86:: with SMTP id 128mr45463859jai.95.1563408741174; Wed, 17 Jul 2019 17:12:21 -0700 (PDT) MIME-Version: 1.0 References: <156260800560.777.13636536980052967232.idtracker@ietfa.amsl.com> <65f155e9-81c7-daac-8e77-e366d0f924fb@pmtu.dev> In-Reply-To: From: Rob Sayre Date: Wed, 17 Jul 2019 17:12:09 -0700 Message-ID: To: Paul Hoffman Cc: dnsop WG , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000a816ff058de976bf" Archived-At: Subject: Re: [Add] [DNSOP] [Ext] new draft: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 00:12:24 -0000 --000000000000a816ff058de976bf Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 5:08 PM Paul Hoffman wrote: > On Jul 17, 2019, at 4:57 PM, Rob Sayre wrote: > > Is there a good definition of the term "policy ideas"? > > No, but you already knew that. Yes, I did. But you still wrote it. > Most specifications of policy ever created in the IETF have been > dissatisfying to some people for various (good) reasons. That's one of the > reasons why the spec in draft-sah-resolver-information allow anyone to > create their own temporary specs before standardization. > So, the spec allows anyone to create whatever they want? Why would that be called a standard? Isn't that just writing code? I might be missing something, but this doesn't seem to make sense. thanks, Rob > > --Paul Hoffman --000000000000a816ff058de976bf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 17, 2019 at 5:08 PM Paul = Hoffman <paul.hoffman@icann.or= g> wrote:
On Jul 17, 2019, at 4:57 PM, Rob Sayre <sayrer@gmail.com> wrote:
> Is there a good definition of the term "policy ideas"?

No, but you already knew that.

Yes, I did. = But you still wrote it.
=C2=A0
Most specifications of policy ever created in the IET= F have been dissatisfying to some people for various (good) reasons. That&#= 39;s one of the reasons why the spec in draft-sah-resolver-information allo= w anyone to create their own temporary specs before standardization.

So, the spec allows anyone to create whatever= they want? Why would that be called a standard? Isn't that just writin= g code?

I might be missing something, but this doe= sn't seem to make sense.

thanks,
Rob=

=C2=A0

--Paul Hoffman
--000000000000a816ff058de976bf-- From nobody Wed Jul 17 19:04:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9614A120616 for ; Wed, 17 Jul 2019 19:03:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OpuVUtf3LdeS for ; Wed, 17 Jul 2019 19:03:57 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9900C1200B4 for ; Wed, 17 Jul 2019 19:03:57 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id j5so44780229ioj.8 for ; Wed, 17 Jul 2019 19:03:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vGnZ4cLy3E+k7jMepca3aXWWGR+aXkaGvIwXvyl3b1A=; b=pDnVrsCEIH7nsQ/psrV7UVKtvxs/F0kH3mXMc5t2WkwofNMKyI7Ogksyi7nYW+V6g0 Ry+jUiV9bSs24amJ/68VJdIM7sC04Ke4UnvasMQhf+xXXtiMdx3lry7Aj4r3GIfA2Obh sY+bc9M3b3Vhesl2IbU3cY04lD21HN9VuNuppz1zerSEQumAom02QWJiNNq0DV7fpvN2 rrhAUpIfW0NCg5P3EU0EpbwJf8H6R4sCMM5BKWXdl6KMRDYEXcoywjPmYZy1opm1gYTt 3/7bGeAaUQH/zwc/BB5TY2aIIy65RxLsqxpcRsMM6sIy4b77qKqyjNjry5IEE4J8FIS2 TMkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vGnZ4cLy3E+k7jMepca3aXWWGR+aXkaGvIwXvyl3b1A=; b=EKjxonMotyiaUPHJiJ2ZXNX0vdLTW7BJw62sg71SL9UeafLYJO61i/xTZullfKnRtp vyGijZ7fF2wCcOrbhQmUauW7TU7t9/1t1t2/clrzBFE4N8x8BozdMyny1LYY0ZDgSFiU 7ux6Ys0A2txel1ZHoSkxkWic9yj6wjNQtYNSzJsj8JJAIr5vAqgqYTAMUDIcsPKIxbQ+ h29obxoswzjFHYUfNUtwPsuGESXhU49VUv/ZZBQVZFSoGxhE0ZH0pi140VSfZCqhBq6P 2xKoGbcnaPX8EU0igSgot4Sixv6VHJiMkfI6e3XSTVn49pXA8iJt8uYK5xh+OHUuvJmg eyQA== X-Gm-Message-State: APjAAAWhLyEjtmreQEG/YNr6kOcuOJw1fBooOQjUzw1S7G0oafYA1jl3 g94d5gIoB79/5or8z7LAfkHeNsE4ZJoF6npaWeM= X-Google-Smtp-Source: APXvYqzf6O9KLE0QgLdaTWpeis+x36uETxQpFsdqy7PyNrP4ms29KsgNtKWx3huvkICSIkqTfHm0+s9FnV2cqNe8Jbg= X-Received: by 2002:a5e:d618:: with SMTP id w24mr5077207iom.73.1563415436748; Wed, 17 Jul 2019 19:03:56 -0700 (PDT) MIME-Version: 1.0 References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> <1702868587.11849.1563400444426@appsuite-gw1.open-xchange.com> In-Reply-To: From: Rob Sayre Date: Wed, 17 Jul 2019 19:03:44 -0700 Message-ID: To: Stephen Farrell Cc: Vittorio Bertola , Alec Muffett , add@ietf.org Content-Type: multipart/alternative; boundary="000000000000be6e8a058deb05f9" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 02:04:00 -0000 --000000000000be6e8a058deb05f9 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 17, 2019 at 3:13 PM Stephen Farrell wrote: > I don't think I've seen such a spectacularly off-topic > (frankly inappropriate) strawman proposed in many a year. > I have seen many similar emails. It's basically part of dealing with the IETF. > That's just not an argument for an IETF list IMO. > Unfortunately, it is. thanks, Rob --000000000000be6e8a058deb05f9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 17, 2019 at 3:13 PM Stephen F= arrell <stephen.farrell@cs.= tcd.ie> wrote:
I don't think I've seen such a spectacularly off-topic
(frankly inappropriate) strawman proposed in many a year.
<= div>
I have seen many similar emails. It's basically part= of dealing with the IETF.
=C2=A0
That's just not an argument for an IETF list IMO.
=
=C2=A0Unfortunately, it is.

thanks,=
Rob
--000000000000be6e8a058deb05f9-- From nobody Wed Jul 17 23:49:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FAB2120606 for ; Wed, 17 Jul 2019 23:49:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yCyQm2QGf46j for ; Wed, 17 Jul 2019 23:49:55 -0700 (PDT) Received: from emh02.mail.saunalahti.fi (emh02.mail.saunalahti.fi [62.142.5.108]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 82486120232 for ; Wed, 17 Jul 2019 23:49:55 -0700 (PDT) Received: from eggert.org (unknown [62.248.255.8]) by emh02.mail.saunalahti.fi (Postfix) with ESMTP id 4CD712003C for ; Thu, 18 Jul 2019 09:49:53 +0300 (EEST) Received: from slate.eggert.org (Slate.eggert.org [172.19.235.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by eggert.org (Postfix) with ESMTPSA id 7E26164C77C for ; Thu, 18 Jul 2019 09:49:44 +0300 (EEST) From: Lars Eggert Content-Type: multipart/signed; boundary="Apple-Mail=_79ACF04C-840F-497A-A791-E1296A6A608F"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: <15E1F79D-A6FE-44AE-AA29-8B8840F1FEAF@eggert.org> Date: Thu, 18 Jul 2019 09:49:44 +0300 To: add@ietf.org X-MailScanner-ID: 7E26164C77C.A2C75 X-MailScanner: Found to be clean X-MailScanner-From: lars@eggert.org Archived-At: Subject: [Add] HEADS UP: cool it down a bit, please X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 06:49:57 -0000 --Apple-Mail=_79ACF04C-840F-497A-A791-E1296A6A608F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi, it's clear that there are a variety of opinions being expressed about = the scope and direction of ADD. On one hand, it's useful that discussion is already happening before the = BOF session, given the inevitable time constraints there. On the other hand, the discussion seems to be getting somewhat heated, = and the frequency and in part tone of the emails may make it difficult = for other folks to contribute. I'd therefore like to ask those of you who have been posting a lot over = the last few days to maybe ask yourselves if you really have to respond = right away and also consider if what you are about to share with the = list is constructively moving us towards some sort of consensus. Thanks, Lars --Apple-Mail=_79ACF04C-840F-497A-A791-E1296A6A608F Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEDrrUO3PMwKM8fddaHbmKvSnuNPgFAl0wFogACgkQHbmKvSnu NPiy1g//Q+D6G9a7KHCAwTFoyuXJhkXc1p6MrmWdOROao8MoqdiCvha8UhM/odWC MFe+XqxfgISK9nsms+XOjlBuQ39nM3Ob10ZD1dC57V1vKnS9vttclRFUx/t+OFxb SliGGTp8oppFEOZQx8bfjwARfQnNWGH6jWVxraKk4dEGk8pcJekPdQ+icpepZNk6 XM03D+DwTzsn1r9PLuSkBkRINzILQ6gQMmKvqBnCS+nuZm2C2z9Qy3UwIyOmUkPM o7aL2LDgHgKTaA6AtyDTM7PAehMCh2w/bL3JKooN5Tccf3yRTOXVvtfgxacKFY/F B1UnUjSv2HgNbbP9Z4LvOpl+QR9wT+o9vc81dLth1dlrSGKd7NowFIZjQIy5e8Pm RIdsYKyKcODmTcoUttV0i03HL5w2hJrmjjollrig5VrJiMtLvmhaot4tgLOCS+rN 6Sg8W6u/S/6kCr2bLKgbfOB3FM+QDPea+zK87mojs6dQkI3X7ciX3HBbOjIY5567 UtAH6sdo6cdMZ2UY63PFnDLdnhPXNF5OZhF4w2RVbAz4twyxjB0vKuWRaydDLwlv a5gE7/2v28ji56ggK7qLBvGcmHX+f7gSbArR9T/41+gmttwK/fWt7+Tgq6NE8NLO tLfyXx55rQorTXpa9DZmupUok4pJLhbU2pK1EJB2TmSmSOqXLh8= =zo3V -----END PGP SIGNATURE----- --Apple-Mail=_79ACF04C-840F-497A-A791-E1296A6A608F-- From nobody Thu Jul 18 00:13:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54AD11200FA for ; Thu, 18 Jul 2019 00:13:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9_EuJ5BDHF6q for ; Thu, 18 Jul 2019 00:13:21 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 77BA31200F3 for ; Thu, 18 Jul 2019 00:13:21 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id A9A265F42A7A; Thu, 18 Jul 2019 09:13:19 +0200 (CEST) Received: from [172.19.152.190] (p5DC68FD7.dip0.t-ipconnect.de [93.198.143.215]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 3CA655F42A3A; Thu, 18 Jul 2019 09:13:17 +0200 (CEST) From: "Ralf Weber" To: "Ted Hardie" Cc: "Brian Dickson" , "Vittorio Bertola" , add@ietf.org, "Neil Cook" , "Rob Sayre" Date: Thu, 18 Jul 2019 09:13:15 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 07:13:25 -0000 Moin! On 17 Jul 2019, at 20:56, Ted Hardie wrote: > On Wed, Jul 17, 2019 at 11:40 AM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: >> The root of the problem is visible in "if they chose not to". The >> nature >> of DoH, is that the network operator (regardless of who they are) is >> unable >> either detect or prevent guests (or users or BYOD or whoever) from >> not >> complying with your network policy. >> >> > I disagree. It forces the existence of the network policy to be > visible, > but it is entirely possible to deny network access to a system which > is > non-compliant. It is not as simple as blocking or intercepting all > port 53 > traffic, but that method never addressed the reality that cleartext > traffic > on that port was available to an observer. To get both > confidentiality and > policy enforcement via this means, practice will need to change. It > will > need to be visible to the system consuming the DNS (be it a browser, > an OS, > or some other application), and the enforcement mechanism will have to > be > better integrated into reachability mechanics. That is definitely new > code > for most people, but it is not impossible. Can you please explain how this could be done, and more precisely how this draft would help in achieving that. If an application uses DoH as resolution mechanism without telling the network this traffic can not be distinguished from normal HTTPs traffic. So the only way to block this is to block known endpoints, but that can be done with or without knowing the policy. So long -Ralf —-- Ralf Weber Principal Architect, Carrier Division Akamai Technologies GmbH Parkring 20-22, 85748 Garching phone: +49.89.9400.6174 mobile: +49.151.22659325 Geschäftsführer: David Matthew McDonald Aitken, Justyna Kalina Jankowska Sitz der Gesellschaft: Garching Amtsgericht München HRB 129886 From nobody Thu Jul 18 01:49:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D317120177 for ; Thu, 18 Jul 2019 01:49:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lCalVwLCTRAU for ; Thu, 18 Jul 2019 01:49:28 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E600B120176 for ; Thu, 18 Jul 2019 01:49:27 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id k8so50296469iot.1 for ; Thu, 18 Jul 2019 01:49:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=C4MLOYgH90SVyThEDTlkjqve/mcGS8H+r+Z01nYOcWg=; b=lX/mD1niBoVOzyQblcRgF90PtKV8jWy0TVIXpHCYBfdVvr/xbCRS5Z28tqVvNhU8gT JqhvnysSDDSTBqv6aDFSO/QzfXQ1s6UxvTKue0glvzprwpwyMarWIlBwHWRq6hDXfohk Y64I+dFIxOMj1GsCj8Yi7zbzi1aauFsF/FqcdCIGT6fxfskBa653kSzKvFqb9/rF3G4/ /g+gloEOihZQ0Y3wjw3sTb26JIZNG8LbpussS5hx4zBOQ2tH7ubj+GEWti3EMDmpxXnz 4Tkeuz0N4aZvSz//xim6L3/mqe5tNaTGqt+Z5AjszdtHbAIX6TgjlG9cfHb53goCFH+f ZwUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=C4MLOYgH90SVyThEDTlkjqve/mcGS8H+r+Z01nYOcWg=; b=KXbOyeidNymlQVRT+qzgOTwvmOtjdqOc4YuegG0KTY5IkwputAZksFbPjq+FGVhXpp 5Abu8h4XE9uHyHA6PC6pTBu52H1LXY8QS3wRokBo/N2ybp9fExRxBjKhnK0BX0zPs5GU hBPhKFRJ4TPhFq229ION0VikE6fHqseyM/mBTPLdwJH4yO551+46gbT+IIRsY4yiBBgh jwH0PwHXpr5E+cNsyqNyoGW2xNHGXr8i0nkansmr90BnhpPezQDCAxi38iTRBFgKWLSv bZv08vGzb+h2hnd8Bj+c+SDspfUN2Nm3EYi0g7s0Ob0Ft5eADgI0G1MAX94Owo9Qw7/C 6LmA== X-Gm-Message-State: APjAAAUCYZdBIKTHQ+ZRD2ZDTvnRN49hXx03EUJrR1qYjwdqbjlXL0YE DoKPN7KK8rykUbtFaEUJR9PPUK7udMK/pvFCSHUHdtKML/k7tGHb X-Google-Smtp-Source: APXvYqzpybejU/sN+r7IW4axJz1tQ49cg/3SKwS8ZXOCxqSCBVi0r7srvy5SO3tsy0dfstjJjV+Zz4UHHAT6SW0LOXw= X-Received: by 2002:a5e:d618:: with SMTP id w24mr6559712iom.73.1563439765873; Thu, 18 Jul 2019 01:49:25 -0700 (PDT) MIME-Version: 1.0 References: <15E1F79D-A6FE-44AE-AA29-8B8840F1FEAF@eggert.org> In-Reply-To: <15E1F79D-A6FE-44AE-AA29-8B8840F1FEAF@eggert.org> From: Rob Sayre Date: Thu, 18 Jul 2019 01:49:14 -0700 Message-ID: To: Lars Eggert Cc: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000df6a28058df0af0a" Archived-At: Subject: Re: [Add] HEADS UP: cool it down a bit, please X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 08:49:30 -0000 --000000000000df6a28058df0af0a Content-Type: text/plain; charset="UTF-8" Hi, I think everyone on the list means well, but there are two obvious issues that the IETF hasn't addressed directly. The first is that PKI infrastructure is probably not secure against government actors. This issue is not a secret--it was in the New York Times. Pretending otherwise can waste a lot of time. The second issue is that DNS filtering doesn't really work all that well. I know some people will call it "defense in depth", but the problem with that argument is that it could be used to justify any ineffective measure. Repressing these facts can cause a lot of distress, and might ultimately harm the reputation of the IETF itself. I agree that the discussion is a bit heated, having been on the receiving end of several fairly strange emails. So, I'll try to be quiet as well. thanks, Rob On Wed, Jul 17, 2019 at 11:50 PM Lars Eggert wrote: > Hi, > > it's clear that there are a variety of opinions being expressed about the > scope and direction of ADD. > > On one hand, it's useful that discussion is already happening before the > BOF session, given the inevitable time constraints there. > > On the other hand, the discussion seems to be getting somewhat heated, and > the frequency and in part tone of the emails may make it difficult for > other folks to contribute. > > I'd therefore like to ask those of you who have been posting a lot over > the last few days to maybe ask yourselves if you really have to respond > right away and also consider if what you are about to share with the list > is constructively moving us towards some sort of consensus. > > Thanks, > Lars > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000df6a28058df0af0a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,

I think everyone on the list = means well, but there are two obvious issues that the IETF hasn't addre= ssed directly.

The first is that PKI infrastructure is probably not = secure against government actors. This issue is not a secret--it was in the= New York Times. Pretending otherwise can waste a lot of time.

The s= econd issue is that DNS filtering doesn't really work all that well. I = know some people will call it "defense in depth", but the problem= with that argument is that it could be used to justify any ineffective mea= sure.

Repressing these facts can cause a lot of distress, and might = ultimately harm the reputation of the IETF itself.

I agree that the = discussion is a bit heated, having been on the receiving end of several fai= rly strange emails. So, I'll try to be quiet as well.

thanks,Rob

On Wed, Jul 17, 2019 at 11:50 PM Lars Eggert <lars@eggert.org> wrote:
Hi,

it's clear that there are a variety of opinions being expressed about t= he scope and direction of ADD.

On one hand, it's useful that discussion is already happening before th= e BOF session, given the inevitable time constraints there.

On the other hand, the discussion seems to be getting somewhat heated, and = the frequency and in part tone of the emails may make it difficult for othe= r folks to contribute.

I'd therefore like to ask those of you who have been posting a lot over= the last few days to maybe ask yourselves if you really have to respond ri= ght away and also consider if what you are about to share with the list is = constructively moving us towards some sort of consensus.

Thanks,
Lars
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000df6a28058df0af0a-- From nobody Thu Jul 18 02:03:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A24D7120178 for ; Thu, 18 Jul 2019 02:03:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IFvvTEWmjx-3 for ; Thu, 18 Jul 2019 02:03:36 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67C6D12016D for ; Thu, 18 Jul 2019 02:03:36 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 48B806A3B5; Thu, 18 Jul 2019 11:03:34 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563440614; bh=Yp6NwBabLxJaO5w+cT9dSwdwSRA/ZZ6iN8f6/10vpBs=; h=Subject:From:In-Reply-To:Date:Cc:References:To:From; b=B3xT+BBZA7OdVUyoVqwKnraOfvvHjH0MQEXdeEOMg9RBKRlAvXfIH1PNYhNIaDLuB iGHSpD0cC16X+i0T9WBY7XhuWach2Cjyg60duR3zEDLU/G/rRrxipLlmiLi/iS16Y+ SEJcL8jvyABQpzeB41TZNSTjE+V7+WoI92Yt/f6MmhdaX8YL2Wfx3kT/SgX4SsB7Tw LJREqf3U1aQ7hYd0oPyIhao39tiWhl+K85Gja9pWjYZm+WXiBwP6tJJcEtDJCusvXl bcwKY50fbyTNZXROaCQwNMC9FySLhZZLH/lWJJwifngCI8smOh/9D5t7Lv86+eXeXq 2NEfaYpLg/yzA== Received: from [10.242.2.29] (unknown [10.242.2.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id DD85D3C0234; Thu, 18 Jul 2019 11:03:33 +0200 (CEST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Neil Cook In-Reply-To: Date: Thu, 18 Jul 2019 10:03:32 +0100 Cc: Lars Eggert , add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <124EDCB6-27D6-46F5-9591-7B68C5B7B893@open-xchange.com> References: <15E1F79D-A6FE-44AE-AA29-8B8840F1FEAF@eggert.org> To: Rob Sayre X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] HEADS UP: cool it down a bit, please X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 09:03:38 -0000 > On 18 Jul 2019, at 09:49, Rob Sayre wrote: >=20 > The second issue is that DNS filtering doesn't really work all that = well. I know some people will call it "defense in depth", but the = problem with that argument is that it could be used to justify any = ineffective measure. >=20 > Repressing these facts can cause a lot of distress, and might = ultimately harm the reputation of the IETF itself. >=20 I would suggest that the above statement is an opinion not a fact.=20 Also I=E2=80=99m not sure what anyone thinks of the effectiveness of DNS = filtering (whether for malware protection, parental control, or to = restrict dissidents etc.) is relevant to the debate on this list. The = fact that is relevant is that DNS filtering is used for all of these = use-cases. Neil From nobody Thu Jul 18 06:20:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82A32120271 for ; Thu, 18 Jul 2019 06:20:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eB3u-jfKMSD5 for ; Thu, 18 Jul 2019 06:20:54 -0700 (PDT) Received: from emh07.mail.saunalahti.fi (emh07.mail.saunalahti.fi [62.142.5.117]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C672C12008F for ; Thu, 18 Jul 2019 06:20:53 -0700 (PDT) Received: from eggert.org (unknown [62.248.255.8]) by emh07.mail.saunalahti.fi (Postfix) with ESMTP id 47CBDB00CA for ; Thu, 18 Jul 2019 16:20:51 +0300 (EEST) Received: from slate.eggert.org (Slate.eggert.org [172.19.235.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by eggert.org (Postfix) with ESMTPSA id 8FACA64D697 for ; Thu, 18 Jul 2019 16:20:29 +0300 (EEST) From: Lars Eggert Content-Type: multipart/signed; boundary="Apple-Mail=_9F11CE4D-76C9-4514-9D2E-86B4054226AF"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 18 Jul 2019 16:20:28 +0300 References: <198E8178-BE2B-428E-98D9-6A117A880864@eggert.org> To: add@ietf.org In-Reply-To: <198E8178-BE2B-428E-98D9-6A117A880864@eggert.org> Message-Id: X-MailScanner-ID: 8FACA64D697.A4193 X-MailScanner: Found to be clean X-MailScanner-From: lars@eggert.org Archived-At: Subject: [Add] Tentative agenda uploaded X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 13:20:56 -0000 --Apple-Mail=_9F11CE4D-76C9-4514-9D2E-86B4054226AF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Sorry for the delay - we have a tentative agenda up at = https://datatracker.ietf.org/doc/agenda-105-add/. This will likely see = more updates based on ongoing discussions. Lars # Applications Doing DNS (add) BOF Responsible AD : Barry Leiba BOF Chairs : David Lawrence, Lars Eggert - Background (chairs, 15 min) - Possible work items for new/existing/rechartered WGs: - Non-browser apps doing DNS (Jim Reid, 10 min) - DoH Preference Hints for HTTP doh-preference-hints (David = Schinazi, 10 min) - DoH BCP (Andy Fidler, 10 min) - DoH Push (Jim Reid, 10 min) - Future (Chairs + ADs, 35 min) --Apple-Mail=_9F11CE4D-76C9-4514-9D2E-86B4054226AF Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEDrrUO3PMwKM8fddaHbmKvSnuNPgFAl0wch0ACgkQHbmKvSnu NPhu6g/9EwqblaKhI008qju2IGwRwDcNr+yXpyYQSzvnBOfZYpRtKBSx8O1pfmzc ELcqBft0M/emmdvPKMVbyMmtyF/QqLWi4311ba+5qkoCkZ0O0Gkw1G1gsEADgL4A z62D3qP34FIJ5N0sQ4t+HW8SWoKAmSDQmLI3e0SYY2ZYmLqajf/wtu0W1bzZCI0K Ksua3J77DK1nMyZgFv1DxnRzSHzDYXJz9veFycMg6OmE0pWT9TCeVh1yT4ySmYZG ECheP46KIC9MGTE9OhdpGjU/zBzY+XjTO0Q0Jgrwzb37AwdyTPuc4u+H+pCDdUnm ZACzyf5HqpyH+j/kdJYg/soroobmR7PYia3Vz0azJvIAf2M791HVFNdttRxPMgPn 1HyoUyCElAp+u4wSYaPvJpTbi9WqmQMgco0VfgTMuguAiYOsrvz+6SYK6Qk6eymx CaXQ7kYeCG0/rOhvE0eUkBRtNK6neOywYyGsk3lsTXRJ8Ett/54Gv7v6MeNvvZav P5W2lcFWiLHaZbc3ge48xN2jOSwXz//6hT0nTThmpXhiT94e4BgeQQWfi5usZJ6Y wMxjI1DpuQkyggI0rosYx36qGDhHNvsLsmngNdAE90Y8FIEBoawCy7zWTvJ6bHXB QvV9sZI9cbnelxt8kUA98730lwvEpPjheCUQJ6mGNoK3WDHrrmg= =b716 -----END PGP SIGNATURE----- --Apple-Mail=_9F11CE4D-76C9-4514-9D2E-86B4054226AF-- From nobody Thu Jul 18 07:58:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D0FE12074B for ; Thu, 18 Jul 2019 07:58:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4jMVDHVryBS8 for ; Thu, 18 Jul 2019 07:58:29 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CAD5612074A for ; Thu, 18 Jul 2019 07:58:29 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id 40B6637402BC; Thu, 18 Jul 2019 07:58:28 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id 17BD6157F850; Thu, 18 Jul 2019 08:58:28 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 135FC157F84F; Thu, 18 Jul 2019 08:58:28 -0600 (MDT) From: Paul Ebersman To: Lars Eggert cc: add@ietf.org In-reply-to: <15E1F79D-A6FE-44AE-AA29-8B8840F1FEAF@eggert.org> References: <15E1F79D-A6FE-44AE-AA29-8B8840F1FEAF@eggert.org> Comments: In-reply-to Lars Eggert message dated "Thu, 18 Jul 2019 09:49:44 +0300." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <83632.1563461907.1@fafnir.local> Date: Thu, 18 Jul 2019 08:58:27 -0600 Message-Id: <20190718145828.17BD6157F850@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] HEADS UP: cool it down a bit, please X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 14:58:31 -0000 lars> I'd therefore like to ask those of you who have been posting a lot lars> over the last few days to maybe ask yourselves if you really have lars> to respond right away and also consider if what you are about to lars> share with the list is constructively moving us towards some sort lars> of consensus. Great suggestion. Might I also suggest we spend the time going over the relevant drafts so that next week can be more effective/efficient? These are all things we've discussed on this list. https://datatracker.ietf.org/doc/draft-grover-add-policy-detection https://datatracker.ietf.org/doc/draft-hal-adot-operational-considerations https://datatracker.ietf.org/doc/draft-ietf-dprive-bcp-op https://datatracker.ietf.org/doc/draft-reddy-dprive-bootstrap-dns-server https://datatracker.ietf.org/doc/draft-sah-resolver-information From nobody Thu Jul 18 19:24:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB910120142 for ; Thu, 18 Jul 2019 19:24:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S2oS0M-n6q6S for ; Thu, 18 Jul 2019 19:24:21 -0700 (PDT) Received: from sudo.sh (hexakaideca.sudo.sh [198.177.251.74]) by ietfa.amsl.com (Postfix) with ESMTP id 839FF120116 for ; Thu, 18 Jul 2019 19:24:21 -0700 (PDT) Received: by sudo.sh (Postfix, from userid 1000) id 46195270AF8; Fri, 19 Jul 2019 02:24:20 +0000 (UTC) Date: Fri, 19 Jul 2019 02:24:20 +0000 From: dagon To: add@ietf.org Message-ID: <20190719022420.GA26335@sudo.sh> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: [Add] FYI: MiTM growth, post DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 02:24:24 -0000 One consequence predicted by DoH critics was that DoH motivates the large-scale installation of tcp/443 MiTM devices. That is, if DoH diminishes the ability of networks to use existing DNS-based filtration systems, operators will simply move from udp/53 filtration to tcp/443. (And, because of increased deployment of TLS 1.3, they will simply force the installation of MiTM CAs; and further, the class of networks enforcing this requirement will be immune to cost pressures, or make use of sovereign powers; and further this will happen first in countries already prone to monitoring; and further this moves users from an "opt-out" situation in DNS-based filtering (where changing their DNS settings evades many filters), to a mandatory surveillance network under tcp/443, etc., so DoT provides a better trade off, etc. Many of these points are in the add@ list history or even predate the list.) This predicted trend is taking place in industry. But have governments also turned to mass tcp/443 interception? This report seems relevant to that question, noting that all end-users of all network providers in Kazakhstan were required to install a government-issued CA in every browser: https://bugzilla.mozilla.org/show_bug.cgi?id=1567114 https://i.imgur.com/WyKjOug.jpg https://i.imgur.com/rFEjXKw.jpg There is yet no report of a MiTM CA for known DoH servers, but one can download the certificate here: http://qca.kz/qazca.{cer, pem, der} which can assist local researchers in monitoring for likely DoH session interceptions. This development might be relevant to those able to attend IETF 105/Montreal. -- David Dagon dagon@sudo.sh "The single raindrop never feels responsible for the flood." From nobody Thu Jul 18 19:55:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C09D8120142 for ; Thu, 18 Jul 2019 19:55:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZYQgvbSK_rkl for ; Thu, 18 Jul 2019 19:55:31 -0700 (PDT) Received: from mail-io1-xd29.google.com (mail-io1-xd29.google.com [IPv6:2607:f8b0:4864:20::d29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6088120116 for ; Thu, 18 Jul 2019 19:55:30 -0700 (PDT) Received: by mail-io1-xd29.google.com with SMTP id j5so51220264ioj.8 for ; Thu, 18 Jul 2019 19:55:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cyhr0u3f88SMNqLF6m/0uKrcOnCb32+DmeqhfpBI4Lw=; b=txecQz01qyWfw6w6qsYiHooIDhP1ePSgQW+ZyOwIunEZWyqc5lKyS23vUegZrZMLIy zryVAl7d9RHSVPAW6lmx+eZ7gmzbail5Eao3u0fw7cscnfqmtSXO91giAq8wbujKkQJZ Iww279awtlqLcdwzHQU73+q7OvVZ/WaC3/m7qCHwNqnblImPqePqOP9rq5CmqnfxvKES QjKu4nfT08bQup/NO4W+NSJMF19/VH70EG1FDdTMqaNzzdDSw7ijRp4GUo3yKAx69UUn aLVOpC6wCMTHqhxFwFsfyeyXHvcfuDLfGUIb5x7OoreinmCNInA6oeq4ew6DhlYE834J 73/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cyhr0u3f88SMNqLF6m/0uKrcOnCb32+DmeqhfpBI4Lw=; b=b8OBNR+jxlCcyH92n2UxMyVO9e98J0NWwz+OArresHzTHZZHsluHQRDTg013f04PUL Dg/Xbm81Qh8/+fjKYSakhjqfsCWsI3JXOFUyRcr0NaaVaHjzo29gyHng1E/GHjuItl94 Om8sLdvdxu4IYu71HiyvbL+0W3bfdZaoJm5VX3EjkTvTu3dDvqPr1jRzm1O4OfLBRleQ sNI9URAYKEwTySadHekzZZw1WFbYB4sRJhMPwgRs6+Y6EAcoFJMF6E5yK5xeAsja6aof L9XEE7Nrkt61HNz6tVslqJ5W8MTUS+eQXKuLLNRQOAngzyXzHfRUlCq++BtYerUlsGsF qRTQ== X-Gm-Message-State: APjAAAVo4ykYfIO8pkFl5AmCodvN6pn4EQdwuDbP92s3A8UiYMXlGPJW Tmw0WnNRdGLMIsuEW4IUwwySUjXWZjWKBZ43Ge20ZsHOVlg= X-Google-Smtp-Source: APXvYqz784ris1HwameJN6gaWNoaL4JZnrueNwZLN06rAfPCMu82OmPxOgLxykLt73+82Tn4lYbIOny+d+lh5DLAeX8= X-Received: by 2002:a02:cc8e:: with SMTP id s14mr25034095jap.142.1563504929777; Thu, 18 Jul 2019 19:55:29 -0700 (PDT) MIME-Version: 1.0 References: <20190719022420.GA26335@sudo.sh> In-Reply-To: <20190719022420.GA26335@sudo.sh> From: Ben Schwartz Date: Thu, 18 Jul 2019 22:55:18 -0400 Message-ID: To: dagon Cc: add@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000fb6926058dffdb28" Archived-At: Subject: Re: [Add] FYI: MiTM growth, post DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 02:55:34 -0000 --000000000000fb6926058dffdb28 Content-Type: multipart/alternative; boundary="000000000000f20db8058dffdb81" --000000000000f20db8058dffdb81 Content-Type: text/plain; charset="UTF-8" In my view, the data you cite indicates the opposite of your inference. 1. This action is being taken in the absence of DoH, which is not currently deployed. The fact that this has been publicly planned since at least 2015, and is occurring now despite no significant deployment of DoH, suggests that this action is not motivated by DoH. 2. This action is not being used to implement "filtering". The attack is passive. 3. The current known forged certificate (*.facebook.com) is not relevant to DNS-based filtering or surveillance. facebook.com can easily be "filtered" by IP address, and its subdomains don't contain any information that is likely to be useful for surveillance (unlike, say, wordpress.com). 4. Anyone who can mount such an attack on facebook.com could have blocked access without creating the forged certificate. The existence of the forged certificate indicates that blocking access is not the primary motivation. 5. The only reason to construct a forged certificate for facebook.com is to surveil the content of citizens' interactions via Facebook, and perhaps to implement selective filtering based on that content. DNS, regardless of transport, has little relevance to this class of attacks on HTTPS. >From these observations, it's clear to me that emphasizing DoT over DoH, or even abandoning DNS privacy altogether, would _not_ have had any effect on this attack. More broadly, this is a reminder that backing away from DoH will not appease actors who desire MITM capability. On Thu, Jul 18, 2019 at 10:24 PM dagon wrote: > One consequence predicted by DoH critics was that DoH motivates the > large-scale installation of tcp/443 MiTM devices. That is, if DoH > diminishes the ability of networks to use existing DNS-based > filtration systems, operators will simply move from udp/53 filtration > to tcp/443. > > (And, because of increased deployment of TLS 1.3, they will simply > force the installation of MiTM CAs; and further, the class of networks > enforcing this requirement will be immune to cost pressures, or make > use of sovereign powers; and further this will happen first in > countries already prone to monitoring; and further this moves users > from an "opt-out" situation in DNS-based filtering (where changing > their DNS settings evades many filters), to a mandatory surveillance > network under tcp/443, etc., so DoT provides a better trade off, etc. > Many of these points are in the add@ list history or even predate the > list.) > > This predicted trend is taking place in industry. But have > governments also turned to mass tcp/443 interception? > > This report seems relevant to that question, noting that all end-users > of all network providers in Kazakhstan were required to install a > government-issued CA in every browser: > > https://bugzilla.mozilla.org/show_bug.cgi?id=1567114 > https://i.imgur.com/WyKjOug.jpg > https://i.imgur.com/rFEjXKw.jpg > > There is yet no report of a MiTM CA for known DoH servers, but one can > download the certificate here: > > http://qca.kz/qazca.{cer, pem, der} > > which can assist local researchers in monitoring for likely DoH > session interceptions. > > This development might be relevant to those able to attend IETF > 105/Montreal. > > -- > David Dagon > dagon@sudo.sh > "The single raindrop never feels responsible for the flood." > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000f20db8058dffdb81 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
In my view, the data you cite indicates the opposite of yo= ur inference.

1. This action is being taken in the absen= ce of DoH, which is not currently deployed.=C2=A0 The fact that this has be= en publicly planned since at least 2015, and is occurring now despite no si= gnificant deployment of DoH, suggests that this action is not motivated by = DoH.
2. This action is not being used to implement "filterin= g".=C2=A0 The attack is passive.
3. The current known forged= certificate (*.facebook.com) is not re= levant to DNS-based filtering or surveillance.=C2=A0 facebook.com can easily be "filtered" by IP address= , and its subdomains don't contain any information that is likely to be= useful for surveillance (unlike, say, wor= dpress.com).
4. Anyone who can mount such an attack on facebook.com could have blocked access withou= t creating the forged certificate.=C2=A0 The existence of the forged=C2=A0c= ertificate indicates that blocking access is not the primary motivation.
5. The only reason to construct a forged certificate for facebook.com is to surveil the content of citizen= s' interactions via Facebook, and perhaps to implement selective filter= ing based on that content.=C2=A0 DNS, regardless of transport, has little r= elevance to this class of attacks on HTTPS.

From t= hese observations, it's clear to me that emphasizing DoT over DoH, or e= ven abandoning DNS privacy altogether, would _not_ have had any effect on t= his attack.=C2=A0 More broadly, this is a reminder that backing away from D= oH will not appease actors who desire MITM capability.

On Thu, Jul 18,= 2019 at 10:24 PM dagon <dagon@sudo.sh> wrote:
One consequence predicted by DoH criti= cs was that DoH motivates the
large-scale installation of tcp/443 MiTM devices.=C2=A0 That is, if DoH
diminishes the ability of networks to use existing DNS-based
filtration systems, operators will simply move from udp/53 filtration
to tcp/443.

(And, because of increased deployment of TLS 1.3, they will simply
force the installation of MiTM CAs; and further, the class of networks
enforcing this requirement will be immune to cost pressures, or make
use of sovereign powers; and further this will happen first in
countries already prone to monitoring; and further this moves users
from an "opt-out" situation in DNS-based filtering (where changin= g
their DNS settings evades many filters), to a mandatory surveillance
network under tcp/443, etc., so DoT provides a better trade off, etc.
Many of these points are in the add@ list history or even predate the
list.)

This predicted trend is taking place in industry.=C2=A0 But have
governments also turned to mass tcp/443 interception?

This report seems relevant to that question, noting that all end-users
of all network providers in Kazakhstan were required to install a
government-issued CA in every browser:

=C2=A0 =C2=A0https://bugzilla.mozilla.org/show= _bug.cgi?id=3D1567114
=C2=A0 =C2=A0https://i.imgur.com/WyKjOug.jpg
=C2=A0 =C2=A0https://i.imgur.com/rFEjXKw.jpg

There is yet no report of a MiTM CA for known DoH servers, but one can
download the certificate here:

=C2=A0 =C2=A0http://qca.kz/qazca.{cer, pem, der}

which can assist local researchers in monitoring for likely DoH
session interceptions.

This development might be relevant to those able to attend IETF
105/Montreal.

--
David Dagon
dagon@sudo.sh
"The single raindrop never feels responsible for the flood."

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000f20db8058dffdb81-- --000000000000fb6926058dffdb28 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCDj+88lTgIgN6t8EL43ej3X AO6YfaxaXP5qYekRqsSmHjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA3MTkwMjU1MzBaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAWSJX6fpG0A++rUbZpjVDXukgVmFu0b2HMs7wVSP6 ZlmTsnqlbhBNGxw1gAgrbQRgsqRxA3tXEAj7FvzKhRyMjj/Ex66PsSwC2NkFpnldppia4PurGuDB +bXpKjPK65VmoPgZ+Cu2DDMedEm2+LTy5skdHpbIXjdT5Sr6bZ/j3w8adyliUnuiL4pmo4qUBgZ0 ibQxyjHpL6LP23QG8tyTvF1sl6a14UYhEZzx0o7Ed9BsQTc6L/O9qJSGRgE2fibcjsMzf6puAR+S kTvyQAijM+wI9xxhyO2gMrzRRapilM0ZNHHQfCtEfDxJJMyrWL65W54cE59JyRhST3I3tbD6/g== --000000000000fb6926058dffdb28-- From nobody Thu Jul 18 21:26:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E9791200F7 for ; Thu, 18 Jul 2019 21:26:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=iseclab.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pGqDSn0s3TBw for ; Thu, 18 Jul 2019 21:26:45 -0700 (PDT) Received: from mail-pf1-x42e.google.com (mail-pf1-x42e.google.com [IPv6:2607:f8b0:4864:20::42e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0391A120043 for ; Thu, 18 Jul 2019 21:26:45 -0700 (PDT) Received: by mail-pf1-x42e.google.com with SMTP id m30so13595718pff.8 for ; Thu, 18 Jul 2019 21:26:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iseclab.org; s=mail; h=content-transfer-encoding:from:mime-version:subject:message-id:date :to:cc; bh=ScT9VsQbnaqDjxsE7l363Hj6HEtOvfUL5w4Oq9JNXsk=; b=OhjD20I+mf5gx87Z5f/PbAvJ/z3GQvabOkZsPpcgVR/2/ThvjUHI2xjiMIlwNl79Oq TW5R+oFLtLhspNR5f0I9RiYVQHW4FXi3ESHNJlo0zA0BpiFWfJML3+BO9vpb7rTSmj0m v5S0eKBzW+i7qtbgkcvVomZF/arByuskXMKCX4y2I0uzAUtZ7NU8nGb1pfhfa1jv+Btq 8nnHsVmNqoZ2xmZlpBc+Ke4BiHcxHmRh5h7qaT+i5HUbmMpxsfwv6sCDF1T00pchanou 5pa6gks92nk+w9YmQ47kwmeF6+RnScbTb+T6yA7DDYMcG4d2TGJnzbMJdEvwO+MZEbEv Cp3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:message-id:date:to:cc; bh=ScT9VsQbnaqDjxsE7l363Hj6HEtOvfUL5w4Oq9JNXsk=; b=PLzQdpeTAKDTyXfUT9hcmQLQVXwellLPDRyD5qg6ORbg38v5QEd4LhyMEyerGThPkL YcHWyBxSZm0L5W3IwmSId0Z9pf3U/6cINrRCxgH1B8wYZmS7cGLVXozhAn+xIXUxId4u O6A/I5BE29A5H2ogyLREqXcZHgS8yD3npjgLq9azQc8jArUlpdIVdoEMKUoYZsqXb28v MBLjPbhvrnbJ4ppFm/Ukwbk68sGz2vo4jEgc2lFwPfokdDrM7cGuLsRpwvGUmz1YGf90 dUxHQ18yGiFRtz8g5WbWWQvHUmdodHMspV6qys6Fbr1Z/aUyCoFnHWZNtzNd2lkA5NWL vSbQ== X-Gm-Message-State: APjAAAVLrpvN/GYatMjTf1fovKXBJ4S0Z7EkzmrwNco7fWZW/gmNV7Kk gCYPhYQp5NmutnPZMmAsNKyzSA== X-Google-Smtp-Source: APXvYqxTBaCz80lDt8Z/rdGjc8G5U9SJUgrIMc6rSzb7LQjAuY32NG/Z0c5Ef/HFaCbxT2hnsS6VpA== X-Received: by 2002:a17:90a:9488:: with SMTP id s8mr56686761pjo.2.1563510404305; Thu, 18 Jul 2019 21:26:44 -0700 (PDT) Received: from [192.168.201.137] ([103.23.203.130]) by smtp.gmail.com with ESMTPSA id g8sm14941328pgk.1.2019.07.18.21.26.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 Jul 2019 21:26:43 -0700 (PDT) Content-Transfer-Encoding: 7bit Content-Type: multipart/alternative; boundary=Apple-Mail-3C754381-F640-4A14-A8C3-6A4C1CC9341B From: Kevin Borgolte Mime-Version: 1.0 (1.0) Message-Id: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> Date: Fri, 19 Jul 2019 12:26:40 +0800 To: add@ietf.org, doh@ietf.org, dnsop@ietf.org, dprive@ietf.org Cc: feamster@uchicago.edu, pschmitt@cs.princeton.edu, jordanah@princeton.edu, ahounsel@cs.princeton.edu X-Mailer: iPad Mail (16F203) Archived-At: Subject: [Add] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 04:26:48 -0000 --Apple-Mail-3C754381-F640-4A14-A8C3-6A4C1CC9341B Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi all, we recently did a study on Do53/DoT/DoH performance on webpage load times in= Firefox, which we wanted to share with you. Austin Hounsel will give a talk= about our work at ANRW on Monday. Paul Schmitt and I will also be around (m= yself only Monday afternoon and Tuesday) if you=E2=80=99d like to chat about= it in person. The extended pre-print of our paper is available here: https:= //arxiv.org/abs/1907.08089 We looked at the effect of Do53/DoT/DoH on page load times because we figure= d they will be a more interesting measure than simple DNS resolution times. W= e also looked at simulated mobile connections (4G, lossy 4G, and 3G). We fou= nd that DoH is on par with Do53/DoT if your Internet connection is good, and= worse if it is not. The potential for DoH seems to be largely push. ADD can= also make sense, or at least an extended/updated OS API would. We think there are two opportunities to improve Do53 and DoT: better wire fo= rmat caching and partial responses combined with multiple questions. Part of= the improvements and issues we discovered we later found out (by talking to= some of you) were mentioned in early working group drafts, but they never m= ade it into published RFCs or mailing list posts (which is where we looked i= nitially). We hope you can help and explain the thoughts that went into thes= e decisions 15 to 20 years ago. Maybe it even makes sense to revisit the ide= as from back then combined with our ideas, considering how the Internet has e= volved? We=E2=80=98d appreciate any feedback on our work. Please also feel free to r= each out to us directly (in person or by email) if you have any insight or f= eedback you=E2=80=99d prefer not to post to the list. Best, Kevin P.S. Please excuse the posting to multiple lists, but all seem relevant. --Apple-Mail-3C754381-F640-4A14-A8C3-6A4C1CC9341B Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Hi all,

we recently did a study on Do53/DoT/DoH= performance on webpage load times in Firefox, which we wanted to share with= you. Austin Houns= el will give a talk about our work at ANRW on Monday. Paul Schmitt and I wil= l also be around (myself only Monday afternoon and Tuesday) if you=E2=80=99d= like to chat about it in person. The extended pre-print of our paper i= s available here: https://= arxiv.org/abs/1907.08089

We looked at th= e effect of Do53/DoT/DoH on page load times because we figured they will be a= more interesting measure than simple DNS resolution times. We also looked a= t simulated mobile connections (4G, lossy 4G, and 3G). We found that DoH is o= n par with Do53/DoT if your Internet connection is good, and worse if it is n= ot. The potential for DoH seems to be largely push. ADD can also make sense,= or at least an extended/updated OS API would.

We t= hink there are two opportunities to improve Do53 and DoT: better wire format= caching and partial responses combined with multiple questions. Part of the= improvements and issues we discovered we later found out (by talking to som= e of you) were mentioned in early working group drafts, but they never made i= t into published RFCs or mailing list posts (which is where we looked initia= lly). We hope you can help and explain the thoughts that went into these dec= isions 15 to 20 years ago. Maybe it even makes sense to revisit the ideas fr= om back then combined with our ideas, considering how the Internet has evolv= ed?

We=E2=80=98d appreciate any feedback on ou= r work. Please also feel free to reach out to us directly (in person or by e= mail) if you have any insight or feedback you=E2=80=99d prefer not to post t= o the list.

Best,
Kevin
<= div>
P.S. Please excuse the posting to multiple lists, but all= seem relevant.
= --Apple-Mail-3C754381-F640-4A14-A8C3-6A4C1CC9341B-- From nobody Thu Jul 18 22:10:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C527F1200FB; Thu, 18 Jul 2019 22:10:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ezbShB4T79Vh; Thu, 18 Jul 2019 22:10:47 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04C2D1200D7; Thu, 18 Jul 2019 22:10:47 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id e20so25514136iob.9; Thu, 18 Jul 2019 22:10:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CSY1YQBkkq6H5Mqa4MdnQ7Usv0j4t0JcuYg7CEHMiJQ=; b=shEXJgfu8WkCQigzFfhrafHLgUhQzS/HJ92343a/jv6UTYEl72cFa/+vOrs2LLq+yE fO446MoCQukeRW8Jb0G3D38FiqnGV+y5Ep4sRle4GbqOlNv69YZLBV2f/D2aU64AvZS5 YzZS5sI9T7RUrr49nvM8iHnOXENCeQDnr02T35zTFbIgLuADMmH8lLQBOtQFcK5W3H4o UA0OBWHpUj+YGvFutax8VDcujLQZbKEQT9x+g/Ed3oo1nLDVJjWuxYwDN9JX+0ulvuHK 7HUTgX2RXyIN5V57NnJeVS0FnVTC7RB9bXn3j9vsAgCoHNVgbsb7Sh8FMIt3qEjFYnIR eg0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CSY1YQBkkq6H5Mqa4MdnQ7Usv0j4t0JcuYg7CEHMiJQ=; b=R7Gu0Z3CIAQq/N0fxP99nAY5ASXkoI21jbcOeK1VVKSa+senTX8zAGViwq+iOk2Wdx d3cblcgTb6OreBhOMIbTkNCKPYM1fHZffQ1RARe1I9ZVxYO8WFLDPEQxnOXxgBoFq++g q3wRdNbTBFMcjiPZSnZfr409jglRq9jDVwyNNqKHzA0wf7NjcyLDFdqFLzk61ogiy6wG axTyee99G0vknV8gPaCDE9NontDit0E/5Un0Hu7Xu2yqeTUGQvu0wpJ27xyF2rxQbRQr l114gB2XAxrMlz8x/zocklHhBAKpkgoNeBcRoXtfCeqfiBv5Ngjj/8XGzGuRm8jK0w0q JqSg== X-Gm-Message-State: APjAAAXxBjaOmpUhJc9G8x3PDhkGM48VVEVONr8zjNC09BAHgTABow1n 8w4mMUlMWGLc1znZXOziFD76gLGuJN/dPHnewqI= X-Google-Smtp-Source: APXvYqw+9R+nI8XfhWAr2ZckccS7OO4V6B+LKTVnXZDm1JuqCI4Iwx8tTXoeUd6BeYnlJ7u2zjfaNxoSxubBtpxSAaw= X-Received: by 2002:a02:1087:: with SMTP id 129mr55454362jay.131.1563513046131; Thu, 18 Jul 2019 22:10:46 -0700 (PDT) MIME-Version: 1.0 References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> In-Reply-To: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> From: Rob Sayre Date: Thu, 18 Jul 2019 22:10:34 -0700 Message-ID: To: Kevin Borgolte Cc: add@ietf.org, doh@ietf.org, dnsop WG , dprive@ietf.org, jordanah@princeton.edu, pschmitt@cs.princeton.edu, ahounsel@cs.princeton.edu, feamster@uchicago.edu Content-Type: multipart/alternative; boundary="000000000000b76903058e01bf50" Archived-At: Subject: Re: [Add] [DNSOP] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 05:10:49 -0000 --000000000000b76903058e01bf50 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Jul 18, 2019 at 9:27 PM Kevin Borgolte wrote: > We=E2=80=98d appreciate any feedback on our work. Please also feel free t= o reach > out to us directly (in person or by email) if you have any insight or > feedback you=E2=80=99d prefer not to post to the list. > This paper looks interesting. Is the software used in the paper published? Or, at least, is the test page set published? I haven't read the whole thing yet, but it seems like the page set would be relevant if the paper tests page load time. thanks, Rob --000000000000b76903058e01bf50 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Jul 18, 2019 at 9:27 PM Kevin Bor= golte <kevin@iseclab.org> wr= ote:
We=E2=80=98d a= ppreciate any feedback on our work. Please also feel free to reach out to u= s directly (in person or by email) if you have any insight or feedback you= =E2=80=99d prefer not to post to the list.

This paper looks interesting. Is the software used = in the paper published?

Or, at least, is the test = page set published? I haven't read the whole thing yet, but it seems li= ke the page set would be relevant if the paper tests page load time.
<= div>
thanks,
Rob
--000000000000b76903058e01bf50-- From nobody Thu Jul 18 22:17:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E47F71200FB for ; Thu, 18 Jul 2019 22:17:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LIZw1nUs9jpQ for ; Thu, 18 Jul 2019 22:17:16 -0700 (PDT) Received: from mail.hardakers.net (mail.hardakers.net [168.150.192.181]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C5788120043 for ; Thu, 18 Jul 2019 22:17:16 -0700 (PDT) Received: from localhost (unknown [10.0.0.3]) by mail.hardakers.net (Postfix) with ESMTPA id 3182C28F0C; Thu, 18 Jul 2019 22:17:16 -0700 (PDT) From: Wes Hardaker To: Ben Schwartz Cc: dagon , add@ietf.org References: <20190719022420.GA26335@sudo.sh> Date: Thu, 18 Jul 2019 22:17:16 -0700 In-Reply-To: (Ben Schwartz's message of "Thu, 18 Jul 2019 22:55:18 -0400") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Add] FYI: MiTM growth, post DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 05:17:18 -0000 Ben Schwartz writes: > 3. The current known forged certificate (*.facebook.com) is not relevant = to DNS-based > filtering or surveillance.=C2=A0 facebook.com can easily be "filtered" by= IP address, and > its subdomains don't contain any information that is likely to be useful = for > surveillance (unlike, say, wordpress.com). As a reminder, a large number of DoH proponents believe the best model of deployment is one where the DoH server also lies within the unfilterable address ranges of major content providers (cloudflare, akamai, AWS, DO, etc). You're right that this may not affect facebook, unless they shift to a cloud provider's address spaces that also house a DoH server. (or, maybe, governments will really really put their foot down and block cloud provider addresses, breaking many sites that current rely on centralized services) --=20 Wes Hardaker USC/ISI From nobody Thu Jul 18 22:42:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E3C012013D for ; Thu, 18 Jul 2019 22:42:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.594 X-Spam-Level: * X-Spam-Status: No, score=1.594 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DRUGS_ERECTILE=1.994, GB_PHARMACY=1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URI_HEX=0.1, URI_NOVOWEL=0.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=iseclab.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FLSR7oRDrvVU for ; Thu, 18 Jul 2019 22:42:31 -0700 (PDT) Received: from mail-pl1-x62b.google.com (mail-pl1-x62b.google.com [IPv6:2607:f8b0:4864:20::62b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E23912013B for ; Thu, 18 Jul 2019 22:42:31 -0700 (PDT) Received: by mail-pl1-x62b.google.com with SMTP id az7so15045977plb.5 for ; Thu, 18 Jul 2019 22:42:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iseclab.org; s=mail; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=oT1vYbJHA7eaM3O0BJjvf8OIUVUsjSlbeMghXKKbsyM=; b=hS01SjC5qeJ6dNegaphsZZxOikVc4AYjqRuvOVHB+y+aX+xiNq0vdIxQ/H/sL4HDsZ iK3rkgoPyADIBcqyKj45MGx0Q/pUJnwTyNyg69Oqishv4yKLeFQhJU2gqSzGtGeyG9Zy pDEsNU1Xz/XREVe+uxlKFPD/9VxAuSpH3l2LN7jmvwaaRJQJUu4btSt3Zy8newVLVujk D6BuZ3MUaiETBww9UBOJsgs5BZBj6uIzP5IhiRDvrboccxgjXJruuGP0QMpT8UySgwLk MC2DzbYdwRtKqqZmeQch3rw5m8WdDB1rhaRNVUctuUrHEog1cFUXDBta63bzRDy8I/PS +mGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=oT1vYbJHA7eaM3O0BJjvf8OIUVUsjSlbeMghXKKbsyM=; b=XoUwEdrxrwG3e9KiM8HC4ZNK2D2DVdYrSl6nc3ZcumsbBydY5UXrFaj/1hmnYU+U4f taM0EDJ7izFEEndNFA4fzOebD701dw2rUYfM1ZzTQiFi3M6Bh59/plxSgWS3EW+4lAch OQDK7l07O72ipLtooA7q+879JjTtighLH1xBOijk384NAgchb9NNEKv+m2R3geLbzpAE diA4zTyWcR0ZjRrOkMgAW91XpIIVFmYJNhMVnd2XbWJRlwytosZsg91jogKwRN3M5Ygv X+MdN/aQQ6zjNKliPZ/t2jeEIoQeuYQqeY3IFE9HNLncPLDsE+fFhKVXUcxw7QIkANDE BypA== X-Gm-Message-State: APjAAAVDiQLY/8cZ1f+L8ab95CoSs5MdBZBhGwozXAPwG82tA/pATtNg kOAigktmF2OGqelfgdpk/9OWjw== X-Google-Smtp-Source: APXvYqxDgg/7NhS4samC3BiFT+VQYMw1HCa8v+Px6N/xPcPhWUlsAkyiGrooeXoQvhlFoh1gg0aVJw== X-Received: by 2002:a17:902:4643:: with SMTP id o61mr26881481pld.101.1563514950776; Thu, 18 Jul 2019 22:42:30 -0700 (PDT) Received: from [192.168.205.139] ([103.23.203.130]) by smtp.gmail.com with ESMTPSA id m4sm56270283pff.108.2019.07.18.22.42.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 Jul 2019 22:42:30 -0700 (PDT) From: Kevin Borgolte Message-Id: <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> Content-Type: multipart/mixed; boundary="Apple-Mail=_62BF672C-84D7-448F-BD03-FB7010D05E14" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 19 Jul 2019 13:42:26 +0800 In-Reply-To: Cc: add@ietf.org, DoH WG , dnsop WG , jordanah@princeton.edu, pschmitt@cs.princeton.edu, ahounsel@cs.princeton.edu, feamster@uchicago.edu, dns-privacy@ietf.org To: Rob Sayre References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [DNSOP] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 05:42:36 -0000 --Apple-Mail=_62BF672C-84D7-448F-BD03-FB7010D05E14 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > This paper looks interesting. Is the software used in the paper = published? Thanks! The code isn=E2=80=99t open source yet, but we will make it = public alongside the Docker setup we used for running it. Not sure when = that is going to happen exactly though. > Or, at least, is the test page set published? I haven't read the whole = thing yet, but it seems like the page set would be relevant if the paper = tests page load time. The list of websites is attached. It is extracted from the top 1,000 and = 99,000 to 100,000 of a Tranco list. Best, Kevin --Apple-Mail=_62BF672C-84D7-448F-BD03-FB7010D05E14 Content-Disposition: attachment; filename=tranco_combined.txt Content-Type: text/plain; x-unix-mode=0644; name="tranco_combined.txt" Content-Transfer-Encoding: 7bit google.com facebook.com youtube.com netflix.com microsoft.com twitter.com wikipedia.org baidu.com yahoo.com linkedin.com instagram.com amazon.com qq.com apple.com live.com msn.com pinterest.com tmall.com bing.com taobao.com reddit.com adobe.com doubleclick.net blogspot.com sohu.com yelp.com wordpress.com vk.com vimeo.com youtu.be yandex.ru weibo.com jd.com amazonaws.com sina.com.cn github.com google-analytics.com ebay.com googletagmanager.com goo.gl googleusercontent.com 360.cn t.co tumblr.com paypal.com godaddy.com nytimes.com mozilla.org bit.ly twitch.tv imgur.com dailymotion.com people.com yahoo.co.jp wordpress.org imdb.com microsoftonline.com fandom.com mail.ru dropbox.com flickr.com pornhub.com quizlet.com fbcdn.net porn555.com office.com buzzfeed.com go.com aliexpress.com skype.com soundcloud.com google.co.in nflxso.net stackexchange.com gravatar.com bbc.co.uk nih.gov stackoverflow.com cnn.com w3.org csdn.net livejasmin.com alipay.com sourceforge.net icloud.com whatsapp.com apache.org googlesyndication.com akamaiedge.net naver.com theguardian.com urbandictionary.com google.com.hk europa.eu digicert.com tribunnews.com ytimg.com amazon.co.jp bilibili.com slideshare.net weebly.com googleadservices.com msedge.net xvideos.com xinhuanet.com archive.org google.de forbes.com bbc.com office365.com medium.com google.co.jp aol.com 163.com spotify.com php.net booking.com craigslist.org xhamster.com glassdoor.com thehill.com hulu.com amazon.co.uk ok.ru nflximg.com tinyurl.com oracle.com virginmedia.com google.com.br quora.com issuu.com google.co.uk cnet.com hp.com creativecommons.org wikimedia.org google.ru gizmodo.com amazon.de google.fr bustle.com github.io akadns.net dailymail.co.uk goodreads.com cnbc.com reuters.com deviantart.com legacy.com wsj.com giphy.com washingtonpost.com wixsite.com wikia.com gnu.org espn.com wix.com softonic.com walmart.com google.it hao123.com addthis.com whitepages.com exosrv.com huffingtonpost.com researchgate.net mit.edu etsy.com amazon.in blogger.com soso.com weather.com bloomberg.com popads.net wp.com google.es sciencedirect.com ranker.com wellsfargo.com harvard.edu facebook.net gamespot.com opera.com so.com ibm.com instructure.com t-online.de windows.net medicalnewstoday.com babytree.com ggpht.com intuit.com stanford.edu zhihu.com rakuten.co.jp cloudflare.com scribd.com tripadvisor.com pixnet.net theverge.com wired.com tianya.cn telegraph.co.uk aparat.com livejournal.com usatoday.com okezone.com youku.com myspace.com force.com eventbrite.com thestartmagazine.com businessinsider.com scorecardresearch.com douban.com googlevideo.com detik.com gfycat.com chase.com alibaba.com groupon.com fc2.com xnxx.com samsung.com mysql.com nasa.gov zillow.com roblox.com slate.com twimg.com ettoday.net indeed.com hugedomains.com salesforce.com surveymonkey.com eonline.com lifehacker.com nicovideo.jp iqiyi.com macromedia.com wiley.com buzzfeednews.com google.cn cpanel.net politico.com outlook.com crashlytics.com mediafire.com free.fr googletagservices.com npr.org indiatimes.com apple-dns.net onlinesbi.com timeanddate.com adnxs.com discordapp.com vice.com google.ca debian.org google.com.mx windows.com list-manage.com cdc.gov time.com cnblogs.com gmw.cn wikihow.com youtube-nocookie.com foxnews.com w3schools.com nature.com steamcommunity.com drudgereport.com ebay.de cpanel.com duckduckgo.com amazon-adsystem.com webmd.com ebay.co.uk jimdo.com steampowered.com ask.com who.int globo.com latimes.com ted.com marriott.com springer.com bankofamerica.com statcounter.com aaplimg.com panda.tv cloudfront.net uol.com.br kickstarter.com behance.net newyorker.com cheatsheet.com avito.ru irs.gov bongacams.com techcrunch.com state.gov about.com dell.com myshopify.com daum.net mailchimp.com android.com openload.co taboola.com 1688.com ca.gov un.org variety.com themeforest.net adp.com shopify.com shutterstock.com berkeley.edu bukalapak.com independent.co.uk windowsupdate.com vox.com demdex.net digg.com zhanqi.tv google.com.tr patch.com sogou.com www.gov.uk 45eijvhgj2.com ups.com ifeng.com slack.com chaturbate.com 2mdn.net patreon.com moatads.com cbsnews.com pinimg.com nationalgeographic.com onenote.net mega.nz dolohen.com china.com.cn ikea.com akamaihd.net google.com.tw txxx.com ntp.org rubiconproject.com adsrvr.org snopes.com feedburner.com amazon.fr gmail.com squarespace.com engadget.com wattpad.com cornell.edu mashable.com zendesk.com washington.edu canva.com app-measurement.com otvfoco.com.br wetransfer.com trello.com caijing.com.cn rollingstone.com ea.com thekitchn.com intel.com cdninstagram.com bandcamp.com academia.edu cisco.com mercadolivre.com.br msftncsi.com stumbleupon.com loc.gov redd.it usps.com messenger.com typepad.com hola.org douyu.com disqus.com nginx.org addtoany.com huanqiu.com ietf.org savefrom.net twentytwowords.com rt.com google.pl pbs.org criteo.com bet9ja.com metropcs.mobi theroot.com pki.goog flipkart.com pubmatic.com sfgate.com box.com usnews.com udemy.com eastday.com sitemaps.org advertising.com airbnb.com sharepoint.com akamai.net aliyun.com zoom.us line.me amazon.it openx.net freepik.com webs.com spanishdict.com tokopedia.com 247sports.com mapquest.com spankbang.com outbrain.com playstation.com deadspin.com kotaku.com gvt2.com cambridge.org americanexpress.com ft.com washingtonexaminer.com google.com.au change.org rlcdn.com arstechnica.com thoughtcatalog.com bluekai.com casalemedia.com amzn.to talktalk.co.uk yts.am speedtest.net evernote.com launchpad.net jianshu.com jalopnik.com avclub.com symantec.com arnebrachhold.de accuweather.com akamaized.net bestbuy.com finance101.com xfinity.com thepiratebay.org dailycaller.com wiktionary.org polygon.com umich.edu radio.com snapchat.com digikala.com onlinevideoconverter.com bodelen.com photobucket.com britannica.com att.com princeton.edu mathtag.com chinadaily.com.cn nickiswift.com pixabay.com expedia.com tripod.com economist.com psychologytoday.com gamepedia.com cbs.com meetup.com noaa.gov psu.edu google.co.kr mozilla.com wunderground.com verizon.com rambler.ru amazon.ca cobalten.com theatlantic.com fidelity.com kayak.com youm7.com fb.com dropcatch.com nike.com google.co.id geocities.com cbssports.com google.com.ar everesttech.net agkn.com google.com.sa bitly.com google.co.th mercurynews.com target.com quantserve.com bidswitch.net google.com.eg guardian.co.uk doi.org elsevier.com cbc.ca rednet.cn amazon.es columbia.edu us.com ameblo.jp didna.io sun.com oath.com 49oa3o49b6.com hilton.com nbcnews.com youporn.com southwest.com okta.com healthline.com jquery.com blackboard.com city-data.com myway.com ign.com mentalfloss.com khanacademy.org worldlifestyle.com tapad.com primevideo.com abs-cbn.com nginx.com doublepimp.com fedex.com kompas.com chicagotribune.com getpocket.com usda.gov constantcontact.com lifewire.com abc.net.au ed.gov prnewswire.com zdnet.com whitehouse.gov howtogeek.com univision.com avast.com fda.gov ieee.org grammarly.com livedoor.jp prezi.com genius.com beian.gov.cn ebay-kleinanzeigen.de ndtv.com hubspot.com hotstar.com hollywoodreporter.com adsafeprotected.com spiegel.de kinopoisk.ru westernjournal.com tandfonline.com krxd.net sbnation.com eepurl.com consumerreports.org refinery29.com yale.edu nba.com breitbart.com kakaku.com gearbest.com upenn.edu amazon.cn axs.com newrelic.com zoho.com fortune.com teamviewer.com wisc.edu fiverr.com sciencemag.org marketwatch.com thechive.com elpais.com zol.com.cn altervista.org example.com thefreedictionary.com instructables.com akismet.com liputan6.com mirror.co.uk trend-chaser.com google.com.ua yy.com sindonews.com bet365.com asus.com whatsapp.net redfin.com comicbook.com ajc.com hotels.com adform.net unsplash.com yimg.com oreilly.com patria.org.ve ucla.edu allegro.pl imore.com fastcompany.com capitalone.com merriam-webster.com history.com sagepub.com epicgames.com toutiao.com 1337x.to mayoclinic.org uproxx.com redhat.com knowledgedish.com ampproject.org 9gag.com livedoor.com utexas.edu tistory.com nvidia.com fastly.net uci.edu epa.gov youdao.com foursquare.com reverso.net pixiv.net unesco.org startribune.com nypost.com umn.edu purdue.edu weather.gov vanityfair.com chegg.com nbcsports.com wordreference.com gamersky.com op.gg browsergames2018.com androidcentral.com comodoca.com rutracker.org barnesandnoble.com asos.com oup.com thesaurus.com turn.com varzesh3.com parallels.com over-blog.com t.me ladbible.com gofundme.com theonion.com jezebel.com 3dmgame.com domainmarket.com ow.ly msftconnecttest.com homedepot.com ox.ac.uk opendns.com dribbble.com nps.gov denverpost.com icepop.com webex.com howstuffworks.com news-speaker.com tmz.com blogspot.co.uk orange.fr indiegogo.com jrj.com.cn criteo.net uk.com zippyshare.com hatenablog.com news.com.au businesswire.com overstock.com goo.ne.jp sciencedaily.com autodesk.com adsymptotic.com google.org crunchyroll.com jf71qh5v14.com tomshardware.com plesk.com lenovo.com cafemom.com exelator.com k618.cn namecheap.com feedly.com worldbank.org knowyourmeme.com iso.org chron.com bbb.org cbslocal.com ning.com drugs.com redtube.com cmu.edu uptodown.com doubleverify.com namnak.com citi.com cam.ac.uk discogs.com united.com entrepreneur.com crwdcntrl.net apnews.com qz.com zend.com imrworldwide.com express.co.uk chouftv.ma bootstrapcdn.com custhelp.com icio.us getawesome1.com dictionary.com uiuc.edu python.org dmm.co.jp ubuntu.com dotomi.com washingtontimes.com uchicago.edu upwork.com hbr.org ltn.com.tw vitals.com bizjournals.com sarkariresult.com edmunds.com inc.com imageshack.us ouo.io spotxchange.com uclaut.net rxlist.com verisign.com investopedia.com momoshop.com.tw w55c.net answers.com mlb.com joomla.org nyu.edu telegram.org cdstm.cn namu.wiki arxiv.org newsweek.com ultimate-guitar.com nydailynews.com theepochtimes.com mi.com nesn.com 17ok.com newegg.com netscape.com ria.ru rfihub.com shmoop.com illinois.edu elegantthemes.com scientificamerican.com hatena.ne.jp coursera.org angelfire.com mercadolibre.com.ar nflxvideo.net baike.com leagueoflegends.com trustpilot.com thekrazycouponlady.com dkn.tv exoclick.com usc.edu 51.la thoughtco.com cricbuzz.com sex.com dw.com dmv.org userapi.com bitbucket.org audible.com rarbg.to mookie1.com smh.com.au creditkarma.com ufl.edu pcworld.com livescience.com egy.best fb.me jstor.org hexun.com costco.com boston.com google.gr 51sole.com seattletimes.com spectrum.net networkadvertising.org nextdoor.com secureserver.net ssl-images-amazon.com qualtrics.com cctv.com envato.com foodnetwork.com kissanime.ru hdfcbank.com earthlink.net www.gov.cn sakura.ne.jp atlassian.net battle.net thesun.co.uk nutaku.net sciencealert.com umd.edu huawei.com atabencot.net onet.pl ustream.tv omtrdc.net truste.com rottentomatoes.com sputniknews.com brainly.com techradar.com letsencrypt.org repubblica.it clicktripz.com flightaware.com nbc.com serving-sys.com 3lift.com humparsi.com usgs.gov norton.com hclips.com duke.edu 1rx.io media.net bmj.com superuser.com ancestry.com rediff.com house.gov streamable.com aboutads.info cars.com vkontakte.ru ebates.com siteadvisor.com mixpanel.com alexa.com ny.gov marca.com liveleak.com hupu.com java.com vmware.com kaskus.co.id lemonde.fr hgtv.com miamiherald.com si.edu nr-data.net leboncoin.fr gstatic.com about.me wish.com cnki.net 2345.com msu.edu grid.id beenverified.com macrumors.com google.nl contextweb.com myanimelist.net littlethings.com kooora.com businessinsider.de ftc.gov oecd.org bodybuilding.com clickondetroit.com statista.com investing.com pastebin.com autotrader.com olx.ua study.com indoxxi.bz unc.edu hm.com directv.com staples.com alicdn.com wpengine.com mercadolibre.com.mx pexels.com walgreens.com google.com.pk searchencrypt.com live.net last.fm kohls.com ucsd.edu manoramaonline.com usaa.com smzdm.com visualstudio.com lowes.com ensonhaber.com phys.org pandora.com pikabu.ru mailchi.mp typeform.com souq.com slashdot.org lijit.com sky.com trulia.com nexusmods.com livestream.com digitaltrends.com nist.gov vogue.com umblr.com xbox.com bobshideout.com aarp.org friv.com chinanews.com nikkei.com google.co.ve nasdaq.com allaboutcookies.org wp.pl epicurious.com setn.com phpbb.com findagrave.com gotowebinar.com hellomagazine.com mercari.com sprint.com cvs.com bonappetit.com squareup.com tutorialspoint.com sitescout.com yourtango.com taleo.net termometropolitico.it themeisle.com okdiario.com yadi.sk pandorarecovery.com fiberone.com speechanddebate.org debugin.com com-repair-windows.live 51meishu.com breakit.se carjob.com.cn mondosonoro.com leicester.gov.uk lerepairedesmotards.com outfittrends.com campus-party.org netnevesht.com bankofgreece.gr hdreporn.com cafergot.company atipt.com puporn.com ayurvedapsychologie.at fenqile.com hplusmagazine.com niederschlagsradar.de coxnewsweb.com weddingwire.ca pbsa-benin.org islamquest.net yandexlauncher.com marqueerewards.com nibis.de zgswcn.com mirohost.net stationcaster.com nextjump.com symantecstore.com viahero.com repairpartsplus.com viagragenrdf.com vansirc.net gonola.com gzt.com do303.com mimer.com myvodafone.com.au erectionjaen.com guitarsite.com trt15.jus.br mybb2.ru anderson.edu mcdlv.net rebath.com timesofmoney.com fishforums.net blackfilm.com datafactory.la wiesbadener-kurier.de forabodiesonly.com bradfordtaxinstitute.com onemorething.nl cdn-image.com theexpertta.com kidshelpphone.ca jerseys.net.in kanbilibili.com pepabo.com games-4-free.com yavideoad.ru itsecure.co.in yournextshoes.com wolflair.com clkmein.com persona.ly powerelectronics.com personalbrandingblog.com dailycampus.com iowaworkforcedevelopment.gov bna.bh smarthinking.com nylaarp.com poweredbygps.com yamap.co.jp cddbp.net iaspassion.com servedbyopenx.com seoptimer.com mycslink.org designntrend.com contorion.de manga99.com mechnet.com.cn timesheets.com edgeboss.net novamovie.net aaahq.org imgprime.com oceanofgame.org astraone.io sethlui.com universalstudiosentertainment.com usn.no sett.com surveyh.com myclassboard.com intelligencesquaredus.org obyava.ua printbar.ru fabulousfox.com genlookups.com bonprix.cz odyclub.com cuddleclones.com themeegg.com indiaenvironmentportal.org.in ollusa.edu travelopod.com kino-dom.org riyasewana.com relyonhorror.com pushservice.info oracleinfinity.io appxigo.com laimanhua.com lxzwknybfvycxr.com online-billpay.com lightingsupply.com sprinklebakes.com zip-rar.com adhslx.com southernexposure.com treato.com nikeflightbonafide.us emergency.vic.gov.au linkt.com.au 54new.com homecontract.eu sakhamusic.ir humanhairextensions4u.com builtinaustin.com mychirotouch.com stratus.com qubes-os.org npo3fm.nl alldevotion.com reservecalifornia.com ja.org fit.pl apollohospitals.com resurva.com privatecams.com autowini.com 82190555.com krogerkrazy.com servientrega.com douglas.co.us mikemann.com canadapharmacyonlinefako.com softwarefreedom.org soccer-douga.com forex-gcc.com ruskino.ru dirxion.com midgardmc.org grands-meres.net branham.org flathub.org cdn7.com mobilehomesell.com landoverbaptist.org oglethorpe.edu paperfree.cn tarfandcity.com ydf-conference.com 12380.gov.cn spmag.ru bfanetempresas.ao bigagnes.com diadora.com maannews.com lead411.com mp3car.com centerforinquiry.net ferrybuildingmarketplace.com jornalcontabil.com.br parishcouncil.net enforex.com protezionecivile.gov.it jacksonpollock.org biosagentplus.com bijog.com gaspricewatch.com webtm.ru steko.com.ua yaani.ru huhot.com spinics.net docbaza.ru yandextrafik.com.tr mobilemaya.com onrealt.ru serialnet.pl blackboardconnect.com theriver.jp christ.de cleanclothes.org talkop.com chat-assistance.com informationbuilders.com mailinblack.com redditodicittadinanza.gov.it cnbz.gov.cn nzcity.co.nz streamload.com tipsyelves.com purehempbotanicals.com meemic.com hasfit.com antlabs.com enenews.com votingdad.com netdisaster.com xn--72c7calxf3czac9hd8gra.com floraadenium.com golfmagic.com probrewer.com insidebigdata.com hedwigbroadway.com slaveryfootprint.org ups.edu.ec pintsizedbaker.com funcionpublica.gov.co nsbank.com kipris.or.kr lapatria.com secureauth.com northernandshell.co.uk lee.edu go2yd.com gnu-darwin.org zonacero.com cheapwigsstore.com hiyobi.me dyndns.dk thompsontee.com usc.co.uk actes-sud.fr dcunited.com amcrestsecurity.com kaufland.bg matiscape.eu hongkongpost.com luz-image.net cozitv.com internettrafficreport.com kramerav.com consul.io 4put.ru adn.es bitseven.com halfclub.com railwire-unifi.in football-russia.tv rockit.it dronelife.com semcs.net yamart.ru breathehr.com notable-quotes.com triumphmotorcycles.co.uk equalitynow.org katzsdelicatessen.com dqydj.com shabbyfabrics.com mashhadhost.com techdifferences.com chicksaddlery.com rwbola.com bookmooch.com appgrowing.cn centralparkresort.hu eeagrants.org njatc.org superherostuff.com heenakhan.com caanet.org.cn southernglazers.com cvm.gov.br commandlinefu.com hostingcouponscodefree.com ncwc.edu qcode.us gtp-tabs.ru mp3indirco.info streetwisereports.com ace2three.com notquitenigella.com lu.ch civitekflorida.com bolterandchainsword.com letechs.com jerryjenkins.com joy.hu bigmailer.io miumiusunglasses.com 2gayboys.com baunetz.de yandex-launcher.com myemailsignin.net seriesfree.to jdmagicbox.com trainworld.com pieology.com lapumiafilmes.com ecomexpress.in pexopower.com ofwpinoytambayan.su ibm.biz drdo.res.in mrdelivery.com xn--82c0bxcybxc2b.com lamoda.by clubcar.com wylsa.com c21.com mfiles.co.uk toyota.com.tw tianfateng.cn phonefactor.net engelschall.com casinonextyear19.com freshpatents.com nudecelebvideo.net virginmedia.ie mhlnews.com apidog.ru ttrockstars.com nacionalloteria.com hct.com.tw century21.fr entercom.com cbr.nl radiotvcalabria.it lebron13.org fh-dortmund.de eliesaab.com nnedv.org ui-patterns.com ntn24america.com larepublica.net minostech.co.kr smiletrain.org clado.plus kgcha.com wrabote.ru redtube1.pro theredlist.com zhonga.ru petel.bg imgfast.net qm-search.com aulaclic.es tribune.gr allassignmenthelp.com mathematiquesfaciles.com sexneigung.com woomintech.com askthiswhen.com ibeinvestmentng.com icmbio.gov.br convenience.org momdot.com mathsgenie.co.uk dwds.de tcbmag.com indra.com matomesakura.com robotics.org kidsdomain.com edlioadmin.com onefinestay.com blognews.am dustinhome.se psywww.com kat-pwr.com croptrust.org betweennapsontheporch.net harrywinstonjewelrys.com dinsta.com haute-garonne.fr livecareer.co.uk mojewypieki.com mbt3th.us ehealthcaresolutions.com motorhome.com zoloft.team 90l6.com piapro.jp sdin.jp mff.gov.eg prepressure.com pelco.com urbansitter.com gotvafrica.com quizalize.com oneprojectcloser.com katalogmedik.ru thenailshop.ru georgepush.com midwayfinanceira.com.br e-vanguard.com kfc.me threenow.co.nz planeandpilotmag.com armysurplusworld.com bongino.com prostagenix.com roaring.earth evilmilk.com carmudi.co.id yikeyz.com bshwat.com streamsnooper.com mothercenter.info excite.es drivelan24.com getgirltofuck.net tickets-online.com tudohd.com iceland.is autoscout24.ru labelorchestra.fr interregeurope.eu gundamplanet.com mecd.es hqtlbsglscrju.com elsoft.vn powertochoose.org xxximagetpb.org smapp.work 24hours.me voyagela.com himmera.com alertlogic.com emagazine.com usccr.gov rightmoveanalytics.co.uk tianduntech.com calciomaglie.it musthavemom.com iiba.org wnbc.com bynorth.com qr.net asser.nl sunfood.com captureone.com wotpack.ru the-natural-method.com salamatnews.com multitheftauto.com softserialkey.com lifeglobe.net kpcnews.com torinotoday.it shabiba.com withlovefromkat.com dnsalias.org hpfanficarchive.com locoso.com 5euros.com auditude.com x-reviewer.com viettimes.vn gtaxmods.com renai.us reftagger.com toribash.com konsumentverket.se semmelweis.hu apages.net downloadnow.com linux-usb.org ist-budget.ru mlsdigital.net emailondeck.com sdjs.gov.cn jbjs.org fmtv.com caixabank.cat 1cros.net nikedunksb.us 73g509fk9a.com momat.go.jp ysts8.com altharawatgroup.com postdirect.com dogvacay.com synchronybusiness.com gwo.pl lkk-zkh.ru iyingdi.cn couples.com monsterfishkeepers.com lawfirms.com kita.net itninja.com irancook.ir viralize.tv campbellsoupcompany.com filterforge.com prima.co.uk vespa-classic-club-geneve.ch mybestruns.com movie-wiki.net breakingbourbon.com 505games.com rosenfeldmedia.com behavenet.com securegive.com yandexdatafactory.com 55printing.com ambientweather.com theupcoming.co.uk univesp.br ecigarettedirect.co.uk cadastre.gouv.fr pollotropical.com yummybazaar.com ingilizceyehazirlik.com lzo.com hbook.com providr.com shentai.org thematureporn.net kidssundayschool.com videoclub.men fmglobal.com condenaststore.com landezine.com turismocity.com.ar pub2srv.com hafryat.com anizm.tv lameuse.be theswiftcodes.com morningstarjp.com acceptiva.com freedomsphoenix.com talpanetwork.com pccppc.com everything-about-rving.com kidswithfoodallergies.org bikinisaletop.com manaus.am.gov.br amathsdictionaryforkids.com gls-online-filiale.de wolfandbadger.com malagahoy.es dsl.sk wealthyretirement.com theamericangenius.com widziecwiecej.pl prospectinfo.ru seattlerefined.com elsaltodiario.com yearbookordercenter.com aghanilyrics.com my5.tv jelasmi.com loopup.com retailwire.com itexts.net tcbresistencias.com appromoters.com ahaic.gov.cn yaodaojiao.com erogazopple.com 5pornovideo.net haaretzdaily.com n-gamer.nl wukongitxueyuan.com soccerbase.com heroeshearth.com gildan.com bagilagi.com kubota.co.jp 3dortgen.com whooosreading.org vocab.com ignatianspirituality.com alltech.com fg-a.com alldigitall.ir rsstop10.com everydayshouldbesaturday.com rewardit.com iosco.org nact.jp jisusaiche.com allcrafts.net surplustown.com kolobok.ua brno.cz zooplus.it higi.com hgmsites.net mfd.ru canadagoose--outlet.ca grooves-inc.com peakonsrv.com boredbutton.com myhuckleberry.com enterbrain.co.jp tusclasesparticulares.com abc64.ru dali.gov.cn treeofsavior.com digikam.org asubtlerevelry.com falkentire.com moparonlineparts.com addicted.org iett.istanbul suzuki.com ndhealth.gov letu.edu reviewability.com astrocal.co.uk alicili.ws teknoseyir.com ewe.de nau.edu.ua rmauctions.com techblog.tips huachengrubberbelt.com mypot.jp gwinnettcourts.com abbconcise.com photoshopsupport.com xxtube.pro thisisafrica.me fidf.org motoservices.com loft-prj.co.jp shimano-eu.com sportschaplains.org prodh.org timtales.com officialauthenticchiefsstore.com kestrelgames.com bloganchoi.com tomferry.com totalrl.com humanbrainproject.eu meghantelpner.com lindafarrowsunglasses.com rhombusads.com laregion.es neatoshop.com cripo.com.ua apcdns.com alk.com hybcomics.xyz deepburner.com zync.edu.cn japan-secure.com pollinator.org peterblum.com bdoplanner.com knoxschools.org cessna.com journalducameroun.com scoresport.live blazerforum.com quanben5.com cityofchesapeake.net shoes.net.cn nicepricefavors.com kommersant.ua tocka.com.mk beanstream.com thehundredsclothing.com ameviet.com haitou.cc dorsetforyou.gov.uk ucb.com girlg.com amazona.de videosexo.blog.br xxx99porn.com dansmovies.com once.es dulux.com.au zeel.com tomboyx.com genghisgrill.com georgiasown.org casece.com rb7url.net blitzresults.com yamahapartshouse.com yemen-now.com twitterstat.us ireland-calling.com 49ersjerseyshop.us pomoho.com isptec.co.ao choies.com texansjerseys.us bookstr.com videosmile.ru vegacdn.vn gbook.ir yate.ch mardel.com thechinesezodiac.org espn.com.co verdenews.com shark-games.net tifbs.net spid.gov.it morningstarfarms.com camera.org ecigarettereviewed.com cbintouch.com jameshardenjerseys.com seriesparaassistironline.org atptennis.com book-online.com.ua themustangsource.com cipro.company filmdiscuss.com sduhsd.net embedgooglemap.net saijogeorge.com zerodayinitiative.com mathsonline.com.au adstage.io a1.hr jword.jp lezhi028.com comedonchisciotte.org impulse.de securitybank.com mlmreport.info pipaffiliates.com tecnicadellascuola.it escortdirectory.com musicsalesclassical.com course-crew.info shoplo.com psy525.cn wordtemplatesonline.net coreldrawchina.com nicolasgallagher.com zurifurniture.com cialischpbrx.com theselby.com biotrustnews.com serviceu.com ttpet.com medica.de pubmed.com stadtbranchenbuch.com bookmarkbook.org inforadio.de tehranmelody.com planetmirror.com adidas.pl ohbulan.com lataco.com cabelasclubvisa.com onlinepharmacysrba.com youtubemp4.biz imaginoproject.com 15navi.com gogosextoys.com ctypy.com mywfg.com positivesingles.com wrbl.com vancouver-webpages.com yandex-school.ru csgopositive.com cdcovers.cc uiu.edu lusana.ru quirkbooks.com alliednews.com kingbrand.com boju88.com planetaexcel.ru princegeorgecitizen.com kelpmedia.com katehorrell.com kscourts.org tridenttech.edu hitbox.com learn2serve.com warforum.cz myonlinestats.com safak-roleplay.com itao.com vk-cdn.net qamshy.kz nationallawjournal.com dentaltown.com imaios.com gjart.cn mlsend2.com hellomedian.com netscape.net worlduc.com siftery.com boulevard.com highrisecarpetcleaning.com cialisndbrx.com halls.md rsguboxyb.com chinadmoz.org testportal.com.ua ourrevolution.com revrtb.com 112gs.com idxxi.co billingjapan.co.jp fuzemeeting.com wwwmonclerjacketsuk.com.co spur.org latestmodapks.com myiuhealth.org tompool.org pingpang.info rossia.org jinbo.net isda.org rnceus.com voobly.com brainbasket.net wehuntedthemammoth.com photobiz.com xbytessolutions.com englishcentral.com dnoticias.pt yaprobki.ru criteriacorp.com got-free-ecards.com orztoon.com udaan.com spiraxsarco.com dragonagekeep.com echoforchange.com minesotatwinsjerseys.us mobilitywod.com sp-studio.de cheapwigshop.com oilru.com mdc-berlin.de atlas-sys.com solowrestling.com covalent.net carenotify.com chiens-de-france.com kaltire.com odaconline.com recmydream.com nordjyske.dk tadalafil.bio seedrah.net metrosport.gr game4v.com thenewsenterprise.com ecer.com daxshat.site newstomato.com ray-ban.me.uk nestpensions.org.uk cryptorescue.org foodora.de emediawire.com i-can.org.za simpleviewcrm.com sunwarrior.com derana.lk theuconnblog.com pixub.com tfes.org banclip.com meiyixia.com bimebazar.com karabas.com free-software.com.ua jsgwyw.org yandex-team.com fortnine.ca blendercn.org lawguru.com symagine.net macwinsofts.com coloringcrew.com airport-data.com skytorrents.to tt.cn lakemedelsverket.se pornxxxdb.com qunsee.com pizzamaking.com rcu.org playgm.cn jeffgeerling.com v1host.com myheart.net erogazo-ngo.com thk.com configserver.com adinc.kr instrumart.com jumbomail.me nadelectronics.com nestingwithgrace.com vinci-autoroutes.com paylogic.nl afterglowvp.com academybank.com vsointernational.org designtrends.com vincityleseine.com pev.pl schoolnutrition.org yts.io gmsp.org tirebusiness.com cyberctm.com spong.com newcar.com marinelayer.com most.gov.tw fragomen.net sgou.com collegeofsanmateo.edu diyideas.ru lehrer-online.de tpc.re uqpay.com lshunter.net jokeblogger.com rogersmedia.com navy.gov.au cookeatshare.com 770k.com gotimeforce2.com weather2umbrella.com bitsandpieces.us destiny.gg janome.com sporticos.com niadd.com yew.ge allergybuyersclub.com linuxbabe.com deliveroo.de pangu8.com truereligionjeans-canada.com reso.ru sohacdn.com orb.ru freshjiveclothing.com daofire.com ktr8.com cine24h.net wycliffe.org inversionesartica.com iachina.cn mhtr.be grassfedgirl.com lodders.ru novinhasdozap.com applianceparts365.com fmnation.net nikerevolution3.us cpalead.com moc.gov.tw xiugei.com bearshare.com romancealley.com bbcomcdn.com mtc.gob.pe payju.ir androidbak.net linkslot.ru qzu.edu.cn umfrageonline.com mol.gov.tw ilmugeografi.com smsd.org ddb.com google.ms weather.gr lllreptile.com sportrider.com sagolfbidder.co.za --Apple-Mail=_62BF672C-84D7-448F-BD03-FB7010D05E14-- From nobody Thu Jul 18 22:46:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BA22120155 for ; Thu, 18 Jul 2019 22:46:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AXKXhdrqal_V for ; Thu, 18 Jul 2019 22:46:27 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5CDA120132 for ; Thu, 18 Jul 2019 22:46:27 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id h6so55966528iom.7 for ; Thu, 18 Jul 2019 22:46:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=oFXz18giRubXv6Ztef+5J7joiuwpHAt6GyBGRTIfGyk=; b=mK1g49E/jKOJPvA1Wv/V2/JNfA+6I+QpCx/lwiW8at7P0vP1NQcXndmIpW+uk/5LXZ 7bzhH+WUW/LBfhKSKquJE2UT8CDMLfbe9sbj9Txr0ePYDe0UxjJ8i5fcS7YjwVQrCw7Q gGbEJXM9/2sU/G373CBWwuV8kOOGgasSt6aDZyKIApw4LZbu+jp8HJg+cXrT14+QlLpo xnALX8LhglGJOImS6l+W70ugkOrtzwpQx/mSSQrWBU6YxmynoEJg2xelkCkjEzaKgiXh lJcSRGNt6CGDxEJG3q5ciLT1umi9aGmVJGqhH4aqbEanl/g6mo6dHaMvjC3SUBfiOAdc qc6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=oFXz18giRubXv6Ztef+5J7joiuwpHAt6GyBGRTIfGyk=; b=KKeZugjj1FQ5UkH2j7hb/DpxEXSl1MXJL6QyW+o6GjDWZRneYvgBEBtrecVAq+zaSv yN6CEZPw3Ue0uL20BbOIksYY8OAS5w6t1Tub05d0m069AR08f4Hv79vQL+vJJakeGFPG +3DA0wC79BbGV/Lq06tT7bw2dqxc9liWrRhLaoNJlcOd5mCf6gZwmrDtcK+bLCc98L/B 6emjg+ZY49Ncy2RdP/0Su9W/4rxvakG8ym2LatsKd5k6+wAoDq9QiQbS21trs1EJurYn gEA8iKpJLempDa/ac+rcGreQK5/lInpeYn16AL0q4TdQppA5H6qwh8Rtt6RfHZEVLR5T EBNw== X-Gm-Message-State: APjAAAU/V6gnXIOoLc9ks6EIS+egxAHtI6iGK4BCy6HhugW3cDnRCGdn bLirONYTdSHGLVn5Jw8evAVu/xwbh8x46T2v3znXNPvl/U27pqoZ X-Google-Smtp-Source: APXvYqwD81tprXn+NpogSnjsdo2gqrO3KSOAoFX3ctlQ81emk//vEtsPlU///JhXU3qPFJd6+I3m+6gUUbtpoEZNxIU= X-Received: by 2002:a05:6602:98:: with SMTP id h24mr48212813iob.49.1563515186796; Thu, 18 Jul 2019 22:46:26 -0700 (PDT) MIME-Version: 1.0 References: <20190719022420.GA26335@sudo.sh> In-Reply-To: From: Rob Sayre Date: Thu, 18 Jul 2019 22:46:15 -0700 Message-ID: To: Wes Hardaker Cc: Ben Schwartz , dagon , add@ietf.org Content-Type: multipart/alternative; boundary="0000000000004f6003058e023f80" Archived-At: Subject: Re: [Add] FYI: MiTM growth, post DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 05:46:30 -0000 --0000000000004f6003058e023f80 Content-Type: text/plain; charset="UTF-8" On Thu, Jul 18, 2019 at 10:17 PM Wes Hardaker wrote: > Ben Schwartz writes: > > > 3. The current known forged certificate (*.facebook.com) is not > relevant to DNS-based > > filtering or surveillance. facebook.com can easily be "filtered" by IP > address, and > > its subdomains don't contain any information that is likely to be useful > for > > surveillance (unlike, say, wordpress.com). > > As a reminder, a large number of DoH proponents believe the best model > of deployment is one where the DoH server also lies within the > unfilterable address ranges of major content providers (cloudflare, > akamai, AWS, DO, etc). You're right that this may not affect facebook, > unless they shift to a cloud provider's address spaces that also house a > DoH server. This argument might make sense if DNS was actually the best way to enact these types of polices. It doesn't seem like that's the case, though. Here's what they do in China: https://en.wikipedia.org/wiki/Great_Firewall#Current_methods There's some DNS functionality in there, but most of what they do relies on other methods. And, to be clear, I'm not trying to get into a moral argument about whether this filtering is right. It's just that DNS-based methods don't work if you're trying to break links on the internet. thanks, Rob --0000000000004f6003058e023f80 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Jul 18, 2019 at 10:17 PM Wes = Hardaker <wjhns1@hardakers.net> wrote:
Be= n Schwartz <bemasc=3D40google.com@dmarc.ietf.org> writes:

> 3. The current known forged certificate (*.facebook.com) is not relevant= to DNS-based
> filtering or surveillance.=C2=A0 facebook.com can easily be "filt= ered" by IP address, and
> its subdomains don't contain any information that is likely to be = useful for
> surveillance (unlike, say, wordpress.com).

As a reminder, a large number of DoH proponents believe the best model
of deployment is one where the DoH server also lies within the
unfilterable address ranges of major content providers (cloudflare,
akamai, AWS, DO, etc).=C2=A0 You're right that this may not affect face= book,
unless they shift to a cloud provider's address spaces that also house = a
DoH server.

This argument might make sense = if DNS was actually the best way to enact these types of polices.
It doesn't seem like that's the case, though.

=
Here's what they do in China:

There's s= ome DNS functionality in there, but most of what they do relies on other me= thods.

And, to be clear, I'm not trying to get= into a moral argument about whether this filtering is right. It's
just that DNS-based methods don't work if you're trying to br= eak links on the internet.

thanks,
Rob
--0000000000004f6003058e023f80-- From nobody Thu Jul 18 22:56:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFBFA120157; Thu, 18 Jul 2019 22:56:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NG2tw7_0IKga; Thu, 18 Jul 2019 22:56:33 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D98EA120025; Thu, 18 Jul 2019 22:56:32 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id h6so56004149iom.7; Thu, 18 Jul 2019 22:56:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=U5NEklj6YBO0mXKdughThqpRKwbiePRInGqQ2xZeAZI=; b=W7rt73uSqywcC0abL+rogDxF8XHvzsqc3tsPgb9g85q5+yrVG7M7b5SHOMwQZN3J0O 9JEAnSUIv97fEL/R5iYZ4kPve6oU1FjjSdl4I0r03u4gGIyaDC6OnPFAgjHEgi8klMqN +xpE9+J2Ct9P2i4bk0CyCGMnQDAFL5hmC53I74aYtE7cY9IbV/nWIUIgPkrjdEeGtYxG 2S63VM+RpagzeszCmmkgN3eZI5kuAVppYEHalyJqvBiFr4+LYqChgKHQV6zIyf3CSmqq Lyk/vEejBbhcTbjd4MslIzshpfHiRx1rWMAyQkjyWbplvSoJdHLlesx1WPHMZsJQmbl2 na3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=U5NEklj6YBO0mXKdughThqpRKwbiePRInGqQ2xZeAZI=; b=g5FpOq7T52kUHLOJlhwgLgqAGoHO2BMA0ASVIiursSqU4SSSWJh2bihM5g/TrsMcty fLY/qrNaVtyFqfPqBE+GQ5nFqGuVgGoKJbhJ+NJZo6MCSyEKd5C0mDYjnvEKYvuRZ8bf mz8laM5DfuxESt91/FP9gVk3o8aGLC2wzXFiYXgyVec1h4v+MiBqjnTLXjyN8PwHtCrg 12UT0wJSBk3G8KvtHDCWtiddqIuEudNgGHzrLu8khHhDzADCBes6OUUaNkyTjR4BrGFu 3h6t2YRBZmkPU3IauxP0VPkFiFfwTPwYpy3GbWameMxq/C0Orv2JBigX7SFNq53Ml1lr SrFg== X-Gm-Message-State: APjAAAWygPrj73lafHCMiDn4bXNeIawIrEDXqIf/LQ8vi/GtP78e1UBP ex6aareKTiAe6Vc6D0Mlr0VPaNG1CZns+WmcNa4= X-Google-Smtp-Source: APXvYqzRtCN3Xq2JMrbI2vHeYBYTYUBr5YQxKT6rm28koAdBPj9bGkxlxbDAbKBhjS64UySpzvypXuogWvXj6mkQY/s= X-Received: by 2002:a5e:d618:: with SMTP id w24mr12275671iom.73.1563515791141; Thu, 18 Jul 2019 22:56:31 -0700 (PDT) MIME-Version: 1.0 References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> In-Reply-To: <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> From: Rob Sayre Date: Thu, 18 Jul 2019 22:56:19 -0700 Message-ID: To: Kevin Borgolte Cc: add@ietf.org, DoH WG , dnsop WG , jordanah@princeton.edu, pschmitt@cs.princeton.edu, ahounsel@cs.princeton.edu, feamster@uchicago.edu, dns-privacy@ietf.org Content-Type: multipart/alternative; boundary="00000000000054ef23058e026351" Archived-At: Subject: Re: [Add] [DNSOP] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 05:56:35 -0000 --00000000000054ef23058e026351 Content-Type: text/plain; charset="UTF-8" On Thu, Jul 18, 2019 at 10:42 PM Kevin Borgolte wrote: > The list of websites is attached. It is extracted from the top 1,000 and > 99,000 to 100,000 of a Tranco list. > Thanks for attaching the list. Having seen a fair a number of these, I think it looks reasonable. But, I think you should add the list and the reason for the range choice to the paper. For example, I can't tell what range you actually used from your description (although that might just be due to a hurried reply). Another issue is that, while your paper might accurately capture the network conditions on your local network, it's probably doesn't capture network variation as well as a large scale test along the lines of what Mozilla did. For example, if the university used a single router brand, this could skew the test. As one data point, I've never seen the various network-throttling apps match a real-user-metrics test very well, although they do catch really problematic situations. This test is a welcome contribution, but given the data in the paper, it would be difficult to reproduce. thanks, Rob --00000000000054ef23058e026351 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Jul 18, 2019 at 10:42 PM Kevin Bo= rgolte <kevin@iseclab.org> w= rote:
The list of websites is attached. It is extracted from the top 1,000 and 99= ,000 to 100,000 of a Tranco list.

Thank= s for attaching the list. Having seen a fair a number of these, I think it = looks reasonable.

But, I think you should add the = list and the reason for the range choice to the paper. For example, I can&#= 39;t tell what range you actually used from your description (although that= might just be due to a hurried reply).

Another is= sue is that, while your paper might accurately capture the network conditio= ns on your local network, it's probably doesn't capture network var= iation as well as a large scale test along the lines of what Mozilla did. F= or example, if the university used a single router brand, this could skew t= he test. As one data point, I've never seen the various network-throttl= ing apps match a real-user-metrics test very well, although they do catch r= eally problematic situations.

This test is a welco= me contribution, but given the data in the paper, it would be difficult to = reproduce.

thanks,
Rob
--00000000000054ef23058e026351-- From nobody Fri Jul 19 03:10:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EBE59120179 for ; Fri, 19 Jul 2019 03:10:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=iseclab.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cj16_ak3Rae8 for ; Fri, 19 Jul 2019 03:10:42 -0700 (PDT) Received: from mail-pf1-x42d.google.com (mail-pf1-x42d.google.com [IPv6:2607:f8b0:4864:20::42d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0DD80120059 for ; Fri, 19 Jul 2019 03:10:42 -0700 (PDT) Received: by mail-pf1-x42d.google.com with SMTP id u14so13990031pfn.2 for ; Fri, 19 Jul 2019 03:10:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iseclab.org; s=mail; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=25ZikMlVCzGtP+Vdf15vRrgcowGxHo6pilCrPOI0FMQ=; b=gRnqM3nlLan5Hw+Q+BnFcJ1At/KV1mFjlzdsKrsduwEDpJL4Q+JBVn7kkbZPr87viG zNAcbcCvIY4cDLh3tBsN8TdkJFXPnlJcDNe7bmc7OCSV2g2Cw50jNGjwxc6V4xccvqQR yaD5TiUFf0798+bykwbULH0EKFQN2fhPjl0Po7ho1HvT//aXPSKnRszExV/ag9keW+nI E3xlsZqm9qTShu8ErfESyY9XHENEu/Pzu+5zmXNIIW+Gn9suXyCbEqpHjKBH1IM4w/9o ZfEyBwbt/ogeyx6NOnuTUiqvgpdWJvF9ThV89hcArMmobEPlEf3QPFHLlGSCEcv9uFbl +A/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=25ZikMlVCzGtP+Vdf15vRrgcowGxHo6pilCrPOI0FMQ=; b=ExJR/KQnqFkkMJoTAwtE0AW2WK/FTdRu5sWGBKfKIPA36njVKz9sp2y9qGpDZRhghZ EdFllc2fm3H5JOObb6CHFrblM7k2c/lciCm511UBaUR94pPNU9i3n29nPnxycya7/oIu 2o3R+rEkiYjPdOUSIQymrAvjcnQM6rrg7tSK7fW3hl8QsedNMcqQIBtaRBNAA7dwYRGs RwEi9K3eOmnPtYwE4iZi8jcY3EJRPKJMYF7dlBiFeVIoVbfQboBmt/muTds7uJbO+Tg/ lQ6+iDq+ywZs/3YtG5ywvyM9tkuSpLo8oSF+Uhdmc3u0FshbR3wc6Ihjt9t2qZzvHmCC v6mg== X-Gm-Message-State: APjAAAW+HfeND1vnuP6HrFA5aJPYD/2icC1LeiMhOIgigkJKFPfqBi5g EgBkB4u/YRyXZjxiheJIkXzIVw== X-Google-Smtp-Source: APXvYqxvYxO7O3hl0HGaP/T/O0ba69u0aEXFNJuIasAOqVIK6iD4/mUNrwLmqu0qibPqJiCeVbFMLA== X-Received: by 2002:a63:9e54:: with SMTP id r20mr17748095pgo.64.1563531038479; Fri, 19 Jul 2019 03:10:38 -0700 (PDT) Received: from [192.168.205.139] ([103.23.203.130]) by smtp.gmail.com with ESMTPSA id q69sm44210052pjb.0.2019.07.19.03.10.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 19 Jul 2019 03:10:38 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Kevin Borgolte In-Reply-To: Date: Fri, 19 Jul 2019 18:10:34 +0800 Cc: add@ietf.org, DoH WG , dnsop WG , jordanah@princeton.edu, pschmitt@cs.princeton.edu, ahounsel@cs.princeton.edu, feamster@uchicago.edu, dns-privacy@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <8B59D2ED-5B57-4C14-8442-102EEBE5A281@iseclab.org> References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> To: Rob Sayre X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [DNSOP] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 10:10:44 -0000 > But, I think you should add the list and the reason for the range = choice to the paper. For example, I can't tell what range you actually = used from your description (although that might just be due to a hurried = reply). Section 3.2.4 talks about the selection of websites: We collect HARs (and resulting DNS lookups) for the top 1,000 websites = on the Tranco top-list to understand browser performance for the average = user visiting popular sites. Furthermore, we measure the bottom 1,000 of = the top 100,000 websites (ranked 99,000 to 100,000) to understand = browser performance for websites that are less popular. We chose to = measure the tail of the top 100,000 instead of the tail of the top 1 = million because we found through experimentation that many of the = websites in the tail of the top 1 million were offline at the time of = our measurements. Furthermore, there is significant churn in the tail of = top 1 million, which means that we would not be accurately measuring = browser performance for the tail across the duration of our experiment. We didn't include the full list in the paper itself for space reasons = and because extracting the list from the paper would be cumbersome. It = will be part of our future open source release though. > Another issue is that, while your paper might accurately capture the = network conditions on your local network, it's probably doesn't capture = network variation as well as a large scale test along the lines of what = Mozilla did. For example, if the university used a single router brand, = this could skew the test. As one data point, I've never seen the various = network-throttling apps match a real-user-metrics test very well, = although they do catch really problematic situations. It is true that the an experiment from more diverse vantage points could = be more useful to capture network variations, however, we already see = that the protocols perform differently to the degree that a human could = notice (that is, we already show that selecting your DNS protocol based = on your network characteristics can have a non-negligible impact). = Running a large scale test for page load times like Mozilla did for = resolution times is also quite difficult: Simple telemetry data won't = answer the questions we want to ask, as websites need to be fetched = multiple times (per protocol/recursor combination), and browser caches = need to be flushed. These are not things you want to do with your users. = Using existing measurement platforms also was not an option, as they are = limited in what you can access or do not support the necessary = protocols. Meaning, you would need to set up your own measurement = clients, which brings questions like "How do you select the vantage = points?" (you can't use hosting/cloud providers, as this would lead to = little network variation). If you have an idea on how to easily run this = on a larger scale, we'd love to look into it. We set link capacity and latency based on best case values from = real-world measurements (Section 3.2.3) from OpenSignal, and we use = iproute2 for traffic control (tc), which we verified to be accurate = through latency (Table 1) and multiple "speedtest" (via Ookla). By = tuning the network setup in this way (instead of using a 4G/3G modem for = connectivity), we eliminated potential differences in routing that could = have otherwise influenced our results and impact comparability. -- Kevin= From nobody Fri Jul 19 13:26:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B148120A4A for ; Fri, 19 Jul 2019 13:26:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.889 X-Spam-Level: X-Spam-Status: No, score=-1.889 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NONE=0.001, T_SPF_HELO_TEMPERROR=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dM9eDbZ-qJNn for ; Fri, 19 Jul 2019 13:26:19 -0700 (PDT) Received: from sudo.sh (hexakaideca.sudo.sh [198.177.251.74]) by ietfa.amsl.com (Postfix) with ESMTP id 3C947120A44 for ; Fri, 19 Jul 2019 13:26:18 -0700 (PDT) Received: by sudo.sh (Postfix, from userid 1000) id 083B925D71F; Fri, 19 Jul 2019 20:26:18 +0000 (UTC) Date: Fri, 19 Jul 2019 20:26:18 +0000 From: dagon To: Ben Schwartz Cc: add@ietf.org Message-ID: <20190719202617.GA31887@sudo.sh> References: <20190719022420.GA26335@sudo.sh> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: Re: [Add] FYI: MiTM growth, post DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 20:26:21 -0000 On Thu, Jul 18, 2019 at 10:55:18PM -0400, Ben Schwartz wrote: > 5. The only reason to construct a forged certificate for > facebook.com is to surveil the content of citizens' interactions via > Facebook, and perhaps to implement selective filtering One telco, https://www.kcell.kz/ru/product/3585/658 , claims this is to comply with the laws of Kazakhstan, "On Communications", para 11, which protects users from cyber attacks, and просмотра противоправного контента. or "viewing illegal content". I'm somewhat familiar with these laws, since they obliged me to relocate some anti-malware services years ago. And in reading more, there are seven governmental groups that may use the new telco-supported interception capability for blocking (roughly: internal affairs, national security cmte, foreign intel authority, mil intel, anticorruption authority, state protective services, and finance/econ investigative groups). Admittedly, some of these groups seem more disposed to passive surveillance. But others have an explicit censoring mandate. So I think we'll see the CA used for blocking, as promised, and therefore also DoH filtration. We might never know the true motive and full use for the CA, since under Kazakhstan's Law on State Secrets, the detailed methods of any investigation are confidential. We know only that all the CA public explanations mention active filtering. I therefore urged others to download the certificate, and observe its promised use. Of potential interest: 89.218.11.194, KAZTELECOM-AS, is available for recursion, via: StrictNodes 1 ExitNodes 85.159.237.210 and less reliably: ExitNodes 109.248.147.198 in torrc. (While these hosts do use 8.8.8.8 in /etc/resolv.conf, there is at least one KAZTELECOM-AS resolver on path.) This might be useful if flagging zones subject to udp/53 filtering, to test correspondence with any MiTM DoH observation. I'm confident Kazakhstan's investigative agencies know about DoH. So looking for DoH MiTM events seems prudent (or, if foolish, at least on topic for this list). > From these observations, it's clear to me that emphasizing DoT over DoH, or > even abandoning DNS privacy altogether, would _not_ have had any effect on > this attack. Bell tolls precede any possible unringing. -- David Dagon dagon@sudo.sh D970 6D9E E500 E877 B1E3 D3F8 5937 48DC 0FDC E717 From nobody Fri Jul 19 14:14:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 83BDF120A44; Fri, 19 Jul 2019 14:14:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gJAXu6ADdvPm; Fri, 19 Jul 2019 14:14:11 -0700 (PDT) Received: from mail-io1-xd44.google.com (mail-io1-xd44.google.com [IPv6:2607:f8b0:4864:20::d44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6A4871207E2; Fri, 19 Jul 2019 14:14:11 -0700 (PDT) Received: by mail-io1-xd44.google.com with SMTP id e20so30932813iob.9; Fri, 19 Jul 2019 14:14:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=r1oPtaiul8VDnunpzcU36ny4SjTGcEvQhylLSkf+GAE=; b=Wr6xLoZnN8/TQt4GHC7vig4lMIZNYieNv1SQRmTGOem5jPphBh5CcKyR18Os2vDsJw KYO7r/yr2PJ2aRHLBdyZek1jDsz/QJN0fbX2yL5TlK+5LU5dCR13UqAm8gcQoqmLQJss TLWRWprLWrudt0W4NXUNh2fpW9vU13n3eZvLz0QyGgQ55BwH9nkbWwTalCRin8wX6qqK Gjh8xWd27WF2ZCxe74O4NqvtYLDTeYVCDV3imsdjDLIsi1Xbgk+ix8Zdz7qfmlZbciAK B/AfOCEBgDC3Dbs/PNdXyBpLdp22JFCEb3p+dcc/3sd3OvwLeBeq9pKmbnOoF17JcaF4 +6sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=r1oPtaiul8VDnunpzcU36ny4SjTGcEvQhylLSkf+GAE=; b=IlCmWrqJwgQw6jTZkUaBq2L8XJ6DHLeqqqBBGnuZisOpNYVIGUCGHcZqKnTDf96h6W 1M7htUHwZrAUr3Ot+dPdS3KubIylG0bJl6D1/Eo/M7L2eApLPOQ/JEXL5qvaJaFqZXp6 zqwrOC9YCAO2RP66xW+8/enagb9h4jnfbAb9aicwh3fk53df8c0I4aBOhgiI01KEQ8xj Yi/K2evzU2EcPj/+BpzrMJ+cvYYLYbNI3ctJZO/QYPm4ogrP+6UHnAlQ2URli0Vj8Xck MuhL9pGSHn1ifiB24w1aUdfzq8xiLRuSiTXnv5jMikm337+i5xkjDXO56mWTCeDiApFz Z0vQ== X-Gm-Message-State: APjAAAV45XZVQivLBy4IlEFS3SnpWWJb2fKp2obKLULcsXvImAFFnhLV OJC+X+MEBJelnNKQL1z7iRs77qLNi/uwOO/80lQ= X-Google-Smtp-Source: APXvYqyAMWk8HJ2W0QNKNq3G771gq6mmfg2GQql+DkgofJ3hheKMR8NSOCmpyUrVJ+XZ73NU4FLSKO18p5uq3oQyzd4= X-Received: by 2002:a6b:bc42:: with SMTP id m63mr37462272iof.189.1563570850573; Fri, 19 Jul 2019 14:14:10 -0700 (PDT) MIME-Version: 1.0 References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> <8B59D2ED-5B57-4C14-8442-102EEBE5A281@iseclab.org> In-Reply-To: <8B59D2ED-5B57-4C14-8442-102EEBE5A281@iseclab.org> From: Rob Sayre Date: Fri, 19 Jul 2019 14:13:59 -0700 Message-ID: To: Kevin Borgolte Cc: add@ietf.org, DoH WG , dnsop WG , jordanah@princeton.edu, pschmitt@cs.princeton.edu, ahounsel@cs.princeton.edu, feamster@uchicago.edu, dns-privacy@ietf.org Content-Type: multipart/alternative; boundary="0000000000002131bb058e0f354c" Archived-At: Subject: Re: [Add] [DNSOP] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jul 2019 21:14:14 -0000 --0000000000002131bb058e0f354c Content-Type: text/plain; charset="UTF-8" On Fri, Jul 19, 2019 at 3:10 AM Kevin Borgolte wrote: > > > But, I think you should add the list and the reason for the range choice > to the paper. For example, I can't tell what range you actually used from > your description (although that might just be due to a hurried reply). > > Section 3.2.4 talks about the selection of websites: > > We collect HARs (and resulting DNS lookups) for the top 1,000 websites on > the Tranco top-list to understand browser performance for the average user > visiting popular sites. Furthermore, we measure the bottom 1,000 of the top > 100,000 websites (ranked 99,000 to 100,000) to understand browser > performance for websites that are less popular. > I see, that makes sense. I'm still having trouble interpreting the measurements, given that pageload can be blocked by additional DNS queries and HTTP requests. For example, could an analytics provider interfere with performance evaluation here, if it were present in a lot of pages? Or, what if the results indicate a performance problem in one common hosting vendor (anything from AWS to Wordpress)? As I said, the paper is a welcome contribution, but I find the results surprising and want to look more. I would have expected DoH and DoT to be about the same in practice, but your paper does not show this. > We didn't include the full list in the paper itself for space reasons and > because extracting the list from the paper would be cumbersome. It will be > part of our future open source release though. > Understood--I meant that I looked for a separate download and didn't see one (thank you for sending it along). thanks, Rob --0000000000002131bb058e0f354c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Jul 19, 2019 at 3:10 AM Kevin= Borgolte <kevin@iseclab.org>= ; wrote:

> But, I think you should add the list and the reason for the range choi= ce to the paper. For example, I can't tell what range you actually used= from your description (although that might just be due to a hurried reply)= .

Section 3.2.4 talks about the selection of websites:

We collect HARs (and resulting DNS lookups) for the top 1,000 websites on t= he Tranco top-list to understand browser performance for the average user v= isiting popular sites. Furthermore, we measure the bottom 1,000 of the top = 100,000 websites (ranked 99,000 to 100,000) to understand browser performan= ce for websites that are less popular.

= I see, that makes sense. I'm still having trouble interpreting the meas= urements, given that pageload can be blocked by additional DNS queries and = HTTP requests. For example, could an analytics provider interfere with perf= ormance evaluation here, if it were present in a lot of pages? Or, what if = the results indicate a performance problem in one common hosting vendor (an= ything from AWS to Wordpress)? As I said, the paper is a welcome contributi= on, but I find the results surprising and want to look more. I would have e= xpected DoH and DoT to be about the same in practice, but your paper does n= ot show this.


We didn't include the full list in the paper itself for space reasons a= nd because extracting the list from the paper would be cumbersome. It will = be part of our future open source release though.

=
Understood--I meant that I looked for a separate download and di= dn't see one (thank you for sending it along).

thanks,
Rob
--0000000000002131bb058e0f354c-- From nobody Sun Jul 21 11:53:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 05D7812004E for ; Sun, 21 Jul 2019 11:53:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NQ7qzHKfsUii for ; Sun, 21 Jul 2019 11:53:09 -0700 (PDT) Received: from emh02.mail.saunalahti.fi (emh02.mail.saunalahti.fi [62.142.5.108]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 45B0E120127 for ; Sun, 21 Jul 2019 11:53:09 -0700 (PDT) Received: from eggert.org (unknown [62.248.255.8]) by emh02.mail.saunalahti.fi (Postfix) with ESMTP id C93B12002B for ; Sun, 21 Jul 2019 21:53:07 +0300 (EEST) Received: from dhcp-88b7.meeting.ietf.org (dhcp-88b7.meeting.ietf.org [31.133.136.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by eggert.org (Postfix) with ESMTPSA id 114DD64C0E8 for ; Sun, 21 Jul 2019 21:53:03 +0300 (EEST) From: Lars Eggert Content-Type: multipart/signed; boundary="Apple-Mail=_82AF20E4-A85C-48D9-B3AE-29D9A74E9B73"; protocol="application/pgp-signature"; micalg=pgp-sha512 Reply-To: Dave Lawrence , Lars Eggert Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: <8B069AD4-0A20-4F76-80DA-B4606729631C@eggert.org> Date: Sun, 21 Jul 2019 14:53:02 -0400 To: add@ietf.org X-MailScanner-ID: 114DD64C0E8.A32E2 X-MailScanner: Found to be clean X-MailScanner-From: lars@eggert.org Archived-At: Subject: [Add] Wanted: minute takers & jabber scribes X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Jul 2019 18:53:11 -0000 --Apple-Mail=_82AF20E4-A85C-48D9-B3AE-29D9A74E9B73 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi, in order to save some time on Tuesday, I'd like to identify our minute = takers and jabber scribes now. Please volunteer by direct email to Dave = and me. Thanks, Lars --Apple-Mail=_82AF20E4-A85C-48D9-B3AE-29D9A74E9B73 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEDrrUO3PMwKM8fddaHbmKvSnuNPgFAl00tI4ACgkQHbmKvSnu NPgYyxAAsm5hoDC7e8YuCkXfKTi9Mjs8eeVSyT78BWH+Tgf+CnzgmWFKhO6cIubv ChN0dWsO8eFTz6o06AnhevFwujlHEOFdcU/yG3TaGjk9KtUinnslUfmHkwc/r77g j0cbK4sx6WgbjT1WPqxr8IKwD6pYmIht3BH62ubKLxYk3NNbKnLF519PnJutVi3T R/F3xrE8slopwJv0jS38pt9g4l/BcsMCLR866GmeAcL2BWBsRhJnkL5mHBbawX/p tsahU9RjuYD5gNEQd22NIPVmki0bGbLim3iZ8yD+BYAVKU7ePXvGvD2IPraLzDui E+mSrtW/XGFPYZBKUP1OlXuCACHjXVxU8AYUDwIrNlrCObeN/xi8HIZmSoBUDDVh YnDM4EeoAEjPLaYL+Hq93T/DOFlT59ZUi919EbOeuzGO9I3Z0NZmos3JvmrQNVf7 CJssh5RGLZF54YTSQ7R5MyfbNekLE5t7qfw0TUiQI9emVTKcUd6237V+hJlNo8w+ 0Qat4WeQOUwv3v5fHumnvthEXEAZavORBQ0BSPCMpc+7cqtqq9CwqhIfJeAGwAdX DVP6d4Iyt7CAomGZnx8MkqE1IVvSYETpyEyuYZ7nUIa7/LANAcygb8PYdsVa/7rm Bm5mfXEEq5bWv2IGAq6gVwNQtDoHsjN9btKkdQpf/2HL0OhbtGQ= =loQK -----END PGP SIGNATURE----- --Apple-Mail=_82AF20E4-A85C-48D9-B3AE-29D9A74E9B73-- From nobody Sun Jul 21 14:39:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D0511200B9 for ; Sun, 21 Jul 2019 13:26:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.501 X-Spam-Level: X-Spam-Status: No, score=-17.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LNNpJfJGsnqB for ; Sun, 21 Jul 2019 13:26:48 -0700 (PDT) Received: from mail-yb1-xb44.google.com (mail-yb1-xb44.google.com [IPv6:2607:f8b0:4864:20::b44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9FDA112013E for ; Sun, 21 Jul 2019 13:26:38 -0700 (PDT) Received: by mail-yb1-xb44.google.com with SMTP id j199so14319201ybg.5 for ; Sun, 21 Jul 2019 13:26:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=Ap9z8tN29nhp8ZXJLRDW4HcOWg5FnscBjlQam/S43Rc=; b=SZNmI14bKycz6JVh7biOzvVkN4hf7jZfdKLhThc9ry+zS9gG+baHqgrhAMAhVi+GAI fXz5rWnouX1x07YfwCxfRkV38a604tHOvljWWA2bD/vbSdsg10MGfSthCyQLObgAUQ/V Z6oWClYgSbS0JwfiEh+u8Sx/GawvfJPS42a8sz6XWvSF2L0k9V+EJlbVRe8gKfDedJKJ mgBhrLXiQ9PwodBN5hfwmyyg4nyYqqZlrJaSmtC+G/zu0lYKpTEg3tpSCOWZ/7MNUBpk qi9RbBRYPjEK6H7YVhPc/DbrC78KXQs24J6O46VyNGv/E8t/egIHuQGFGYQLmsE7k4dd wMnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=Ap9z8tN29nhp8ZXJLRDW4HcOWg5FnscBjlQam/S43Rc=; b=UZkBRJdBMxksU8ECWEDuX+jVMfT/FpW3xdEy1p4B3CSarmuZh/G004QC7F/m6tORo3 /VH4wuDNYHU7qjkDX68YX1LIivEczCovDk35wCwY8jCPnGns0fCmutywk/b4AktcaIsa lfm/yv2rrgiemql+NaEb1c28BSrRbqC1MEG9A+QM0sNr8ureYwAuD4m36La5TmgmVq9y kgRGp7tOjB+8h60tNx+FFhoYAYyW0qoVwuScnDLh+DO+rtT9XISCRRyhO0o9ml7EfeQV 83xvDaTJvRpjz1BB5PLN7cyOZPcd3tBwm/DX0ik4pLHKX0dXG2gvzvP4TTRAV6gRlD5S 330Q== X-Gm-Message-State: APjAAAX+kzCr8JZB2nuFD1WIrj5Y+nhxUac3xOX2XmT1T072Slvkxhsy jcOKqbMe4kq8/R9drZjd0U1sdh/sleFso1ick7gFog== X-Google-Smtp-Source: APXvYqwGAWqfYbLvM8YO51NxMsLw1SaT9POywsXyd2j2xXVWd1R4S+ofZZ16imlhGyt9wanHUv8d0Sx7HDOj1etM8A4= X-Received: by 2002:a25:4585:: with SMTP id s127mr36737162yba.139.1563740797325; Sun, 21 Jul 2019 13:26:37 -0700 (PDT) MIME-Version: 1.0 References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> In-Reply-To: <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> From: Puneet Sood Date: Sun, 21 Jul 2019 16:26:24 -0400 Message-ID: To: Kevin Borgolte Cc: Rob Sayre , DoH WG , pschmitt@cs.princeton.edu, dnsop WG , jordanah@princeton.edu, feamster@uchicago.edu, add@ietf.org, dns-privacy@ietf.org, ahounsel@cs.princeton.edu Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: X-Mailman-Approved-At: Sun, 21 Jul 2019 14:39:32 -0700 Subject: Re: [Add] [dns-privacy] [DNSOP] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Jul 2019 20:26:53 -0000 Thanks for sharing the results of your work. It will be great to have the software available so others can run the experiments from other locations. When looking at the page load results the CDF graphs comparing the various services are very useful to see the relative performance of different services. However I could not find the range of time values for the page loads in the experiment. Basically what percentage of the page load time variation was related to DNS? Note: For Google DoH, we will be reviewing our implementation for latency. BTW we have launched our production RFC 8484 DoH service recently at https://dns.google/dns-query (https://security.googleblog.com/2019/06/google-public-dns-over-https-doh.h= tml). It will be great if you can update your software to use this endpoint. * The experiment was run from Princeton, New Jersey in Northeast US. The location is in a very well connected part of the world between network peering points in NYC and Washington DC. You will not see much difference (due to network latency) between the cloud providers and the default (local) Do53. Running the experiment from locations which are further away from cloud providers would provide another interesting set of data. * Conclusion on benefit (or lack) of ECS. Did the page load measurements include content that would benefit from proximity to the end user, e.g. streaming videos or large downloads? This kind of content benefits from ECS when the resolver is further away from the client. Thanks, Puneet On Fri, Jul 19, 2019 at 1:42 AM Kevin Borgolte wrote: > > > > This paper looks interesting. Is the software used in the paper publish= ed? > > Thanks! The code isn=E2=80=99t open source yet, but we will make it publi= c alongside the Docker setup we used for running it. Not sure when that is = going to happen exactly though. > > > Or, at least, is the test page set published? I haven't read the whole = thing yet, but it seems like the page set would be relevant if the paper te= sts page load time. > > The list of websites is attached. It is extracted from the top 1,000 and = 99,000 to 100,000 of a Tranco list. > > Best, > Kevin > > _______________________________________________ > dns-privacy mailing list > dns-privacy@ietf.org > https://www.ietf.org/mailman/listinfo/dns-privacy From nobody Mon Jul 22 09:42:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82F2F120347 for ; Mon, 22 Jul 2019 09:42:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6iKfS9Iba1uj for ; Mon, 22 Jul 2019 09:41:59 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1ABFB12030D for ; Mon, 22 Jul 2019 09:41:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1563813718; x=2427727318; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=qARnlAMgI0U+aBzUl/+2sY8jAhcb9JMi5MLR3K58lz8=; b=uh7PB58+7Vk/mJIAlAvlZ3bPmj1f2isy3r6IBiAGBhb/RUVTUDZERfT7Zo7VSE78 b9dxDBssV5yBpWh6UkHzQmR+fJ+3pL/1wraXtzXZGWr+xPZCPkLCTAs4kAvVhqgP Ue5Bp/cX4oQRVcdCuAg1S6Mgx6YNLBX6FhyVUa+XQZLVtNIvuN6ULggVNmFZa0UX 0Z9KhewsSzk2/qfoa3UPoPLYU4O1G/fEyqb/VN7gvcYFMmVdbWSTqKlUCJMnkoti FzJsGeAD/OZLWtzC4x7AxTfwoccCuXJq0R/lG6mWbxf5xO/9XmFZNIdI7yZRTZxz 0QSvDQkBM+42mu6rcn6bRA==; X-AuditID: 60729ed4-20fff700000013e0-8c-5d35e7568555 Received: from COPDCEXC36.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id D0.F1.05088.657E53D5; Mon, 22 Jul 2019 10:41:58 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC36.cable.comcast.com (147.191.125.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Mon, 22 Jul 2019 12:41:57 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Mon, 22 Jul 2019 12:41:57 -0400 From: "Livingood, Jason" To: Brian Dickson , Ted Hardie CC: Vittorio Bertola , "add@ietf.org" , Neil Cook , Rob Sayre Thread-Topic: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 Thread-Index: AQHVO+Hh5aPtQvEEk0q6d5pi9A2P/6bNoEQAgAAD9oCAAAkDAIAAE/GAgAAYiICAAAOPgIAAAlmAgAAFggCAAJ93gIAAM9YAgAB6ioCAAAPEAIAABUeAgAAthACAAARTAIAADiAAgAARVQCAABPhgIAHKsQA Date: Mon, 22 Jul 2019 16:41:55 +0000 Message-ID: <081FF993-1678-409F-9BD6-A054AA6D34E7@cable.comcast.com> References: <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [68.87.29.8] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrMKsWRmVeSWpSXmKPExsWSUDRnsm7Yc9NYgzPNKhb/T69js2i7y2HR cWUri0XnrAlMFo1z7SxendzJ7sDmsXPWXXaPJUt+MnnMejyRPYA5qoHRpiSjKDWxxCU1LTWv ONWOSwED2CSlpuUXpbomFuVUBqXmpCZiVwZSmZKak1mWWqSP1Rh9rOYkdDFlHHk+h61gC2fF s09NzA2MUzi7GDk5JARMJKZ+/8/UxcjFISRwhEnifOt0NginhUli8aRJrBDOaUaJCc0zmUBa 2ATMJO4uvMIMYosIhEgs7G4EK2IWWMgosWfab3aQhLCAm0TXlhdMEEXuEn0zXoKNFRFYxSjR OeMzK0iCRUBVYu/qFWANvAIuEreb57NArHvGI9G6YwJYN6dAoMSEFbsZQWxGATGJ76fWgMWZ BcQlbj2ZzwTxhYDEkj3nmSFsUYmXj/+BLRAV0Jf4cm4TC0RcTqJnRyvQHA6gXk2J9bv0IcZY SXw985YNwlaUmNL9EOoeQYmTM59AtYpLHD6yg3UCo+QsJJtnIUyahWTSLCSTZiGZtICRdRUj n6WZnqGhiZ6hqYWekaHRJkZw0pp3ZQfj5ekehxgFOBiVeHhtL5vGCrEmlhVX5h5ilOBgVhLh zTMACvGmJFZWpRblxxeV5qQWH2KU5mBREufN26sTKySQnliSmp2aWpBaBJNl4uCUamDckv1U XaArrNR6h9yfWYHev89fesRyQajT4FHvL7M9xtviX79lXL1l+d4H827MvP1494p/L671BRre Zp7WpRby7ci25V8fhrFc9o05ZSmce9293+JSof7hDWrxUzVrPs9Z7KNikn1OuYK97bfVGcO5 wU1/C7X4zaR3PlhnLrnchocrspJtip20EktxRqKhFnNRcSIAbXH4m1YDAAA= Archived-At: Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 16:42:05 -0000 RnJvbTogQWRkIDxhZGQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIEJyaWFuIERpY2tz b24gPGJyaWFuLnBldGVyLmRpY2tzb25AZ21haWwuY29tPg0KPiBNYW55IG9mIHRoZSBjb21tb24g aXNzdWVzIGJldHdlZW4gInNoZW5hbmlnYW5zIiBhbmQgRG9YIHVzYWdlLCB3b3VsZCBiZW5lZml0 IGZyb20gY2xpZW50LXNpZGUgRE5TU0VDIHZhbGlkYXRpb24uDQpJbiBwYXJ0aWN1bGFyLCB0aGUg YmVoYXZpb3Igb2YgRE5TU0VDIHZhbGlkYXRpb24gZmFpbHVyZSAocmV0dXJuaW5nIFNFUlZGQUlM KSB3b3JrcyB3ZWxsIHdpdGggdGhlIHVzZSBvZiBtdWx0aXBsZSByZXNvbHZlciBhbmQgcHJvdG9j b2wgImxpc3RzIiAoaGllcmFyY2hpY2FsIHN0cnVjdHVyZXMpLg0KPiBJIGFtIHByb3Bvc2luZyBk b2luZyBzbyB2aWEgRG9ULCBhbmQgcHJlZmVyYWJseSBhbHNvIHdpdGggRE5TU0VDIGNsaWVudCB2 YWxpZGF0aW9uLi4NCg0KW0pMXSBJdCBzZWVtcyBpbnRlcmVzdGluZyB0byBjb25zaWRlciB0aGUg cXVlc3Rpb24gb2Ygd2hldGhlciBhIERvVCBvciBEb0ggcmVzb2x2ZXIgU0hPVUxEIG9yIE1VU1Qg YWxzbyBwZXJmb3JtIEROU1NFQyB2YWxpZGF0aW9uLiBBcyB3ZWxsLCBJIHdvbmRlciBpZiBtYW55 IG9mIHRoZSBvcmdhbml6YXRpb25zIHRoYXQgYXJlIGN1cnJlbnRseSB3b3JraW5nIG9uIGRlcGxv eWluZyBlbmNyeXB0ZWQgRE5TIG9yIGhhdmUgYWxyZWFkeSBkb25lIHNvIHNob3VsZCBhbHNvIHRh a2Ugc3RlcHMgdG8gc2lnbiBhbGwgb2YgdGhlaXIga2V5IGRvbWFpbnMgLSBiZWNhdXNlIGl0IGNl cnRhaW5seSBzZWVtcyB3b3J0aHkgZ29hbCBpcyB0byBhY2hpZXZlIGJvdGggY2hhbm5lbCBhbmQg Y29udGVudCBzZWN1cml0eS4gDQoNCg0K From nobody Mon Jul 22 10:58:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51644120366 for ; Mon, 22 Jul 2019 09:42:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mC6GN2PC18Sp for ; Mon, 22 Jul 2019 09:42:00 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D3DB6120338 for ; Mon, 22 Jul 2019 09:41:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1563813705; x=2427727305; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=drixkcZtrbubfprxlM48dAw+8UpCYqQmWTDXVt4vrpE=; b=aQhwkWzgR7E/HB8UvEIoWXnEOVNyndp8uyirYelpwE6vTGc2CBs9w+mbG8pOiFAa yEVkvHjd3f4eNrsdNAVA/WHdx5D5dQdLYYvhIE5naXUZqMosHHbVzVkj0r+WcOAk amt7Bc9KOtJoK45v1t7H/YlKKt3w0Vxfl4GOYNA2ZAXPvFe0I3XHoLnmpnEuTbT8 mOtKhTlB0oN0EpKAEQMU22c1uRamAxLLaTmDgXnFj468Hdv0dmvSm6g74NAb32Q8 ln6ki7TOz7N/d+xCpfUZPREnJ/xV1fBdTjrVI9wVQ5JNhpvpadB+hn67wrbbMhRQ NDoKM29QGHwt4WbSfpZACg==; X-AuditID: a2962c47-ab9ff7000002e144-05-5d35e7496d5c Received: from COPDCEXC38.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 1A.DD.57668.947E53D5; Mon, 22 Jul 2019 10:41:45 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC38.cable.comcast.com (147.191.125.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Mon, 22 Jul 2019 12:41:58 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Mon, 22 Jul 2019 12:41:58 -0400 From: "Livingood, Jason" To: Puneet Sood , Kevin Borgolte CC: DoH WG , "add@ietf.org" , "pschmitt@cs.princeton.edu" , dnsop WG , "feamster@uchicago.edu" , "jordanah@princeton.edu" , "dns-privacy@ietf.org" , Rob Sayre , "ahounsel@cs.princeton.edu" Thread-Topic: [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW Thread-Index: AQHVQAKpiwWiGVXJY0iQLg/SQuIMEqbWwjGA Date: Mon, 22 Jul 2019 16:41:57 +0000 Message-ID: <5F9202DE-ED2F-4F2A-8463-12334E54BC46@cable.comcast.com> References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [68.87.29.8] Content-Type: text/plain; charset="utf-8" Content-ID: <0938F540FC185941B33EB4EDF2E99508@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrNKsWRmVeSWpSXmKPExsWSUDRnsq7nc9NYg+Ov+Sz+n17HZtHw7j6b xYbWHawWd99cZrG4dvcim8WiU0cYLS7O47Q4vfs8u8Xa+4wWL44mW3TOmsDkwO3R97iT1ePE siusHjtn3WX3WLLkJ5PH/jVvWD1a/25g8VjTkhDAHtXAaFOSUZSaWOKSmpaaV5xqx6WAAWyS UtPyi1JdE4tyKoNSc1ITsSsDqUxJzcksSy3Sx2qMPlZzErqYMv4/6WYsuMFVsf3YHNYGxi1c XYwcHBICJhLPD3N3MXJxCAkcYZLYOHkCE4TTwiTxcd57RgjnNKPE+Y9HgRxODjYBM4m7C68w g9giAtESPX3nmEGKmAUamCWWHJoPlhAGSrSv/MsIURQjcejMTiYI20jixpy5bCA2i4CqxO2t 11hBbF4BF4kZy/4zQ2xrZJKY+7IXrIhTIFBi+4aFYEMZBcQkvp9aAzaIWUBc4taT+WC2hICA xJI955khbFGJl4//gQ0VFdCX+HJuEwtEXE6iZ0crI8jPzAKaEut36UOMsZK4cvISM4StKDGl +yE7xD2CEidnPoFqFZc4fGQH6wRGyVlINs9CmDQLyaRZSCbNQjJpASPrKkZeQzMjPUNTAz0T Ez1zw02MwCS4aJqO+w7GD+djDzEKcDAq8fDGXTaNFWJNLCuuzD3EKMHBrCTCm2cAFOJNSays Si3Kjy8qzUktPsQozcGiJM57eLJGrJBAemJJanZqakFqEUyWiYNTqoFRVCv2/p66OusVCkzb K7Yd3iO3kT3nxYmX+1oOz2TkvWL6h+HN4pD3s42NA392h12Kf+OlU/hC8Ljn170WPgZMl0ri i55zaFWlPrH9K9vuFTirzlnK3Tdvz7tgZ64tWX0T/gRLS9puq17xpULedI70gvLZLycXXZ2o khZqUy52ffmfzT/ctixTYinOSDTUYi4qTgQAmRhp4n4DAAA= Archived-At: X-Mailman-Approved-At: Mon, 22 Jul 2019 10:58:19 -0700 Subject: Re: [Add] [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 16:42:05 -0000 T24gNy8yMS8xOSwgNDoyNyBQTSwgIkROU09QIG9uIGJlaGFsZiBvZiBQdW5lZXQgU29vZCI6DQo+ IFJ1bm5pbmcgdGhlIGV4cGVyaW1lbnQgZnJvbSBsb2NhdGlvbnMgd2hpY2ggYXJlIGZ1cnRoZXIg YXdheSBmcm9tIGNsb3VkIHByb3ZpZGVycyB3b3VsZCBwcm92aWRlIGFub3RoZXIgaW50ZXJlc3Rp bmcgc2V0IG9mIGRhdGEuDQoNCltKTF0gKzEuIEkgdW5kZXJzdGFuZCB0aGUgVVMgRkNDIGlzIGNv bnNpZGVyaW5nIHJ1bm5pbmcgRG9IIHRlc3RzIGZyb20gdGhlaXIgTWVhc3VyaW5nIEJyb2FkYmFu ZCBBbWVyaWNhIGVuZCBwb2ludHMgYXJvdW5kIHRoZSBVUy4gVGhvc2UgZGV2aWNlcyBhcmUgbWFu YWdlZCBieSBTYW1Lbm93cywgd2hpY2gganVzdCBhbm5vdW5jZWQgdGhleSBhZGRlZCBhIERvSCB0 ZXN0IHRvIHRoZWlyIHN1aXRlIG9mIG1lYXN1cmVtZW50cy4gDQoNCj4gQ29uY2x1c2lvbiBvbiBi ZW5lZml0IChvciBsYWNrKSBvZiBFQ1MuIERpZCB0aGUgcGFnZSBsb2FkIG1lYXN1cmVtZW50cyBp bmNsdWRlIGNvbnRlbnQgdGhhdCB3b3VsZCBiZW5lZml0IGZyb20gcHJveGltaXR5IHRvIHRoZSBl bmQgdXNlciwgZS5nLiBzdHJlYW1pbmcgdmlkZW9zIG9yIGxhcmdlIGRvd25sb2Fkcz8gVGhpcyBr aW5kIG9mIGNvbnRlbnQgYmVuZWZpdHMgZnJvbSBFQ1Mgd2hlbiB0aGUgcmVzb2x2ZXIgaXMgZnVy dGhlciBhd2F5IGZyb20gdGhlIGNsaWVudC4NCg0KW0pMXSBJIHdvbmRlciBpZiBpdCBtaWdodCBi ZSB1c2VmdWwgZm9yIENETnMgdG8gcHVibGlzaCBzb21lIG1lYXN1cmVtZW50IHRlc3QgVVJMcyB0 aGF0IGFyZSBoaWdobHkgbG9jYWxpemVkIChlLmcuIGRpc3RyaWJ1dGVkIHdpZGVseSAmIGFzIGNs b3NlIGFzIHBvc3NpYmxlIHRvIHVzZXJzKS4gVGhhdCBtaWdodCBlbmFibGUgYmV0dGVyIHRlc3Rp bmcgb2YgcGVyZm9ybWFuY2UgZm9yIGFjY2Vzc2luZyBjb250ZW50IHRoYXQgYmVuZWZpdHMgZnJv bSBwcm94aW1pdHkgdG8gdXNlcnMuIA0KDQoNCg== From nobody Mon Jul 22 12:55:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90BC112008C; Mon, 22 Jul 2019 12:55:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.952 X-Spam-Level: X-Spam-Status: No, score=0.952 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=outlook.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 58GfU1QqerNS; Mon, 22 Jul 2019 12:55:07 -0700 (PDT) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-oln040092068043.outbound.protection.outlook.com [40.92.68.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 135B012011B; Mon, 22 Jul 2019 12:55:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4U+dn2qR9n9hkC9G5dr4IAqOlhYxeHiC5f36RYKnTto=; b=bGeYsFZdqdm+iJbMwN9RLgaZbKBrWqpqZs31jDBBcV9aiBQcRZa0SHzzm7pR1kazGG0XVP04ulFl4jNWqnjcIX10MSJ65VJ1gX3uFmNc58t/GaO+4ulIKsfbQlNk/daC2NNUj2Og9buGUL9Kvh6YMxCt9FCmHzApw2M7XfF9DTJS54yX3ngtKICLqFH3qdZeKmeITRrbNyiLKghBvcBQXssFvY3m9CVTQk1sB5c8oFbyQKvz6x223uoQRL+ng8ndycv1s1uweb9KBZIVXrysTLT6ZiozPCyqPBRLC0jDb/O7Crbfqmd/zzXa9dvB34tBjZXXMCoWzMTJO3LnHItzlw== Received: from HE1EUR02FT004.eop-EUR02.prod.protection.outlook.com (10.152.10.58) by HE1EUR02HT122.eop-EUR02.prod.protection.outlook.com (10.152.10.252) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.19; Mon, 22 Jul 2019 19:55:04 +0000 Received: from DB8PR08MB5404.eurprd08.prod.outlook.com (10.152.10.51) by HE1EUR02FT004.mail.protection.outlook.com (10.152.10.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.19 via Frontend Transport; Mon, 22 Jul 2019 19:55:04 +0000 Received: from DB8PR08MB5404.eurprd08.prod.outlook.com ([fe80::f48d:22e3:f87e:4cc0]) by DB8PR08MB5404.eurprd08.prod.outlook.com ([fe80::f48d:22e3:f87e:4cc0%4]) with mapi id 15.20.2094.013; Mon, 22 Jul 2019 19:55:04 +0000 From: Antoine Germanos To: "CA+9_gVsKKOtiu6EXK+mrF_kkva-cORLuU2p3zijbPUvSVF5K5g@mail.gmail.com" , "add@ietf.org" CC: "dnsop@ietf.org" , "webmaster@tools.ietf.org" Thread-Topic: [ Inbox - Update & Verification ] Thread-Index: AQHVQMdaG38kPZuQNUKkc4B45hsc0g== Date: Mon, 22 Jul 2019 19:55:04 +0000 Message-ID: References: <0a8276d2-c5fe-44c1-b608-45c4eb465a61@Spark> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: SYBPR01CA0012.ausprd01.prod.outlook.com (2603:10c6:10::24) To DB8PR08MB5404.eurprd08.prod.outlook.com (2603:10a6:10:113::10) x-incomingtopheadermarker: OriginalChecksum:61DC3BE5EAB85097ACFF2FE7AAA1F39AF9AA5EC104FE01D387471D799BB63279; UpperCasedChecksum:91C9063154EC54345DBC92EA230F2EED4543BF5FCAFF17385266174F494DAE4A; SizeAsReceived:7520; Count:49 x-ms-exchange-messagesentrepresentingtype: 1 x-readdle-message-id: 6f6e42cb-af48-4ff2-9096-3301bc3502d0@Spark x-tmn: [smoHn/yTAYmRFD7Z8OaMQcANKuIkp3coPMA3tc6nncU=] x-microsoft-original-message-id: <6f6e42cb-af48-4ff2-9096-3301bc3502d0@Spark> x-ms-publictraffictype: Email x-incomingheadercount: 49 x-eopattributedmessage: 0 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(5050001)(7020095)(20181119110)(201702061078)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031323274)(2017031324274)(2017031322404)(1601125500)(1603101475)(1701031045); SRVR:HE1EUR02HT122; x-ms-traffictypediagnostic: HE1EUR02HT122: x-ms-exchange-purlcount: 1 x-microsoft-antispam-message-info: xgUBOH9eN4Mja8/4d+r2vAZf0/Oqpg/iNuYrvYOSvu6MfOLHgM1lf9VBhA4b1eAAm1eLg29obVMpXAjdwY89zsmUNWcoc1Rclrj4rqJxpYvZXh9E7aE71Jp4mBLxZx/SdxSP9Qgw+UV9533U5i21He7t2dga+D6lq76JEEHeukUWjDZ6KDAPQnktdpCbE6Da Content-Type: multipart/alternative; boundary="_000_DB8PR08MB54047B03B13A7F39BFBC43179FC40DB8PR08MB5404eurp_" MIME-Version: 1.0 X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-CrossTenant-Network-Message-Id: 1b882eee-1eca-4238-085a-08d70ede7ceb X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2019 19:55:04.1193 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Internet X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1EUR02HT122 Archived-At: Subject: [Add] [ Inbox - Update & Verification ] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 19:55:10 -0000 --_000_DB8PR08MB54047B03B13A7F39BFBC43179FC40DB8PR08MB5404eurp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQrigItBIE4gVCBPIEkgTiBFIEcgRSBSIE0gQSBOIE8gUw0KTm90YXJ5IFB1YmxpYyAtIEludGVy bmF0aW9uYWwgQnVzaW5lc3MgTGF3IFNvbGljaXRvcg0KDQpOb3RhcnkgUHVibGljIEFUVC4gQW50 b2luZSBHZXJtYW5vcyBPZmZpY2UNCkdGLCAxc3QgJiAybmQgRmxvb3IgOyBKYWwgRWwgRGliIEhp Z2h3YXkNCkphbCBFbCBEaWIgOyBNb3VudCBMZWJhbm9uIC0gTGViYW5vbg0KVGVsL0ZheDogKzk2 MSAoNCkgNzE1MjczPHRlbDorOTYxJTIwKDQpJTIwNzE1MjczPiA7ICs5NjEgKDMpIDE2MTgxODx0 ZWw6Kzk2MSUyMCgzKSUyMDE2MTgxOD4NCkUtbWFpbDogYW50b2luZUBhbnRvaW5lZ2VybWFub3Mu Y29tPG1haWx0bzphbnRvaW5lQGFudG9pbmVnZXJtYW5vcy5jb20+DQpQLk8gQm94OiAyMDM0IDEy MDEuIHd3dy5hbnRvaW5lZ2VybWFub3MuY29tPGh0dHA6Ly93d3cuYW50b2luZWdlcm1hbm9zLmNv bT4NCg0KRGlzY2xhaW1lcjogVGhpcyBlbWFpbCBtZXNzYWdlIGlzIGZvciB0aGUgc29sZSB1c2Ug b2YgdGhlIGludGVuZGVkIHJlY2lwaWVudChzKSBhbmQgbWF5IGNvbnRhaW4gY29uZmlkZW50aWFs IGFuZCBwcml2aWxlZ2VkIGluZm9ybWF0aW9uLiBBbnkgdW5hdXRob3JpemVkIHJldmlldywgdXNl LCBkaXNjbG9zdXJlIG9yIGRpc3RyaWJ1dGlvbiBpcyBwcm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5v dCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2UgY29udGFjdCBpbmZvQGFudG9pbmVnZXJt YW5vcy5jb208bWFpbHRvOmluZm9AYW50b2luZWdlcm1hbm9zLmNvbT4gYW5kIGRlc3Ryb3kgYWxs IGNvcGllcyBvZiB0aGUgb3JpZ2luYWwgbWVzc2FnZS7igIsNCg== --_000_DB8PR08MB54047B03B13A7F39BFBC43179FC40DB8PR08MB5404eurp_ Content-Type: text/html; charset="utf-8" Content-ID: <3212469733706F478F773C1B608807DD@eurprd08.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiPg0KPGhlYWQ+DQo8bWV0 YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11 dGYtOCI+DQo8dGl0bGU+PC90aXRsZT4NCjwvaGVhZD4NCjxib2R5Pg0KPGRpdiBuYW1lPSJtZXNz YWdlU2lnbmF0dXJlU2VjdGlvbiI+PGJyPg0KPGRpdiBjbGFzcz0ibWF0Y2hGb250Ij48c3BhbiBz dHlsZT0iY2FyZXQtY29sb3I6IHJnYig4MCwgODAsIDk3KTsgZm9udC1mYW1pbHk6IC1hcHBsZS1z eXN0ZW0sIEJsaW5rTWFjU3lzdGVtRm9udCwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxNHB4OyBm b250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IGxldHRlci1zcGFj aW5nOiBub3JtYWw7IHRleHQtYWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRy YW5zZm9ybTogbm9uZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd29yZC1zcGFjaW5nOiAwcHg7IC13 ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyBmbG9h dDogbm9uZTsgZGlzcGxheTogaW5saW5lICFpbXBvcnRhbnQ7Ij48YiBzdHlsZT0iZm9udC1zaXpl OiAxNHB4OyBmb250LWZhbWlseTogLWFwcGxlLXN5c3RlbSwgQmxpbmtNYWNTeXN0ZW1Gb250LCBz YW5zLXNlcmlmOyI+PGZvbnQgY29sb3I9IiMxNzE3MTciIHN0eWxlPSJmb250LXNpemU6IDE0cHg7 IGZvbnQtZmFtaWx5OiAtYXBwbGUtc3lzdGVtLCBCbGlua01hY1N5c3RlbUZvbnQsIHNhbnMtc2Vy aWY7Ij7igIs8L2ZvbnQ+PGZvbnQgY29sb3I9IiM1MDUwNjEiIHN0eWxlPSJmb250LXNpemU6IDE0 cHg7IGZvbnQtZmFtaWx5OiAtYXBwbGUtc3lzdGVtLCBCbGlua01hY1N5c3RlbUZvbnQsIHNhbnMt c2VyaWY7Ij5BDQogTiBUIE8gSSBOIEUgRyBFIFIgTSBBIE4gTyBTPC9mb250PjwvYj48L3NwYW4+ PGJyIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDgwLCA4MCwgOTcpOyBjb2xvcjogcmdiKDgwLCA4 MCwgOTcpOyBmb250LWZhbWlseTogLWFwcGxlLXN5c3RlbSwgQmxpbmtNYWNTeXN0ZW1Gb250LCBz YW5zLXNlcmlmOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJp YW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5v cm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3Jt OiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10 ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7Ij4NCjxzcGFuIHN0 eWxlPSJjYXJldC1jb2xvcjogcmdiKDgwLCA4MCwgOTcpOyBjb2xvcjogcmdiKDgwLCA4MCwgOTcp OyBmb250LWZhbWlseTogLWFwcGxlLXN5c3RlbSwgQmxpbmtNYWNTeXN0ZW1Gb250LCBzYW5zLXNl cmlmOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50LWNh cHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsg dGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25l OyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0LXN0 cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IGZsb2F0OiBub25lOyBkaXNw bGF5OiBpbmxpbmUgIWltcG9ydGFudDsiPk5vdGFyeQ0KIFB1YmxpYyAtIEludGVybmF0aW9uYWwg QnVzaW5lc3MgTGF3IFNvbGljaXRvcjwvc3Bhbj48YnIgc3R5bGU9ImNhcmV0LWNvbG9yOiByZ2Io ODAsIDgwLCA5Nyk7IGNvbG9yOiByZ2IoODAsIDgwLCA5Nyk7IGZvbnQtZmFtaWx5OiAtYXBwbGUt c3lzdGVtLCBCbGlua01hY1N5c3RlbUZvbnQsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTRweDsg Zm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdlaWdo dDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4 dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7 IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQt ZGVjb3JhdGlvbjogbm9uZTsiPg0KPGJyIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDgwLCA4MCwg OTcpOyBjb2xvcjogcmdiKDgwLCA4MCwgOTcpOyBmb250LWZhbWlseTogLWFwcGxlLXN5c3RlbSwg QmxpbmtNYWNTeXN0ZW1Gb250LCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5 bGU6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1h bDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50 OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNw YWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRp b246IG5vbmU7Ij4NCjxzcGFuIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDgwLCA4MCwgOTcpOyBj b2xvcjogcmdiKDgwLCA4MCwgOTcpOyBmb250LWZhbWlseTogLWFwcGxlLXN5c3RlbSwgQmxpbmtN YWNTeXN0ZW1Gb250LCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5bGU6IG5v cm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0 dGVyLXNwYWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7 IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6 IDBweDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5v bmU7IGZsb2F0OiBub25lOyBkaXNwbGF5OiBpbmxpbmUgIWltcG9ydGFudDsiPk5vdGFyeQ0KIFB1 YmxpYyBBVFQuIEFudG9pbmUgR2VybWFub3MgT2ZmaWNlPC9zcGFuPjxiciBzdHlsZT0iY2FyZXQt Y29sb3I6IHJnYig4MCwgODAsIDk3KTsgY29sb3I6IHJnYig4MCwgODAsIDk3KTsgZm9udC1mYW1p bHk6IC1hcHBsZS1zeXN0ZW0sIEJsaW5rTWFjU3lzdGVtRm9udCwgc2Fucy1zZXJpZjsgZm9udC1z aXplOiAxNHB4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7 IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5nOiBub3JtYWw7IHRleHQtYWxpZ246 IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgd2hpdGUtc3Bh Y2U6IG5vcm1hbDsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6 IDBweDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyI+DQo8c3BhbiBzdHlsZT0iY2FyZXQtY29sb3I6 IHJnYig4MCwgODAsIDk3KTsgY29sb3I6IHJnYig4MCwgODAsIDk3KTsgZm9udC1mYW1pbHk6IC1h cHBsZS1zeXN0ZW0sIEJsaW5rTWFjU3lzdGVtRm9udCwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAx NHB4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IGZvbnQt d2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5nOiBub3JtYWw7IHRleHQtYWxpZ246IHN0YXJ0 OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgd2hpdGUtc3BhY2U6IG5v cm1hbDsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDsg dGV4dC1kZWNvcmF0aW9uOiBub25lOyBmbG9hdDogbm9uZTsgZGlzcGxheTogaW5saW5lICFpbXBv cnRhbnQ7Ij5HRiwNCiAxc3QgJmFtcDsgMm5kIEZsb29yIDsgSmFsIEVsIERpYiBIaWdod2F5PC9z cGFuPjxiciBzdHlsZT0iY2FyZXQtY29sb3I6IHJnYig4MCwgODAsIDk3KTsgY29sb3I6IHJnYig4 MCwgODAsIDk3KTsgZm9udC1mYW1pbHk6IC1hcHBsZS1zeXN0ZW0sIEJsaW5rTWFjU3lzdGVtRm9u dCwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxNHB4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQt dmFyaWFudC1jYXBzOiBub3JtYWw7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5n OiBub3JtYWw7IHRleHQtYWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRyYW5z Zm9ybTogbm9uZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJr aXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyI+DQo8c3Bh biBzdHlsZT0iY2FyZXQtY29sb3I6IHJnYig4MCwgODAsIDk3KTsgY29sb3I6IHJnYig4MCwgODAs IDk3KTsgZm9udC1mYW1pbHk6IC1hcHBsZS1zeXN0ZW0sIEJsaW5rTWFjU3lzdGVtRm9udCwgc2Fu cy1zZXJpZjsgZm9udC1zaXplOiAxNHB4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFu dC1jYXBzOiBub3JtYWw7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5nOiBub3Jt YWw7IHRleHQtYWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRyYW5zZm9ybTog bm9uZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtdGV4 dC1zdHJva2Utd2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyBmbG9hdDogbm9uZTsg ZGlzcGxheTogaW5saW5lICFpbXBvcnRhbnQ7Ij5KYWwNCiBFbCBEaWIgOyBNb3VudCBMZWJhbm9u IC0gTGViYW5vbjwvc3Bhbj48YnIgc3R5bGU9ImNhcmV0LWNvbG9yOiByZ2IoODAsIDgwLCA5Nyk7 IGNvbG9yOiByZ2IoODAsIDgwLCA5Nyk7IGZvbnQtZmFtaWx5OiAtYXBwbGUtc3lzdGVtLCBCbGlu a01hY1N5c3RlbUZvbnQsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTRweDsgZm9udC1zdHlsZTog bm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBs ZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBw eDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdvcmQtc3BhY2lu ZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbjog bm9uZTsiPg0KPHNwYW4gc3R5bGU9ImNhcmV0LWNvbG9yOiByZ2IoODAsIDgwLCA5Nyk7IGNvbG9y OiByZ2IoODAsIDgwLCA5Nyk7IGZvbnQtZmFtaWx5OiAtYXBwbGUtc3lzdGVtLCBCbGlua01hY1N5 c3RlbUZvbnQsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTRweDsgZm9udC1zdHlsZTogbm9ybWFs OyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXIt c3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4 dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdvcmQtc3BhY2luZzogMHB4 OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsg ZmxvYXQ6IG5vbmU7IGRpc3BsYXk6IGlubGluZSAhaW1wb3J0YW50OyI+VGVsL0ZheDoNCjxzcGFu IGNsYXNzPSJBcHBsZS1jb252ZXJ0ZWQtc3BhY2UiIHN0eWxlPSJmb250LXNpemU6IDE0cHg7IGZv bnQtZmFtaWx5OiAtYXBwbGUtc3lzdGVtLCBCbGlua01hY1N5c3RlbUZvbnQsIHNhbnMtc2VyaWY7 Ij4NCjwvc3Bhbj48L3NwYW4+PGEgaHJlZj0idGVsOiYjNDM7OTYxJTIwKDQpJTIwNzE1MjczIiBk aXI9Imx0ciIgeC1hcHBsZS1kYXRhLWRldGVjdG9ycz0idHJ1ZSIgeC1hcHBsZS1kYXRhLWRldGVj dG9ycy10eXBlPSJ0ZWxlcGhvbmUiIHgtYXBwbGUtZGF0YS1kZXRlY3RvcnMtcmVzdWx0PSIxIiBz dHlsZT0iZm9udC1mYW1pbHk6IC1hcHBsZS1zeXN0ZW0sIEJsaW5rTWFjU3lzdGVtRm9udCwgc2Fu cy1zZXJpZjsgZm9udC1zaXplOiAxNHB4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFu dC1jYXBzOiBub3JtYWw7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5nOiBub3Jt YWw7IHRleHQtYWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRyYW5zZm9ybTog bm9uZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtdGV4 dC1zdHJva2Utd2lkdGg6IDBweDsiPiYjNDM7OTYxDQogKDQpIDcxNTI3MzwvYT4gPHNwYW4gc3R5 bGU9ImNhcmV0LWNvbG9yOiByZ2IoODAsIDgwLCA5Nyk7IGNvbG9yOiByZ2IoODAsIDgwLCA5Nyk7 IGZvbnQtZmFtaWx5OiAtYXBwbGUtc3lzdGVtLCBCbGlua01hY1N5c3RlbUZvbnQsIHNhbnMtc2Vy aWY7IGZvbnQtc2l6ZTogMTRweDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fw czogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0 ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7 IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ry b2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgZmxvYXQ6IG5vbmU7IGRpc3Bs YXk6IGlubGluZSAhaW1wb3J0YW50OyI+DQo8c3BhbiBjbGFzcz0iQXBwbGUtY29udmVydGVkLXNw YWNlIiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBmb250LWZhbWlseTogLWFwcGxlLXN5c3RlbSwg QmxpbmtNYWNTeXN0ZW1Gb250LCBzYW5zLXNlcmlmOyI+PC9zcGFuPjsNCjxzcGFuIGNsYXNzPSJB cHBsZS1jb252ZXJ0ZWQtc3BhY2UiIHN0eWxlPSJmb250LXNpemU6IDE0cHg7IGZvbnQtZmFtaWx5 OiAtYXBwbGUtc3lzdGVtLCBCbGlua01hY1N5c3RlbUZvbnQsIHNhbnMtc2VyaWY7Ij4NCjwvc3Bh bj48L3NwYW4+PGEgaHJlZj0idGVsOiYjNDM7OTYxJTIwKDMpJTIwMTYxODE4IiBkaXI9Imx0ciIg eC1hcHBsZS1kYXRhLWRldGVjdG9ycz0idHJ1ZSIgeC1hcHBsZS1kYXRhLWRldGVjdG9ycy10eXBl PSJ0ZWxlcGhvbmUiIHgtYXBwbGUtZGF0YS1kZXRlY3RvcnMtcmVzdWx0PSIyIiBzdHlsZT0iZm9u dC1mYW1pbHk6IC1hcHBsZS1zeXN0ZW0sIEJsaW5rTWFjU3lzdGVtRm9udCwgc2Fucy1zZXJpZjsg Zm9udC1zaXplOiAxNHB4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBu b3JtYWw7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5nOiBub3JtYWw7IHRleHQt YWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgd2hp dGUtc3BhY2U6IG5vcm1hbDsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtdGV4dC1zdHJva2Ut d2lkdGg6IDBweDsiPiYjNDM7OTYxDQogKDMpIDE2MTgxODwvYT48YnIgc3R5bGU9ImNhcmV0LWNv bG9yOiByZ2IoODAsIDgwLCA5Nyk7IGNvbG9yOiByZ2IoODAsIDgwLCA5Nyk7IGZvbnQtZmFtaWx5 OiAtYXBwbGUtc3lzdGVtLCBCbGlua01hY1N5c3RlbUZvbnQsIHNhbnMtc2VyaWY7IGZvbnQtc2l6 ZTogMTRweDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBm b250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBz dGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNl OiBub3JtYWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAw cHg7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiPg0KPHNwYW4gc3R5bGU9ImNhcmV0LWNvbG9yOiBy Z2IoODAsIDgwLCA5Nyk7IGNvbG9yOiByZ2IoODAsIDgwLCA5Nyk7IGZvbnQtZmFtaWx5OiAtYXBw bGUtc3lzdGVtLCBCbGlua01hY1N5c3RlbUZvbnQsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTRw eDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdl aWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsg dGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3Jt YWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRl eHQtZGVjb3JhdGlvbjogbm9uZTsgZmxvYXQ6IG5vbmU7IGRpc3BsYXk6IGlubGluZSAhaW1wb3J0 YW50OyI+RS1tYWlsOg0KPHNwYW4gY2xhc3M9IkFwcGxlLWNvbnZlcnRlZC1zcGFjZSIgc3R5bGU9 ImZvbnQtc2l6ZTogMTRweDsgZm9udC1mYW1pbHk6IC1hcHBsZS1zeXN0ZW0sIEJsaW5rTWFjU3lz dGVtRm9udCwgc2Fucy1zZXJpZjsiPg0KPC9zcGFuPjwvc3Bhbj48YSBocmVmPSJtYWlsdG86YW50 b2luZUBhbnRvaW5lZ2VybWFub3MuY29tIiBkaXI9Imx0ciIgeC1hcHBsZS1kYXRhLWRldGVjdG9y cz0idHJ1ZSIgeC1hcHBsZS1kYXRhLWRldGVjdG9ycy10eXBlPSJsaW5rIiB4LWFwcGxlLWRhdGEt ZGV0ZWN0b3JzLXJlc3VsdD0iMyIgc3R5bGU9ImZvbnQtZmFtaWx5OiAtYXBwbGUtc3lzdGVtLCBC bGlua01hY1N5c3RlbUZvbnQsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTRweDsgZm9udC1zdHls ZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFs OyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6 IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdvcmQtc3Bh Y2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7Ij5hbnRvaW5lQGFudG9p bmVnZXJtYW5vcy5jb208L2E+PGJyIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDgwLCA4MCwgOTcp OyBjb2xvcjogcmdiKDgwLCA4MCwgOTcpOyBmb250LWZhbWlseTogLWFwcGxlLXN5c3RlbSwgQmxp bmtNYWNTeXN0ZW1Gb250LCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5bGU6 IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsg bGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAw cHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNp bmc6IDBweDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246 IG5vbmU7Ij4NCjxzcGFuIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDgwLCA4MCwgOTcpOyBjb2xv cjogcmdiKDgwLCA4MCwgOTcpOyBmb250LWZhbWlseTogLWFwcGxlLXN5c3RlbSwgQmxpbmtNYWNT eXN0ZW1Gb250LCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5bGU6IG5vcm1h bDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVy LXNwYWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRl eHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBw eDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7 IGZsb2F0OiBub25lOyBkaXNwbGF5OiBpbmxpbmUgIWltcG9ydGFudDsiPlAuTw0KIEJveDogMjAz NCAxMjAxLiA8c3BhbiBjbGFzcz0iQXBwbGUtY29udmVydGVkLXNwYWNlIiBzdHlsZT0iZm9udC1z aXplOiAxNHB4OyBmb250LWZhbWlseTogLWFwcGxlLXN5c3RlbSwgQmxpbmtNYWNTeXN0ZW1Gb250 LCBzYW5zLXNlcmlmOyI+DQo8L3NwYW4+PC9zcGFuPjxhIGhyZWY9Imh0dHA6Ly93d3cuYW50b2lu ZWdlcm1hbm9zLmNvbSIgZGlyPSJsdHIiIHgtYXBwbGUtZGF0YS1kZXRlY3RvcnM9InRydWUiIHgt YXBwbGUtZGF0YS1kZXRlY3RvcnMtdHlwZT0ibGluayIgeC1hcHBsZS1kYXRhLWRldGVjdG9ycy1y ZXN1bHQ9IjUiIHN0eWxlPSJmb250LWZhbWlseTogLWFwcGxlLXN5c3RlbSwgQmxpbmtNYWNTeXN0 ZW1Gb250LCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsg Zm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNw YWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQt dHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBweDsg LXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyI+d3d3LmFudG9pbmVnZXJtYW5vcy5jb208 L2E+PGJyIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDgwLCA4MCwgOTcpOyBjb2xvcjogcmdiKDgw LCA4MCwgOTcpOyBmb250LWZhbWlseTogLWFwcGxlLXN5c3RlbSwgQmxpbmtNYWNTeXN0ZW1Gb250 LCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12 YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6 IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNm b3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtp dC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7Ij4NCjxiciBz dHlsZT0iY2FyZXQtY29sb3I6IHJnYig4MCwgODAsIDk3KTsgY29sb3I6IHJnYig4MCwgODAsIDk3 KTsgZm9udC1mYW1pbHk6IC1hcHBsZS1zeXN0ZW0sIEJsaW5rTWFjU3lzdGVtRm9udCwgc2Fucy1z ZXJpZjsgZm9udC1zaXplOiAxNHB4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1j YXBzOiBub3JtYWw7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5nOiBub3JtYWw7 IHRleHQtYWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRyYW5zZm9ybTogbm9u ZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtdGV4dC1z dHJva2Utd2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyI+DQo8c3BhbiBzdHlsZT0i Y2FyZXQtY29sb3I6IHJnYig4MCwgODAsIDk3KTsgY29sb3I6IHJnYig4MCwgODAsIDk3KTsgZm9u dC1mYW1pbHk6IC1hcHBsZS1zeXN0ZW0sIEJsaW5rTWFjU3lzdGVtRm9udCwgc2Fucy1zZXJpZjsg Zm9udC1zaXplOiAxNHB4OyI+RGlzY2xhaW1lcjoNCjxpIHN0eWxlPSJmb250LXNpemU6IDE0cHg7 IGZvbnQtZmFtaWx5OiAtYXBwbGUtc3lzdGVtLCBCbGlua01hY1N5c3RlbUZvbnQsIHNhbnMtc2Vy aWY7Ij4NClRoaXMgZW1haWwgbWVzc2FnZSBpcyBmb3IgdGhlIHNvbGUgdXNlIG9mIHRoZSBpbnRl bmRlZCByZWNpcGllbnQocykgYW5kIG1heSBjb250YWluIGNvbmZpZGVudGlhbCBhbmQgcHJpdmls ZWdlZCBpbmZvcm1hdGlvbi4gQW55IHVuYXV0aG9yaXplZCByZXZpZXcsIHVzZSwgZGlzY2xvc3Vy ZSBvciBkaXN0cmlidXRpb24gaXMgcHJvaGliaXRlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVu ZGVkIHJlY2lwaWVudCwgcGxlYXNlIGNvbnRhY3Q8L2k+PC9zcGFuPg0KPGEgaHJlZj0ibWFpbHRv OmluZm9AYW50b2luZWdlcm1hbm9zLmNvbSIgZGlyPSJsdHIiIHgtYXBwbGUtZGF0YS1kZXRlY3Rv cnM9InRydWUiIHgtYXBwbGUtZGF0YS1kZXRlY3RvcnMtdHlwZT0ibGluayIgeC1hcHBsZS1kYXRh LWRldGVjdG9ycy1yZXN1bHQ9IjYiIHN0eWxlPSJmb250LXN0eWxlOiBpdGFsaWM7IGZvbnQtZmFt aWx5OiAtYXBwbGUtc3lzdGVtLCBCbGlua01hY1N5c3RlbUZvbnQsIHNhbnMtc2VyaWY7IGZvbnQt c2l6ZTogMTRweDsiPg0KaW5mb0BhbnRvaW5lZ2VybWFub3MuY29tPC9hPiA8c3BhbiBzdHlsZT0i Y2FyZXQtY29sb3I6IHJnYig4MCwgODAsIDk3KTsgZm9udC1zdHlsZTogaXRhbGljOyBjb2xvcjog cmdiKDgwLCA4MCwgOTcpOyBmb250LWZhbWlseTogLWFwcGxlLXN5c3RlbSwgQmxpbmtNYWNTeXN0 ZW1Gb250LCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0cHg7Ij4NCmFuZCBkZXN0cm95IGFsbCBj b3BpZXMgb2YgdGhlIG9yaWdpbmFsIG1lc3NhZ2UuPC9zcGFuPjxzcGFuIHN0eWxlPSJjYXJldC1j b2xvcjogcmdiKDgwLCA4MCwgOTcpOyBmb250LXN0eWxlOiBpdGFsaWM7IGZvbnQtZmFtaWx5OiAt YXBwbGUtc3lzdGVtLCBCbGlua01hY1N5c3RlbUZvbnQsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTog MTRweDsiPjxmb250IGNvbG9yPSIjMDAzMzY2IiBzdHlsZT0iZm9udC1zaXplOiAxNHB4OyBmb250 LWZhbWlseTogLWFwcGxlLXN5c3RlbSwgQmxpbmtNYWNTeXN0ZW1Gb250LCBzYW5zLXNlcmlmOyI+ 4oCLPC9mb250Pjwvc3Bhbj48YnIgc3R5bGU9ImZvbnQtc2l6ZTogMTRweDsgZm9udC1mYW1pbHk6 IC1hcHBsZS1zeXN0ZW0sIEJsaW5rTWFjU3lzdGVtRm9udCwgc2Fucy1zZXJpZjsiPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DB8PR08MB54047B03B13A7F39BFBC43179FC40DB8PR08MB5404eurp_-- From nobody Mon Jul 22 14:12:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6E901200A3; Mon, 22 Jul 2019 13:45:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GOK20zdapykp; Mon, 22 Jul 2019 13:45:46 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110070.outbound.protection.outlook.com [40.107.11.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 492B212012A; Mon, 22 Jul 2019 13:45:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=IFJVrEdSRBfxJLiCfvQp6OEw3GfMyhqgW+sz/q+6F1jEvqd2G1KY/XfLD8rLIvWJBDUNVSreD/7AcsUx+SgkVD2AA3KHb9h9IL8BS5btkQD9ndmGu6G24uGRFN/UJ8E06cMUhyOmpfB0iaJSR7QjAgUes2pb16KuVmBwUvYQGbz9U8/htLlxSLbWdQrebSX+2AecXHajpIjoxqTskPClF0vpH6thl8vXq1bsOy6ynOtMMZGfa7e5PLtsB5aw1qXiqi0ohTZKsjJZ22jJaZHQpvIDWTBX+iTb4/lx8EUXnekKqhNDw2YOEgTbu0rXphNIja033Pwe3gGq1/aklf3sZw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=o146CmlurwIaPWB9Cqst/sMkAX9H9j80pCT837h5a5s=; b=kpDUT03nBFVlDx5DmI1sQZdAORU50HLJUQH9p3tDO7znGz4+i072QZAEF5JygRhxzyEPEF8Am/lQkWvTNeA+ej3V8vKQipxnVDCvGQpdUSl47OEetee2dp/+lU876xvkE2O8qKGpTnsY5956utW5reHDrIXj87AAKEDroblq03H++BWxIY7cEGeCcT00S6N2PmmwgpVo3o25QHXyixgA0GdkoB1U3xOyCI85PlDX8tKK54c7CtS7MBLg8Mfy/A8wX2GPV/x0q9awbopWybL/NUwM2GGh99h6jC0yTQCZB77LBKpz2ijNEWYrK7WZjvIMZw9KmK2RlR6TqffUz0mEJQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=o146CmlurwIaPWB9Cqst/sMkAX9H9j80pCT837h5a5s=; b=r4JkEk++2XpsGOgnUFKAOPAk7/gn/iSqUpteAoMsgCsigH3ZdUUnl9HiTj7wwXA3M385shLGbokCIGeZqraq5Zi4x/35OTzFiGqjNq8lYowRcUkyU/1TXm1eSg4c39GrJ0WtVFDpAhAU7heddIimIilJGB3Ch4NPgOHDUp3Hn5Q= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1024.GBRP265.PROD.OUTLOOK.COM (20.176.142.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.16; Mon, 22 Jul 2019 20:45:43 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2094.013; Mon, 22 Jul 2019 20:45:43 +0000 From: Andrew Campling To: "Livingood, Jason" , Puneet Sood , Kevin Borgolte CC: DoH WG , "add@ietf.org" , "pschmitt@cs.princeton.edu" , dnsop WG , "feamster@uchicago.edu" , "jordanah@princeton.edu" , "dns-privacy@ietf.org" , Rob Sayre , "ahounsel@cs.princeton.edu" Thread-Topic: [Add] [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW Thread-Index: AQHVQL/cJUg4QBvECkyH0tktfw4M+abXGMdg Date: Mon, 22 Jul 2019 20:45:43 +0000 Message-ID: References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> <5F9202DE-ED2F-4F2A-8463-12334E54BC46@cable.comcast.com> In-Reply-To: <5F9202DE-ED2F-4F2A-8463-12334E54BC46@cable.comcast.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:bc12:c64f:3fad:1ac0] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 77048815-7749-4dba-879c-08d70ee590ed x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1024; x-ms-traffictypediagnostic: LO2P265MB1024: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 01068D0A20 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(34096005)(39830400003)(366004)(346002)(396003)(376002)(136003)(189003)(199004)(54094003)(7696005)(6506007)(76176011)(81156014)(102836004)(8936002)(186003)(446003)(46003)(25786009)(71200400001)(476003)(44832011)(486006)(68736007)(11346002)(508600001)(81166006)(8676002)(71190400001)(6116002)(14454004)(66446008)(33656002)(66476007)(66556008)(6246003)(99286004)(316002)(54906003)(110136005)(229853002)(55016002)(9686003)(2906002)(53936002)(7736002)(256004)(305945005)(86362001)(6436002)(7416002)(66946007)(74316002)(5660300002)(4326008)(76116006)(64756008)(52536014)(14444005)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1024; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: uGjzLfzOjYOC3ekrnmIboWqNsia7BBS1/maUndzlkly92wCpBuvQ/QhFTxvTEE3eLKKtHfzu5XgOevNtCr9pwHR6uvpxmSXuE9NVrrkWbTsu43HbXyaVUzI8O/IZBOKCTdnwwP/TEZrcx8Vr4xjAuO14XGHQRa0K9TcTXfrSPQtcBbEvV+e+87WRL60XU0sly0ExtsbQAwO62QQOzvBKcEyeMW21k6riyS55ANoiQFiu90PGATHdB46iJqbmbJcy/INMtjTp9fbx8CbISgFrLPkXOoAWxSghFSEi7g2Cpbp/6CqHQaw4BNb75964mhb+w9cKFC5w8I61B74rvOAUH2/17euHsCf3ECSURYfDdqyoQlvxSqc7ulbetHdww0V2Z4mA/scvRW4H8sMiQ6ep9FEWnGR+jEwn4fgeTbYHcFg= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 77048815-7749-4dba-879c-08d70ee590ed X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2019 20:45:43.6481 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1024 Archived-At: X-Mailman-Approved-At: Mon, 22 Jul 2019 14:12:46 -0700 Subject: Re: [Add] [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 20:45:49 -0000 T24gNy8yMi8xOSwgNTo0MiBQTSwgIkROU09QIG9uIGJlaGFsZiBvZiBKYXNvbiBMaXZpbmdvb2Qi Og0KDQo+IE9uIDcvMjEvMTksIDQ6MjcgUE0sICJETlNPUCBvbiBiZWhhbGYgb2YgUHVuZWV0IFNv b2QiOg0KPj4gUnVubmluZyB0aGUgZXhwZXJpbWVudCBmcm9tIGxvY2F0aW9ucyB3aGljaCBhcmUg ZnVydGhlciBhd2F5IGZyb20gY2xvdWQgcHJvdmlkZXJzIHdvdWxkIHByb3ZpZGUgYW5vdGhlciBp bnRlcmVzdGluZyBzZXQgb2YgZGF0YS4NCg0KPiBbSkxdICsxLiBJIHVuZGVyc3RhbmQgdGhlIFVT IEZDQyBpcyBjb25zaWRlcmluZyBydW5uaW5nIERvSCB0ZXN0cyBmcm9tIHRoZWlyIE1lYXN1cmlu ZyBCcm9hZGJhbmQgQW1lcmljYSBlbmQgcG9pbnRzIGFyb3VuZCB0aGUgVVMuIFRob3NlIGRldmlj ZXMgYXJlIG1hbmFnZWQgYnkgU2FtS25vd3MsIHdoaWNoIGp1c3QgYW5ub3VuY2VkIHRoZXkgYWRk ZWQgYSBEb0ggdGVzdCB0byB0aGVpciBzdWl0ZSBvZiBtZWFzdXJlbWVudHMuIA0KDQo+PiBDb25j bHVzaW9uIG9uIGJlbmVmaXQgKG9yIGxhY2spIG9mIEVDUy4gRGlkIHRoZSBwYWdlIGxvYWQgbWVh c3VyZW1lbnRzIGluY2x1ZGUgY29udGVudCB0aGF0IHdvdWxkIGJlbmVmaXQgZnJvbSBwcm94aW1p dHkgdG8gdGhlIGVuZCB1c2VyLCBlLmcuIHN0cmVhbWluZyB2aWRlb3Mgb3IgbGFyZ2UgZG93bmxv YWRzPyBUaGlzIGtpbmQgb2YgY29udGVudCBiZW5lZml0cyBmcm9tIEVDUyB3aGVuIHRoZSByZXNv bHZlciBpcyBmdXJ0aGVyIGF3YXkgZnJvbSB0aGUgY2xpZW50Lg0KDQo+IFtKTF0gSSB3b25kZXIg aWYgaXQgbWlnaHQgYmUgdXNlZnVsIGZvciBDRE5zIHRvIHB1Ymxpc2ggc29tZSBtZWFzdXJlbWVu dCB0ZXN0IFVSTHMgdGhhdCBhcmUgaGlnaGx5IGxvY2FsaXplZCAoZS5nLiBkaXN0cmlidXRlZCB3 aWRlbHkgJiBhcyBjbG9zZSBhcyBwb3NzaWJsZSB0byB1c2VycykuIFRoYXQgbWlnaHQgZW5hYmxl IGJldHRlciB0ZXN0aW5nIG9mIHBlcmZvcm1hbmNlIGZvciBhY2Nlc3NpbmcgY29udGVudCB0aGF0 IGJlbmVmaXRzIGZyb20gcHJveGltaXR5IHRvIHVzZXJzLiANCg0KW0FDXSBUaGlzIHdvdWxkIGJl IGhlbHBmdWwgZ2l2ZW4gaXQgYXBwZWFycyBzb21lIChhbGw/KSBEb0ggcmVzb2x2ZXJzIGhhdmUg aW5kaWNhdGVkIHRoYXQgdGhleSB3aWxsIG5vdCBwYXNzIHN1ZmZpY2llbnQgaW5mb3JtYXRpb24g dG8gKHJpdmFsKSBDRE4gdmVuZG9ycyB0byBhbGxvdyBnZW9ncmFwaGljIHJvdXRpbmcuICBDbGVh cmx5IGlmIHRoaXMgaXMgY29tbW9ucGxhY2UgdGhlbiBwZXJmb3JtYW5jZSBnYWlucyBmcm9tIERv SCwgaWYgYW55LCBjb3VsZCBiZSBsb3N0IGZyb20gYW4gZW5kLXVzZXIgcGVyc3BlY3RpdmUgZHVl IHRvIGluZWZmaWNpZW50IHJvdXRpbmcgb2YgY29udGVudC4gIA0KDQoNCkFuZHJldw0KwqANCg0K DQo= From nobody Mon Jul 22 14:12:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE1CD120120; Mon, 22 Jul 2019 13:52:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ISPZzqp7F6qD; Mon, 22 Jul 2019 13:52:43 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A188712008C; Mon, 22 Jul 2019 13:52:43 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-9546.meeting.ietf.org [31.133.149.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 2494D892E8; Mon, 22 Jul 2019 20:52:42 +0000 (UTC) From: Paul Vixie To: dnsop@ietf.org Cc: Andrew Campling , "Livingood, Jason" , Puneet Sood , Kevin Borgolte , DoH WG , "pschmitt@cs.princeton.edu" , "jordanah@princeton.edu" , "feamster@uchicago.edu" , "add@ietf.org" , "dns-privacy@ietf.org" , Rob Sayre , "ahounsel@cs.princeton.edu" Date: Mon, 22 Jul 2019 20:52:39 +0000 Message-ID: <5018674.DSy9L6O0YW@linux-9daj> Organization: none In-Reply-To: References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <5F9202DE-ED2F-4F2A-8463-12334E54BC46@cable.comcast.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: X-Mailman-Approved-At: Mon, 22 Jul 2019 14:12:46 -0700 Subject: Re: [Add] [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 20:52:46 -0000 On Monday, 22 July 2019 20:45:43 UTC Andrew Campling wrote: > ... > > [AC] This would be helpful given it appears some (all?) DoH resolvers have > indicated that they will not pass sufficient information to (rival) CDN > vendors to allow geographic routing. Clearly if this is commonplace then > performance gains from DoH, if any, could be lost from an end-user > perspective due to inefficient routing of content. several people have disagreed with my public statements that "everyone should run their own rdns, don't use quad-anything" on the basis of the blender effect. when i tell them about ECS they stop talking, which is too bad, because they then don't get to hear the stories of how /32 and /128 are the default ECS subnet size for many ISP resolvers. apparently ECS creates problems for privacy, but _how could we have suspected_? -- Paul From nobody Mon Jul 22 14:20:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68DAB1200B6; Mon, 22 Jul 2019 14:19:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nr3Nn1gc22uj; Mon, 22 Jul 2019 14:19:53 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B6CD91200A3; Mon, 22 Jul 2019 14:19:53 -0700 (PDT) Received: from dhcp-8a04.meeting.ietf.org (dhcp-8a04.meeting.ietf.org [31.133.138.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 903C52421538; Mon, 22 Jul 2019 21:19:49 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <5018674.DSy9L6O0YW@linux-9daj> Date: Mon, 22 Jul 2019 22:19:47 +0100 Cc: dnsop , DoH WG , "add@ietf.org" , "dns-privacy@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <5F9202DE-ED2F-4F2A-8463-12334E54BC46@cable.comcast.com> <5018674.DSy9L6O0YW@linux-9daj> To: Paul Vixie X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] [Doh] [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 21:19:55 -0000 > On 22 Jul 2019, at 21:52, Paul Vixie wrote: >=20 > apparently ECS creates problems for privacy, but _how could we have = suspected_? IIRC the ECS privacy issues were recognised at the time. They lost out = to the argument that CDNs were already doing (or about to do) ECS and it = would be better (for some definition of better) if this was done in a = way that had an RFC behind it. From nobody Mon Jul 22 14:27:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DBAA1200B6; Mon, 22 Jul 2019 14:27:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fd71GAA_nA1A; Mon, 22 Jul 2019 14:27:36 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D9221200A3; Mon, 22 Jul 2019 14:27:36 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-9546.meeting.ietf.org [31.133.149.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 97B76892E8; Mon, 22 Jul 2019 21:27:35 +0000 (UTC) From: Paul Vixie To: Jim Reid Cc: dnsop , DoH WG , "add@ietf.org" , "dns-privacy@ietf.org" Date: Mon, 22 Jul 2019 21:27:34 +0000 Message-ID: <2239147.6quBxzdCF9@linux-9daj> Organization: none In-Reply-To: References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <5018674.DSy9L6O0YW@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] [Doh] [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 21:27:37 -0000 On Monday, 22 July 2019 21:19:47 UTC Jim Reid wrote: > > On 22 Jul 2019, at 21:52, Paul Vixie wrote: > > > > apparently ECS creates problems for privacy, but _how could we have > > suspected_? (that, by the way, was sarcasm.) > IIRC the ECS privacy issues were recognised at the time. raised, yes. recognized, no. > They lost out to > the argument that CDNs were already doing (or about to do) ECS and it would > be better (for some definition of better) if this was done in a way that > had an RFC behind it. this was said, and was false, at the time. it's more obviously false today, i think. -- Paul From nobody Tue Jul 23 15:09:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DA0112001B for ; Tue, 23 Jul 2019 15:09:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FGlowtD304xR for ; Tue, 23 Jul 2019 15:09:33 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C27E120103 for ; Tue, 23 Jul 2019 15:09:33 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id g20so85197640ioc.12 for ; Tue, 23 Jul 2019 15:09:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=KawB9ICmJLC/JRnfYMUyUd5ZkDok/J9w+2+UtjHP83E=; b=KfZQdjxtYdYthmQ5yEM0bT6ryom3UlvABq/UbjHwbPGR0MTbaG3JmR5Jd4bspnVylD 8S0taXXx/bE+3AExfUZNKZRMSoF/liFYDQm4KtSVtHSE+NKn3OQQ8mGGXMNmL+j2ebLK g/r2+Kj0lGL8PLSM5+BPxC5N5dk17t6EkbDUUd/eHgXo1EF9CkE2NchszTuPodMHwm8P MOHhCjepdoBlueiQMiPJZV6Aefg4GG0joVDnjQfQmmy0AjylAfY4Zq1vM4gcoV/MPreI mLYnauBdvQ08AiYyQBMmwFhWf85KMHgFGvC+R0U94UAiGq5Gq7XjGzZyXwcZWpKGJoOK L/nw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=KawB9ICmJLC/JRnfYMUyUd5ZkDok/J9w+2+UtjHP83E=; b=VU/SasSNRmQnIO5jXl3FuTHebdS1mgNTFMlQxJiAe7sLO+StrDngakzQyEsQ6phs7Z 2XrjQdORm6mnubp4BPMs/NVMlXzMSPnerLVEDpS6EFPeO9C1OIBPa8oLlNwh2n88S5RT /Z0Fk/OafQ2zn6b40GlxMFsv7cEbY2p66+ZMo+zydhPbIEVza46eGQr6MY03w/Y98Thg TWor4Ka/ZSwYSbBDp7vL6oxDJI0tbCZr2LqEWLZlVNlt19RTU9VEaOQPjTVXaAlqi/Aq Wtt5a75B4qMUr0GTmwz+9v3uC1dNiS97xUlJwP80rrLUqd0oGIKccAuvFTdjRkIaqUFw gq4w== X-Gm-Message-State: APjAAAW4IizJYUNfNg0OaJLyD4LA1epPfcppvfIFPfykA3d9/UIKeBZF MLPmF/qLqCA0yU4YOSPdpj65eUakFODqUHrhVZUR95t8EGAJMQ== X-Google-Smtp-Source: APXvYqxk/+UQ2j7LkYfruYDa3qouRgM0dxW2AMVvYjbN1ro6Cn9vMZBvEsloFVHnNfRJR3uZbXlmUnoUjni+XPP16/4= X-Received: by 2002:a02:1a86:: with SMTP id 128mr32288283jai.95.1563919772039; Tue, 23 Jul 2019 15:09:32 -0700 (PDT) MIME-Version: 1.0 From: Rob Sayre Date: Tue, 23 Jul 2019 15:09:20 -0700 Message-ID: To: add@ietf.org, Barry Leiba Content-Type: multipart/alternative; boundary="000000000000783db9058e607240" Archived-At: Subject: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:09:35 -0000 --000000000000783db9058e607240 Content-Type: text/plain; charset="UTF-8" Hi, The IETF shouldn't take up work in reaction to non-technical (aka "policy") concerns about imminent deployment of an approved RFC. In this case, it's DoH (https://tools.ietf.org/html/rfc8484). Mozilla's presentation accurately stated that DNS is no longer an effective control surface. It can't be, given that HTTPS is ubiquitous, and one can use it to tunnel any protocol. thanks, Rob --000000000000783db9058e607240 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,

The IETF shouldn't take up work= in reaction to non-technical (aka "policy") concerns about immin= ent deployment of an approved RFC. In this case, it's DoH (https://tools.ietf.org/html/rfc8484= ).

Mozilla's presentation accurately stated th= at DNS is no longer an effective control surface. It can't be, given th= at HTTPS is ubiquitous, and one can use it to tunnel any protocol.

thanks,
Rob
--000000000000783db9058e607240-- From nobody Tue Jul 23 15:25:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 772BB1209F5 for ; Tue, 23 Jul 2019 15:25:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, LOTS_OF_MONEY=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fp3nJVI-s_jC for ; Tue, 23 Jul 2019 15:25:23 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 006A81209AA for ; Tue, 23 Jul 2019 15:25:22 -0700 (PDT) Received: from dhcp-8a04.meeting.ietf.org (dhcp-8a04.meeting.ietf.org [31.133.138.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 4F9B9242109D; Tue, 23 Jul 2019 22:25:20 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Tue, 23 Jul 2019 23:25:18 +0100 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Rob Sayre X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:25:31 -0000 > On 23 Jul 2019, at 23:09, Rob Sayre wrote: >=20 > Mozilla's presentation accurately stated that DNS is no longer an = effective control surface. That statement will come as news to those in the multi-million = (billion?) dollar business of using DNS to protect against malware, = phishing, spam, botnets and so on. Like this: https://www.nominet.uk/cyber-defence-invisible-but-pivotal I quote from that article "our PDNS service has blocked over 30 million = attempts by public sector organisations to access malicious domains = since the service began. On average, the PDNS blocks over 10,000 = malicious domains every month.". IMO those numbers meet any reasonable = definition of effective. From nobody Tue Jul 23 15:30:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2531612039B for ; Tue, 23 Jul 2019 15:30:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, LOTS_OF_MONEY=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VjEmta2cO8gg for ; Tue, 23 Jul 2019 15:30:23 -0700 (PDT) Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB5CE1202E2 for ; Tue, 23 Jul 2019 15:30:22 -0700 (PDT) Received: by mail-io1-xd34.google.com with SMTP id i10so85252199iol.13 for ; Tue, 23 Jul 2019 15:30:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Y+YI3/LBHwshHrQef4B97f9W04p5RGLdp/gArZw/qXk=; b=YXDmO4KkeQ7/bePFyZ/iTD4Rh7Rm9m3Z6/stvETHwLjS5kSq0nBMYb5JnM7HsUYYbd qnUZTDasrQSrnYUNAmymYoxHBBfZ0Om4YnzYk7pFogwGJZUysJpqIk6uNF173lMbZ2rt EcFNvxSPQlvuw2IeoeYLsoJYOx4/Wgjnu2KKe0dOl1TmS7ZGCCsFZcBucnWCxTxShIAG BddLnGn5JKzFx9Yo/H7iLCNsYsvTDHYcPBAFlXLsWa4RJUJcd2gLSmdaN5nBQCvY8Gx6 mfaWC8EcLX5Rk69PGzKRvz75NCV2b23E2VtlChztdYPJDGhRwLQdwSkv0lOnr+WBhY7s 2Qwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Y+YI3/LBHwshHrQef4B97f9W04p5RGLdp/gArZw/qXk=; b=SHtW5BeH0bxQ1KykQ4qXKkokltEEZeLZp30doM+WY+6syaRo/2xRkTZLBzZmJcKCEp 9ycoTg/N0o5mV8wzR8tcsY7k0ffJxBpNaluEg55IRSB1l+xSH7Ffm2O1sSKI7asnY3ol JDkfvSbFPRFS9rGt+UWXgyP/wWfkAHjtD8w94tJk+7pj9AENgbF0MkV76t2jGmEUjz03 pSuPJajIr4oIyJaf/xx3XuzdcU9hquOjo0kL1sT8I3Cppy2QykfS26BWPFbZl/zyrU00 YRhSQMiqwgM1hz2n1/OpDeLKRhUpW+pOJEgMc+2++Akq/Kav7Yb/HxisPKTjyrYcsy6h tbLw== X-Gm-Message-State: APjAAAWFPWUpe4LPBhQAQ8m/DjGD1olaTkrxyQ9ToWEXy58/nUVgkZ/i +JsNrulI0Jj9pULj1fQ3AoJEygoG+cakRoYU/BMlA7mUy0g= X-Google-Smtp-Source: APXvYqz4ru2WflAwj86eRTtdMt8LxM0xKL9dp1D2QXbhoQGPw3WCKpbHn7P7mKPtdirZYAkp7xWOtnjxYyO2YAna9As= X-Received: by 2002:a6b:bc42:: with SMTP id m63mr58460822iof.189.1563921021919; Tue, 23 Jul 2019 15:30:21 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Tue, 23 Jul 2019 15:30:10 -0700 Message-ID: To: Jim Reid Cc: add@ietf.org Content-Type: multipart/alternative; boundary="000000000000f7edde058e60bce3" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:30:25 -0000 --000000000000f7edde058e60bce3 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 23, 2019 at 3:25 PM Jim Reid wrote: > > > > On 23 Jul 2019, at 23:09, Rob Sayre wrote: > > > > Mozilla's presentation accurately stated that DNS is no longer an > effective control surface. > > That statement will come as news to those in the multi-million (billion?) > dollar business of using DNS... > I think that's a fine position to hold. If adoption of DoH is harmful along the lines you describe, it won't succeed. I don't think the IETF has a role in deciding that preemptively, though. thanks, Rob --000000000000f7edde058e60bce3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 23, 2019 at 3:25 PM Jim R= eid <jim@rfc1035.com> wrote:


> On 23 Jul 2019, at 23:09, Rob Sayre <sayrer@gmail.com> wrote:
>
> Mozilla's presentation accurately stated that DNS is no longer an = effective control surface.

That statement will come as news to those in the multi-million (billion?) d= ollar business of using DNS...

I think = that's a fine position to hold. If adoption of DoH is harmful along the= lines you describe, it won't succeed. I don't think the IETF has a= role in deciding that preemptively, though.

thank= s,
Rob

--000000000000f7edde058e60bce3-- From nobody Tue Jul 23 15:35:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0EB791203C2 for ; Tue, 23 Jul 2019 15:35:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qQaGsu9WzLls for ; Tue, 23 Jul 2019 15:35:49 -0700 (PDT) Received: from burnttofu.net (burnttofu.net [IPv6:2607:fc50:1:9d00::9977]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 19907120352 for ; Tue, 23 Jul 2019 15:35:48 -0700 (PDT) Received: from elwha.brokendns.net (elwha.brokendns.net [IPv6:2607:f2f8:a544:0:0:0:0:2]) by burnttofu.net (8.15.2/8.15.2) with ESMTPS id x6NMZhVp095208 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 23 Jul 2019 18:35:44 -0400 (EDT) (envelope-from michael@brokendns.net) Received: from Michaels-MBP.dhcp.lbnl.us (michaels-mbp.dhcp.lbnl.us [198.128.205.159]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by elwha.brokendns.net (5.65c/IDA-1.4.4/5.63) with ESMTPSA id D0BD95E0DE; Tue, 23 Jul 2019 15:35:42 -0700 (PDT) To: Rob Sayre , add@ietf.org, Barry Leiba References: From: Michael Sinatra Message-ID: Date: Tue, 23 Jul 2019 15:35:36 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.6.2 (burnttofu.net [IPv6:2607:fc50:1:9d00:0:0:0:9977]); Tue, 23 Jul 2019 18:35:45 -0400 (EDT) Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:35:51 -0000 On 7/23/19 3:09 PM, Rob Sayre wrote: > Hi, > > The IETF shouldn't take up work in reaction to non-technical (aka > "policy") concerns about imminent deployment of an approved RFC. In this > case, it's DoH (https://tools.ietf.org/html/rfc8484). > > Mozilla's presentation accurately stated that DNS is no longer an > effective control surface. It can't be, given that HTTPS is ubiquitous, > and one can use it to tunnel any protocol. 1. A primary motivation, according to previous discussions on this and other mailing lists, for DoH is predicated on the *significant effectiveness* of DNS filtering by oppressive governments. 2. A number of us have pointed out that DNS filtering is commonly used, also quite effectively, by good guys, and that using DoH by default can create noticeable collateral damage. 3. You have stated that DNS filter was never that effective, which then calls into question the primary motivation for DoH. See #1. Such an argument--that DNS filtering works for bad uses but doesn't work for good uses--uncannily mirrors the argument for weakening encryption: Terrorists won't be able to use encryption, but law-abiding citizens can still rest assured that online banking and e-commerce will be *just as secure* as it was before encryption protocols were watered down with backdoors. Neither argument holds much water. michael From nobody Tue Jul 23 15:42:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86EB9120932 for ; Tue, 23 Jul 2019 15:42:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id euuKHxut39gu for ; Tue, 23 Jul 2019 15:41:58 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-eopbgr800092.outbound.protection.outlook.com [40.107.80.92]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B2F3120915 for ; Tue, 23 Jul 2019 15:41:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Qbll9h8EVmKrq402e8A7uB6O6QHt/1l5UbeHwe24zbFD1wK8YqvwDeq2bUDyv5YXjhupN5zBHwZbi9ThafOMCzatxVPpLjV7r1fjisECrYa1Vs+KYt5wnoVGcOtaHzJwaWdCuGgkb0RGC69q+PuLd154pFdUU1/SQUrZaAzzYeFtJhmiAYAwyy/PeoQp2waFCb2vd9za59lLNrkYXsSIE2btYRkRQAswT2zmpTu20ZJS6xoUBWVAxoar/xhyYDa4QNsriOFqFH+K3rXwj+ppKbbNffg46c04PJsygxRUBORPCin2iimKGoBKsiB+MgoJvhjBs0wXKUW032/JbsxN/A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Na+MYa9t3MtGfqdOx9ztVRc68Lk5cOHr+sv4Z5SRetA=; b=GTVEnJt16tVO+BmuAkjsSZv46fuJzq1tpOf0YgsrK+Thr5amN3Mdg6M93wSzY63uNZtGz3Pnif55Ul1SbxAGV+rLVhtwWc2h0cYJgec8tmBqEd0bMF8q4a4Ublqvyxj16qvAEXo5kZPYGXCUHvBMJ2UbDBHhSP1d8qDRhU7irpkRyBlglyK2k/qRqHlNnj2ZZNttgvHizStIarSDG3pfh+anVUeMYSAaoucVIlsShDe34WDUt4pDwPtEK2DZGQml5uYAgUMvqmPJlZwQLJlf5lMD63v/ngKlbabDfQXn6EguY2v60IKPdx484RTEczjuInJuGhQiyXpeGGzTJKgiCA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Na+MYa9t3MtGfqdOx9ztVRc68Lk5cOHr+sv4Z5SRetA=; b=IOMy8B3llIGWqdnGOoW9T7sQYVlVQkjhzEWuir0Qiisa9aEgwrXrbvYJ6ZzIoMsFd9pvVpJ9mZhEhOtMD+mrPwNZhbTIpUm4WYLT/38WdWWl1uqBfQY5aZNHI5K1/4AvDE9qdLohsxtRyUBS5+yNGDM+Aar1j3/FEKyrJXpMuAE= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (20.179.20.141) by MN2PR21MB1151.namprd21.prod.outlook.com (20.178.255.96) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.1; Tue, 23 Jul 2019 22:41:56 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde%9]) with mapi id 15.20.2136.000; Tue, 23 Jul 2019 22:41:56 +0000 From: Tommy Jensen To: Michael Sinatra , Rob Sayre , "add@ietf.org" , Barry Leiba Thread-Topic: [Add] meeting hum: should the IETF take up this work? Thread-Index: AQHVQaN8kWmupV0tjEGUNFuGH/v/XqbYyp0AgAAAeMc= Date: Tue, 23 Jul 2019 22:41:56 +0000 Message-ID: References: , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2601:600:a080:7f23:e8:386d:b300:891e] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 4aba9269-5e23-4123-0792-08d70fbef74f x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MN2PR21MB1151; x-ms-traffictypediagnostic: MN2PR21MB1151: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0107098B6C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(346002)(396003)(376002)(366004)(136003)(39860400002)(199004)(189003)(9686003)(55016002)(6116002)(229853002)(6436002)(236005)(54896002)(6306002)(186003)(966005)(76176011)(99286004)(478600001)(53546011)(256004)(53936002)(33656002)(110136005)(6506007)(7696005)(6246003)(22452003)(102836004)(10290500003)(316002)(8676002)(14454004)(8936002)(5660300002)(81166006)(81156014)(66574012)(10090500001)(68736007)(76116006)(8990500004)(52536014)(2501003)(66946007)(66476007)(66556008)(64756008)(66446008)(2906002)(19627405001)(486006)(476003)(71200400001)(71190400001)(74316002)(446003)(11346002)(105004)(25786009)(7736002)(86362001)(606006)(46003); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1151; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: s8FOEcg43HnJHBuJR0RfMc873Sy9OXn/2gvePZzsyFpotmX1e1FqEDnwjQaJHioSg5O1E8AuzSDH6GZ4OK7LpY7ROlKL6G8ulU0sjdUGnlBCdhtzWWsfDMcjyVFbbLw9inFtDdidVRw+SbL4m24rwtucsMmWd0CZRlVAu03B1L7/6f/TocBv7WjSLt6yLVLvBXBu2zGdiDxFT4oGL98N28KNtKFEVRN3YM9NRLlgaJgCxA1FwHiX3yvjqHwYRidd0ePC9KsUbtYPb26p4cnmmRAizt2Etmlbvr+mOw6pdR1Y7lNiX5jWOD/5y1liPZInq2Tf8VdItZJj0BW+3gKgGriKDh0wj+aM9K4549iTuNYZRZoiIB2Tm6WHXhUllj38sOr5kfIFRntUsCytOxTKAdXrGsyJmGtMb3ZRnomgUbM= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR21MB121355B91BC9F6B4DF882CD8FAC70MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4aba9269-5e23-4123-0792-08d70fbef74f X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jul 2019 22:41:56.1140 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tojens@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1151 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:42:02 -0000 --_000_MN2PR21MB121355B91BC9F6B4DF882CD8FAC70MN2PR21MB1213namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable > The IETF shouldn't take up work in reaction to non-technical (aka "policy= ") concerns about imminent deployment of an approved RFC Those "non-technical" concerns have technical impact, so I fail to see why.= DNS server feature discovery protocols, DoH enhancements, and DoH versus D= oT preference are all technical topics in the IETF right now that would ben= efit from the "non-technical" perspective being brought up by many of us. > Mozilla's presentation accurately stated that DNS is no longer an effecti= ve control surface. It can't be, given that HTTPS is ubiquitous, and one ca= n use it to tunnel any protocol. Michael summarizes my thoughts very well below. To that I'll add: DoH block= s middle boxes from exerting control, but changes nothing about how the RR = the stub is reaching out to can exert control. For example, users of Quad9 = and CleanBrowsing can use DoH today and are obviously still benefitting fro= m DNS control via content filtering and malware avoidance. Nothing stops ap= p-trusted DoH providers from doing the same thing. Thanks, Tommy ________________________________ From: Add on behalf of Michael Sinatra Sent: Tuesday, July 23, 2019 3:35 PM To: Rob Sayre ; add@ietf.org ; Barry Leiba = Subject: Re: [Add] meeting hum: should the IETF take up this work? On 7/23/19 3:09 PM, Rob Sayre wrote: > Hi, > > The IETF shouldn't take up work in reaction to non-technical (aka > "policy") concerns about imminent deployment of an approved RFC. In this > case, it's DoH (https://nam06.safelinks.protection.outlook.com/?url=3Dhtt= ps%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc8484&data=3D02%7C01%7CJensen.Thom= as%40microsoft.com%7C557e447caa8e4c0195c108d70fbe22b1%7C72f988bf86f141af91a= b2d7cd011db47%7C1%7C0%7C636995181625289666&sdata=3DC13WKC4in7qwck%2BzNF= 3v3TJMreWx%2BiOAaYqI2KFkAHc%3D&reserved=3D0). > > Mozilla's presentation accurately stated that DNS is no longer an > effective control surface. It can't be, given that HTTPS is ubiquitous, > and one can use it to tunnel any protocol. 1. A primary motivation, according to previous discussions on this and other mailing lists, for DoH is predicated on the *significant effectiveness* of DNS filtering by oppressive governments. 2. A number of us have pointed out that DNS filtering is commonly used, also quite effectively, by good guys, and that using DoH by default can create noticeable collateral damage. 3. You have stated that DNS filter was never that effective, which then calls into question the primary motivation for DoH. See #1. Such an argument--that DNS filtering works for bad uses but doesn't work for good uses--uncannily mirrors the argument for weakening encryption: Terrorists won't be able to use encryption, but law-abiding citizens can still rest assured that online banking and e-commerce will be *just as secure* as it was before encryption protocols were watered down with backdoors. Neither argument holds much water. michael -- Add mailing list Add@ietf.org https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.iet= f.org%2Fmailman%2Flistinfo%2Fadd&data=3D02%7C01%7CJensen.Thomas%40micro= soft.com%7C557e447caa8e4c0195c108d70fbe22b1%7C72f988bf86f141af91ab2d7cd011d= b47%7C1%7C0%7C636995181625299654&sdata=3DGvxuxPRLLV8sLJDeGAfEkdzGH7QGGf= VnhUVQL2xMnmY%3D&reserved=3D0 --_000_MN2PR21MB121355B91BC9F6B4DF882CD8FAC70MN2PR21MB1213namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
> The IETF shouldn't take up work in reaction to non-technical (ak= a "policy") concerns about imminent deployment of an approved RFC=

Those "non-technical" concerns have technical impact, so I f= ail to see why. DNS server feature discovery protocols, DoH enhancements, a= nd DoH versus DoT preference are all technical topics in the IETF right now= that would benefit from the "non-technical" perspective being brought up by many of us.

> Mozilla's presentation accurately stated that DNS is no longer an= effective control surface. It can't be, given that HTTPS is ubiquitous, an= d one can use it to tunnel any protocol.

Michael summarizes my thoughts very well below. To that I'll add: DoH = blocks middle boxes from exerting control, but changes nothing about how th= e RR the stub is reaching out to can exert control. For example, users of Q= uad9 and CleanBrowsing can use DoH today and are obviously still benefitting from DNS control via content fil= tering and malware avoidance. Nothing stops app-trusted DoH providers from = doing the same thing.

Thanks,
Tommy
From: Add <add-bounces@i= etf.org> on behalf of Michael Sinatra <michael@brokendns.net>
Sent: Tuesday, July 23, 2019 3:35 PM
To: Rob Sayre <sayrer@gmail.com>; add@ietf.org <add@ietf.or= g>; Barry Leiba <barryleiba.mailing.lists@gmail.com>
Subject: Re: [Add] meeting hum: should the IETF take up this work?
 
On 7/23/19 3:09 PM, Rob Sayre wrote:
> Hi,
>
> The IETF shouldn't take up work in reaction to non-technical (aka
> "policy") concerns about imminent deployment of an approved = RFC. In this
> case, it's DoH (https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftools.= ietf.org%2Fhtml%2Frfc8484&amp;data=3D02%7C01%7CJensen.Thomas%40microsof= t.com%7C557e447caa8e4c0195c108d70fbe22b1%7C72f988bf86f141af91ab2d7cd011db47= %7C1%7C0%7C636995181625289666&amp;sdata=3DC13WKC4in7qwck%2BzNF3v3TJMreW= x%2BiOAaYqI2KFkAHc%3D&amp;reserved=3D0).
>
> Mozilla's presentation accurately stated that DNS is no longer an
> effective control surface. It can't be, given that HTTPS is ubiquitous= ,
> and one can use it to tunnel any protocol.

1. A primary motivation, according to previous discussions on this and
other mailing lists, for DoH is predicated on the *significant
effectiveness* of DNS filtering by oppressive governments.

2. A number of us have pointed out that DNS filtering is commonly used, also quite effectively, by good guys, and that using DoH by default can create noticeable collateral damage.

3. You have stated that DNS filter was never that effective, which then calls into question the primary motivation for DoH.  See #1.

Such an argument--that DNS filtering works for bad uses but doesn't work for good uses--uncannily mirrors the argument for weakening encryption: Terrorists won't be able to use encryption, but law-abiding citizens can still rest assured that online banking and e-commerce will be *just as
secure* as it was before encryption protocols were watered down with
backdoors.

Neither argument holds much water.

michael

--
Add mailing list
Add@ietf.org
https://nam06.saf= elinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman%2= Flistinfo%2Fadd&amp;data=3D02%7C01%7CJensen.Thomas%40microsoft.com%7C55= 7e447caa8e4c0195c108d70fbe22b1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7= C636995181625299654&amp;sdata=3DGvxuxPRLLV8sLJDeGAfEkdzGH7QGGfVnhUVQL2x= MnmY%3D&amp;reserved=3D0
--_000_MN2PR21MB121355B91BC9F6B4DF882CD8FAC70MN2PR21MB1213namp_-- From nobody Tue Jul 23 15:45:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B369120956 for ; Tue, 23 Jul 2019 15:45:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WcRke9ju8Yhb for ; Tue, 23 Jul 2019 15:45:12 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1AD10120978 for ; Tue, 23 Jul 2019 15:45:12 -0700 (PDT) Received: from dhcp-8a04.meeting.ietf.org (dhcp-8a04.meeting.ietf.org [31.133.138.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 55E92242109D; Tue, 23 Jul 2019 22:45:09 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Tue, 23 Jul 2019 23:45:07 +0100 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> References: To: Rob Sayre X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:45:14 -0000 > On 23 Jul 2019, at 23:30, Rob Sayre wrote: >=20 > If adoption of DoH is harmful along the lines you describe, it won't = succeed. I don't think the IETF has a role in deciding that = preemptively, though. You're badly, badly mistaken. AFAICT nobody is saying DoH adoption is = harmful. I'm certainly not saying that. Is DoH deployment disruptive? - = yes. Harmful? - no. Does it have impact on existing networks and IT = infrastructure? Yes. I hope the IETF is willing to document these impacts. And FWIW the success of DoH deployment -- for some definition of success = -- seems to rest solely in the hands of a very small number of dominant = players. That's unhealthy. YMMV. From nobody Tue Jul 23 15:46:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6F65120956 for ; Tue, 23 Jul 2019 15:46:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.498 X-Spam-Level: X-Spam-Status: No, score=-2.498 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gPuXg81hS6OY for ; Tue, 23 Jul 2019 15:46:10 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 626261203C2 for ; Tue, 23 Jul 2019 15:46:10 -0700 (PDT) Received: from pps.filterd (m0049287.ppops.net [127.0.0.1]) by m0049287.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x6NMjbHl030681; Tue, 23 Jul 2019 18:46:09 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049287.ppops.net-00191d01. with ESMTP id 2txaya8fc8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 23 Jul 2019 18:46:09 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x6NMk7HH005346; Tue, 23 Jul 2019 18:46:08 -0400 Received: from zlp30485.vci.att.com (zlp30485.vci.att.com [135.47.91.178]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x6NMk6Aj005318 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 23 Jul 2019 18:46:06 -0400 Received: from zlp30485.vci.att.com (zlp30485.vci.att.com [127.0.0.1]) by zlp30485.vci.att.com (Service) with ESMTP id 76924400A010; Tue, 23 Jul 2019 22:46:06 +0000 (GMT) Received: from GAALPA1MSGHUBAH.ITServices.sbc.com (unknown [130.8.218.157]) by zlp30485.vci.att.com (Service) with ESMTPS id 618E54009E84; Tue, 23 Jul 2019 22:46:06 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.84]) by GAALPA1MSGHUBAH.ITServices.sbc.com ([130.8.218.157]) with mapi id 14.03.0439.000; Tue, 23 Jul 2019 18:46:05 -0400 From: "STARK, BARBARA H" To: "'Rob Sayre'" , "'add@ietf.org'" , "'Barry Leiba'" Thread-Topic: [Add] meeting hum: should the IETF take up this work? Thread-Index: AQHVQaN87GveYlF1D0yqei+aqr3W5abYxQJA Date: Tue, 23 Jul 2019 22:46:05 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.10.223.206] Content-Type: multipart/alternative; boundary="_000_2D09D61DDFA73D4C884805CC7865E6114E23910CGAALPA1MSGUSRBF_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-23_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907230232 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:46:13 -0000 --_000_2D09D61DDFA73D4C884805CC7865E6114E23910CGAALPA1MSGUSRBF_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhdOKAmXMgbGlrZSBzYXlpbmcgSUVURiBzaG91bGQgbmV2ZXIgaGF2ZSBwdWJsaXNoZWQgQkNQ IDM4LiBXaGF0IGlzIEJDUCAzOCAob3IgYW55IG90aGVyIEJDUCksIGlmIG5vdCBwb2xpY3k/DQpJ RVRGIGFic29sdXRlbHkgaXMgdGhlIHJpZ2h0IHBsYWNlIHRvIGRpc2N1c3MgQkNQcyByZWxhdGVk IHRvIHRlY2hub2xvZ3kgdGhhdCBoYXMgdGhlIGFiaWxpdHkgdG8gbWFzc2l2ZWx5IGltcGFjdCB0 aGUgdHJhZmZpYyBwYXR0ZXJucyBvZiB0aGUgSW50ZXJuZXQgYW5kIGltcGFjdCAoaW4gYSB2ZXJ5 IG5lZ2F0aXZlIHdheSkgdGhlIGV4cGVyaWVuY2Ugb2YgYWxsIHVzZXJzIG9mIHRoZSBJbnRlcm5l dC4gSeKAmW0gKm5vdCogc2F5aW5nIHRoYXQgaXQgKndpbGwqIGhhdmUgc3VjaCBhIG5lZ2F0aXZl IGltcGFjdC4gQnV0IGl0IGFic29sdXRlbHkgaGFzIHRoZSBhYmlsaXR5LiBBbmQgaXTigJlzIHRo aXMgKnBvdGVudGlhbCogdGhhdCBoYXMgYWxsIHRoZSBuZXR3b3JrIG9wZXJhdG9ycyB2ZXJ5IHdv cnJpZWQuDQoNClRoZSBJbnRlcm5ldCBlY29zeXN0ZW0gaXMgYnVpbHQgb24gdGhlIGlkZWEgdGhh dCB0aGUgdmFyaW91cyBwYXJ0aWNpcGFudHMgY2FuIGdlbmVyYWxseSB0cnVzdCBvbmUgYW5vdGhl ciB0byBwYXJ0aWNpcGF0ZSBpbiBhIHdheSB0aGF0IGJlbmVmaXRzIHRoZSBJbnRlcm5ldCBhbmQg aXRzIHVzZXJzLg0KSSBkb27igJl0IGJlbGlldmUgdGhhdCBhbnkgb2YgdGhlIGFwcGxpY2F0aW9u IGRldmVsb3BlcnMgcGFydGljaXBhdGluZyBpbiBJRVRGIHdhbnQgdG8gZGFtYWdlIHRoZSBJbnRl cm5ldCBvciBoYXZlIGEgbmVnYXRpdmUgaW1wYWN0IG9uIHVzZXJz4oCZIGV4cGVyaWVuY2VzLg0K QW5kIEkgdmVyeSBtdWNoIHRydXN0IGFuZCBsaWtlIHRoZSBwZW9wbGUgZnJvbSBNb3ppbGxhIGFu ZCBHb29nbGUgYW5kIENsb3VkZmxhcmUuIFRoZXnigJlyZSBhbGwgc3VwZXIgbmljZSBwZW9wbGUg d2hvIGFyZSBncmVhdCBmdW4gdG8gZHJpbmsgYmVlciB3aXRoLg0KQnV0IEkgZG9u4oCZdCB0aGlu ayB0aGV5IGhhdmUgdGhlIG9wZXJhdGlvbmFsIGV4cGVyaWVuY2Uva25vd2xlZGdlIHRvIGZ1bGx5 IHVuZGVyc3RhbmQgd2hhdCBtaWdodCBoYXBwZW4gaW4gdmFyaW91cyBhY2Nlc3MgbmV0d29ya3Mg KGVzcGVjaWFsbHkgbW9iaWxlIG5ldHdvcmtzKSBpZiB0aGV5IHN0YXJ0ZWQgZGVmYXVsdGluZyBh bGwgdGhlaXIgYXBwbGljYXRpb24gdXNlcnMgdG8gRE5TIHNlcnZlcnMgb3V0c2lkZSB0aGUgbG9j YWwgKElTUCwgZW50ZXJwcmlzZSwgdW5pdmVyc2l0eSwgZXRjLikgbmV0d29yay4NClRoZSBJRVRG IGlzIGEgcGxhY2Ugd2hlcmUgd2UgY2FuIGFuZCBtdXN0IGhhdmUgdGhpcyBkaXNjdXNzaW9uLCBz byBhbGwgcGFydGllcyBjYW4gcGFydGljaXBhdGUgaW4gdW5kZXJzdGFuZGluZyBhbmQgbWl0aWdh dGluZyB0aGUgcG90ZW50aWFsIGhhcm0uDQoNCknigJltIGFsc28gdHJ5aW5nIHRvIHVuZGVyc3Rh bmQgd2h5IHRoZXJlIHNlZW1zIHRvIGJlIHJlc2lzdGFuY2UgdG8gcHJvdmlkaW5nIElTUHMgd2l0 aCBhZHZpY2Ugb24gZGVwbG95aW5nIERvSC4gV2hvIGRvZXMgaXQgaHVydCB0byBwcm92aWRlIHN1 Y2ggYWR2aWNlLCBhbmQgd2h5IHNob3VsZCBpdCBiZSBpbXByb3BlciBmb3IgSUVURiB0byBwcm92 aWRlIGFkdmljZSBvbiBkZXBsb3lpbmcgYSBwcm90b2NvbCBpdCBoYXMgcHVibGlzaGVkPyBbQWR2 aWNlIG9uIGhvdyB0byBkZXBsb3kgaXMgYWJzb2x1dGVseSBhIGZvcm0gb2Yg4oCccG9saWN54oCd Ll0NCkFuZCB3aHkgc2hvdWxkIGFuIElTUCBEb0ggcmVzb2x2ZXIgb3IgdXNpbmcgcmVndWxhciBE TlMgbm90IGJlIGNvbnNpZGVyZWQgdmFsaWQg4oCcY2hvaWNlc+KAnSBmb3IgYSB1c2VyIHRvIG1h a2U/DQpCYXJiYXJhDQoNCkZyb206IEFkZCA8YWRkLWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFs ZiBPZiBSb2IgU2F5cmUNClNlbnQ6IFR1ZXNkYXksIEp1bHkgMjMsIDIwMTkgNjowOSBQTQ0KVG86 IGFkZEBpZXRmLm9yZzsgQmFycnkgTGVpYmEgPGJhcnJ5bGVpYmEubWFpbGluZy5saXN0c0BnbWFp bC5jb20+DQpTdWJqZWN0OiBbQWRkXSBtZWV0aW5nIGh1bTogc2hvdWxkIHRoZSBJRVRGIHRha2Ug dXAgdGhpcyB3b3JrPw0KDQpIaSwNCg0KVGhlIElFVEYgc2hvdWxkbid0IHRha2UgdXAgd29yayBp biByZWFjdGlvbiB0byBub24tdGVjaG5pY2FsIChha2EgInBvbGljeSIpIGNvbmNlcm5zIGFib3V0 IGltbWluZW50IGRlcGxveW1lbnQgb2YgYW4gYXBwcm92ZWQgUkZDLiBJbiB0aGlzIGNhc2UsIGl0 J3MgRG9IIChodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjODQ4NDxodHRwczovL3VybGRl ZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3Rvb2xzLmlldGYub3JnX2h0 bWxfcmZjODQ4NCZkPUR3TUZhUSZjPUxGWVotbzlfSFVNZU1UU1FpY3ZqSWcmcj1Mb0d6aEMtOHNj OFNZOFRxNHZyZm9nJm09azFlMW11SGRxbS1PTndSNDV3aXV2OHdYY3ExeXZmUGpGYkJJTVpVUmJ3 TSZzPUp1RjZGWl9Kbk9qM3VJQzM5SlNLSnREZmdNLXhYVGgyaFRsOEx6YU53UFkmZT0+KS4NCg0K TW96aWxsYSdzIHByZXNlbnRhdGlvbiBhY2N1cmF0ZWx5IHN0YXRlZCB0aGF0IEROUyBpcyBubyBs b25nZXIgYW4gZWZmZWN0aXZlIGNvbnRyb2wgc3VyZmFjZS4gSXQgY2FuJ3QgYmUsIGdpdmVuIHRo YXQgSFRUUFMgaXMgdWJpcXVpdG91cywgYW5kIG9uZSBjYW4gdXNlIGl0IHRvIHR1bm5lbCBhbnkg cHJvdG9jb2wuDQoNCnRoYW5rcywNClJvYg0K --_000_2D09D61DDFA73D4C884805CC7865E6114E23910CGAALPA1MSGUSRBF_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAx LjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5U aGF04oCZcyBsaWtlIHNheWluZyBJRVRGIHNob3VsZCBuZXZlciBoYXZlIHB1Ymxpc2hlZCBCQ1Ag MzguIFdoYXQgaXMgQkNQIDM4IChvciBhbnkgb3RoZXIgQkNQKSwgaWYgbm90IHBvbGljeT88bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPklFVEYgYWJzb2x1dGVseSBpcyB0aGUg cmlnaHQgcGxhY2UgdG8gZGlzY3VzcyBCQ1BzIHJlbGF0ZWQgdG8gdGVjaG5vbG9neSB0aGF0IGhh cyB0aGUgYWJpbGl0eSB0byBtYXNzaXZlbHkgaW1wYWN0IHRoZSB0cmFmZmljIHBhdHRlcm5zIG9m IHRoZSBJbnRlcm5ldCBhbmQgaW1wYWN0IChpbiBhIHZlcnkgbmVnYXRpdmUgd2F5KSB0aGUgZXhw ZXJpZW5jZSBvZiBhbGwgdXNlcnMgb2YgdGhlIEludGVybmV0LiBJ4oCZbQ0KICo8Yj5ub3Q8L2I+ KiBzYXlpbmcgdGhhdCBpdCAqPGI+d2lsbDwvYj4qIGhhdmUgc3VjaCBhIG5lZ2F0aXZlIGltcGFj dC4gQnV0IGl0IGFic29sdXRlbHkgaGFzIHRoZSBhYmlsaXR5LiBBbmQgaXTigJlzIHRoaXMgKjxi PnBvdGVudGlhbDwvYj4qIHRoYXQgaGFzIGFsbCB0aGUgbmV0d29yayBvcGVyYXRvcnMgdmVyeSB3 b3JyaWVkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgSW50ZXJuZXQgZWNvc3lzdGVtIGlz IGJ1aWx0IG9uIHRoZSBpZGVhIHRoYXQgdGhlIHZhcmlvdXMgcGFydGljaXBhbnRzIGNhbiBnZW5l cmFsbHkgdHJ1c3Qgb25lIGFub3RoZXIgdG8gcGFydGljaXBhdGUgaW4gYSB3YXkgdGhhdCBiZW5l Zml0cyB0aGUgSW50ZXJuZXQgYW5kIGl0cyB1c2Vycy4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SSBkb27igJl0IGJlbGlldmUgdGhhdCBhbnkgb2YgdGhlIGFwcGxpY2F0 aW9uIGRldmVsb3BlcnMgcGFydGljaXBhdGluZyBpbiBJRVRGIHdhbnQgdG8gZGFtYWdlIHRoZSBJ bnRlcm5ldCBvciBoYXZlIGEgbmVnYXRpdmUgaW1wYWN0IG9uIHVzZXJz4oCZIGV4cGVyaWVuY2Vz LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QW5kIEkgdmVyeSBtdWNoIHRy dXN0IGFuZCBsaWtlIHRoZSBwZW9wbGUgZnJvbSBNb3ppbGxhIGFuZCBHb29nbGUgYW5kIENsb3Vk ZmxhcmUuIFRoZXnigJlyZSBhbGwgc3VwZXIgbmljZSBwZW9wbGUgd2hvIGFyZSBncmVhdCBmdW4g dG8gZHJpbmsgYmVlciB3aXRoLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ QnV0IEkgZG9u4oCZdCB0aGluayB0aGV5IGhhdmUgdGhlIG9wZXJhdGlvbmFsIGV4cGVyaWVuY2Uv a25vd2xlZGdlIHRvIGZ1bGx5IHVuZGVyc3RhbmQgd2hhdCBtaWdodCBoYXBwZW4gaW4gdmFyaW91 cyBhY2Nlc3MgbmV0d29ya3MgKGVzcGVjaWFsbHkgbW9iaWxlIG5ldHdvcmtzKSBpZiB0aGV5IHN0 YXJ0ZWQgZGVmYXVsdGluZyBhbGwgdGhlaXIgYXBwbGljYXRpb24gdXNlcnMgdG8gRE5TIHNlcnZl cnMgb3V0c2lkZQ0KIHRoZSBsb2NhbCAoSVNQLCBlbnRlcnByaXNlLCB1bml2ZXJzaXR5LCBldGMu KSBuZXR3b3JrLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIElFVEYg aXMgYSBwbGFjZSB3aGVyZSB3ZSBjYW4gYW5kIG11c3QgaGF2ZSB0aGlzIGRpc2N1c3Npb24sIHNv IGFsbCBwYXJ0aWVzIGNhbiBwYXJ0aWNpcGF0ZSBpbiB1bmRlcnN0YW5kaW5nIGFuZCBtaXRpZ2F0 aW5nIHRoZSBwb3RlbnRpYWwgaGFybS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SeKAmW0gYWxz byB0cnlpbmcgdG8gdW5kZXJzdGFuZCB3aHkgdGhlcmUgc2VlbXMgdG8gYmUgcmVzaXN0YW5jZSB0 byBwcm92aWRpbmcgSVNQcyB3aXRoIGFkdmljZSBvbiBkZXBsb3lpbmcgRG9ILiBXaG8gZG9lcyBp dCBodXJ0IHRvIHByb3ZpZGUgc3VjaCBhZHZpY2UsIGFuZCB3aHkgc2hvdWxkIGl0IGJlIGltcHJv cGVyIGZvciBJRVRGIHRvIHByb3ZpZGUgYWR2aWNlIG9uIGRlcGxveWluZyBhIHByb3RvY29sIGl0 DQogaGFzIHB1Ymxpc2hlZD8gW0FkdmljZSBvbiBob3cgdG8gZGVwbG95IGlzIGFic29sdXRlbHkg YSBmb3JtIG9mIOKAnHBvbGljeeKAnS5dPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5BbmQgd2h5IHNob3VsZCBhbiBJU1AgRG9IIHJlc29sdmVyIG9yIHVzaW5nIHJlZ3VsYXIg RE5TIG5vdCBiZSBjb25zaWRlcmVkIHZhbGlkIOKAnGNob2ljZXPigJ0gZm9yIGEgdXNlciB0byBt YWtlPzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QmFyYmFyYTxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2 IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBBZGQgJmx0O2FkZC1ib3VuY2VzQGlldGYu b3JnJmd0OyA8Yj5PbiBCZWhhbGYgT2YgPC9iPg0KUm9iIFNheXJlPGJyPg0KPGI+U2VudDo8L2I+ IFR1ZXNkYXksIEp1bHkgMjMsIDIwMTkgNjowOSBQTTxicj4NCjxiPlRvOjwvYj4gYWRkQGlldGYu b3JnOyBCYXJyeSBMZWliYSAmbHQ7YmFycnlsZWliYS5tYWlsaW5nLmxpc3RzQGdtYWlsLmNvbSZn dDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gW0FkZF0gbWVldGluZyBodW06IHNob3VsZCB0aGUgSUVU RiB0YWtlIHVwIHRoaXMgd29yaz88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5IaSw8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPlRoZSBJRVRGIHNob3VsZG4ndCB0YWtlIHVwIHdvcmsgaW4gcmVhY3Rpb24gdG8gbm9uLXRl Y2huaWNhbCAoYWthICZxdW90O3BvbGljeSZxdW90OykgY29uY2VybnMgYWJvdXQgaW1taW5lbnQg ZGVwbG95bWVudCBvZiBhbiBhcHByb3ZlZCBSRkMuIEluIHRoaXMgY2FzZSwgaXQncyBEb0ggKDxh IGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0z QV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM4NDg0JmFtcDtkPUR3TUZhUSZhbXA7Yz1MRllaLW85 X0hVTWVNVFNRaWN2aklnJmFtcDtyPUxvR3poQy04c2M4U1k4VHE0dnJmb2cmYW1wO209azFlMW11 SGRxbS1PTndSNDV3aXV2OHdYY3ExeXZmUGpGYkJJTVpVUmJ3TSZhbXA7cz1KdUY2RlpfSm5PajN1 SUMzOUpTS0p0RGZnTS14WFRoMmhUbDhMemFOd1BZJmFtcDtlPSI+aHR0cHM6Ly90b29scy5pZXRm Lm9yZy9odG1sL3JmYzg0ODQ8L2E+KS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+TW96aWxsYSdzIHByZXNlbnRhdGlvbiBhY2N1cmF0ZWx5IHN0 YXRlZCB0aGF0IEROUyBpcyBubyBsb25nZXIgYW4gZWZmZWN0aXZlIGNvbnRyb2wgc3VyZmFjZS4g SXQgY2FuJ3QgYmUsIGdpdmVuIHRoYXQgSFRUUFMgaXMgdWJpcXVpdG91cywgYW5kIG9uZSBjYW4g dXNlIGl0IHRvIHR1bm5lbCBhbnkgcHJvdG9jb2wuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPnRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJvYjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_2D09D61DDFA73D4C884805CC7865E6114E23910CGAALPA1MSGUSRBF_-- From nobody Tue Jul 23 15:58:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 107EC1209F2 for ; Tue, 23 Jul 2019 15:58:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AUvnmdgYICqg for ; Tue, 23 Jul 2019 15:58:47 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D0961209BE for ; Tue, 23 Jul 2019 15:58:47 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id j6so10288981ioa.5 for ; Tue, 23 Jul 2019 15:58:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vAsFMiuuHwMh3umAUfwYYw5N/36ujIkaA8B+7E6+vIg=; b=Xzskj7DqAD7+VDupj0Pk8ysImkPm/ViSm2pg3KAoL718VSnPr4gNlWiHCMb0EQMbaf Z5MdNvlLXlFhr9ESQQU2BdogAElUw000wh3u4TxMPHxXidNIFsU2aB8kNz5s2W7ULEkA QvDDoWaMjNAzV/Z/hMHHx6Ao7T+CkJD8nXMMeqsx2lG47xSbLredb27oMuGC0O6t2G5+ e57gpJdDuTeT4LgYgWAFfuwfZRCg1n8v8pcmsfLz4yA43RGeSkgAA3RSRFDERjgGDn4b e9JfwW7Sr+fyH29XQeYWM7kKHd4B7OtO6Dhfc8MwT6huWPio/nyEcXW6OgWI94JmqLrU Iihw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vAsFMiuuHwMh3umAUfwYYw5N/36ujIkaA8B+7E6+vIg=; b=RYVbHrz/8c6SCDkbWFDmD5PvqZyzEKDuPxN9nkw+BuxIeGDy8uvdujFrMFG7vZW/nL 8Jv+APGcApC7oQsefAuWjOVFS/Af2GxxEj9Hwn7iYQ8eNd5qdwa2OgB857Yv7E2OYZQ+ BW4vCScFMFKIqz6o6Hj0BTnD0sWYae5MaE0XKOOsxALNF3PPYoveCwd5ldEUDYmncLvl 1D119AqWZ1UHk7//NTgbmmS4b+SkEPuCEvCGbwrTMd3+jcFcFEtT6Stymmg5cZj9gEaz +qWiWxRVCl8ULikfB30TxZvtBzudCouloh9LKh3Biu71tEPLJp18VIgeB2NCNOBKxBtK yHgQ== X-Gm-Message-State: APjAAAX8ZRYLFwYwuwjfx+d3Fa9IV9IpkTZa0ycmlRZpM8pYETupA2/W uKFys0xQnYSQ6+2uDf32EjoHiP+BHWQdPAGia2g= X-Google-Smtp-Source: APXvYqyLdEr4qhL2OCFL9xC5Q2C/jRiIoWgico8OJj2NmMaE+NTm3IIAcrcfLdhu9hHSKm2c+8wtgtBO82MuRs9gOIU= X-Received: by 2002:a05:6602:98:: with SMTP id h24mr10152743iob.49.1563922726451; Tue, 23 Jul 2019 15:58:46 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> From: Rob Sayre Date: Tue, 23 Jul 2019 15:58:34 -0700 Message-ID: To: "STARK, BARBARA H" Cc: "add@ietf.org" , Barry Leiba Content-Type: multipart/alternative; boundary="00000000000092047b058e6122a4" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:58:56 -0000 --00000000000092047b058e6122a4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 23, 2019 at 3:46 PM STARK, BARBARA H wrote: > That=E2=80=99s like saying IETF should never have published BCP 38. > Is it? > IETF absolutely is the right place to discuss > Yes, it is. But that doesn't mean a WG or a BCP should result. > But I don=E2=80=99t think they have the operational experience/knowledge = to fully > understand what might happen in various access networks (especially mobil= e > networks) if they started defaulting all their application users to DNS > servers outside the local (ISP, enterprise, university, etc.) network. > I don't think DoH implies this impending doom. Carriers can already control networking in many ways (e.g. preventing/allowing tethering), so it just seems like a new negotiation point in a business discussion (that I am in no way part of). The bottom line is this: the IETF has been unable to secure DNS in a successful way for 31 years. I think people are losing patience. thanks, Rob --00000000000092047b058e6122a4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 23, 2019 at 3:46 PM STARK, BA= RBARA H <bs7652@att.com> wrote:=

That=E2=80=99s like saying IETF should never have pu= blished BCP 38.


Is it?
=C2=A0

IETF absolutely is the right place to discuss=C2=A0<= /p>


=C2=A0Yes, it is. But that = doesn't mean a WG or a BCP should result.
=C2=A0

But I don=E2=80=99t think they have the operational = experience/knowledge to fully understand what might happen in various acces= s networks (especially mobile networks) if they started defaulting all thei= r application users to DNS servers outside the local (ISP, enterprise, university, etc.) network.


I don't think DoH implies this impending d= oom. Carriers can already control networking in many ways (e.g. preventing/= allowing tethering), so it just seems like a new negotiation point in a bus= iness discussion (that I am in no way part of).

Th= e bottom line is this: the IETF has been unable to secure DNS in a successf= ul way for 31 years. I think people are losing patience.

thanks,
Rob


--00000000000092047b058e6122a4-- From nobody Tue Jul 23 16:49:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14776120991 for ; Tue, 23 Jul 2019 16:49:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ayshYz8MePJx for ; Tue, 23 Jul 2019 16:49:03 -0700 (PDT) Received: from relay.sandelman.ca (relay.cooperix.net [IPv6:2a01:7e00::f03c:91ff:feae:de77]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B35112098D for ; Tue, 23 Jul 2019 16:49:03 -0700 (PDT) Received: from dooku.sandelman.ca (dhcp-8960.meeting.ietf.org [31.133.137.96]) by relay.sandelman.ca (Postfix) with ESMTPS id E21301F44B; Tue, 23 Jul 2019 23:49:01 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id 670981BBF; Tue, 23 Jul 2019 19:49:24 -0400 (EDT) From: Michael Richardson To: Rob Sayre cc: Jim Reid , add@ietf.org In-reply-to: References: Comments: In-reply-to Rob Sayre message dated "Tue, 23 Jul 2019 15:30:10 -0700." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <6245.1563925764.1@dooku.sandelman.ca> Date: Tue, 23 Jul 2019 19:49:24 -0400 Message-ID: <6246.1563925764@dooku.sandelman.ca> Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 23:49:05 -0000 Rob Sayre wrote: > I think that's a fine position to hold. If adoption of DoH is harmful > along the lines you describe, it won't succeed. I don't think the IETF > has a role in deciding that preemptively, though. But, perhaps we can both. From nobody Tue Jul 23 17:02:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7F02120995 for ; Tue, 23 Jul 2019 17:02:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id seTgf-JOf8rS for ; Tue, 23 Jul 2019 17:02:03 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7CD351201B5 for ; Tue, 23 Jul 2019 17:02:03 -0700 (PDT) Received: from pps.filterd (m0050102.ppops.net [127.0.0.1]) by m0050102.ppops.net-00190b01. (8.16.0.42/8.16.0.42) with SMTP id x6O01cuX003305; Wed, 24 Jul 2019 01:02:00 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=4NrbrsXYl0mIeVFGVtBvnN0E+3NmtPyXDs4wzd01C+I=; b=FSRKZBX/sAO0mIBoXFvL3agB6UylZ9KhozCJEjil3QDrQ+sdmfe3amDvyefK2T+gSK23 FiW1WNyzXWNYJlvgbBtl3PKHRQMXUCUmkgDt+8qOh3/ywcA0EGbc3z16qAdjL1n1fck9 rRrO52WuEhZArLQqgaOu540UkR7mn+Da8OlgvbfqTjufoQmU3PB5adWzV1RFicrlLEVa Xd24M4Ryg0nE+RD3zzkqJL8gw/z0+WisaUB2cU+CSOj+VrbXPrvPcvARAT4T0C4qWhNs uosArXyKJsULYjo2hDFmQ7K0vExGSc9jXepFCiOEoO1Gd+2NfsmuL2dzE8F9y2qSOjTM Mg== Received: from prod-mail-ppoint5 (prod-mail-ppoint5.akamai.com [184.51.33.60] (may be forged)) by m0050102.ppops.net-00190b01. with ESMTP id 2tx60vsacu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 24 Jul 2019 01:02:00 +0100 Received: from pps.filterd (prod-mail-ppoint5.akamai.com [127.0.0.1]) by prod-mail-ppoint5.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x6NNl49E018582; Tue, 23 Jul 2019 17:01:59 -0700 Received: from email.msg.corp.akamai.com ([172.27.25.33]) by prod-mail-ppoint5.akamai.com with ESMTP id 2tx62xrb2j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 23 Jul 2019 17:01:59 -0700 Received: from USTX2EX-DAG3MB1.msg.corp.akamai.com (172.27.27.22) by USTX2EX-DAG3MB6.msg.corp.akamai.com (172.27.27.28) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 23 Jul 2019 19:01:57 -0500 Received: from USTX2EX-DAG3MB1.msg.corp.akamai.com ([172.27.27.22]) by USTX2EX-DAG3MB1.msg.corp.akamai.com ([172.27.27.22]) with mapi id 15.00.1473.005; Tue, 23 Jul 2019 20:01:45 -0400 From: "Reed, Jon" To: "STARK, BARBARA H" , 'Rob Sayre' , "'add@ietf.org'" , 'Barry Leiba' Thread-Topic: [Add] meeting hum: should the IETF take up this work? Thread-Index: AQHVQaN5+1Au2+5A/0edwHZJ5gvJc6bZEJmA///SFQA= Date: Wed, 24 Jul 2019 00:01:45 +0000 Message-ID: <14DF8769-A817-4C06-9140-80198518244F@akamai.com> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.36.118] Content-Type: multipart/alternative; boundary="_000_14DF8769A8174C06914080198518244Fakamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-23_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907230245 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.84,1.0.8 definitions=2019-07-23_10:2019-07-23,2019-07-23 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 lowpriorityscore=0 adultscore=0 priorityscore=1501 phishscore=0 clxscore=1011 bulkscore=0 malwarescore=0 mlxscore=0 spamscore=0 mlxlogscore=999 impostorscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1906280000 definitions=main-1907230249 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 00:02:06 -0000 --_000_14DF8769A8174C06914080198518244Fakamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SW4gYWRkaXRpb24gdG8gZXZlcnl0aGluZyBCYXJiYXJhIHNheXMsIEnigJltIG5vdCBhIGZhbiBv ZiBwaHJhc2luZyB0aGVzZSBjb25jZXJucyBhcyDigJxub24tdGVjaG5pY2Fs4oCdLiAgVGhleSBh cmUgYSBkaXJlY3QgcmVzdWx0IG9mIHN0YW5kYXJkcyBkZXZlbG9wZWQgaGVyZS4gICBJ4oCZbSBu b3QgcGxhY2luZyBhIHZhbHVlIGp1ZGdlbWVudCBvbiB0aGUgcHJvdG9jb2wgaXRzZWxmLCBidXQg dGhlIGFkb3B0aW9uIHRoZXJlb2YgZnVuZGFtZW50YWxseSBjaGFuZ2VkIHdoYXQgQmFyYmFyYSBz byBhY2N1cmF0ZSBkZXNjcmliZWQgYXMgYW4gZWNvc3lzdGVtLiAgIEl04oCZcyBmaW5lIHRvIHNh eSB0aGF0IHRoZSBlY29zeXN0ZW0gd2FzIOKAnHdyb25n4oCdIHRvIGJlZ2luIHdpdGgsIGFuZCBp dOKAmXMgZmluZSB0byBzYXkgdGhhdCB5b3UgYmVsaWV2ZSB0aGUgYmVuZWZpdHMgb3V0d2VpZ2gg dGhlIG5lZ2F0aXZlIGltcGFjdHMsIGJ1dCBJIGRvbuKAmXQgdGhpbmsgd2UgY2FuIHByZXRlbmQg bm90aGluZyBoYXMgY2hhbmdlZC4NCkJ1dCBJ4oCZZCBhbHNvIGxpa2UgdG8gdG91Y2ggb24gYSB0 aGVtZSB0b2RheSBJIGhlYXJkIGluIHRoZSB2YXJpb3VzIHByZXNlbnRhdGlvbnMgYW5kIG1pYyBj b21tZW50czogIHRoZSByb2xlIG9mIHRoZSBlbmQgdXNlci4NCg0KVGhlcmUgd2FzIGNvbnNpZGVy YWJsZSB0YWxrIG9mIHVzZXIgY29uc2VudC4gIEJ1dCBpdCBpcyBpbXBvc3NpYmxlIHRvIGNvbnNl bnQgdG8gc29tZXRoaW5nIHlvdSBjYW5ub3QgdW5kZXJzdGFuZCwgYW5kIHdlIGFsc28gY29udGlu dWUgYXNzZXJ0IHRoYXQgdXNlcnMgbmVlZCBub3QgdW5kZXJzdGFuZCB0aGUgRE5TICjigJx0aGUg cGx1bWJpbmfigJ0pIGluIG9yZGVyIHRvIHVzZSBhcHBsaWNhdGlvbnMgd2hpY2ggbWFrZSB1c2Ug b2YgaXQuICAgU28gSSB0aGluayDigJxjb25zZW504oCdIGlzIGluYWNjdXJhdGUsIGFuZCB3ZSBz aG91bGQgcGVyaGFwcyB1c2Ug4oCcYWNxdWllc2NlbmNl4oCdIGluc3RlYWQuDQoNCi1Kb24NCg0K RnJvbTogIlNUQVJLLCBCQVJCQVJBIEgiIDxiczc2NTJAYXR0LmNvbT4NCkRhdGU6IFR1ZXNkYXks IEp1bHkgMjMsIDIwMTkgYXQgNjo0NiBQTQ0KVG86ICdSb2IgU2F5cmUnIDxzYXlyZXJAZ21haWwu Y29tPiwgIidhZGRAaWV0Zi5vcmcnIiA8YWRkQGlldGYub3JnPiwgJ0JhcnJ5IExlaWJhJyA8YmFy cnlsZWliYS5tYWlsaW5nLmxpc3RzQGdtYWlsLmNvbT4NClN1YmplY3Q6IFJlOiBbQWRkXSBtZWV0 aW5nIGh1bTogc2hvdWxkIHRoZSBJRVRGIHRha2UgdXAgdGhpcyB3b3JrPw0KDQpUaGF04oCZcyBs aWtlIHNheWluZyBJRVRGIHNob3VsZCBuZXZlciBoYXZlIHB1Ymxpc2hlZCBCQ1AgMzguIFdoYXQg aXMgQkNQIDM4IChvciBhbnkgb3RoZXIgQkNQKSwgaWYgbm90IHBvbGljeT8NCklFVEYgYWJzb2x1 dGVseSBpcyB0aGUgcmlnaHQgcGxhY2UgdG8gZGlzY3VzcyBCQ1BzIHJlbGF0ZWQgdG8gdGVjaG5v bG9neSB0aGF0IGhhcyB0aGUgYWJpbGl0eSB0byBtYXNzaXZlbHkgaW1wYWN0IHRoZSB0cmFmZmlj IHBhdHRlcm5zIG9mIHRoZSBJbnRlcm5ldCBhbmQgaW1wYWN0IChpbiBhIHZlcnkgbmVnYXRpdmUg d2F5KSB0aGUgZXhwZXJpZW5jZSBvZiBhbGwgdXNlcnMgb2YgdGhlIEludGVybmV0LiBJ4oCZbSAq bm90KiBzYXlpbmcgdGhhdCBpdCAqd2lsbCogaGF2ZSBzdWNoIGEgbmVnYXRpdmUgaW1wYWN0LiBC dXQgaXQgYWJzb2x1dGVseSBoYXMgdGhlIGFiaWxpdHkuIEFuZCBpdOKAmXMgdGhpcyAqcG90ZW50 aWFsKiB0aGF0IGhhcyBhbGwgdGhlIG5ldHdvcmsgb3BlcmF0b3JzIHZlcnkgd29ycmllZC4NCg0K VGhlIEludGVybmV0IGVjb3N5c3RlbSBpcyBidWlsdCBvbiB0aGUgaWRlYSB0aGF0IHRoZSB2YXJp b3VzIHBhcnRpY2lwYW50cyBjYW4gZ2VuZXJhbGx5IHRydXN0IG9uZSBhbm90aGVyIHRvIHBhcnRp Y2lwYXRlIGluIGEgd2F5IHRoYXQgYmVuZWZpdHMgdGhlIEludGVybmV0IGFuZCBpdHMgdXNlcnMu DQpJIGRvbuKAmXQgYmVsaWV2ZSB0aGF0IGFueSBvZiB0aGUgYXBwbGljYXRpb24gZGV2ZWxvcGVy cyBwYXJ0aWNpcGF0aW5nIGluIElFVEYgd2FudCB0byBkYW1hZ2UgdGhlIEludGVybmV0IG9yIGhh dmUgYSBuZWdhdGl2ZSBpbXBhY3Qgb24gdXNlcnPigJkgZXhwZXJpZW5jZXMuDQpBbmQgSSB2ZXJ5 IG11Y2ggdHJ1c3QgYW5kIGxpa2UgdGhlIHBlb3BsZSBmcm9tIE1vemlsbGEgYW5kIEdvb2dsZSBh bmQgQ2xvdWRmbGFyZS4gVGhleeKAmXJlIGFsbCBzdXBlciBuaWNlIHBlb3BsZSB3aG8gYXJlIGdy ZWF0IGZ1biB0byBkcmluayBiZWVyIHdpdGguDQpCdXQgSSBkb27igJl0IHRoaW5rIHRoZXkgaGF2 ZSB0aGUgb3BlcmF0aW9uYWwgZXhwZXJpZW5jZS9rbm93bGVkZ2UgdG8gZnVsbHkgdW5kZXJzdGFu ZCB3aGF0IG1pZ2h0IGhhcHBlbiBpbiB2YXJpb3VzIGFjY2VzcyBuZXR3b3JrcyAoZXNwZWNpYWxs eSBtb2JpbGUgbmV0d29ya3MpIGlmIHRoZXkgc3RhcnRlZCBkZWZhdWx0aW5nIGFsbCB0aGVpciBh cHBsaWNhdGlvbiB1c2VycyB0byBETlMgc2VydmVycyBvdXRzaWRlIHRoZSBsb2NhbCAoSVNQLCBl bnRlcnByaXNlLCB1bml2ZXJzaXR5LCBldGMuKSBuZXR3b3JrLg0KVGhlIElFVEYgaXMgYSBwbGFj ZSB3aGVyZSB3ZSBjYW4gYW5kIG11c3QgaGF2ZSB0aGlzIGRpc2N1c3Npb24sIHNvIGFsbCBwYXJ0 aWVzIGNhbiBwYXJ0aWNpcGF0ZSBpbiB1bmRlcnN0YW5kaW5nIGFuZCBtaXRpZ2F0aW5nIHRoZSBw b3RlbnRpYWwgaGFybS4NCg0KSeKAmW0gYWxzbyB0cnlpbmcgdG8gdW5kZXJzdGFuZCB3aHkgdGhl cmUgc2VlbXMgdG8gYmUgcmVzaXN0YW5jZSB0byBwcm92aWRpbmcgSVNQcyB3aXRoIGFkdmljZSBv biBkZXBsb3lpbmcgRG9ILiBXaG8gZG9lcyBpdCBodXJ0IHRvIHByb3ZpZGUgc3VjaCBhZHZpY2Us IGFuZCB3aHkgc2hvdWxkIGl0IGJlIGltcHJvcGVyIGZvciBJRVRGIHRvIHByb3ZpZGUgYWR2aWNl IG9uIGRlcGxveWluZyBhIHByb3RvY29sIGl0IGhhcyBwdWJsaXNoZWQ/IFtBZHZpY2Ugb24gaG93 IHRvIGRlcGxveSBpcyBhYnNvbHV0ZWx5IGEgZm9ybSBvZiDigJxwb2xpY3nigJ0uXQ0KQW5kIHdo eSBzaG91bGQgYW4gSVNQIERvSCByZXNvbHZlciBvciB1c2luZyByZWd1bGFyIEROUyBub3QgYmUg Y29uc2lkZXJlZCB2YWxpZCDigJxjaG9pY2Vz4oCdIGZvciBhIHVzZXIgdG8gbWFrZT8NCkJhcmJh cmENCg0KRnJvbTogQWRkIDxhZGQtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIFJvYiBT YXlyZQ0KU2VudDogVHVlc2RheSwgSnVseSAyMywgMjAxOSA2OjA5IFBNDQpUbzogYWRkQGlldGYu b3JnOyBCYXJyeSBMZWliYSA8YmFycnlsZWliYS5tYWlsaW5nLmxpc3RzQGdtYWlsLmNvbT4NClN1 YmplY3Q6IFtBZGRdIG1lZXRpbmcgaHVtOiBzaG91bGQgdGhlIElFVEYgdGFrZSB1cCB0aGlzIHdv cms/DQoNCkhpLA0KDQpUaGUgSUVURiBzaG91bGRuJ3QgdGFrZSB1cCB3b3JrIGluIHJlYWN0aW9u IHRvIG5vbi10ZWNobmljYWwgKGFrYSAicG9saWN5IikgY29uY2VybnMgYWJvdXQgaW1taW5lbnQg ZGVwbG95bWVudCBvZiBhbiBhcHByb3ZlZCBSRkMuIEluIHRoaXMgY2FzZSwgaXQncyBEb0ggKGh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM4NDg0PGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM4NDg0 JmQ9RHdNRmFRJmM9TEZZWi1vOV9IVU1lTVRTUWljdmpJZyZyPUxvR3poQy04c2M4U1k4VHE0dnJm b2cmbT1rMWUxbXVIZHFtLU9Od1I0NXdpdXY4d1hjcTF5dmZQakZiQklNWlVSYndNJnM9SnVGNkZa X0puT2ozdUlDMzlKU0tKdERmZ00teFhUaDJoVGw4THphTndQWSZlPT4pLg0KDQpNb3ppbGxhJ3Mg cHJlc2VudGF0aW9uIGFjY3VyYXRlbHkgc3RhdGVkIHRoYXQgRE5TIGlzIG5vIGxvbmdlciBhbiBl ZmZlY3RpdmUgY29udHJvbCBzdXJmYWNlLiBJdCBjYW4ndCBiZSwgZ2l2ZW4gdGhhdCBIVFRQUyBp cyB1YmlxdWl0b3VzLCBhbmQgb25lIGNhbiB1c2UgaXQgdG8gdHVubmVsIGFueSBwcm90b2NvbC4N Cg0KdGhhbmtzLA0KUm9iDQo= --_000_14DF8769A8174C06914080198518244Fakamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: <7D2CCFE668C48E4AB288C70E5726EC50@akamai.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNv TGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowaW47 DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCgltYXJnaW4tbGVmdDou NWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFs MCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJn aW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0 eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJ Y29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpw ZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xv cjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1v bmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41 aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBs aXN0IGwwDQoJe21zby1saXN0LWlkOjE3ODI2MDc0MjU7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7 DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjE0NDQzNDY4NzQgLTI0MTAwNzM1NiA2NzY5ODY5MSA2 NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5 ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Oi07DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28t ZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJpO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2 ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv gqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0K QGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpT eW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZl bDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30N CkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 V2luZ2RpbmdzO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjIxMDY4ODM0NjQ7DQoJbXNvLWxp c3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjQxNzEzNDQxMCAtMTc4NzY0 NzgxNiA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4 OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0 LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Oi07DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0Oi4yNWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpD YWxpYnJpO30NCkBsaXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6Ljc1aW47DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2 ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv gqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjEuMjVpbjsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9u dC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDox Ljc1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlz dCBsMTpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjIuMjVpbjsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZlbDYNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFy Z2luLWxlZnQ6Mi43NWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5n ZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjMuMjVpbjsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsOA0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJbWFyZ2luLWxlZnQ6My43NWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWls eToiQ291cmllciBOZXciO30NCkBsaXN0IGwxOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDo0LjI1 aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpvbA0K CXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48L3N0 eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJw bGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPklu IGFkZGl0aW9uIHRvIGV2ZXJ5dGhpbmcgQmFyYmFyYSBzYXlzLCBJ4oCZbSBub3QgYSBmYW4gb2Yg cGhyYXNpbmcgdGhlc2UgY29uY2VybnMgYXMg4oCcbm9uLXRlY2huaWNhbOKAnS4mbmJzcDsgVGhl eSBhcmUgYSBkaXJlY3QgcmVzdWx0IG9mIHN0YW5kYXJkcyBkZXZlbG9wZWQgaGVyZS4mbmJzcDsm bmJzcDsgSeKAmW0gbm90IHBsYWNpbmcgYSB2YWx1ZSBqdWRnZW1lbnQgb24gdGhlIHByb3RvY29s IGl0c2VsZiwgYnV0IHRoZSBhZG9wdGlvbiB0aGVyZW9mDQogZnVuZGFtZW50YWxseSBjaGFuZ2Vk IHdoYXQgQmFyYmFyYSBzbyBhY2N1cmF0ZSBkZXNjcmliZWQgYXMgYW4gZWNvc3lzdGVtLiZuYnNw OyZuYnNwOyBJdOKAmXMgZmluZSB0byBzYXkgdGhhdCB0aGUgZWNvc3lzdGVtIHdhcyDigJx3cm9u Z+KAnSB0byBiZWdpbiB3aXRoLCBhbmQgaXTigJlzIGZpbmUgdG8gc2F5IHRoYXQgeW91IGJlbGll dmUgdGhlIGJlbmVmaXRzIG91dHdlaWdoIHRoZSBuZWdhdGl2ZSBpbXBhY3RzLCBidXQgSSBkb27i gJl0IHRoaW5rIHdlIGNhbiBwcmV0ZW5kIG5vdGhpbmcNCiBoYXMgY2hhbmdlZC48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+QnV0IEnigJlkIGFsc28gbGlrZSB0byB0b3VjaCBvbiBhIHRoZW1lIHRvZGF5IEkg aGVhcmQgaW4gdGhlIHZhcmlvdXMgcHJlc2VudGF0aW9ucyBhbmQgbWljIGNvbW1lbnRzOiZuYnNw OyB0aGUgcm9sZSBvZiB0aGUgZW5kIHVzZXIuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZXJl IHdhcyBjb25zaWRlcmFibGUgdGFsayBvZiB1c2VyIGNvbnNlbnQuJm5ic3A7IEJ1dCBpdCBpcyBp bXBvc3NpYmxlIHRvIGNvbnNlbnQgdG8gc29tZXRoaW5nIHlvdSBjYW5ub3QgdW5kZXJzdGFuZCwg YW5kIHdlIGFsc28gY29udGludWUgYXNzZXJ0IHRoYXQgdXNlcnMgbmVlZCBub3QgdW5kZXJzdGFu ZCB0aGUgRE5TICjigJx0aGUgcGx1bWJpbmfigJ0pIGluIG9yZGVyIHRvIHVzZSBhcHBsaWNhdGlv bnMgd2hpY2ggbWFrZQ0KIHVzZSBvZiBpdC4mbmJzcDsmbmJzcDsgU28gSSB0aGluayDigJxjb25z ZW504oCdIGlzIGluYWNjdXJhdGUsIGFuZCB3ZSBzaG91bGQgcGVyaGFwcyB1c2Ug4oCcYWNxdWll c2NlbmNl4oCdIGluc3RlYWQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi1Kb248bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6 My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206IDwvc3Bhbj48L2I+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPiZxdW90O1NUQVJLLCBCQVJCQVJBIEgm cXVvdDsgJmx0O2JzNzY1MkBhdHQuY29tJmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5UdWVzZGF5LCBK dWx5IDIzLCAyMDE5IGF0IDY6NDYgUE08YnI+DQo8Yj5UbzogPC9iPidSb2IgU2F5cmUnICZsdDtz YXlyZXJAZ21haWwuY29tJmd0OywgJnF1b3Q7J2FkZEBpZXRmLm9yZycmcXVvdDsgJmx0O2FkZEBp ZXRmLm9yZyZndDssICdCYXJyeSBMZWliYScgJmx0O2JhcnJ5bGVpYmEubWFpbGluZy5saXN0c0Bn bWFpbC5jb20mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbQWRkXSBtZWV0aW5nIGh1bTog c2hvdWxkIHRoZSBJRVRGIHRha2UgdXAgdGhpcyB3b3JrPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGF04oCZcyBsaWtlIHNheWluZyBJRVRG IHNob3VsZCBuZXZlciBoYXZlIHB1Ymxpc2hlZCBCQ1AgMzguIFdoYXQgaXMgQkNQIDM4IChvciBh bnkgb3RoZXIgQkNQKSwgaWYgbm90IHBvbGljeT88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPklFVEYgYWJzb2x1dGVseSBpcyB0aGUgcmlnaHQgcGxhY2UgdG8gZGlzY3VzcyBC Q1BzIHJlbGF0ZWQgdG8gdGVjaG5vbG9neSB0aGF0IGhhcyB0aGUgYWJpbGl0eSB0byBtYXNzaXZl bHkgaW1wYWN0IHRoZSB0cmFmZmljIHBhdHRlcm5zIG9mIHRoZSBJbnRlcm5ldCBhbmQgaW1wYWN0 IChpbiBhIHZlcnkgbmVnYXRpdmUgd2F5KSB0aGUgZXhwZXJpZW5jZSBvZiBhbGwgdXNlcnMgb2Yg dGhlIEludGVybmV0LiBJ4oCZbQ0KICo8Yj5ub3Q8L2I+KiBzYXlpbmcgdGhhdCBpdCAqPGI+d2ls bDwvYj4qIGhhdmUgc3VjaCBhIG5lZ2F0aXZlIGltcGFjdC4gQnV0IGl0IGFic29sdXRlbHkgaGFz IHRoZSBhYmlsaXR5LiBBbmQgaXTigJlzIHRoaXMgKjxiPnBvdGVudGlhbDwvYj4qIHRoYXQgaGFz IGFsbCB0aGUgbmV0d29yayBvcGVyYXRvcnMgdmVyeSB3b3JyaWVkLjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5UaGUgSW50ZXJuZXQgZWNvc3lzdGVtIGlzIGJ1aWx0IG9uIHRoZSBpZGVhIHRoYXQg dGhlIHZhcmlvdXMgcGFydGljaXBhbnRzIGNhbiBnZW5lcmFsbHkgdHJ1c3Qgb25lIGFub3RoZXIg dG8gcGFydGljaXBhdGUgaW4gYSB3YXkgdGhhdCBiZW5lZml0cyB0aGUgSW50ZXJuZXQgYW5kIGl0 cyB1c2Vycy4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBkb27igJl0 IGJlbGlldmUgdGhhdCBhbnkgb2YgdGhlIGFwcGxpY2F0aW9uIGRldmVsb3BlcnMgcGFydGljaXBh dGluZyBpbiBJRVRGIHdhbnQgdG8gZGFtYWdlIHRoZSBJbnRlcm5ldCBvciBoYXZlIGEgbmVnYXRp dmUgaW1wYWN0IG9uIHVzZXJz4oCZIGV4cGVyaWVuY2VzLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+QW5kIEkgdmVyeSBtdWNoIHRydXN0IGFuZCBsaWtlIHRoZSBwZW9wbGUg ZnJvbSBNb3ppbGxhIGFuZCBHb29nbGUgYW5kIENsb3VkZmxhcmUuIFRoZXnigJlyZSBhbGwgc3Vw ZXIgbmljZSBwZW9wbGUgd2hvIGFyZSBncmVhdCBmdW4gdG8gZHJpbmsgYmVlciB3aXRoLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QnV0IEkgZG9u4oCZdCB0aGluayB0aGV5 IGhhdmUgdGhlIG9wZXJhdGlvbmFsIGV4cGVyaWVuY2Uva25vd2xlZGdlIHRvIGZ1bGx5IHVuZGVy c3RhbmQgd2hhdCBtaWdodCBoYXBwZW4gaW4gdmFyaW91cyBhY2Nlc3MgbmV0d29ya3MgKGVzcGVj aWFsbHkgbW9iaWxlIG5ldHdvcmtzKSBpZiB0aGV5IHN0YXJ0ZWQgZGVmYXVsdGluZyBhbGwgdGhl aXIgYXBwbGljYXRpb24gdXNlcnMgdG8gRE5TIHNlcnZlcnMgb3V0c2lkZQ0KIHRoZSBsb2NhbCAo SVNQLCBlbnRlcnByaXNlLCB1bml2ZXJzaXR5LCBldGMuKSBuZXR3b3JrLjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIElFVEYgaXMgYSBwbGFjZSB3aGVyZSB3ZSBjYW4g YW5kIG11c3QgaGF2ZSB0aGlzIGRpc2N1c3Npb24sIHNvIGFsbCBwYXJ0aWVzIGNhbiBwYXJ0aWNp cGF0ZSBpbiB1bmRlcnN0YW5kaW5nIGFuZCBtaXRpZ2F0aW5nIHRoZSBwb3RlbnRpYWwgaGFybS48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SeKAmW0gYWxzbyB0cnlpbmcgdG8gdW5kZXJzdGFuZCB3 aHkgdGhlcmUgc2VlbXMgdG8gYmUgcmVzaXN0YW5jZSB0byBwcm92aWRpbmcgSVNQcyB3aXRoIGFk dmljZSBvbiBkZXBsb3lpbmcgRG9ILiBXaG8gZG9lcyBpdCBodXJ0IHRvIHByb3ZpZGUgc3VjaCBh ZHZpY2UsIGFuZCB3aHkgc2hvdWxkIGl0IGJlIGltcHJvcGVyIGZvciBJRVRGIHRvIHByb3ZpZGUg YWR2aWNlIG9uIGRlcGxveWluZyBhIHByb3RvY29sIGl0DQogaGFzIHB1Ymxpc2hlZD8gW0Fkdmlj ZSBvbiBob3cgdG8gZGVwbG95IGlzIGFic29sdXRlbHkgYSBmb3JtIG9mIOKAnHBvbGljeeKAnS5d PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BbmQgd2h5IHNob3VsZCBhbiBJ U1AgRG9IIHJlc29sdmVyIG9yIHVzaW5nIHJlZ3VsYXIgRE5TIG5vdCBiZSBjb25zaWRlcmVkIHZh bGlkIOKAnGNob2ljZXPigJ0gZm9yIGEgdXNlciB0byBtYWtlPzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+QmFyYmFyYTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRp dj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBw dDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZy b206PC9iPiBBZGQgJmx0O2FkZC1ib3VuY2VzQGlldGYub3JnJmd0OyA8Yj5PbiBCZWhhbGYgT2Yg PC9iPg0KUm9iIFNheXJlPGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNkYXksIEp1bHkgMjMsIDIwMTkg NjowOSBQTTxicj4NCjxiPlRvOjwvYj4gYWRkQGlldGYub3JnOyBCYXJyeSBMZWliYSAmbHQ7YmFy cnlsZWliYS5tYWlsaW5nLmxpc3RzQGdtYWlsLmNvbSZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4g W0FkZF0gbWVldGluZyBodW06IHNob3VsZCB0aGUgSUVURiB0YWtlIHVwIHRoaXMgd29yaz88bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSw8bzpwPjwvbzpw PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBJRVRGIHNob3VsZG4ndCB0 YWtlIHVwIHdvcmsgaW4gcmVhY3Rpb24gdG8gbm9uLXRlY2huaWNhbCAoYWthICZxdW90O3BvbGlj eSZxdW90OykgY29uY2VybnMgYWJvdXQgaW1taW5lbnQgZGVwbG95bWVudCBvZiBhbiBhcHByb3Zl ZCBSRkMuIEluIHRoaXMgY2FzZSwgaXQncyBEb0ggKDxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9y ZmM4NDg0JmFtcDtkPUR3TUZhUSZhbXA7Yz1MRllaLW85X0hVTWVNVFNRaWN2aklnJmFtcDtyPUxv R3poQy04c2M4U1k4VHE0dnJmb2cmYW1wO209azFlMW11SGRxbS1PTndSNDV3aXV2OHdYY3ExeXZm UGpGYkJJTVpVUmJ3TSZhbXA7cz1KdUY2RlpfSm5PajN1SUMzOUpTS0p0RGZnTS14WFRoMmhUbDhM emFOd1BZJmFtcDtlPSI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzg0ODQ8L2E+KS48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TW96 aWxsYSdzIHByZXNlbnRhdGlvbiBhY2N1cmF0ZWx5IHN0YXRlZCB0aGF0IEROUyBpcyBubyBsb25n ZXIgYW4gZWZmZWN0aXZlIGNvbnRyb2wgc3VyZmFjZS4gSXQgY2FuJ3QgYmUsIGdpdmVuIHRoYXQg SFRUUFMgaXMgdWJpcXVpdG91cywgYW5kIG9uZSBjYW4gdXNlIGl0IHRvIHR1bm5lbCBhbnkgcHJv dG9jb2wuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPnRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPlJvYjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_14DF8769A8174C06914080198518244Fakamaicom_-- From nobody Tue Jul 23 17:16:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF3611209A2 for ; Tue, 23 Jul 2019 17:16:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4cqKG2veIxq8 for ; Tue, 23 Jul 2019 17:16:19 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 045D012098D for ; Tue, 23 Jul 2019 17:16:19 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id j6so10603251ioa.5 for ; Tue, 23 Jul 2019 17:16:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=JTe1/X51nlrZ0NEnS835GgiYIH1IE1ncXo5txnoVGHM=; b=TCeK1HmgbIbce0mEZhh32D0Xxrg0INjqBK2x0O+gEl5hfCSTGpV25L8AyKeDb/0OvW XNI6DPa9YrpE9AsCnt6U1oYAKe5rq2gE6hCejO+lSdtIi1oTHeySouzy1BIb9GW5+vH5 90SIlrWVBiP91Ia/uQVIVlu1fdCP6Do87Pf6qVx5yAP2wm9r25pVoj99zMzyaFSWYI1P uEY+bkGqrKNgjJ/Oml342Tf3/QAzLufigi8EpZLmkZnyce6mHiSdU7KqzeoL8hQBtIj4 dEikqySLk8N1NikQ5r2FVHSTby2zIdFSjYtt8+vfLBE6JFKBQj2MXLMLBUsNk4yfDzAg qAYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JTe1/X51nlrZ0NEnS835GgiYIH1IE1ncXo5txnoVGHM=; b=WOsC9RKUi20ZWAuwQgZdPyLDmm0ORDruzYw0jHlTFU+CXQefKlZheYCLLqiOagAGnk 2NwUjUINRG0XZ65ayykJPYXGjahwoyzxENHL4fV/XC1kaJJr/8jGkM83+bSf0vl2ogA4 NPairXT5uJNGgcmuND6Fjp0aIQUKpondYRXD0tdXdrD5CmJBzyxNreSPlAvVqZnu9Foy JDq++yiv9kmrk7SloQho8MJ1ZKfONzAY+urktVHV1ehySCc0VcyG5hCKJKHONwZx2HH+ FrlGpnj0X/PSYjbPCLPbTdtyoJwuxz650Z46wAgZ8h31ZNhkivc+5RBc+PHwp/mIZS/e BdkQ== X-Gm-Message-State: APjAAAUOA5s0PiJstbY+/LyvfDQCZkItG5wJ17fOLMofyYNGnByCG/Fs 4gjC5f5frwSy7BRovTKa6m1jOXz1h8Q4OnWUr4I= X-Google-Smtp-Source: APXvYqzf9jmrJtp7BGwmrJ5Q/yzTvVbB5t+fy5wbeCgwbH7WSU2cI7yLlS+aw9h7xtd5wdtf65j0JlY4LeEkoDCt5XM= X-Received: by 2002:a6b:bc42:: with SMTP id m63mr58842846iof.189.1563927378120; Tue, 23 Jul 2019 17:16:18 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> In-Reply-To: <14DF8769-A817-4C06-9140-80198518244F@akamai.com> From: Rob Sayre Date: Tue, 23 Jul 2019 17:16:06 -0700 Message-ID: To: "Reed, Jon" Cc: "STARK, BARBARA H" , "add@ietf.org" , Barry Leiba Content-Type: multipart/alternative; boundary="000000000000d3d850058e6237ab" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 00:16:22 -0000 --000000000000d3d850058e6237ab Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 23, 2019 at 5:02 PM Reed, Jon wrote: > In addition to everything Barbara says, I=E2=80=99m not a fan of phrasing= these > concerns as =E2=80=9Cnon-technical=E2=80=9D. They are a direct result of= standards > developed here. > That's a fine opinion. However, I'm not sure everyone is in sync on what the IETF does. For example, there was a presentation today that suggested requiring use of the OS DNS stack might be an appropriate subject for an IETF WG. It isn't, even though it is a technical topic. DNS is insecure in a coffee shop, and that is going to be fixed. thanks, Rob > > > *From: *"STARK, BARBARA H" > *Date: *Tuesday, July 23, 2019 at 6:46 PM > *To: *'Rob Sayre' , "'add@ietf.org'" , > 'Barry Leiba' > *Subject: *Re: [Add] meeting hum: should the IETF take up this work? > > > > That=E2=80=99s like saying IETF should never have published BCP 38. What = is BCP 38 > (or any other BCP), if not policy? > > IETF absolutely is the right place to discuss BCPs related to technology > that has the ability to massively impact the traffic patterns of the > Internet and impact (in a very negative way) the experience of all users = of > the Internet. I=E2=80=99m **not** saying that it **will** have such a neg= ative > impact. But it absolutely has the ability. And it=E2=80=99s this **potent= ial** > that has all the network operators very worried. > > > > The Internet ecosystem is built on the idea that the various participants > can generally trust one another to participate in a way that benefits the > Internet and its users. > > I don=E2=80=99t believe that any of the application developers participat= ing in > IETF want to damage the Internet or have a negative impact on users=E2=80= =99 > experiences. > > And I very much trust and like the people from Mozilla and Google and > Cloudflare. They=E2=80=99re all super nice people who are great fun to dr= ink beer > with. > > But I don=E2=80=99t think they have the operational experience/knowledge = to fully > understand what might happen in various access networks (especially mobil= e > networks) if they started defaulting all their application users to DNS > servers outside the local (ISP, enterprise, university, etc.) network. > > The IETF is a place where we can and must have this discussion, so all > parties can participate in understanding and mitigating the potential har= m. > > > > I=E2=80=99m also trying to understand why there seems to be resistance to > providing ISPs with advice on deploying DoH. Who does it hurt to provide > such advice, and why should it be improper for IETF to provide advice on > deploying a protocol it has published? [Advice on how to deploy is > absolutely a form of =E2=80=9Cpolicy=E2=80=9D.] > > And why should an ISP DoH resolver or using regular DNS not be considered > valid =E2=80=9Cchoices=E2=80=9D for a user to make? > > Barbara > > > > *From:* Add *On Behalf Of * Rob Sayre > *Sent:* Tuesday, July 23, 2019 6:09 PM > *To:* add@ietf.org; Barry Leiba > *Subject:* [Add] meeting hum: should the IETF take up this work? > > > > Hi, > > > > The IETF shouldn't take up work in reaction to non-technical (aka > "policy") concerns about imminent deployment of an approved RFC. In this > case, it's DoH (https://tools.ietf.org/html/rfc8484 > > ). > > > > Mozilla's presentation accurately stated that DNS is no longer an > effective control surface. It can't be, given that HTTPS is ubiquitous, a= nd > one can use it to tunnel any protocol. > > > > thanks, > > Rob > --000000000000d3d850058e6237ab Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 23, 2019 at 5:02 PM Reed, Jon= <jreed@akamai.com> wrote:

In addition to everything Barbara says, I=E2=80=99m = not a fan of phrasing these concerns as =E2=80=9Cnon-technical=E2=80=9D.=C2= =A0 They are a direct result of standards developed here.


That's a fine opinion. However, I'm = not sure everyone is in sync on what the IETF does.

For example, there was a presentation today that suggested requiring use = of the OS DNS stack might be an appropriate subject for an IETF WG. It isn&= #39;t, even though it is a technical topic.

DNS is= insecure in a coffee shop, and that is going to be fixed.

thanks,
Rob

=C2=A0

=C2=A0

From: = "STARK, BARBARA = H" <bs7652@att.= com>
Date: Tuesday, July 23, 2019 at 6:46 PM
To: 'Rob Sayre' <sayrer@gmail.com>, "'add@ietf.org'" <add@ietf.org>, 'Barry Leiba'= ; <barryleiba.mailing.lists@gmail.com>
Subject: Re: [Add] meeting hum: should the IETF take up this work?

=C2=A0

That=E2=80=99s like saying IETF should never have pu= blished BCP 38. What is BCP 38 (or any other BCP), if not policy?=

IETF absolutely is the right place to discuss BCPs r= elated to technology that has the ability to massively impact the traffic p= atterns of the Internet and impact (in a very negative way) the experience = of all users of the Internet. I=E2=80=99m *not* saying that it *will* have such a negative impact. But= it absolutely has the ability. And it=E2=80=99s this *potential* th= at has all the network operators very worried.

=C2=A0

The Internet ecosystem is built on the idea that the= various participants can generally trust one another to participate in a w= ay that benefits the Internet and its users.

I don=E2=80=99t believe that any of the application = developers participating in IETF want to damage the Internet or have a nega= tive impact on users=E2=80=99 experiences.

And I very much trust and like the people from Mozil= la and Google and Cloudflare. They=E2=80=99re all super nice people who are= great fun to drink beer with.

But I don=E2=80=99t think they have the operational = experience/knowledge to fully understand what might happen in various acces= s networks (especially mobile networks) if they started defaulting all thei= r application users to DNS servers outside the local (ISP, enterprise, university, etc.) network.

The IETF is a place where we can and must have this = discussion, so all parties can participate in understanding and mitigating = the potential harm.

=C2=A0

I=E2=80=99m also trying to understand why there seem= s to be resistance to providing ISPs with advice on deploying DoH. Who does= it hurt to provide such advice, and why should it be improper for IETF to = provide advice on deploying a protocol it has published? [Advice on how to deploy is absolutely a form of =E2=80=9Cp= olicy=E2=80=9D.]

And why should an ISP DoH resolver or using regular = DNS not be considered valid =E2=80=9Cchoices=E2=80=9D for a user to make?

Barbara

=C2=A0

From: Add <add-bounces@ietf.org> On Behalf Of Rob Sayre
Sent: Tuesday, July 23, 2019 6:09 PM
To: add@ietf.org; Barry Leiba <barryleiba.mailing.lists@gmail.com>
Subject: [Add] meeting hum: should the IETF take up this work?

=C2=A0

Hi,

=C2=A0

The IETF shouldn't take up work in reaction to n= on-technical (aka "policy") concerns about imminent deployment of= an approved RFC. In this case, it's DoH (https://tools.ietf.org/htm= l/rfc8484).

=C2=A0

Mozilla's presentation accurately stated that DN= S is no longer an effective control surface. It can't be, given that HT= TPS is ubiquitous, and one can use it to tunnel any protocol.=

=C2=A0

thanks,

Rob

--000000000000d3d850058e6237ab-- From nobody Tue Jul 23 18:38:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 707C11209BF for ; Tue, 23 Jul 2019 18:38:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.128 X-Spam-Level: X-Spam-Status: No, score=-1.128 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FROM_WORDY=1.571, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=protonmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y6BkmCtBb1J7 for ; Tue, 23 Jul 2019 18:38:31 -0700 (PDT) Received: from mail-40132.protonmail.ch (mail-40132.protonmail.ch [185.70.40.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 859321209BA for ; Tue, 23 Jul 2019 18:38:31 -0700 (PDT) Date: Wed, 24 Jul 2019 01:38:25 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=default; t=1563932307; bh=NvjIGD1ge4gVko+XJ3bakF9JtuF9eoKOqYsAeBqMLS4=; h=Date:To:From:Reply-To:Subject:Feedback-ID:From; b=TLJWMu4PW5VToVnidKLyyb8xFKhLZdcBG2lPRfniQWm2vNX2K3F+Y7iHCVNu72R6Z dMc6op0Ijob9FkN1wgWqTiMWkYtErjPciMXMevda0edbxBGtKd/s37G5gXfgn8OqhG fen5Vxx/+P42Xej0Wn7CUGl6ZODg+vdsf0LuzXhQ= To: "add@ietf.org" , Barry Leiba From: "Arnaud.Taddei.IETF" Reply-To: "Arnaud.Taddei.IETF" Message-ID: Feedback-ID: kou6vaSHQeY5dgFN9dCIYKo4z6hnnNmKuV4IBJw2wx4vSVPtftyhWUTBigri6zMJ3K1hxYJjI-3RAIGaizMt5g==:Ext:ProtonMail MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1_9e1e0b824b44d609c1e61f0e68d6e4fe" Archived-At: Subject: [Add] Followup from ADD session today X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 01:38:34 -0000 This is a multi-part message in MIME format. --b1_9e1e0b824b44d609c1e61f0e68d6e4fe Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 QXMgYSBtYXR0ZXIgb2YgZmFjdCB0b2RheSBJIHdhcyBjdXQgb24gdGhlIG1pYyBhbmQgeWV0IGFm dGVyIG1lLCBCYXJyeSBoYWQgdGhlIGNoYW5jZSB0byBzcGVhayBhbmQgdGhlbiBhbm90aGVyIHBl cnNvbiBoYWQgdGhlIGNoYW5jZSB0byBzcGVhayBzbyBpdCBnaXZlcyBtZSB0aGUgY29udGludWVk IGFwcGVhcmFuY2UgdGhhdCBpdCBpcyBkaWZmaWN1bHQgdG8gd29yayBpbiB0aGUgSUVURi4KClNv IGlmIEkgd291bGQgaGF2ZSBoYWQgdGhlIGNoYW5jZSB0byBzcGVhaywgSSB3b3VsZCBoYXZlIGFz a2VkIHRoZSBxdWVzdGlvbiByZWdhcmRpbmcgRGF2aWQncyBwcmVzZW50YXRpb24gdGhhdCB0aGUg YXBwcm9hY2ggdGFrZW4gaGVyZSBzZWVtcyB0byBwYXJ0aWN1bGFybHkgaW5jcmVhc2UgdGhlIGNl bnRyYWxpc2F0aW9uIGVmZmVjdCBhbmQgSSB3b3VsZCBoYXZlIGFza2VkIGNsYXJpZmljYXRpb24g cXVlc3Rpb25zIG9uIHRoZSBVWCBpbXBsaWNhdGlvbnMgb24gaG93IHRoZSB1c2VyIHdvdWxkIGNo b3NlIHRoZSByaWdodCBEb0ggc2VydmVyIGZyb20gdGhlIHZldHRlZCBoYXJkIGNvZGVkIG9uZSB2 cyB0aGUgcHJvcG9zZWQgbmV3IG9uZSwgZXRjLiB3aGljaCBVWCB3YXMgZXhwZWN0ZWQsIHdvbmRl cmluZyBob3cgY291bGQgaXQgYmUgZG9uZSB3aXRoIGEgZ29vZCBVWCBpbiBhIHNpdHVhdGlvbiBv ZiBhIGV4cGFuc2lvbiBvZiBtb2RhbGl0aWVzICh0aGlzIGFwcCBpcyB1c2luZyB0aGlzIERvSCBz ZXJ2ZXIsIHRoaXMgYnJvd3NlciBhbm90aGVyIG9uZSwgbXkgT1MgYW5vdGhlciBvbmUgYW5kIG5v dyBJIGFtIGFza2VkIHRvIG1ha2UgYSBjaG9pY2UgIT8hIGFyZSB3ZSDigJhjdXN0b21lciBjZW50 cmlj4oCZID8pLiBOb3Qgc2F5aW5nIGF0IGFsbCBpdCBpcyBpbXBvc3NpYmxlLCBub3Igd2hldGhl ciBJIGxpa2UgaXQgb3Igbm90IGJ1dCB3aGF0IHdhcyBjb25zaWRlcmVkLgoKVGhlIG90aGVyIGFz cGVjdHMgYXJlLCBhcyBWYXNpbHkgRG9sbWF0b3Ygc2FpZCwgdGhlIGZhY3QgdGhhdCB3ZSBhcmUg aW1wbGljaXRseSBhY2NlcHRpbmcgYSBkZWZhdWx0IG9mIGNvbmZpZ3VyYXRpb24gYXQgYXBwbGlj YXRpb24gbGV2ZWwgZm9yIDEuMS4xLjEsIGV0Yy4gaXMgZ29pbmcgdG8gaGF2ZSBhIG51bWJlciBv ZiBjb25zZXF1ZW5jZXMgdGhhdCB3ZSBwcm9iYWJseSBkbyBub3QgbWVhc3VyZSB5ZXQgY29tcGxl dGVseSBpbiBwYXJ0aWN1bGFyLCBJIGJhY2t1cCBWYXNpbHksIHRoYXQgaXQgd2lsbCBjcmVhdGUg aW50ZXJlc3Rpbmcgc2VtYW50aWMgaXNzdWVzIGJldHdlZW4gZG9tYWlucyAoYXBwbGljYXRpb24g bGV2ZWwgdnMgaW5mcmFzdHJ1Y3R1cmUgbGV2ZWwpIGFuZCBJIHNoYXJlIGhpcyBjb25jZXJuIGFi b3V0IHRoZSBwb3RlbnRpYWwgaW1wbGljYXRpb25zLgoKQW5vdGhlciBwZXJzb24gbWFkZSB0aGUg Z29vZCByZW1hcmsgdGhhdCBpdCBpcyBhIGNoYW5nZSBvbiB0aGUgYXJjaGl0ZWN0dXJlIGZvciBh cHBsaWNhdGlvbnMgYW5kIHNlcnZpY2VzIG92ZXJhbGwgYW5kIHdlIHNob3VsZCBwYXVzZSBhbmQg ZGlzY3VzcyBpdCBhbmQgSmFyaSBwb2ludGVkIHRoZSBwcm9ibGVtIG9mIGNlbnRyYWxpemF0aW9u IHdoaWNoIGlzIGEgcmVhbCBwcm9ibGVtIHRvIG1lIHRvbwoKU28gbXkgcXVlc3Rpb24gb24gYW5v dGhlciBhbHRlcm5hdGl2ZSB0byB3aGF0IERhdmlkIGlzIHByb3Bvc2luZywgaXMgd2h5IGRvbid0 IHdlIHRyeSB0byByZWNvZ25pc2UgdGhhdCBoZXJlIHdlIGhhdmUgZ2VuZXJhbCBhcHBsaWNhdGlv biBjb25maWd1cmF0aW9uIGlzc3VlIGFuZCB0aGlzIHNpdHVhdGlvbiByZW1pbmRlZCBtZSB0aGUg aW5mYW5jeSAyNSB5ZWFycyBhZ28gd2hlbiBtYWlsIGFuZCBETlMgd2hlcmUgYmFzaWNhbGx5IHRo ZSAyIG9ubHkgc2VydmljZXMgdGhhdCBjb3VsZCBiZSBvZmZlcmVkIHRvIGN1c3RvbWVycywgY2l0 aXplbnMgZXRjLiBhbmQgd2hlbiB3ZSB3ZXJlIG1pc3Npbmcgc28gbWFueSBwaWVjZXMgYW5kIGl0 IGhhZCBtYW55IHNpZGUgZWZmZWN0cyBvbiB3aGF0IHdlIHdlcmUgdHJ5aW5nIHRvIGRvIGxpa2Ug aG93IHRvIGdldCBjbGllbnRzIHRvIHVuZGVyc3RhbmQgdGhlaXIgb3duIGNvbmZpZ3VyYXRpb24u IEluIHRoaXMgdmVpbiBhbiBhcHBsaWNhdGlvbiBhY2Nlc3MgcHJvdG9jb2wgd2FzIGNyZWF0ZWQg Y2FsbGVkIEFDQVAgd2hpY2ggaXMgc3RpbGwgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3Jm YzIyNDQuIGl0IGRpZG4ndCBtZWV0IGFueSBiaWcgc3VjY2VzcyBwZXJoYXBzIGZvciB0aGUgc2lt aWxhciBjZW50cmFsaXNhdGlvbiBpc3N1ZXMgYXMgd2UgaGF2ZSB0b2RheSBidXQgaW4gYSBkaWZm ZXJlbnQgY29udGV4dCBhdCB0aGF0IHRpbWUKCkkgYW0gc3VyZWx5IHZlcnkgbmFpdmUgaGVyZSBi dXQgaWYgd2hhdCB3ZSBhcmUgZmFjaW5nIGhlcmUgYXJlIGFwcGxpY2F0aW9ucyB0aGF0IG5lZWQg dG8gZmluZCB0aGVpciBEb0ggc2VydmVyIGFuZCBwZXJoYXBzIG90aGVyIHJlc291cmNlcywgd2h5 IGFyZSB3ZSBub3QgbW9yZSBhbWJpdGlvdXMgYW5kIHdoeSBkb24ndCB3ZSByZWNvbnNpZGVyIGEg cHJvdG9jb2wgdGhhdCBpcyBmb3IgYXBwbGljYXRpb24gY29uZmlndXJhdGlvbiBhbmQgdGh1cyBp dCBjb3VsZCBiZSBtYW5hZ2VkIGJ5IHNlcnZpY2UgcHJvdmlkZXJzLCB3b3VsZCBrZWVwIHRoZSBh bGlnbm1lbnQgdG8gaW5mcmFzdHJ1Y3R1cmUgc2VtYW50aWNzLCB3b3VsZCBoZWxwIHRvIGRpc3Ry aWJ1dGUgdGhlIGRlcGxveW1lbnQsIGNvdWxkIGF2b2lkIGNlbnRyYWxpc2F0aW9uIGFuZCBjb3Vs ZCBoZWxwIHRoZSBhcmNoaXRlY3R1cmU/CgpNeSAwLjAyIENIRgoKU2VudCB3aXRoIFtQcm90b25N YWlsXShodHRwczovL3Byb3Rvbm1haWwuY29tKSBTZWN1cmUgRW1haWwu --b1_9e1e0b824b44d609c1e61f0e68d6e4fe Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 PHAgc3R5bGU9Im1hcmdpbjogMGNtIDBjbSAwLjAwMDFwdDsgY2FyZXQtY29sb3I6IHJnYigwLCAw LCAwKTsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250 LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFy dDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBu b3JtYWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7 IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiPjxzcGFuIHN0eWxlPSJjb2xvcjpyZ2IoMCwgMCwgMCki PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJpLCBzYW5zLXNlcmlmIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOm1lZGl1bSI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6LXdlYmtpdC1zdGFuZGFyZCwgc2VyaWYiPkFzIGEgbWF0dGVyIG9mIGZh Y3QgdG9kYXkgSSB3YXMgY3V0IG9uIHRoZSBtaWMgYW5kIHlldCBhZnRlciBtZSwgQmFycnkgaGFk IHRoZSBjaGFuY2UgdG8gc3BlYWsgYW5kIHRoZW4gYW5vdGhlciBwZXJzb24gaGFkIHRoZSBjaGFu Y2UgdG8gc3BlYWsgc28gaXQgZ2l2ZXMgbWUgdGhlIGNvbnRpbnVlZCBhcHBlYXJhbmNlIHRoYXQg aXQgaXMgZGlmZmljdWx0IHRvIHdvcmsgaW4gdGhlIElFVEYuPC9zcGFuPjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwvc3Bhbj48YnI+PC9wPjxwIHN0eWxlPSJtYXJnaW46IDBjbSAwY20gMC4wMDAxcHQ7 IGNhcmV0LWNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJp YW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5v cm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3Jt OiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10 ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7Ij48c3BhbiBzdHls ZT0iY29sb3I6cmdiKDAsIDAsIDApIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaSwg c2Fucy1zZXJpZiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTptZWRpdW0iPjxzcGFuIHN0eWxlPSJj b2xvcjpibGFjayI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQsIHNl cmlmIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjxicj48L3A+PHAg c3R5bGU9Im1hcmdpbjogMGNtIDBjbSAwLjAwMDFwdDsgY2FyZXQtY29sb3I6IHJnYigwLCAwLCAw KTsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdl aWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsg dGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3Jt YWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRl eHQtZGVjb3JhdGlvbjogbm9uZTsiPjxzcGFuIHN0eWxlPSJjb2xvcjpyZ2IoMCwgMCwgMCkiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJpLCBzYW5zLXNlcmlmIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOm1lZGl1bSI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6LXdlYmtpdC1zdGFuZGFyZCwgc2VyaWYiPlNvIGlmIEkgd291bGQgaGF2ZSBo YWQgdGhlIGNoYW5jZSB0byBzcGVhaywgSSB3b3VsZCBoYXZlIGFza2VkIHRoZSBxdWVzdGlvbiBy ZWdhcmRpbmcgRGF2aWQncyBwcmVzZW50YXRpb24gdGhhdCB0aGUgYXBwcm9hY2ggdGFrZW4gaGVy ZSBzZWVtcyB0byBwYXJ0aWN1bGFybHkgaW5jcmVhc2UgdGhlIGNlbnRyYWxpc2F0aW9uIGVmZmVj dCBhbmQgSSB3b3VsZCBoYXZlIGFza2VkIGNsYXJpZmljYXRpb24gcXVlc3Rpb25zIG9uIHRoZSBV WCBpbXBsaWNhdGlvbnMgb24gaG93IHRoZSB1c2VyIHdvdWxkIGNob3NlIHRoZSByaWdodCBEb0gg c2VydmVyIGZyb20gdGhlIHZldHRlZCBoYXJkIGNvZGVkIG9uZSB2cyB0aGUgcHJvcG9zZWQgbmV3 IG9uZSwgZXRjLiB3aGljaCBVWCB3YXMgZXhwZWN0ZWQsIHdvbmRlcmluZyBob3cgY291bGQgaXQg YmUgZG9uZSB3aXRoIGEgZ29vZCBVWCBpbiBhIHNpdHVhdGlvbiBvZiBhIGV4cGFuc2lvbiBvZiBt b2RhbGl0aWVzICh0aGlzIGFwcCBpcyB1c2luZyB0aGlzIERvSCBzZXJ2ZXIsIHRoaXMgYnJvd3Nl ciBhbm90aGVyIG9uZSwgbXkgT1MgYW5vdGhlciBvbmUgYW5kIG5vdyBJIGFtIGFza2VkIHRvIG1h a2UgYSBjaG9pY2UgIT8hIGFyZSB3ZSDigJhjdXN0b21lciBjZW50cmlj4oCZID8pLiBOb3Qgc2F5 aW5nIGF0IGFsbCBpdCBpcyBpbXBvc3NpYmxlLCBub3Igd2hldGhlciBJIGxpa2UgaXQgb3Igbm90 IGJ1dCB3aGF0IHdhcyBjb25zaWRlcmVkLjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PGJyPjwvcD48cCBzdHlsZT0ibWFyZ2luOiAwY20gMGNtIDAuMDAwMXB0OyBjYXJldC1jb2xv cjogcmdiKDAsIDAsIDApOyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBu b3JtYWw7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5nOiBub3JtYWw7IHRleHQt YWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgd2hp dGUtc3BhY2U6IG5vcm1hbDsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtdGV4dC1zdHJva2Ut d2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyI+PHNwYW4gc3R5bGU9ImNvbG9yOnJn YigwLCAwLCAwKSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmksIHNhbnMtc2VyaWYi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6bWVkaXVtIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2si PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTotd2Via2l0LXN0YW5kYXJkLCBzZXJpZiI+Jm5ic3A7 PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48YnI+PC9wPjxwIHN0eWxlPSJtYXJn aW46IDBjbSAwY20gMC4wMDAxcHQ7IGNhcmV0LWNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtc3R5 bGU6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1h bDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50 OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNw YWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRp b246IG5vbmU7Ij48c3BhbiBzdHlsZT0iY29sb3I6cmdiKDAsIDAsIDApIj48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6Q2FsaWJyaSwgc2Fucy1zZXJpZiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTpt ZWRpdW0iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 Oi13ZWJraXQtc3RhbmRhcmQsIHNlcmlmIj5UaGUgb3RoZXIgYXNwZWN0cyBhcmUsIGFzIFZhc2ls eSBEb2xtYXRvdiBzYWlkLCB0aGUgZmFjdCB0aGF0IHdlIGFyZSBpbXBsaWNpdGx5IGFjY2VwdGlu ZyBhIGRlZmF1bHQgb2YgY29uZmlndXJhdGlvbiBhdCBhcHBsaWNhdGlvbiBsZXZlbCBmb3IgMS4x LjEuMSwgZXRjLiBpcyBnb2luZyB0byBoYXZlIGEgbnVtYmVyIG9mIGNvbnNlcXVlbmNlcyB0aGF0 IHdlIHByb2JhYmx5IGRvIG5vdCBtZWFzdXJlIHlldCBjb21wbGV0ZWx5IGluIHBhcnRpY3VsYXIs IEkgYmFja3VwIFZhc2lseSwgdGhhdCBpdCB3aWxsIGNyZWF0ZSBpbnRlcmVzdGluZyBzZW1hbnRp YyBpc3N1ZXMgYmV0d2VlbiBkb21haW5zIChhcHBsaWNhdGlvbiBsZXZlbCB2cyBpbmZyYXN0cnVj dHVyZSBsZXZlbCkgYW5kIEkgc2hhcmUgaGlzIGNvbmNlcm4gYWJvdXQgdGhlIHBvdGVudGlhbCBp bXBsaWNhdGlvbnMuPC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48YnI+PC9wPjxw IHN0eWxlPSJtYXJnaW46IDBjbSAwY20gMC4wMDAxcHQ7IGNhcmV0LWNvbG9yOiByZ2IoMCwgMCwg MCk7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13 ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7 IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9y bWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0 ZXh0LWRlY29yYXRpb246IG5vbmU7Ij48c3BhbiBzdHlsZT0iY29sb3I6cmdiKDAsIDAsIDApIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaSwgc2Fucy1zZXJpZiI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTptZWRpdW0iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQsIHNlcmlmIj4mbmJzcDs8L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjxicj48L3A+PHAgc3R5bGU9Im1hcmdpbjogMGNtIDBjbSAw LjAwMDFwdDsgY2FyZXQtY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1zdHlsZTogbm9ybWFsOyBm b250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3Bh Y2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10 cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdvcmQtc3BhY2luZzogMHB4OyAt d2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiPjxz cGFuIHN0eWxlPSJjb2xvcjpyZ2IoMCwgMCwgMCkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpD YWxpYnJpLCBzYW5zLXNlcmlmIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOm1lZGl1bSI+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6LXdlYmtpdC1zdGFu ZGFyZCwgc2VyaWYiPkFub3RoZXIgcGVyc29uIG1hZGUgdGhlIGdvb2QgcmVtYXJrIHRoYXQgaXQg aXMgYSBjaGFuZ2Ugb24gdGhlIGFyY2hpdGVjdHVyZSBmb3IgYXBwbGljYXRpb25zIGFuZCBzZXJ2 aWNlcyBvdmVyYWxsIGFuZCB3ZSBzaG91bGQgcGF1c2UgYW5kIGRpc2N1c3MgaXQgYW5kIEphcmkg cG9pbnRlZCB0aGUgcHJvYmxlbSBvZiBjZW50cmFsaXphdGlvbiB3aGljaCBpcyBhIHJlYWwgcHJv YmxlbSB0byBtZSB0b288L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjxicj48L3A+ PGRpdj48YnI+PC9kaXY+PGRpdj48c3BhbiBzdHlsZT0iY29sb3I6cmdiKDAsIDAsIDApIj48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaSwgc2Fucy1zZXJpZiI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTptZWRpdW0iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQsIHNlcmlmIj5TbyBteSBxdWVzdGlvbiBvbiBhbm90 aGVyIGFsdGVybmF0aXZlIHRvIHdoYXQgRGF2aWQgaXMgcHJvcG9zaW5nLCBpcyB3aHkgZG9uJ3Qg d2UgdHJ5IHRvIHJlY29nbmlzZSB0aGF0IGhlcmUgd2UgaGF2ZSBnZW5lcmFsIGFwcGxpY2F0aW9u IGNvbmZpZ3VyYXRpb24gaXNzdWUgYW5kJm5ic3A7dGhpcyBzaXR1YXRpb24gcmVtaW5kZWQgbWUg dGhlIGluZmFuY3kgMjUgeWVhcnMgYWdvIHdoZW4gbWFpbCBhbmQgRE5TIHdoZXJlIGJhc2ljYWxs eSB0aGUgMiBvbmx5IHNlcnZpY2VzIHRoYXQgY291bGQgYmUgb2ZmZXJlZCB0byBjdXN0b21lcnMs IGNpdGl6ZW5zIGV0Yy4gYW5kIHdoZW4gd2Ugd2VyZSBtaXNzaW5nIHNvIG1hbnkgcGllY2VzIGFu ZCBpdCBoYWQgbWFueSBzaWRlIGVmZmVjdHMgb24gd2hhdCB3ZSB3ZXJlIHRyeWluZyB0byBkbyBs aWtlIGhvdyB0byBnZXQgY2xpZW50cyB0byB1bmRlcnN0YW5kIHRoZWlyIG93biBjb25maWd1cmF0 aW9uLiBJbiB0aGlzIHZlaW4gYW4gYXBwbGljYXRpb24gYWNjZXNzIHByb3RvY29sIHdhcyBjcmVh dGVkIGNhbGxlZCBBQ0FQIHdoaWNoIGlzIHN0aWxsJm5ic3A7PHNwYW4gc3R5bGU9ImNvbG9yOiBy Z2IoMTQ5LCA3OSwgMTE0KTsgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7IiBsYW5nPSJFTi1V UyI+PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzIyNDQiIHN0eWxlPSJj b2xvcjogcmdiKDE0OSwgNzksIDExNCk7IHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lOyI+aHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzIyNDQ8L2E+Ljwvc3Bhbj4mbmJzcDtpdCBkaWRu J3QgbWVldCBhbnkgYmlnIHN1Y2Nlc3MgcGVyaGFwcyBmb3IgdGhlIHNpbWlsYXIgY2VudHJhbGlz YXRpb24gaXNzdWVzIGFzIHdlIGhhdmUgdG9kYXkgYnV0IGluIGEgZGlmZmVyZW50IGNvbnRleHQg YXQgdGhhdCB0aW1lPC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48YnI+PC9kaXY+ PGRpdj48YnI+PC9kaXY+PHAgc3R5bGU9Im1hcmdpbjogMGNtIDBjbSAwLjAwMDFwdDsgY2FyZXQt Y29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fw czogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0 ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7 IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ry b2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiPjxzcGFuIHN0eWxlPSJjb2xv cjpyZ2IoMCwgMCwgMCkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJpLCBzYW5zLXNl cmlmIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOm1lZGl1bSI+PHNwYW4gc3R5bGU9ImNvbG9yOmJs YWNrIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6LXdlYmtpdC1zdGFuZGFyZCwgc2VyaWYiPkkg YW0gc3VyZWx5IHZlcnkgbmFpdmUgaGVyZSBidXQgaWYgd2hhdCB3ZSBhcmUgZmFjaW5nIGhlcmUg YXJlIGFwcGxpY2F0aW9ucyB0aGF0IG5lZWQgdG8gZmluZCB0aGVpciBEb0ggc2VydmVyIGFuZCBw ZXJoYXBzIG90aGVyIHJlc291cmNlcywgd2h5IGFyZSB3ZSBub3QgbW9yZSBhbWJpdGlvdXMgYW5k IHdoeSBkb24ndCB3ZSByZWNvbnNpZGVyIGEgcHJvdG9jb2wgdGhhdCBpcyBmb3IgYXBwbGljYXRp b24gY29uZmlndXJhdGlvbiBhbmQgdGh1cyBpdCBjb3VsZCBiZSBtYW5hZ2VkIGJ5IHNlcnZpY2Ug cHJvdmlkZXJzLCB3b3VsZCBrZWVwIHRoZSBhbGlnbm1lbnQgdG8gaW5mcmFzdHJ1Y3R1cmUgc2Vt YW50aWNzLCB3b3VsZCBoZWxwIHRvIGRpc3RyaWJ1dGUgdGhlIGRlcGxveW1lbnQsIGNvdWxkIGF2 b2lkIGNlbnRyYWxpc2F0aW9uIGFuZCBjb3VsZCBoZWxwIHRoZSBhcmNoaXRlY3R1cmU/Jm5ic3A7 PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48YnI+PC9wPjxkaXY+PGJyPjwvZGl2 PjxkaXY+PHNwYW4gc3R5bGU9ImNvbG9yOnJnYigwLCAwLCAwKSI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OkNhbGlicmksIHNhbnMtc2VyaWYiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6bWVkaXVt Ij48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTotd2Vi a2l0LXN0YW5kYXJkLCBzZXJpZiI+TXkgMC4wMiBDSEY8L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2IGNsYXNzPSJwcm90b25tYWls X3NpZ25hdHVyZV9ibG9jayI+PGRpdiBjbGFzcz0icHJvdG9ubWFpbF9zaWduYXR1cmVfYmxvY2st dXNlciBwcm90b25tYWlsX3NpZ25hdHVyZV9ibG9jay1lbXB0eSI+PGJyPjwvZGl2PjxkaXYgY2xh c3M9InByb3Rvbm1haWxfc2lnbmF0dXJlX2Jsb2NrLXByb3RvbiI+U2VudCB3aXRoIDxhIGhyZWY9 Imh0dHBzOi8vcHJvdG9ubWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5Qcm90b25NYWlsPC9hPiBT ZWN1cmUgRW1haWwuPGJyPjwvZGl2PjwvZGl2PjxkaXY+PGJyPjwvZGl2Pg== --b1_9e1e0b824b44d609c1e61f0e68d6e4fe-- From nobody Tue Jul 23 18:51:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E62D1209C3 for ; Tue, 23 Jul 2019 18:51:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M31ldj2zBJvj for ; Tue, 23 Jul 2019 18:51:00 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 644561209C1 for ; Tue, 23 Jul 2019 18:51:00 -0700 (PDT) Received: from dhcp-962f.meeting.ietf.org (dhcp-962f.meeting.ietf.org [31.133.150.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 19F5B242109D; Wed, 24 Jul 2019 01:50:58 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 24 Jul 2019 02:56:15 +0100 Cc: "add@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> To: Rob Sayre X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 01:51:02 -0000 > On 24 Jul 2019, at 01:16, Rob Sayre wrote: >=20 > DNS is insecure in a coffee shop, and that is going to be fixed. It didn't/doesn't take or need DoH (or DoT) to fix that problem. Though of course I'm glad we've got DoT and DoH as new weapons in the = on-going security arms race. BTW, using DoH or DoT in the above scenario doesn't necessarily make = things "secure". It just changes the security landscape by swapping one = set of concerns for another. A cynic (or realist) would say they'd just = replaced one DNS resolver they probably didn't/shouldn't trust to = another that isn't necessarily more trustworthy. Unless DNSSEC = validation is used, a client can never tell if its resolving server is = telling the truth or not -- irrespective of whether that answer got sent = from port 53, port 443 or port 853. From nobody Tue Jul 23 19:05:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F7B71209C1 for ; Tue, 23 Jul 2019 19:05:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t67MCZ8L38xJ for ; Tue, 23 Jul 2019 19:05:11 -0700 (PDT) Received: from mail-qk1-x734.google.com (mail-qk1-x734.google.com [IPv6:2607:f8b0:4864:20::734]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3481012008C for ; Tue, 23 Jul 2019 19:05:11 -0700 (PDT) Received: by mail-qk1-x734.google.com with SMTP id s22so32682948qkj.12 for ; Tue, 23 Jul 2019 19:05:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=n5hmrSczqJkDHGUE5pXWClwxlu1cfmvoDln6BImX+Xo=; b=nr6mUPaC1H/wzZgv9cSN4zn1e5HtPRGHvgp4JbvmOTYh8Ec0UuLpzZhXJRS0wHo19X M0K7cxTeTIH6Ix1gE9DPVbP6awnhkgb5/bLV9Lws1tF/3Cc+vNn6HT9HgRujl/abXY0e kvcfYnSuS45Lbpf5hetas5zLfV/U5god+lmNnM8lPsOfkRskjYcy5VMxcLoDVywMDi1S /rll0J250UCUdlldxiHeOaIhMOj4fMeHUNpfz436oKTnDtaegWiWM/5C0cmIah0UAYRr 0J2J9jJvTjjOEQ6+TRUKKDCko0eABRTmEzsMO7f4R+hDVUEYu4NOI78xduN8L9/epAIN +9DA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=n5hmrSczqJkDHGUE5pXWClwxlu1cfmvoDln6BImX+Xo=; b=h57bwqEKzbn3AJlI8gYCh7Ct8U4g7oN9e19WslEE/+kOPaGXB/csQNEaWQ+QSNK6+I aMo21giE24V5610xegUsHexz1ug8kwt+yXW54lw/1Oinlrbx7L17ZbqmN3uSde3hf6Qo jtxiubiwi1ECQfczb/EORR72hUq38ETvJSO6Zyn5zhYXsUJMaaLVXiyMtkgSUd9yFGSt 9YY6djBzt3iLSlQ1s9jXdivxZIBHqmVUGwwXJ+ReDM3YYRU+gNElqImjsyhVIBf9im/x YudcLo4BNBVHCnHkEV6JiFWP8jTqGLIfWWUWrQ9tE+t80lqm3Ei+9Z8FMTfUo8wP6Ncd JunA== X-Gm-Message-State: APjAAAV7QV1VLI8W9Wp2UkD2ERYlyH0Sx8nTr2oLJOGavG3q58bD2bjM O/Nx0yxCebvNTt83S+VLXik= X-Google-Smtp-Source: APXvYqyDQhDY+sH7+tq+/KhRevlJMgzAp2dL4M/ShudKmr+pmEjaGIBqIsOau4mZd33Elc0xsdUfAw== X-Received: by 2002:a05:620a:15cd:: with SMTP id o13mr51656292qkm.273.1563933910323; Tue, 23 Jul 2019 19:05:10 -0700 (PDT) Received: from [172.20.3.66] ([216.113.24.76]) by smtp.gmail.com with ESMTPSA id k74sm22820677qke.53.2019.07.23.19.05.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 23 Jul 2019 19:05:09 -0700 (PDT) From: Bret Jordan Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_E1316C44-460F-4B98-AE87-A44F628B2777" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 23 Jul 2019 22:05:06 -0400 In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> Cc: Rob Sayre , "add@ietf.org" , Barry Leiba To: "STARK, BARBARA H" References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 02:05:13 -0000 --Apple-Mail=_E1316C44-460F-4B98-AE87-A44F628B2777 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I agree with Barbara. Further, why is it so hard for us to acknowledge = and document how this is going to impact operators and even give them = some options? What are we so afraid of? Letting people know that we = made a change that is going to impact them?=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Jul 23, 2019, at 6:46 PM, STARK, BARBARA H wrote: >=20 > That=E2=80=99s like saying IETF should never have published BCP 38. = What is BCP 38 (or any other BCP), if not policy? > IETF absolutely is the right place to discuss BCPs related to = technology that has the ability to massively impact the traffic patterns = of the Internet and impact (in a very negative way) the experience of = all users of the Internet. I=E2=80=99m *not* saying that it *will* have = such a negative impact. But it absolutely has the ability. And it=E2=80=99= s this *potential* that has all the network operators very worried. > =20 > The Internet ecosystem is built on the idea that the various = participants can generally trust one another to participate in a way = that benefits the Internet and its users. > I don=E2=80=99t believe that any of the application developers = participating in IETF want to damage the Internet or have a negative = impact on users=E2=80=99 experiences. > And I very much trust and like the people from Mozilla and Google and = Cloudflare. They=E2=80=99re all super nice people who are great fun to = drink beer with. > But I don=E2=80=99t think they have the operational = experience/knowledge to fully understand what might happen in various = access networks (especially mobile networks) if they started defaulting = all their application users to DNS servers outside the local (ISP, = enterprise, university, etc.) network. > The IETF is a place where we can and must have this discussion, so all = parties can participate in understanding and mitigating the potential = harm. > =20 > I=E2=80=99m also trying to understand why there seems to be resistance = to providing ISPs with advice on deploying DoH. Who does it hurt to = provide such advice, and why should it be improper for IETF to provide = advice on deploying a protocol it has published? [Advice on how to = deploy is absolutely a form of =E2=80=9Cpolicy=E2=80=9D.] > And why should an ISP DoH resolver or using regular DNS not be = considered valid =E2=80=9Cchoices=E2=80=9D for a user to make? > Barbara > =20 > From: Add On Behalf Of Rob Sayre > Sent: Tuesday, July 23, 2019 6:09 PM > To: add@ietf.org; Barry Leiba > Subject: [Add] meeting hum: should the IETF take up this work? > =20 > Hi, > =20 > The IETF shouldn't take up work in reaction to non-technical (aka = "policy") concerns about imminent deployment of an approved RFC. In this = case, it's DoH (https://tools.ietf.org/html/rfc8484 = ). > =20 > Mozilla's presentation accurately stated that DNS is no longer an = effective control surface. It can't be, given that HTTPS is ubiquitous, = and one can use it to tunnel any protocol. > =20 > thanks, > Rob > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_E1316C44-460F-4B98-AE87-A44F628B2777 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I = agree with Barbara.  Further, why is it so hard for us to = acknowledge and document how this is going to impact operators and even = give them some options?  What are we so afraid of?  Letting = people know that we made a change that is going to impact = them? 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Jul 23, 2019, at 6:46 PM, STARK, BARBARA H <bs7652@att.com> = wrote:

That=E2=80=99= s like saying IETF should never have published BCP 38. What is BCP 38 = (or any other BCP), if not policy?
IETF absolutely is the right place to = discuss BCPs related to technology that has the ability to massively = impact the traffic patterns of the Internet and impact (in a very = negative way) the experience of all users of the Internet. I=E2=80=99m = *not* saying that it *will* have = such a negative impact. But it absolutely has the ability. And it=E2=80=99= s this *potential* that has all the network operators = very worried.
 
The Internet ecosystem is built on the idea that the various = participants can generally trust one another to participate in a way = that benefits the Internet and its users.
I don=E2=80=99t believe that any of the = application developers participating in IETF want to damage the Internet = or have a negative impact on users=E2=80=99 experiences.
And I = very much trust and like the people from Mozilla and Google and = Cloudflare. They=E2=80=99re all super nice people who are great fun to = drink beer with.
But I don=E2=80=99t think they have the operational = experience/knowledge to fully understand what might happen in various = access networks (especially mobile networks) if they started defaulting = all their application users to DNS servers outside the local (ISP, = enterprise, university, etc.) network.
The IETF is a place where we can and = must have this discussion, so all parties can participate in = understanding and mitigating the potential harm.
 
I=E2=80=99m= also trying to understand why there seems to be resistance to providing = ISPs with advice on deploying DoH. Who does it hurt to provide such = advice, and why should it be improper for IETF to provide advice on = deploying a protocol it has published? [Advice on how to deploy is = absolutely a form of =E2=80=9Cpolicy=E2=80=9D.]
And why = should an ISP DoH resolver or using regular DNS not be considered valid = =E2=80=9Cchoices=E2=80=9D for a user to make?
Barbara
 
From: Add <add-bounces@ietf.org> On Behalf = Of Rob Sayre
Sent: Tuesday, July 23, 2019 6:09 = PM
To: add@ietf.org; Barry Leiba = <barryleiba.mailing.lists@gmail.com>
Subject: [Add] meeting hum: should = the IETF take up this work?
 
Hi,
 
The IETF shouldn't take up work in = reaction to non-technical (aka "policy") concerns about imminent = deployment of an approved RFC. In this case, it's DoH (https://tools.ietf.org/html/rfc8484).
 
Mozilla's presentation accurately = stated that DNS is no longer an effective control surface. It can't be, = given that HTTPS is ubiquitous, and one can use it to tunnel any = protocol.
 
thanks,
Rob
-- Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_E1316C44-460F-4B98-AE87-A44F628B2777-- From nobody Tue Jul 23 19:08:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6A331209C7 for ; Tue, 23 Jul 2019 19:08:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qJb8EVTL9_YN for ; Tue, 23 Jul 2019 19:08:06 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8DC912008C for ; Tue, 23 Jul 2019 19:08:05 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id h6so86149734iom.7 for ; Tue, 23 Jul 2019 19:08:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=J9R1Hkx63zAaMP6i5TAGclXbEmoRGeJgJ0l/RFbvhrU=; b=V/a5bsmJVRzPkbp9qk+uNEv80eW9Nf0YhSq+AeIolTsyMCibo5BXGXcu0/mx11vnwV P4tFpLMcgL7Sna8R6oYzvBNXP+RmmGugiHHqUurTwB1KTq2NW6CI2B6KQLxy5o9X5LB/ absnW60m71VuGFoOAI/k7dD2MkXKtwsOkYVMhFXJTtpRZTMxNFAF2UNDYd0q1RHNMHvP x3WcEIgMX6t6VniFQGSzBqI7UjElbxuTOlD6NxXKQkombrpF0ol7/6uFWpg46NskU8zb zuMRIOk9UCWHIR/0apo0Db/At0TwmbwI6j165kjyeqsE94iGpvi8pZy1TmSEggZzbUgU 4cKw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=J9R1Hkx63zAaMP6i5TAGclXbEmoRGeJgJ0l/RFbvhrU=; b=pR18FWreslwYhVITB5rguY+HSv6qKdaUe5BXDA/tQPjwM/sMDfwYKQEjIPhl1Q5QX/ Ziu2G7DO5PYYwBVj4jIYFdqJys8Phnvze7s4HH4qf93uMWcaheD34Eg+CKF43zJxz+QJ jSnKdBLgCeV2GToRTzYP2pIWh6mfs3bX6pMWcAPfnfrVZRH41+1QSfvv5eb1Wj3uCtdz 5q7nJ/Rsz+i/pcWKF7yiUzU/Ynq6LRMw3pnF/l6/vyWNKx0MIDiQbkdnBYluMO1Jy5iS LuhJ2LTNFWd22kDtaqd9HgcvNune2GMV/uongT7vhe/fRsCDdXeH1X/Evs5VDORfxvU9 2Hyg== X-Gm-Message-State: APjAAAW8kXuYG6D5j8Hn68wxdjQhSYaGDRJMfYJ8FKdp/ns/T0Ph9lG/ /h4/8LlPzmqU56p8l8VwNKBrbma9HxmQeEZMdnHkAHdsXu4= X-Google-Smtp-Source: APXvYqyzfEeASBANveQ/U4suS3iv8vo6DDU1OEKszEZ5P5nEN0x3g6Eq9utwaZ/Xrx1rX6BwG21wT34J+xRM8krGuJw= X-Received: by 2002:a05:6638:303:: with SMTP id w3mr28332922jap.103.1563934084961; Tue, 23 Jul 2019 19:08:04 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> In-Reply-To: From: Rob Sayre Date: Tue, 23 Jul 2019 19:07:53 -0700 Message-ID: To: Jim Reid Cc: "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000961b61058e63c7b9" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 02:08:08 -0000 --000000000000961b61058e63c7b9 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 23, 2019 at 6:50 PM Jim Reid wrote: > It didn't/doesn't take or need DoH (or DoT) to fix that problem. > DNS has had 31 years to fix the problem. It's still just unencrypted coffee shop traffic, right? > Though of course I'm glad we've got DoT and DoH as new weapons in the > on-going security arms race. > That's not clear to me. > BTW, using DoH or DoT in the above scenario doesn't necessarily make > things "secure". It just changes the security landscape by swapping one set > of concerns for another. A cynic (or realist) would say they'd just > replaced one DNS resolver they probably didn't/shouldn't trust to another > that isn't necessarily more trustworthy. It does avoid a variety of local attacks. > Unless DNSSEC validation is used > Uh, no. thanks, Rob --000000000000961b61058e63c7b9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 23, 2019 at 6:50 PM Jim Reid = <jim@rfc1035.com> wrote:
It didn't/doesn't take or need DoH (or DoT) to fix that problem.

DNS has had 31 years to fix the problem. = It's still just unencrypted coffee shop traffic, right?
=C2= =A0
Though of course I'm glad we've got DoT and DoH as new weapons in t= he on-going security arms race.

That= 9;s not clear to me.
=C2=A0
BTW, using DoH or DoT in the above scenario doesn't necessarily make th= ings "secure". It just changes the security landscape by swapping= one set of concerns for another. A cynic (or realist) would say they'd= just replaced one DNS resolver they probably didn't/shouldn't trus= t to another that isn't necessarily more trustworthy.

It does avoid a variety of local attacks.
=C2=A0<= /div>
Unless DNSSEC valida= tion is used

Uh, no.

thanks,
Rob=C2=A0
--000000000000961b61058e63c7b9-- From nobody Tue Jul 23 19:12:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A50B11209CB for ; Tue, 23 Jul 2019 19:12:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1pHsSbuscKV0 for ; Tue, 23 Jul 2019 19:12:50 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E4845120026 for ; Tue, 23 Jul 2019 19:12:49 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id f4so86224625ioh.6 for ; Tue, 23 Jul 2019 19:12:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=EHJMzW0v+Km+jH3OPFvl9qZBoB2HR1BmCQ7u6OVBenI=; b=qAICOKcHawnBp+0mmjk2UxiRgc0XlXv4F3hT3occ2SjyeJ/4eBrxIoT1y2nQffYY9V 3n9ncy4uV6AXEmh5yLQr50bu6tVpyHlbGNPlje0eL/PHP+6R29UNo51T6ufa2EypZK6P p6Q7+63v+B1A87RpkLFBtW6j2RJGWVwFxOFQwKLgARhbvE3vkulN+jZFZ2ggSqSAWdIK mMDzuYvzTD8yimznRw/81say5CNyVvCEiWGVxqT1MoUD7qhgQw4IkwAhz2cd9HeEXnNg SW7cznM/t2m3KNurkk4A9psMVQ0B8fD85fQ1g8qKRCOyFxoREmlepGIdRnk70QDGN93Q 6g/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=EHJMzW0v+Km+jH3OPFvl9qZBoB2HR1BmCQ7u6OVBenI=; b=amEB98RConC9QR9LBh+l2XRQgFMU4OcJVndmWUz52O8EzSiZ2VRIhMeE7eD0TXiERo cclsyY2meQhIapzXm7Wh8VVxjwLjxBEo6JH5DYWafHfsoIrNa7mJ8046QfkE1Dpy2RfG vYbTAbQG/ETRgdswbFVyVD9GiiIiLyZ2Qiq2/0h+DEJWms2kTMF1pU7qJgDzb7vCEQKq ilCFToMRQji3N1PLd8lZ7S98C7fRNvXfhl6ezZykmKSWXDuQ6J0olzpIbap8z7O4VDx6 5tZVG+PWIq7GgD03rYHMPzlmGbE5eDr9Uc93iAASf3t6NVxcGmeBlkjpJBAbNNHn5z6u JC/g== X-Gm-Message-State: APjAAAWyGnc9QRyJZDhxYoYRF8juq5vy6OqheLbcOH8FWAXu7+NDVQe8 +AuxoBoMgDoYufPdsnDGcxNcem95xaMoX3LXPiXqnTjRjFp6yQ== X-Google-Smtp-Source: APXvYqzvBObqQsnf4BzPbYDJcm2B8RHQOgruSSVLIpir9KF1LinA77bjyRzP2Fhgnz3JPhUXaSvUdHSjvo2TtcnjZGA= X-Received: by 2002:a5e:9515:: with SMTP id r21mr40613334ioj.257.1563934369197; Tue, 23 Jul 2019 19:12:49 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: From: Rob Sayre Date: Tue, 23 Jul 2019 19:12:38 -0700 Message-ID: To: Bret Jordan Cc: "STARK, BARBARA H" , "add@ietf.org" , Barry Leiba Content-Type: multipart/alternative; boundary="0000000000008735ed058e63d808" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 02:12:52 -0000 --0000000000008735ed058e63d808 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 23, 2019 at 7:05 PM Bret Jordan wrote: > this is going to impact operators > Saying "this is going to impact operators" without specifics sounds more like a business problem, rather than a technical issue. thanks, Rob --0000000000008735ed058e63d808 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 23, 2019 at 7:05 PM Bret Jord= an <jordan.ietf@gmail.com&g= t; wrote:
this is goin= g to impact operators

Saying "th= is is going to impact operators" without specifics sounds more like a = business problem, rather than a technical issue.

t= hanks,
Rob

--0000000000008735ed058e63d808-- From nobody Tue Jul 23 19:15:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 102D61209D1 for ; Tue, 23 Jul 2019 19:15:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cRlbZDCyICSr for ; Tue, 23 Jul 2019 19:15:01 -0700 (PDT) Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBE461209C3 for ; Tue, 23 Jul 2019 19:15:00 -0700 (PDT) Received: by mail-qk1-x72f.google.com with SMTP id r6so32713697qkc.0 for ; Tue, 23 Jul 2019 19:15:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=U3RfcJJvXjjAC/Igsv34C6LT9rOh90+UX8VD/N//yEQ=; b=DHKMKkVpOduMZJNQKDp27sIozGu5+ivpUaBFlxbWZ4VtIrv7ejBhJofgNDhT91dUX9 OTWe9u6a0atAqSx4CtzP0q/JtObClqbxD/WogcVk5qyKR6FEpFyNN1FtPvKsD1liAWFB si/dCbYvT+1kHAFNu3eoD+2cbzMHTFz+GrfaxuoUP5IdS358eDXaxjbTMw8N5SU9brqG 2lhFcls9qUGFpm8At2yWg1xfUSDwhKGuo56BHIkZ9yP6ZuiM40eqwnZKSTLlGJUPrUzF 7+A7emsyUNi3nxVLjwC78zQWQnTYvId2ozj95RGKLrMxP312lyTNqrw503ai4NgM8QKY YqIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=U3RfcJJvXjjAC/Igsv34C6LT9rOh90+UX8VD/N//yEQ=; b=Jf3nvY+0MSuYCJIku2wZU0TcdyJKqFY+dcdNuvc4iuJZQEpkOOLwS9MQ/n8aaIzdKD KEj0QgPrH4r2v3rGtVXrQk+kJNMk4rv5+/bliNIhhnpKVXUWt/hYWiY3O2XWJMb/Waf3 7SDmkBG7BF7cmYh/ONgX7l/ixkWM7WPkNFb/Ad8J9jvIzur0JjDm2KszJEelREdk2M+o SBZoN+yBqFq9yopwZfbXBF38DR67xkOykMGKg48wJPfTLJMMC3gSwEB3G/lKJsVHodac nTkSQ1EVTcx+cUoc407IME4UZlcL1KHld/FLJVKdVESMwBzrRFB7xjxigxCNq1GC2IgK +nXA== X-Gm-Message-State: APjAAAW8l8PZ5TpMvUxBfFSaXSLp8q3FBqPTTLw2mQM+yne37W6x2ZbH HGYTi6oMnTGMWjwoM2nK3io= X-Google-Smtp-Source: APXvYqwUXvKbsBKLTtn4ZYjgzc9c6azWnfmwsiyIYrVo4k/mEgV+uFAuoH2rq2KkHT2NygCoo9W7aw== X-Received: by 2002:a37:9ec8:: with SMTP id h191mr55818269qke.229.1563934500033; Tue, 23 Jul 2019 19:15:00 -0700 (PDT) Received: from [172.20.3.66] ([216.113.24.76]) by smtp.gmail.com with ESMTPSA id m5sm18869252qkb.117.2019.07.23.19.14.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 23 Jul 2019 19:14:59 -0700 (PDT) From: Bret Jordan Message-Id: <06B41162-5936-4BF7-A9D6-3D864BB93ED2@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_C2938C65-9AB7-4142-925F-A1A014FE7734" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 23 Jul 2019 22:14:55 -0400 In-Reply-To: Cc: "add@ietf.org" , Barry Leiba To: Arnaud Taddei References: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Followup from ADD session today X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 02:15:04 -0000 --Apple-Mail=_C2938C65-9AB7-4142-925F-A1A014FE7734 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 You touch on a point that I think is critical. All of this provides the = potential for massive centralization and tracking of DNS data, on a = scale much more severe than anything we have today. The internet and = privacy works best when we are very decentralized.=20 Imaging an app being installed on a device that allows a user to browse = the web. It has a hard coded DoH server that it wants to use, that = points to the DoH server of its choice. The app can add as many other = headers it wants to ensure that it can fully track that user and = application, no matter where they are. So no matter where that client = is, you will always be able to have a perfect telemetry of everything = they have done and when they do it.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Jul 23, 2019, at 9:38 PM, Arnaud.Taddei.IETF = wrote: >=20 > As a matter of fact today I was cut on the mic and yet after me, Barry = had the chance to speak and then another person had the chance to speak = so it gives me the continued appearance that it is difficult to work in = the IETF. > =20 > So if I would have had the chance to speak, I would have asked the = question regarding David's presentation that the approach taken here = seems to particularly increase the centralisation effect and I would = have asked clarification questions on the UX implications on how the = user would chose the right DoH server from the vetted hard coded one vs = the proposed new one, etc. which UX was expected, wondering how could it = be done with a good UX in a situation of a expansion of modalities (this = app is using this DoH server, this browser another one, my OS another = one and now I am asked to make a choice !?! are we =E2=80=98customer = centric=E2=80=99 ?). Not saying at all it is impossible, nor whether I = like it or not but what was considered. > =20 > The other aspects are, as Vasily Dolmatov said, the fact that we are = implicitly accepting a default of configuration at application level for = 1.1.1.1, etc. is going to have a number of consequences that we probably = do not measure yet completely in particular, I backup Vasily, that it = will create interesting semantic issues between domains (application = level vs infrastructure level) and I share his concern about the = potential implications. > =20 > Another person made the good remark that it is a change on the = architecture for applications and services overall and we should pause = and discuss it and Jari pointed the problem of centralization which is a = real problem to me too >=20 > So my question on another alternative to what David is proposing, is = why don't we try to recognise that here we have general application = configuration issue and this situation reminded me the infancy 25 years = ago when mail and DNS where basically the 2 only services that could be = offered to customers, citizens etc. and when we were missing so many = pieces and it had many side effects on what we were trying to do like = how to get clients to understand their own configuration. In this vein = an application access protocol was created called ACAP which is still = https://tools.ietf.org/html/rfc2244 = . it didn't meet any big success = perhaps for the similar centralisation issues as we have today but in a = different context at that time >=20 > I am surely very naive here but if what we are facing here are = applications that need to find their DoH server and perhaps other = resources, why are we not more ambitious and why don't we reconsider a = protocol that is for application configuration and thus it could be = managed by service providers, would keep the alignment to infrastructure = semantics, would help to distribute the deployment, could avoid = centralisation and could help the architecture?=20 >=20 > My 0.02 CHF >=20 >=20 > Sent with ProtonMail Secure Email. >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_C2938C65-9AB7-4142-925F-A1A014FE7734 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 You = touch on a point that I think is critical. All of this provides the = potential for massive centralization and tracking of DNS data, on a = scale much more severe than anything we have today. The internet and = privacy works best when we are very decentralized. 

Imaging an app being = installed on a device that allows a user to browse the web. It has a = hard coded DoH server that it wants to use, that points to the DoH = server of its choice.  The app can add as many other headers it = wants to ensure that it can fully track that user and application, no = matter where they are.  So no matter where that client is, you will = always be able to have a perfect telemetry of everything they have done = and when they do it. 

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Jul 23, 2019, at 9:38 PM, Arnaud.Taddei.IETF <Arnaud.Taddei.IETF=3D40protonmail.com@dmarc.ietf.org> = wrote:

As a matter of fact today I was cut on the mic and yet after = me, Barry had the chance to speak and then another person had the chance = to speak so it gives me the continued appearance that it is difficult to = work in the IETF.
 
So if I would = have had the chance to speak, I would have asked the question regarding = David's presentation that the approach taken here seems to particularly = increase the centralisation effect and I would have asked clarification = questions on the UX implications on how the user would chose the right = DoH server from the vetted hard coded one vs the proposed new one, etc. = which UX was expected, wondering how could it be done with a good UX in = a situation of a expansion of modalities (this app is using this DoH = server, this browser another one, my OS another one and now I am asked = to make a choice !?! are we =E2=80=98customer centric=E2=80=99 ?). Not = saying at all it is impossible, nor whether I like it or not but what = was considered.
 
The other = aspects are, as Vasily Dolmatov said, the fact that we are implicitly = accepting a default of configuration at application level for 1.1.1.1, = etc. is going to have a number of consequences that we probably do not = measure yet completely in particular, I backup Vasily, that it will = create interesting semantic issues between domains (application level vs = infrastructure level) and I share his concern about the potential = implications.
 
Another person = made the good remark that it is a change on the architecture for = applications and services overall and we should pause and discuss it and = Jari pointed the problem of centralization which is a real problem to me = too

So my question on another alternative to what David is = proposing, is why don't we try to recognise that here we have general = application configuration issue and this situation reminded me the = infancy 25 years ago when mail and DNS where basically the 2 only = services that could be offered to customers, citizens etc. and when we = were missing so many pieces and it had many side effects on what we were = trying to do like how to get clients to understand their own = configuration. In this vein an application access protocol was created = called ACAP which is still https://tools.ietf.org/html/rfc2244. it = didn't meet any big success perhaps for the similar centralisation = issues as we have today but in a different context at that = time

I am surely = very naive here but if what we are facing here are applications that = need to find their DoH server and perhaps other resources, why are we = not more ambitious and why don't we reconsider a protocol that is for = application configuration and thus it could be managed by service = providers, would keep the alignment to infrastructure semantics, would = help to distribute the deployment, could avoid centralisation and could = help the architecture? 

My 0.02 = CHF


Sent with ProtonMail Secure Email.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_C2938C65-9AB7-4142-925F-A1A014FE7734-- From nobody Tue Jul 23 19:16:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 215B11209CA for ; Tue, 23 Jul 2019 19:16:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o5F3efaf0BWU for ; Tue, 23 Jul 2019 19:16:33 -0700 (PDT) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C9F231209C3 for ; Tue, 23 Jul 2019 19:16:32 -0700 (PDT) Received: by mail-qk1-x729.google.com with SMTP id 201so32656026qkm.9 for ; Tue, 23 Jul 2019 19:16:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=DYeJPoYnY0/TU505FOjX7OFd+FeZfCWj0ePMZh/TOV0=; b=fTYNmzNgIRnmYKkUdr9a/nkzjxypqjgkGxX+5sUPyLJzgtAQutoNqCH7K64TrhBIlD Cd0TScEzKBShWjT+XsyjQCBhJge7heM0M5gXMv5CdQRbzufMTzTU9xWoA+G1olAT6w/q Pou92Wf/OzfdyCXExwH2Bm+G+Nh1mxjgn80BgOTCPlyiN/8WrT4piRlhhKCR54cGxKsv R9XPisS/62O95K5bbwPRJt6aS8c+MK7PMblm4X2P0YC1SIQGuyQ/288b5RBKBrathL2q zq+rQc2/tI2QmcvA/dJc47AfaSDXrgGs3WArzGwOb1uHV/H95kmcTbHYNB4rqDOA7sH4 Fw5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=DYeJPoYnY0/TU505FOjX7OFd+FeZfCWj0ePMZh/TOV0=; b=sn88D3M3DIAaMwe8OAI+s6Yi1CwN+H4ZCW5dYVXq9p56bLwAxTxYspDXGI27wrZZTA Z8kmICmptu6kjY9SDTjM9N3cEF2qIjNBRFfZbSsKSWmR1q9lEyrHxZZDRwp8xUbx4ehE aYCUEFyAMn8uY4oZ+YRiF/X5AEha4V0PtI9R/0faWdJYrAnmU8KkUqLGbviuhzlTa551 RkORLRo53DcY1pkeKqyR3z++I5DW9wTRPAkcV+d3S9mO9LdqgnZZGIz6dUlI8QhLYz7u XbkZt3fs37BTYwrXnRg/ps7/p0EVbBNe2Dj2oJNcvETogtZf2AG2sMsUeT0yF91EH9r8 DkWA== X-Gm-Message-State: APjAAAVImehYL0OFSh6tf3Qsq48FTrzxr9RrQooFhQRphLfB4S8//Vj/ KczeLneESrt202hUXHqPYYw= X-Google-Smtp-Source: APXvYqxtYLs8rSR/LOHRmHtlwqC4Dn0C/Ha0J69fGeduViyfi8cmZHZslND+L1oVcJjUZ99GyQgmYA== X-Received: by 2002:a37:9a4a:: with SMTP id c71mr19779730qke.258.1563934592018; Tue, 23 Jul 2019 19:16:32 -0700 (PDT) Received: from [172.20.3.66] ([216.113.24.76]) by smtp.gmail.com with ESMTPSA id f22sm18306843qkk.45.2019.07.23.19.16.31 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 23 Jul 2019 19:16:31 -0700 (PDT) From: Bret Jordan Message-Id: <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_3BD6603E-4C01-44BF-9F6C-ACA0D777BAB1" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 23 Jul 2019 22:16:28 -0400 In-Reply-To: Cc: Jim Reid , "add@ietf.org" To: Rob Sayre References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 02:16:35 -0000 --Apple-Mail=_3BD6603E-4C01-44BF-9F6C-ACA0D777BAB1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Well to use the argument that others have used, why not just use VPN in = your coffee shop? Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Jul 23, 2019, at 10:07 PM, Rob Sayre wrote: >=20 > On Tue, Jul 23, 2019 at 6:50 PM Jim Reid > wrote: > It didn't/doesn't take or need DoH (or DoT) to fix that problem. >=20 > DNS has had 31 years to fix the problem. It's still just unencrypted = coffee shop traffic, right? > =20 > Though of course I'm glad we've got DoT and DoH as new weapons in the = on-going security arms race. >=20 > That's not clear to me. > =20 > BTW, using DoH or DoT in the above scenario doesn't necessarily make = things "secure". It just changes the security landscape by swapping one = set of concerns for another. A cynic (or realist) would say they'd just = replaced one DNS resolver they probably didn't/shouldn't trust to = another that isn't necessarily more trustworthy. >=20 > It does avoid a variety of local attacks. > =20 > Unless DNSSEC validation is used >=20 > Uh, no. >=20 > thanks, > Rob=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_3BD6603E-4C01-44BF-9F6C-ACA0D777BAB1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Well = to use the argument that others have used, why not just use VPN in your = coffee shop?


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Jul 23, 2019, at 10:07 PM, Rob Sayre <sayrer@gmail.com> = wrote:

On Tue, Jul 23, 2019 = at 6:50 PM Jim Reid <jim@rfc1035.com> wrote:
It didn't/doesn't take or need DoH (or DoT) to fix that problem.

DNS has had 31 years to fix the problem. It's still just = unencrypted coffee shop traffic, right?
 
Though of course I'm glad we've got DoT and DoH as new weapons in the = on-going security arms race.

That's not clear to = me.
 
BTW, using DoH or DoT in the above scenario doesn't necessarily make = things "secure". It just changes the security landscape by swapping one = set of concerns for another. A cynic (or realist) would say they'd just = replaced one DNS resolver they probably didn't/shouldn't trust to = another that isn't necessarily more trustworthy.

It does avoid a variety = of local attacks.
 
Unless DNSSEC validation is = used

Uh, no.

thanks,
Rob 
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_3BD6603E-4C01-44BF-9F6C-ACA0D777BAB1-- From nobody Tue Jul 23 19:19:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 852C41209CA for ; Tue, 23 Jul 2019 19:19:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V9D2_adfxckt for ; Tue, 23 Jul 2019 19:19:50 -0700 (PDT) Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B764B1209C3 for ; Tue, 23 Jul 2019 19:19:50 -0700 (PDT) Received: by mail-io1-xd34.google.com with SMTP id m24so86285696ioo.2 for ; Tue, 23 Jul 2019 19:19:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=k8ho1VMlmQkMA/HSy006LknV89UhobLnYI8296CRLZM=; b=Pp/FVjD5ZyCZCKRWXGwV4rbN7Xo8fA7/uGPOoNg21q/sGXhV3YID7ReFpKQvzRjn4F cxRc2qAWU2pJmlOMUslI2xVKtw8A3t0LJx4UNqHwHvi6kLen4w7mm4uWMSFYmfMMYswW SWCxV/K8iLE7FaoDQqg5N/LNlfSpl08QJsKzwGQcmO359d21W6VJ52pZaLvac1s0PBR3 lGDlMyT5TWjCurAqpCtw7jYU+dLwKPzGhY+0Q/5ZjQrliq466MTq8faeAD2ma1w/2KGK iVgs1ye9WdLuwqgHBoI3BGtR7hd4RAxkrBh7BIW4GIiIU7HGz5OTA+SiF1/8Kit3l04a R1/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=k8ho1VMlmQkMA/HSy006LknV89UhobLnYI8296CRLZM=; b=EXKXW/iwTfKVM3NozRkAhj4Y3KmZD6pwM09O3GNhcaW5PWKLKES77uLpM37yJ+G5q1 UH7sNhV/Y9ir6hBpuiZPI53HZZ+5fJ3XObWv7+c0WjPaNVgv2Am9RJQCYw2Z4jnZSCOb autllDYbXtpUr1yQCmAJgv6+n3ehWXEY3IwgLKMwrTL7CmOMyMR57ebW6pryaCVaW1+X 0xxUMc/jtHigq3cnE+ft8og7l34LxGiY1fek7f5GL4NoquvdmLQm8ospuBqK9nf/1IqI ZnK8QvNO0IxZIQkyhr5z7zi/57022RjnEhUtNLwujqhEvZi5ThSRjxvu9WGCllebjza1 ggsw== X-Gm-Message-State: APjAAAWRQZ+9+7XJCX7hD1nJeiWdhMqxPaLw3KljgkFYfOz/Nze+Dilh OXieFDCGASuW3XYz4fAyqsjMQjRO4b4MO0E9JE8= X-Google-Smtp-Source: APXvYqx/lwNXps/FgPcnzdmyFHHapAUlercyzq7JqyGAd1gsoHgSksiPd0c2+pKCM8AYwwe0B6aNM7DsbPTgQnTkSrg= X-Received: by 2002:a02:13c3:: with SMTP id 186mr81006127jaz.30.1563934789913; Tue, 23 Jul 2019 19:19:49 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> In-Reply-To: <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> From: Rob Sayre Date: Tue, 23 Jul 2019 19:19:38 -0700 Message-ID: To: Bret Jordan Cc: Jim Reid , "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000009ad458058e63f1bb" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 02:19:54 -0000 --0000000000009ad458058e63f1bb Content-Type: text/plain; charset="UTF-8" On Tue, Jul 23, 2019 at 7:16 PM Bret Jordan wrote: Well to use the argument that others have used, why not just use VPN in your coffee shop? It's a fair point. It seems like this isn't really about security. Are people selling DNS logs to ad tech companies? Is that the ecosystem being disrupted? thanks, Rob --0000000000009ad458058e63f1bb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 23, 2019 at 7:16 PM Bret Jord= an <jordan.ietf@gmail.com&g= t; wrote:
Well to use the argument that others have used, why not just u= se VPN in your coffee shop?

It's a fair point. It seems like thi= s isn't really about security.

Are people selling DNS logs to ad= tech companies? Is that the ecosystem being disrupted?

thanks,
Rob

--0000000000009ad458058e63f1bb-- From nobody Tue Jul 23 19:26:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68B841209CA for ; Tue, 23 Jul 2019 19:26:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tXQLJ9odXW9i for ; Tue, 23 Jul 2019 19:26:05 -0700 (PDT) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-eopbgr780113.outbound.protection.outlook.com [40.107.78.113]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F1A4F120045 for ; Tue, 23 Jul 2019 19:26:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NQS6HmS8nFGVZWdS9vBDRbNextE8Eg/0x6zTB/esgeEbOUBeGGapIAkLn6E0Pw3kkcCse0WYeXA+1wO62nIpH/iqhSJwH7WD+11H/0Vg7JYItJtKeTAYuxXuUtr6bujFqD8fkDqEaMw40kN/gwPQOgjHh843RbdIO4yUEuAHofEACBa+8XvFVJQKjQkQby9uNf/a47BM9zeuhGngkR8SE6TaCx8IAs7NwuLedqpritHF60gGS2Pt/02I2nI3aE+raFNw5vCcOVlZCsT8xKSHsqSNAiDdwHwJTwW+ES/O4S5163yKcP6MDpOUjVeLCV3WqPHQO6R5w6dMn1MwT0SQ1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4wCEFIO5SXUptCWNsIqX+O9FBddtpQAicoVvv342uxg=; b=GnmMv+hwm5NWJaARmn3bjpnrCR6gf5ufaG8J6ZYwMp4y9pqfO4WXpjOJ0OPlVW14gVMNDim2uQfN0Cd1Vcswf//uXy2cxgj1Qr/fdIH/pm0TF10OIr4JDcdRk8ME+p9DCaJDXax1iEh9kXjhl7yWLGdaeca/DNcruUPFl2gO7Mh5KIJgJnkaGkqDSzT6/rT+xixa6aNi5TCfd6tXZ0JvnuozyxInpZoAxK2M0tLGgzlifgyuF4Ln+hEb+ulnW0aCCmDhbcurvyKGc05UdYmRw46+rRqKkIGRoIquaUoua4nBeB+CTkxvQwKcb/jQTbiuae+LP/3KGisl35spKkquAg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4wCEFIO5SXUptCWNsIqX+O9FBddtpQAicoVvv342uxg=; b=F5985LuedSGT9ni5JUgGKaQRlpo0GhRd7ujiTSXy9emkHJvV5MBrldjqwNheAs5s6yTdcMf2vDhzDoX5TBU1S9cMVcqFv3XEh6NN6wBTHGwtLK79xqlM0W2m4R0roB8WqykLh1/BJ+03YuS2vsKUdKxwgHTpvEe/+yN6cqf/ndc= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (20.179.20.141) by MN2PR21MB1213.namprd21.prod.outlook.com (20.179.20.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.0; Wed, 24 Jul 2019 02:26:03 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde%9]) with mapi id 15.20.2136.000; Wed, 24 Jul 2019 02:26:03 +0000 From: Tommy Jensen To: Rob Sayre , Bret Jordan CC: Jim Reid , "add@ietf.org" Thread-Topic: [Add] fixing coffee shop brokenness with DoH Thread-Index: AQHVQcJHSskpE/E+406M/yFgYvUHuKbZBa+AgAACZgCAAADiAIAAANO0 Date: Wed, 24 Jul 2019 02:26:03 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2601:600:a080:7f23:98f1:e7df:6daf:10a8] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 67115f2b-5a8e-4274-ecc1-08d70fde4650 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:MN2PR21MB1213; x-ms-traffictypediagnostic: MN2PR21MB1213: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 0108A997B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(39860400002)(376002)(346002)(366004)(396003)(136003)(189003)(199004)(4744005)(2906002)(256004)(14444005)(486006)(71190400001)(71200400001)(229853002)(10090500001)(7696005)(76176011)(186003)(99286004)(53546011)(6506007)(102836004)(54906003)(110136005)(22452003)(316002)(7736002)(74316002)(476003)(33656002)(8990500004)(8676002)(11346002)(46003)(6116002)(53936002)(478600001)(4326008)(6246003)(6436002)(54896002)(55016002)(86362001)(25786009)(68736007)(236005)(9686003)(10290500003)(66476007)(8936002)(14454004)(52536014)(66446008)(64756008)(66946007)(76116006)(66556008)(81156014)(5660300002)(81166006)(446003); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1213; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: AZIo7IkiD5rwQKL5vj+I6upsGfcliB5brsu4xUZhPUxNqsutzZSd8SkvzHPLvjape0V6s6gl87YcMvpbj0oI8jq2pw1tsPWepQgd6W/aVcVrWN0R0dejmSUE337TTu2w2CY86A7MXmrrltxhRGStxq9s/wMR01wcqFRAKGaEbNCbAnZ3tnuqWZW+pZzRWvYJo0Ff7ZXN5trU+89hSYBAimy+5j5sksEla0ejqqqsgT1EApX3hyg4Hb/BsO4SRpeBPMeG6kKdYpibfouq8qefh0kwKLHElrA3N84tNHuYIHsCV3BPVQ6rJMNteeT8rgfDilVlINRY31ByOjrhlR3z/nwAHnXKHZGx2OdSiRe1kh34gtn1oIMQ9Bu3R4ZWUogY1p2D6pDx7VMzCjGzYstnjiF2+oEAFfghGoVOYy+dfn4= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR21MB12134C6B57220E1B8BF5C811FAC60MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 67115f2b-5a8e-4274-ecc1-08d70fde4650 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2019 02:26:03.1120 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tojens@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1213 Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 02:26:08 -0000 --_000_MN2PR21MB12134C6B57220E1B8BF5C811FAC60MN2PR21MB1213namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable > Are people selling DNS logs to ad tech companies? Is that the ecosystem b= eing disrupted? Given how many valid points have been brought up in the last few weeks abou= t the drawbacks of centralized app-configured DNS, I don=92t think the glib= tone is constructive. Thanks, Tommy ________________________________ From: Add on behalf of Rob Sayre Sent: Tuesday, July 23, 2019 7:19:38 PM To: Bret Jordan Cc: Jim Reid ; add@ietf.org Subject: Re: [Add] fixing coffee shop brokenness with DoH On Tue, Jul 23, 2019 at 7:16 PM Bret Jordan > wrote: Well to use the argument that others have used, why not just use VPN in you= r coffee shop? It's a fair point. It seems like this isn't really about security. Are people selling DNS logs to ad tech companies? Is that the ecosystem bei= ng disrupted? thanks, Rob --_000_MN2PR21MB12134C6B57220E1B8BF5C811FAC60MN2PR21MB1213namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable > Are people selling DNS logs to ad tech companies? Is that the ecosyste= m being disrupted?

Given how many valid points have been brought up in the last few weeks abou= t the drawbacks of centralized app-configured DNS, I don=92t think the glib= tone is constructive.

Thanks,
Tommy
From: Add <add-bounces@i= etf.org> on behalf of Rob Sayre <sayrer@gmail.com>
Sent: Tuesday, July 23, 2019 7:19:38 PM
To: Bret Jordan <jordan.ietf@gmail.com>
Cc: Jim Reid <jim@rfc1035.com>; add@ietf.org <add@ietf.org&= gt;
Subject: Re: [Add] fixing coffee shop brokenness with DoH
 
On Tue, Jul 23, 2019 at 7:16 PM Bret Jordan <jordan.ietf@gmail.com> wrote:
Well to use the argument that others have used, why not just use VPN in you= r coffee shop?

It's a fair point. It seems like this isn't really about security.

Are people selling DNS logs to ad tech companies? Is that the ecosystem bei= ng disrupted?

thanks,
Rob

--_000_MN2PR21MB12134C6B57220E1B8BF5C811FAC60MN2PR21MB1213namp_-- From nobody Tue Jul 23 19:33:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7FC3E120823 for ; Tue, 23 Jul 2019 19:33:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cR7NeKFv0kFv for ; Tue, 23 Jul 2019 19:33:52 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F02E120074 for ; Tue, 23 Jul 2019 19:33:52 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id g20so86261477ioc.12 for ; Tue, 23 Jul 2019 19:33:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NtbS9J5iUekzWtOq1z4J4VP8/neQFCedl9K10nmqGs8=; b=kIrpDd5lwzzKVMTDDl31ULV23AVFOMBpkA3wkyrr9A5smzIQdBIQvBtJvw8DVLB4q0 LQ0AzvdUYdLXWGPK9VXjlL50YggjgFd2/etp1YDpBu9zmRGaAVfvaX85L0Lkp3gMmtPZ KWzYVfMzgJ1Ya2rQ28eLv0R2eBaiQETdLacRmBysQamydAkqi+5IG67O9ZGpSvSTyY9A VTJ/bfBOiNfpznVaaFXoaQ9SkX/dXjJvjEphB3JVPbqUBVTnFr5DnI8JQ2NotBJ1f7iz oVdy1W3YvDA3FQf1GUxszdIpBJdOZ2/oCaWh/dQM1Z3EufK0tfJLMGNu5/pTWez4XcHW yb5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NtbS9J5iUekzWtOq1z4J4VP8/neQFCedl9K10nmqGs8=; b=T9oS+2PuC/sm/5Zuk6WY0shXhLiWpwJNX8lKAZXimDm/MOcfxhiCgg7YRTNGjvdeR/ McBqkiJxUUmNxAX4MTU6CXG18toCbklGULiXUGa+z+/V8MMnsLhlBJxEBJdfed/Hnm1V nExNP+q7xhnxi86uwylu13vTkT7FWwvIQZUsO4qCcXidp/N4770PprXhvVxIo1w4U5Di n7scKHvWnYv06bl9+h0K6tMZOus+o10ukZ1ug4CeiYXpPRx13NnAuCeELuSRcrOh3cUf Wa9KweO1KjVD/Tfmdhl/sSCbX9mWklWZYxo1FNhM5ybOxUcdlhvdaeFez3ofcbvfHVA1 me7w== X-Gm-Message-State: APjAAAWpT1xG7VC/XR1WI6qQr4mJ1X94hj9cH0Tw1Jxh5zV97q5LR5DF AwUOnhWjB+czuCHU17LrqVdmv0RGCHm+xh3cX7E= X-Google-Smtp-Source: APXvYqwx3wQOfRZOmO4h8Y+Wv65/wViMvacB+HAAwHNW6+ChLG1sPo52aOM9NmzpKB/oZ1BaByOzji1N0lkDAM0MDAc= X-Received: by 2002:a6b:b602:: with SMTP id g2mr73027842iof.54.1563935631787; Tue, 23 Jul 2019 19:33:51 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> In-Reply-To: From: Rob Sayre Date: Tue, 23 Jul 2019 19:33:40 -0700 Message-ID: To: Tommy Jensen Cc: Bret Jordan , Jim Reid , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000c8cc4f058e642365" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 02:33:55 -0000 --000000000000c8cc4f058e642365 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 23, 2019 at 7:26 PM Tommy Jensen wrote: > > Are people selling DNS logs to ad tech companies? Is that the ecosystem > being disrupted? > > Given how many valid points have been brought up in the last few weeks > about the drawbacks of centralized app-configured DNS > Valid points: 0. (see how easy it is to just claim points are valid or invalid?) > I don=E2=80=99t think the glib tone is constructive. > You just sent me an email that said your thoughts were very well represented by an incoherent email about terrorists and encryption [0]. Spare me the tone policing. thanks, Rob [0] https://mailarchive.ietf.org/arch/msg/add/8purz-Ks-d6sNAynV5jd5zE71-o --000000000000c8cc4f058e642365 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 23, 2019 at 7:26 PM Tommy Jen= sen <Jensen.Thomas@micros= oft.com> wrote:
> Are people selling DNS logs to ad tech companies? Is that the ecosyste= m being disrupted?

Given how many valid points have been brought up in the last few weeks abou= t the drawbacks of centralized app-configured DNS
Valid points: 0. (see how easy it is to just claim points are = valid or invalid?)
=C2=A0
I don=E2=80=99t think the glib tone is constructive.

You just sent me an email that said yo= ur thoughts were very well represented by an incoherent email about terrori= sts and encryption [0].

Spare me the tone policing= .

thanks,
Rob

--000000000000c8cc4f058e642365-- From nobody Tue Jul 23 19:58:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA6C51207B1 for ; Tue, 23 Jul 2019 19:58:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZJzAAY2c-l7d for ; Tue, 23 Jul 2019 19:57:58 -0700 (PDT) Received: from NAM05-BY2-obe.outbound.protection.outlook.com (mail-eopbgr710102.outbound.protection.outlook.com [40.107.71.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F0DF1120046 for ; Tue, 23 Jul 2019 19:57:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NgbtOd+/skUHXGAGetBcgE3pW4hf3QyR5Byn//O5GuIEyxdF1XxUIZphR+3SO+V53gVsG4zhrKkei8EHUb+6bhAUZIOvkdrYpYm1rJndBp2KLiiCHlams4OH3/VNT6rfDXu7EN4vYw/+eowop13oI76/XAH3/guiCMadB3sLN1iOfPuTATqeTSltVSfnEc5x25+Irygp7EBTwW4giDWXzH+YcYK+hlCwaDKdCme+zqZvzkthgfo8+Vu6TyVBouHfImwwI0vLvaIblr4wfuzJkzeeiHEH/81R6V7Z658rbOwZMwm1he25weimwI09zEMOUtWRuaGp6PMi4/BZZnDRfg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HQQK+rTNevAtsQ8R+tmE6thkjZPerwg1m8q0FEQ7lZw=; b=XlWzsq4LQFB9ocQlCuUpB/IkCwWvBitQRxNvYRQN/CgMXBZTYgPLCYiwLLffDl362tnwr0JRnH2snHALy9nRYbh7dmz2hzGWAqRqe4QGHCrjAfylOQuZxBg4klPOgkU6qySe+7z+OkvzpP02/qi6/TnQ1A8RjLN9v96ma1KYLhtVl3WKmBGVCS9f6cm39j7czaXsHkucBpcPD3b/1Ha6Dr5dHa1DM5eS9KVen6m5+7h3zFsD0y/jEsNL+hNYoFUBKZFXc+ZZklj42sv7ZCvgVJQ5kW2Clf1sXSwynFDGrj2DdqoKLmLg/MZdJhBAjgIPXH1Zw4s4+FG4u+keSHfCfg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HQQK+rTNevAtsQ8R+tmE6thkjZPerwg1m8q0FEQ7lZw=; b=ErQFoF9Fs5YJzM8qAQVjSGL5s1vLss5BfsB1xt9tIj5tMSPemczOUqbMa+MwQ4KLjhqzSdUgtXOduHhtLkRFR/zQ72TA2SPIrUOtckAHpKdARAtWtl50X7UXGFjAFYWxtH6K9CMMsx5p1tQW4ErF9DBqRGutrELg/8CcYfaDTpE= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (20.179.20.141) by MN2PR21MB1149.namprd21.prod.outlook.com (20.178.255.94) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.2; Wed, 24 Jul 2019 02:57:56 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde%9]) with mapi id 15.20.2136.000; Wed, 24 Jul 2019 02:57:56 +0000 From: Tommy Jensen To: Rob Sayre CC: Bret Jordan , Jim Reid , "add@ietf.org" Thread-Topic: [Add] fixing coffee shop brokenness with DoH Thread-Index: AQHVQcJHSskpE/E+406M/yFgYvUHuKbZBa+AgAACZgCAAADiAIAAANO0gAADGQCAAAWUWg== Date: Wed, 24 Jul 2019 02:57:56 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2601:600:a080:7f23:98f1:e7df:6daf:10a8] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 8c877987-6f20-4542-49d0-08d70fe2ba80 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:MN2PR21MB1149; x-ms-traffictypediagnostic: MN2PR21MB1149: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6790; x-forefront-prvs: 0108A997B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(376002)(366004)(396003)(346002)(136003)(39860400002)(199004)(189003)(53936002)(74316002)(46003)(10090500001)(6506007)(14454004)(81166006)(186003)(316002)(52536014)(81156014)(6306002)(256004)(76176011)(22452003)(53546011)(6246003)(1411001)(64756008)(66556008)(66446008)(66946007)(66476007)(54906003)(606006)(8676002)(99286004)(6436002)(8936002)(236005)(9686003)(229853002)(7696005)(54896002)(10290500003)(8990500004)(486006)(2906002)(71200400001)(6916009)(5660300002)(33656002)(25786009)(966005)(446003)(86362001)(11346002)(55016002)(76116006)(478600001)(71190400001)(4326008)(7736002)(102836004)(68736007)(6116002)(476003); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1149; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 2q+GZn8LIqd9zL5mjPGGHcnXIYC43YxkCBJA1ucqPcYH+/+/2DKSUgZ3T/yhIF3R0dUoiWKb4+Mf9+WFfnGeJtHs3OeP6QwkO14S1QiTnMIb0SC4Rl6Mu2xybZvemqWHLMxJT978YrS99QcXFeiEUy/GH6ZRy5k2oYXhq+NwoZy6rdEAmUTbp9oCWcF8Oa1jF/bR6DqARSmIdQvJuhqCEExvTtjHGxjqqx56QAEy1KEPfjJO4FMGXFVFBwHOSopyHHl9oyK9nKWTgZjVJqS6k9YoC4Da2CrzG7iETHfU+AGTHTO/6STaxuE0YN+3QQkZn5JCQo34xzrIaYCQtixDNragH7Dj7Opai9nwEVwl+SWqJQU04qcVU7QEoCKQVN6Awy7YfkGyhHacU56PQfjyHID5jG8wTSXKJwAED8xVD5s= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR21MB12136794EE15EB90E88FAF47FAC60MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8c877987-6f20-4542-49d0-08d70fe2ba80 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2019 02:57:56.0590 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tojens@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1149 Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 02:58:09 -0000 --_000_MN2PR21MB12136794EE15EB90E88FAF47FAC60MN2PR21MB1213namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I don=92t agree that the email was =93incoherent=94 as it pointed out the f= law in insisting that DNS filtering is a dead technology, the conflict bein= g that DNS tampering is effective enough by bad actors to deserve work and = attention but not effective enough by good actors to deserve consideration. Thanks, Tommy ________________________________ From: Rob Sayre Sent: Tuesday, July 23, 2019 7:33:40 PM To: Tommy Jensen Cc: Bret Jordan ; Jim Reid ; add@ie= tf.org Subject: Re: [Add] fixing coffee shop brokenness with DoH On Tue, Jul 23, 2019 at 7:26 PM Tommy Jensen > wrote: > Are people selling DNS logs to ad tech companies? Is that the ecosystem b= eing disrupted? Given how many valid points have been brought up in the last few weeks abou= t the drawbacks of centralized app-configured DNS Valid points: 0. (see how easy it is to just claim points are valid or inva= lid?) I don=92t think the glib tone is constructive. You just sent me an email that said your thoughts were very well represente= d by an incoherent email about terrorists and encryption [0]. Spare me the tone policing. thanks, Rob [0] https://mailarchive.ietf.org/arch/msg/add/8purz-Ks-d6sNAynV5jd5zE71-o --_000_MN2PR21MB12136794EE15EB90E88FAF47FAC60MN2PR21MB1213namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I don=92t agree that the email was =93incoherent=94 as it pointed out the f= law in insisting that DNS filtering is a dead technology, the conflict bein= g that DNS tampering is effective enough by bad actors to deserve work and = attention but not effective enough by good actors to deserve consideration.

Thanks,
Tommy
From: Rob Sayre <sayrer@= gmail.com>
Sent: Tuesday, July 23, 2019 7:33:40 PM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>
Cc: Bret Jordan <jordan.ietf@gmail.com>; Jim Reid <jim@rfc1= 035.com>; add@ietf.org <add@ietf.org>
Subject: Re: [Add] fixing coffee shop brokenness with DoH
 
On Tue, Jul 23, 2019 at 7:26 PM Tommy Jensen <Jensen.Thomas@microsoft.com>= wrote:
> Are people selling DNS logs to ad tech companies? Is that the eco= system being disrupted?

Given how many valid points have been brought up in the last few weeks abou= t the drawbacks of centralized app-configured DNS

Valid points: 0. (see how easy it is to just claim points are valid or= invalid?)
 
I don=92t think the glib tone is constructive.

You just sent me an email that said your thoughts were very well repre= sented by an incoherent email about terrorists and encryption [0].

Spare me the tone policing.

thanks,
Rob

--_000_MN2PR21MB12136794EE15EB90E88FAF47FAC60MN2PR21MB1213namp_-- From nobody Tue Jul 23 20:03:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39C9C1209EA for ; Tue, 23 Jul 2019 20:02:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jc6bq-_Ht5Yb for ; Tue, 23 Jul 2019 20:02:56 -0700 (PDT) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 526491209DA for ; Tue, 23 Jul 2019 20:02:54 -0700 (PDT) Received: by mail-io1-xd31.google.com with SMTP id s7so86286356iob.11 for ; Tue, 23 Jul 2019 20:02:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=qNVJRSe8IXVn3jvVTps1Od0hXqd0AsnuX5vdRH/jmnQ=; b=pdyBzAEQ398U8YhTuqW2JmYCEJCNLlaQRZ1NlPF+tFndYpk5tQ3la4wxM47bT4IP2E ayzQbZN1sVavDf5YfU3YN4wl/pNQtJbauD6PTIVXVXOA0VFs3Y/o3re85jNObNqVN10s 5VjXUIcpwjRfJAKxx31pNFmG6uvTLkbnBKM+4GaVOfskowFdu5wV++lygnxT9JG5XIaR qGfnFPsAS1X759dEzw/uosY98WwKRVhyfnkH0e68gF+pKy/iBTAR4FoWpRBFx38BTQl3 BjYaHGccdGoE7dfi0E+Ewl5qwtreonpxRebfrL8U+WlvS7AEB6BQpL18Iu8twBYJIA6x IXlw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=qNVJRSe8IXVn3jvVTps1Od0hXqd0AsnuX5vdRH/jmnQ=; b=Hy95oTLZFOIaUPfQP/2i9+R6U+vtweBiKT6z4POISZ8vCE1Rp+umqacu6+oiywVWrU emTDx3G+BGWrmQMNeDrTzqys3T92On0PEXLRbrRMgSP/lQGoMsSNrsOMOofmtFb407fQ PXymsas4/3qCnt3xkwJ8nEU2O+0X6JyF21jfWBnJvmTB7qZ0lujDIwSnC9pKABg11GbC kA2q/7x1DkN887fAwLFUlxLCJf+2IJvzV3R3SAgIhSRH1PY5/cc7i4XZTFVVrdJzFBGf t37eG6+O9VoOhtXE8OgfD5OhLij4fSaoWUDIOqxTAvVkY6Ot0TKZ9MPg3tnDcbMrUQGc jYbA== X-Gm-Message-State: APjAAAW3NHOCgQRnZxThLWyTmYqBgmO1yX9LIuiXKnjWLwwf9ylKMuGy bp4rZ9O3ghpF9i2mxKydrknFW20Z2KZvYGku+W8= X-Google-Smtp-Source: APXvYqy5IZ5TscFBC9WSdfMiijR8W13uf2EbzYywqJPdUfmnF6stigw/CnN1YgV5zHjysMuXJQYyvlPN/OhGlRS41O4= X-Received: by 2002:a5e:d618:: with SMTP id w24mr39639524iom.73.1563937373600; Tue, 23 Jul 2019 20:02:53 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> In-Reply-To: From: Rob Sayre Date: Tue, 23 Jul 2019 20:02:42 -0700 Message-ID: To: Tommy Jensen Cc: Bret Jordan , Jim Reid , "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000009ac2f0058e648b20" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 03:03:05 -0000 --0000000000009ac2f0058e648b20 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 23, 2019 at 7:57 PM Tommy Jensen wrote: > I don=E2=80=99t agree that the email was =E2=80=9Cincoherent=E2=80=9D as = it pointed out the flaw > in insisting that DNS filtering is a dead technology, the conflict being > that DNS tampering is effective enough by bad actors to deserve work and > attention but not effective enough by good actors to deserve consideratio= n. > Ah, now this sounds like a good idea for an Internet-Draft. Why not write up this idea? That way, it can be evaluated outside of a message thread. thanks, Rob --0000000000009ac2f0058e648b20 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 23, 2019 at 7:57 PM Tommy Jen= sen <Jensen.Thomas@micros= oft.com> wrote:
I don=E2=80=99t agree that the email was =E2=80=9Cincoherent=E2=80=9D as it= pointed out the flaw in insisting that DNS filtering is a dead technology,= the conflict being that DNS tampering is effective enough by bad actors to= deserve work and attention but not effective enough by good actors to deserve consideration.

Ah, now this sounds like a good idea for an Internet-Draft. Why not = write up this idea? That way, it can be evaluated outside of a message thre= ad.

thanks,
Rob
=C2=A0
--0000000000009ac2f0058e648b20-- From nobody Tue Jul 23 20:10:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3346A12008A for ; Tue, 23 Jul 2019 20:10:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7KgWmlwwDI08 for ; Tue, 23 Jul 2019 20:10:24 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-eopbgr800120.outbound.protection.outlook.com [40.107.80.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 952F9120046 for ; Tue, 23 Jul 2019 20:10:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dDVzOvLPlXdd6MUeTTlPk1CYzmPCMBnlvn7OONgwklNRBoBaaUNF+JeZbWB2xkBmCUU0ielRNNls7weZRRCYRRlmnKuUWsSboTmaqSh0mcLqCjaMdhc5SSeEBwMPXotUd990/P2r/iiS5ql/JbgqVPsG4Y8zy+QB9//VBTaJB2TxJi1Ph21D/pgbSKwtWSIfx3Cygo9Ebaf+3iv0uVTRgu3EeQYGtnY9yk5ml3tTUAZILzfQJF6aP9RF3LTogS6m1Ge6MgmDx9J9f+/8Di9GflXTZkJPuiQWsRGm9hMfbTGVrgQg2aHT3ve+RgGUjf+HY6IQwiAvBZIztpaZhk9s2w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Yid+juils7YxXlRRz+RbXnk7w9/gdO9vdWTY1K4Gxoo=; b=UFpUf/EEoOY1+0ks5Oy0scRQDsDvwfT7bb8f9T6VriAJjM3bJpayUw3Epkn7uq3SJdn5FvSuaOsWlFhpznOu5wFzGhCCiagWKKgc8gNzlMYFkiaekmg9dBA0K/zW/+sMv5ZPwMZ5u5Z5ZWjytD5qwsRbki1qCzLED7ef2yIVIBx5M4HZu1xC6uHtkiDwOQnxHN31M2i6yn3PmwqyK42mrbG8be6yNmefyd+9GCOBzsc2/5wfeM8tkur+3CFwz+7DxjsZLSKb57k0tM2GCoAs/diE/hntECJMJYoIIqTXn9ktufE43BaLqZ2YeSe7UTdCm8+ago0+fpEFVRryukwHnw== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Yid+juils7YxXlRRz+RbXnk7w9/gdO9vdWTY1K4Gxoo=; b=fdlcpzobP1MGhxg0V74aQLdExLgjbCrgNnQNQ2dGFGv2LFGf7wm2azK8sO1hW3TXQalbX6z0nlXEbV1jwQCOT27qy2VVzWAKIdFatYId8K3ueaIrwIZdfsoSh3Ba5Y8Jv6B/COMKqVsha3nqpcChLOqRV9l+CiOvsxyBM0AHhlQ= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (20.179.20.141) by MN2PR21MB1262.namprd21.prod.outlook.com (20.179.21.28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.3; Wed, 24 Jul 2019 03:10:22 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde%9]) with mapi id 15.20.2136.000; Wed, 24 Jul 2019 03:10:22 +0000 From: Tommy Jensen To: Bret Jordan , Arnaud Taddei CC: "add@ietf.org" , Barry Leiba Thread-Topic: [Add] Followup from ADD session today Thread-Index: AQHVQcCIv9bLx74Nyk69A3H0Y8exPabZB6mAgAAMZg8= Date: Wed, 24 Jul 2019 03:10:22 +0000 Message-ID: References: , <06B41162-5936-4BF7-A9D6-3D864BB93ED2@gmail.com> In-Reply-To: <06B41162-5936-4BF7-A9D6-3D864BB93ED2@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2601:600:a080:7f23:98f1:e7df:6daf:10a8] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 05089f06-1a1c-4e77-a609-08d70fe4777e x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MN2PR21MB1262; x-ms-traffictypediagnostic: MN2PR21MB1262: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0108A997B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(396003)(366004)(39860400002)(136003)(346002)(376002)(199004)(189003)(6506007)(33656002)(53936002)(52536014)(25786009)(2906002)(11346002)(53546011)(86362001)(7696005)(5660300002)(486006)(22452003)(6116002)(99286004)(76176011)(6246003)(14454004)(71200400001)(606006)(71190400001)(236005)(4326008)(476003)(64756008)(6306002)(54896002)(66446008)(446003)(66946007)(66556008)(76116006)(66476007)(9686003)(55016002)(316002)(81156014)(46003)(6436002)(229853002)(186003)(8676002)(14444005)(8936002)(7736002)(66574012)(110136005)(256004)(102836004)(81166006)(54906003)(68736007)(10090500001)(8990500004)(10290500003)(74316002)(478600001)(966005); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1262; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: X2cAXTIZJ0S84OrMVggJ8lmkIsH31PB1y28xwC20qC01WuDr4RUzVurSp8BYDe1O0b4VNtB7ryfNVqM6WiUrgAxidTLiLl/CudOybI60duvbIAZ+Q8CpxVVLwv+14LWhEUB4ocaoIX+SaCK0anhMLLlUH+TTE8fDeL2VRhmGcFPkzr9B6DmwM0WEzZmXdFMXUtJ8gh8+bmZ58tFrfpvEH02wDJnwKpwKDozrzm0RbLW0+AcmS1xFIDY43o0hQnDXi9bGqwjc84Fj8CrxP5PHCKtQsQltzvzYXl6P8eC5fzxscavfGlNEprQ2TJI3Tx8JxoRCmwZOGUo9gdVktmJsPXrTWiFB2LYuIJS99zaYM+HTmcu3D2u7arZzNF63rB7/DcfGvUFDmmTGTwCuzn7SeSeS8WcqrB/uI2l2CLELC5E= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR21MB1213C1A98A61908696AEEA91FAC60MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 05089f06-1a1c-4e77-a609-08d70fe4777e X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2019 03:10:22.6144 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tojens@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1262 Archived-At: Subject: Re: [Add] Followup from ADD session today X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 03:10:27 -0000 --_000_MN2PR21MB1213C1A98A61908696AEEA91FAC60MN2PR21MB1213namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable There was talk about this in the Jabber thread today. Ekr suggested having = a drop down of server suggestions was a possibility. While I=92m personally= a fan of promoting DNS server choice to the user=92s attention, it=92s als= o very important to make that choice optional as users shouldn=92t have to = understand the question to get online. Perhaps having the default choice be random (or geolocation driven, or any = other function) per install to distribute the lion=92s share of traffic whi= ch will never open DNS UI as much as possible? Apps could also defer to the= platform=92s DNS if we can establish a contract under which the app gains = assurance the platform DNS is user/admin blessed as opposed to user/admin n= ot-blessed configuration such as public WiFi. Thanks, Tommy ________________________________ From: Add on behalf of Bret Jordan Sent: Tuesday, July 23, 2019 7:14:55 PM To: Arnaud Taddei Cc: add@ietf.org ; Barry Leiba Subject: Re: [Add] Followup from ADD session today You touch on a point that I think is critical. All of this provides the pot= ential for massive centralization and tracking of DNS data, on a scale much= more severe than anything we have today. The internet and privacy works be= st when we are very decentralized. Imaging an app being installed on a device that allows a user to browse the= web. It has a hard coded DoH server that it wants to use, that points to t= he DoH server of its choice. The app can add as many other headers it want= s to ensure that it can fully track that user and application, no matter wh= ere they are. So no matter where that client is, you will always be able t= o have a perfect telemetry of everything they have done and when they do it= . Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can= not be unscrambled is an egg." On Jul 23, 2019, at 9:38 PM, Arnaud.Taddei.IETF > wrote: As a matter of fact today I was cut on the mic and yet after me, Barry had = the chance to speak and then another person had the chance to speak so it g= ives me the continued appearance that it is difficult to work in the IETF. So if I would have had the chance to speak, I would have asked the question= regarding David's presentation that the approach taken here seems to parti= cularly increase the centralisation effect and I would have asked clarifica= tion questions on the UX implications on how the user would chose the right= DoH server from the vetted hard coded one vs the proposed new one, etc. wh= ich UX was expected, wondering how could it be done with a good UX in a sit= uation of a expansion of modalities (this app is using this DoH server, thi= s browser another one, my OS another one and now I am asked to make a choic= e !?! are we =91customer centric=92 ?). Not saying at all it is impossible,= nor whether I like it or not but what was considered. The other aspects are, as Vasily Dolmatov said, the fact that we are implic= itly accepting a default of configuration at application level for 1.1.1.1,= etc. is going to have a number of consequences that we probably do not mea= sure yet completely in particular, I backup Vasily, that it will create int= eresting semantic issues between domains (application level vs infrastructu= re level) and I share his concern about the potential implications. Another person made the good remark that it is a change on the architecture= for applications and services overall and we should pause and discuss it a= nd Jari pointed the problem of centralization which is a real problem to me= too So my question on another alternative to what David is proposing, is why do= n't we try to recognise that here we have general application configuration= issue and this situation reminded me the infancy 25 years ago when mail an= d DNS where basically the 2 only services that could be offered to customer= s, citizens etc. and when we were missing so many pieces and it had many si= de effects on what we were trying to do like how to get clients to understa= nd their own configuration. In this vein an application access protocol was= created called ACAP which is still https://tools.ietf.org/html/rfc2244. it didn't meet any big success perhaps for the similar c= entralisation issues as we have today but in a different context at that ti= me I am surely very naive here but if what we are facing here are applications= that need to find their DoH server and perhaps other resources, why are we= not more ambitious and why don't we reconsider a protocol that is for appl= ication configuration and thus it could be managed by service providers, wo= uld keep the alignment to infrastructure semantics, would help to distribut= e the deployment, could avoid centralisation and could help the architectur= e? My 0.02 CHF Sent with ProtonMail Secure Email. -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add --_000_MN2PR21MB1213C1A98A61908696AEEA91FAC60MN2PR21MB1213namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable There was talk about this in the Jabber thread today. Ekr suggested having = a drop down of server suggestions was a possibility. While I=92m personally= a fan of promoting DNS server choice to the user=92s attention, it=92s als= o very important to make that choice optional as users shouldn=92t have to understand the question to get online.

Perhaps having the default choice be random (or geolocation driven, or any = other function) per install to distribute the lion=92s share of traffic whi= ch will never open DNS UI as much as possible? Apps could also defer to the= platform=92s DNS if we can establish a contract under which the app gains assurance the platform DNS is user/ad= min blessed as opposed to user/admin not-blessed configuration such as publ= ic WiFi.

Thanks,
Tommy
From: Add <add-bounces@i= etf.org> on behalf of Bret Jordan <jordan.ietf@gmail.com>
Sent: Tuesday, July 23, 2019 7:14:55 PM
To: Arnaud Taddei <Arnaud.Taddei.IETF@protonmail.com>
Cc: add@ietf.org <add@ietf.org>; Barry Leiba <barryleiba.ma= iling.lists@gmail.com>
Subject: Re: [Add] Followup from ADD session today
 

Imaging an app being installed on a device that allows a us= er to browse the web. It has a hard coded DoH server that it wants to use, = that points to the DoH server of its choice.  The app can add as many = other headers it wants to ensure that it can fully track that user and application, no matter where they are.  = ;So no matter where that client is, you will always be able to have a perfe= ct telemetry of everything they have done and when they do it. 

Thanks,
Bret
PGP Fingerprin= t: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however,= the only thing that can not be unscrambled is an egg."

On Jul 23, 2019, at 9:38 PM, Arnaud.Taddei.IETF <Arnaud.Taddei.IETF=3D40protonmail.com@dmarc.ietf.org> wrote:

As a matter of fact today I was cut on= the mic and yet after me, Barry had the chance to speak and then another person had the chance to speak so it gives me the continu= ed appearance that it is difficult to work in the IETF.
 
So if I would have had the chance to s= peak, I would have asked the question regarding David's presentation that the approach taken here seems to particularly increase t= he centralisation effect and I would have asked clarification questions on = the UX implications on how the user would chose the right DoH server from t= he vetted hard coded one vs the proposed new one, etc. which UX was expected, wondering how could it be do= ne with a good UX in a situation of a expansion of modalities (this app is = using this DoH server, this browser another one, my OS another one and now = I am asked to make a choice !?! are we =91customer centric=92 ?). Not saying at all it is impossible, nor = whether I like it or not but what was considered.
 
The other aspects are, as Vasily Dolma= tov said, the fact that we are implicitly accepting a default of configuration at application level for 1.1.1.1, etc. is going= to have a number of consequences that we probably do not measure yet compl= etely in particular, I backup Vasily, that it will create interesting seman= tic issues between domains (application level vs infrastructure level) and I share his concern about the potential= implications.
 
Another person made the good remark th= at it is a change on the architecture for applications and services overall and we should pause and discuss it and Jari pointed t= he problem of centralization which is a real problem to me too

So my question on anot= her alternative to what David is proposing, is why don't we try to recognise that here we have general application configuration is= sue and this situation reminded me the infancy 25 years ago when mail = and DNS where basically the 2 only services that could be offered to custom= ers, citizens etc. and when we were missing so many pieces and it had many side effects on what we were trying to do l= ike how to get clients to understand their own configuration. In this vein = an application access protocol was created called ACAP which is still = https://tools.ietf.org/html/rfc2244. it didn't meet any big success perhaps for the similar centralisation issues = as we have today but in a different context at that time

I am surely very naive here but if wha= t we are facing here are applications that need to find their DoH server and perhaps other resources, why are we not more ambitiou= s and why don't we reconsider a protocol that is for application configurat= ion and thus it could be managed by service providers, would keep the align= ment to infrastructure semantics, would help to distribute the deployment, could avoid centralisation and co= uld help the architecture? 

My 0.02 CHF


Sent with ProtonMail Secure Email.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

--_000_MN2PR21MB1213C1A98A61908696AEEA91FAC60MN2PR21MB1213namp_-- From nobody Tue Jul 23 20:17:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD91512008A for ; Tue, 23 Jul 2019 20:17:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zGbmAyDyf49H for ; Tue, 23 Jul 2019 20:17:25 -0700 (PDT) Received: from NAM05-DM3-obe.outbound.protection.outlook.com (mail-dm3nam05on072e.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe51::72e]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73994120046 for ; Tue, 23 Jul 2019 20:17:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=GQsctf8hAAXTjS5SBC4B/PCVjPsuLRH35hviPAfLP5kfdwYq2mTuOWO/oEAFitr5JLwKkfEckYGubUIps39fmFtCaJkvOjr1RPPlucdKW3xdRQjainKPOgU9T4Y5I8MpI6T6Vl87CiMzqnceVQPAs/P8DYlf+sZsJHJw9gcyvHmbbYpmzgA2+tzBluzELKyPa9rDfW217QlhJVEeOkls3YFwLEwp+ZM5LLjft0QgkgHYNfU2EipxPOXAhqUlCDbddxR3jux9LImy1a6/BGIl++/S1jBSr5M3AOYzeg46qqm5dG1VBFrHjvhcMQv61TcF1ZSBUeZkPKP/b/H4zJpeHw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/Ack7poqbA8jnRNaEVKX7zW/RdNFijPKaYo9qIUwkR4=; b=PBz1IvhciMZeubnEvQEZ1iezD9oJW0SZ6hi5HqdAcP4y54xLfuvdzaxYK8YK3JZOI1bRqballdMWPRMigJa2Fo8VclFEW1VSJJaIS/6SV4tu7XmC6NEgPA4y99baj3Fu+yY0DuA/8JX+IX1KbEtqQM5F8hybWS5SXiCnPDrmen3pI4K9QzBSkjYqkqfXst+LCyocz2xxvM1gKbMEiKBn6xO6zKVLyU7oMdspKzTB2QR7heaK75G3CBLRKF6zRwCt4bJz6Y728uFWSbgH+PKtD8WW6N/RSPhy+9NAn17ggJ87TNfEW03a+BweGW1Mobi16Lch4N2zXxA30FcnbKaRSg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/Ack7poqbA8jnRNaEVKX7zW/RdNFijPKaYo9qIUwkR4=; b=h5S8CyAiysAz5BXu6IHI9xa1pX0ytbJ83MTabbi8k2w2s0nfkevzVS8FUlnj2ry6+OxIZsiCJSqT/m392thDcaiouxr3Sg5IUe7Wb37AzLkMkDKiqyVg7dppztbhe9qPKt1eG1UqT3GCpEsnOyZg1UTk15yk3oz2dzEcW8Lt5eM= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (20.179.20.141) by MN2PR21MB1264.namprd21.prod.outlook.com (20.179.21.30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.3; Wed, 24 Jul 2019 03:17:23 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde%9]) with mapi id 15.20.2136.000; Wed, 24 Jul 2019 03:17:23 +0000 From: Tommy Jensen To: Rob Sayre CC: Bret Jordan , Jim Reid , "add@ietf.org" Thread-Topic: [Add] fixing coffee shop brokenness with DoH Thread-Index: AQHVQcJHSskpE/E+406M/yFgYvUHuKbZBa+AgAACZgCAAADiAIAAANO0gAADGQCAAAWUWoAAAokAgAADEA8= Date: Wed, 24 Jul 2019 03:17:23 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2601:600:a080:7f23:98f1:e7df:6daf:10a8] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 2306eb3c-567d-4745-4b4b-08d70fe57273 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:MN2PR21MB1264; x-ms-traffictypediagnostic: MN2PR21MB1264: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0108A997B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(39860400002)(136003)(346002)(376002)(366004)(396003)(199004)(189003)(66476007)(53546011)(66556008)(81156014)(6506007)(66574012)(81166006)(5660300002)(229853002)(186003)(4326008)(66446008)(10290500003)(64756008)(22452003)(102836004)(9686003)(316002)(236005)(74316002)(66946007)(6436002)(8936002)(486006)(53936002)(33656002)(256004)(54896002)(6246003)(6916009)(76176011)(76116006)(1411001)(7696005)(7736002)(86362001)(11346002)(25786009)(55016002)(14454004)(71200400001)(71190400001)(8990500004)(6116002)(68736007)(10090500001)(54906003)(478600001)(8676002)(2906002)(99286004)(446003)(52536014)(46003)(476003); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1264; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: mso/x0TwwVWeXh29JsboNwTbtM5Ge0vbHiKuNAUNnlXFySp8fAoP3ae1hREH1INkZ7VY14/TK2ujcohUHfg/H/VAJy45Ty97jVy35Qu9ODBH2oKY36arMfaor9HgGe3S8Lrwdnvr3XWOFkyr/OhatTG/ZJHyWnc6Z8ilb4zBvUaqzhbEeCug1XKT3AuYMnVanRNnmCorYVc2JqDsgOIUeHn3OkvIHQOq+qXYw07MF+s3hwks9JbZE3dWucqwjhhP1u0ruEfQt+0BOfQi6jWFelWzSMMXWXnViytxkiv6o4lFsZH5sgVm8TG7V6Bk6x29vL8QZhu0aaPRiHeQVFIdvfqnRgxhekc98ir0LH5PwdwvONJAQKCU8bQDsgUjC3c4qTRK/s0kD8v/RJt9R4/YqteElKUa+u41zP+l+qLSQNE= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR21MB12139D398C42C555F8AA51E0FAC60MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2306eb3c-567d-4745-4b4b-08d70fe57273 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2019 03:17:23.6231 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tojens@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1264 Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 03:17:28 -0000 --_000_MN2PR21MB12139D398C42C555F8AA51E0FAC60MN2PR21MB1213namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I appreciate the feedback. If I bring an I-D it will be more broad than thi= s particular point. The point of =93DNS filtering isn=92t dead=94 is small = potatoes compared to the larger =93how we can collaborate as ecosystem comp= onents on providing the most ideal DNS experience=94 I think we=92re all tr= ying to go for. I=92m listening and participating on these threads to see i= f I can even convince myself of such a draft. Thanks, Tommy ________________________________ From: Rob Sayre Sent: Tuesday, July 23, 2019 8:02:42 PM To: Tommy Jensen Cc: Bret Jordan ; Jim Reid ; add@ie= tf.org Subject: Re: [Add] fixing coffee shop brokenness with DoH On Tue, Jul 23, 2019 at 7:57 PM Tommy Jensen > wrote: I don=92t agree that the email was =93incoherent=94 as it pointed out the f= law in insisting that DNS filtering is a dead technology, the conflict bein= g that DNS tampering is effective enough by bad actors to deserve work and = attention but not effective enough by good actors to deserve consideration. Ah, now this sounds like a good idea for an Internet-Draft. Why not write u= p this idea? That way, it can be evaluated outside of a message thread. thanks, Rob --_000_MN2PR21MB12139D398C42C555F8AA51E0FAC60MN2PR21MB1213namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I appreciate the feedback. If I bring an I-D it will be more broad than thi= s particular point. The point of =93DNS filtering isn=92t dead=94 is small = potatoes compared to the larger =93how we can collaborate as ecosystem comp= onents on providing the most ideal DNS experience=94 I think we=92re all trying to go for. I=92m listening and participating on= these threads to see if I can even convince myself of such a draft.

Thanks,
Tommy
From: Rob Sayre <sayrer@= gmail.com>
Sent: Tuesday, July 23, 2019 8:02:42 PM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>
Cc: Bret Jordan <jordan.ietf@gmail.com>; Jim Reid <jim@rfc1= 035.com>; add@ietf.org <add@ietf.org>
Subject: Re: [Add] fixing coffee shop brokenness with DoH
 
On Tue, Jul 23, 2019 at 7:57 PM Tommy Jensen <Jensen.Thomas@microsoft.com>= wrote:
I don=92t agree that the email was =93incoherent=94 as it pointed out = the flaw in insisting that DNS filtering is a dead technology, the conflict= being that DNS tampering is effective enough by bad actors to deserve work= and attention but not effective enough by good actors to deserve consideration.

Ah, now this sounds like a good idea for an Internet-Draft. Why not wr= ite up this idea? That way, it can be evaluated outside of a message thread= .

thanks,
Rob
 
--_000_MN2PR21MB12139D398C42C555F8AA51E0FAC60MN2PR21MB1213namp_-- From nobody Tue Jul 23 20:32:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 898FF12008A for ; Tue, 23 Jul 2019 20:32:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p0iLdTVIgyI0 for ; Tue, 23 Jul 2019 20:32:11 -0700 (PDT) Received: from mail-qt1-x829.google.com (mail-qt1-x829.google.com [IPv6:2607:f8b0:4864:20::829]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C0EC5120046 for ; Tue, 23 Jul 2019 20:32:10 -0700 (PDT) Received: by mail-qt1-x829.google.com with SMTP id h21so44055614qtn.13 for ; Tue, 23 Jul 2019 20:32:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=xPQQa8sNiogEd4B867253q4KWmxWBPZWVKktbWfeAGo=; b=Gj1dmhK5/MFjJZYokUVE5p+aIOTpenMjncH08fuJh4Yet3VzpU/gYAQZd6XK18wDUD Zx63+SdE8/eENVHqPwW81PWs7aZTV8wSi+rwsexX6TPcuEthGOiop5tPAX3e2U/pdSKK I2tEVKvRJ9LqHQkKw1xPRqJ+7hCz5d+pVeNmnnmDOpv50t5SjenPotka/L1pddG9iVsB U25Zi0bnalR1S50thLXSZSB4C8x/PRT97TT9J+/t7s28UuXGXJDCII4wPyEFjTz072jZ GNw3krnuI7KuDyRpFRNX4OwS9GhUze2kzErUjpq2rOUmpiyYC0TiupMgiWsxS63TOADQ 6Phw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=xPQQa8sNiogEd4B867253q4KWmxWBPZWVKktbWfeAGo=; b=uIH2ESN9SpMhWORCv0FZXqHGdgB4AH44EU9Q0RrmNbZD/0U6SXMZoLw1BlS/7vvWd6 tEA7tp7SHT6otQViAAWreev9xWc5p6GKGba30COeivow679fi+98tCqPJmEvayBPTXyj v4ktxjOi2GV6mnbUB8+em3eJ10KXu6kk+c2YKxHdKuZ3G/S+XizYHHYNLvXQlkuWHMaE Er2qf0eg3ROQgSgBpdSIp/WrSaO3QO5ewUqujhjQWkLqgIECJYbgMIjhu3EMYz40YEer GXVRa8EIYuLsxYFmbmiJYjtGJIFQ5UHdSsTZTtMhLP6alynVmn3OlNAIK/RoO6Lg6BuY HlkA== X-Gm-Message-State: APjAAAUUfKkJlzhG4pDXw3RUkln992MZgTKeiF3qvRekr4z1ELewi6nQ 7sbr18rV8r88yKU+mQcAac9LoQLW X-Google-Smtp-Source: APXvYqwACW9rjDgi4R19EZAvFEGqlweBq/p8k7mUti7fMSt6WlXcRAXFevCa5dYAwngSo2uPH8lWNw== X-Received: by 2002:ac8:21f2:: with SMTP id 47mr55623349qtz.38.1563939129494; Tue, 23 Jul 2019 20:32:09 -0700 (PDT) Received: from [172.20.0.236] ([216.113.24.76]) by smtp.gmail.com with ESMTPSA id s8sm18887836qkg.64.2019.07.23.20.32.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 23 Jul 2019 20:32:08 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-A75EEDBB-1EBC-482B-9234-1EA506A57BAF Mime-Version: 1.0 (1.0) From: Bret Jordan X-Mailer: iPhone Mail (16F203) In-Reply-To: Date: Tue, 23 Jul 2019 23:32:07 -0400 Cc: Arnaud Taddei , "add@ietf.org" , Barry Leiba Content-Transfer-Encoding: 7bit Message-Id: <67B7D613-0E37-46F4-B430-BD2DF9CBF04E@gmail.com> References: <06B41162-5936-4BF7-A9D6-3D864BB93ED2@gmail.com> To: Tommy Jensen Archived-At: Subject: Re: [Add] Followup from ADD session today X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 03:32:15 -0000 --Apple-Mail-A75EEDBB-1EBC-482B-9234-1EA506A57BAF Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Yeah, or maybe we could just have a tool like DHCP give out the DNS server i= nformation for the default case to prevent any one organization from trackin= g everyone. If only a tool like that existed. (Sarcasm) Then for anyone that wants to manually change things or hide their traffic t= hey could run a vpn service or configure their own dns resolver on their cli= ent. (More sarcasm). =20 One problem with a random DNS server, is it runs the risk of giving less tha= n optimal routes to services. Local services may also not work in that case f= or most managed networks. So schools and enterprises would have a hard time= . Split dns is a thing.=20 Bret=20 Sent from my Commodore 128D PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > On Jul 23, 2019, at 11:10 PM, Tommy Jensen w= rote: >=20 > There was talk about this in the Jabber thread today. Ekr suggested having= a drop down of server suggestions was a possibility. While I=E2=80=99m pers= onally a fan of promoting DNS server choice to the user=E2=80=99s attention,= it=E2=80=99s also very important to make that choice optional as users shou= ldn=E2=80=99t have to understand the question to get online.=20 >=20 > Perhaps having the default choice be random (or geolocation driven, or any= other function) per install to distribute the lion=E2=80=99s share of traff= ic which will never open DNS UI as much as possible? Apps could also defer t= o the platform=E2=80=99s DNS if we can establish a contract under which the a= pp gains assurance the platform DNS is user/admin blessed as opposed to user= /admin not-blessed configuration such as public WiFi. >=20 > Thanks, > Tommy=20 > From: Add on behalf of Bret Jordan > Sent: Tuesday, July 23, 2019 7:14:55 PM > To: Arnaud Taddei > Cc: add@ietf.org ; Barry Leiba > Subject: Re: [Add] Followup from ADD session today > =20 > You touch on a point that I think is critical. All of this provides the po= tential for massive centralization and tracking of DNS data, on a scale much= more severe than anything we have today. The internet and privacy works bes= t when we are very decentralized.=20 >=20 > Imaging an app being installed on a device that allows a user to browse th= e web. It has a hard coded DoH server that it wants to use, that points to t= he DoH server of its choice. The app can add as many other headers it wants= to ensure that it can fully track that user and application, no matter wher= e they are. So no matter where that client is, you will always be able to h= ave a perfect telemetry of everything they have done and when they do it.=20= >=20 > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing that ca= n not be unscrambled is an egg." >=20 >> On Jul 23, 2019, at 9:38 PM, Arnaud.Taddei.IETF wrote: >>=20 >> As a matter of fact today I was cut on the mic and yet after me, Barry ha= d the chance to speak and then another person had the chance to speak so it g= ives me the continued appearance that it is difficult to work in the IETF. >> =20 >> So if I would have had the chance to speak, I would have asked the questi= on regarding David's presentation that the approach taken here seems to part= icularly increase the centralisation effect and I would have asked clarifica= tion questions on the UX implications on how the user would chose the right D= oH server from the vetted hard coded one vs the proposed new one, etc. which= UX was expected, wondering how could it be done with a good UX in a situati= on of a expansion of modalities (this app is using this DoH server, this bro= wser another one, my OS another one and now I am asked to make a choice !?! a= re we =E2=80=98customer centric=E2=80=99 ?). Not saying at all it is impossi= ble, nor whether I like it or not but what was considered. >> =20 >> The other aspects are, as Vasily Dolmatov said, the fact that we are impl= icitly accepting a default of configuration at application level for 1.1.1.1= , etc. is going to have a number of consequences that we probably do not mea= sure yet completely in particular, I backup Vasily, that it will create inte= resting semantic issues between domains (application level vs infrastructure= level) and I share his concern about the potential implications. >> =20 >> Another person made the good remark that it is a change on the architectu= re for applications and services overall and we should pause and discuss it a= nd Jari pointed the problem of centralization which is a real problem to me t= oo >>=20 >> So my question on another alternative to what David is proposing, is why d= on't we try to recognise that here we have general application configuration= issue and this situation reminded me the infancy 25 years ago when mail and= DNS where basically the 2 only services that could be offered to customers,= citizens etc. and when we were missing so many pieces and it had many side e= ffects on what we were trying to do like how to get clients to understand th= eir own configuration. In this vein an application access protocol was creat= ed called ACAP which is still https://tools.ietf.org/html/rfc2244. it didn't= meet any big success perhaps for the similar centralisation issues as we ha= ve today but in a different context at that time >>=20 >> I am surely very naive here but if what we are facing here are applicatio= ns that need to find their DoH server and perhaps other resources, why are w= e not more ambitious and why don't we reconsider a protocol that is for appl= ication configuration and thus it could be managed by service providers, wou= ld keep the alignment to infrastructure semantics, would help to distribute t= he deployment, could avoid centralisation and could help the architecture?=20= >>=20 >> My 0.02 CHF >>=20 >>=20 >> Sent with ProtonMail Secure Email. >>=20 >> --=20 >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >=20 --Apple-Mail-A75EEDBB-1EBC-482B-9234-1EA506A57BAF Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Yeah, or maybe we could just have a tool li= ke DHCP give out the DNS server information for the default case to prevent a= ny one organization from tracking everyone.  If only a tool like that e= xisted.  (Sarcasm)

Then for anyone that wants to man= ually change things or hide their traffic they could run a vpn service or co= nfigure their own dns resolver on their client. (More sarcasm).  
=

One problem with a random DNS server, is it runs the ris= k of giving less than optimal routes to services. Local services may also no= t work in that case for most managed networks.  So schools and enterpri= ses would have a hard time. Split dns is a thing. 

=
Bret 

Sent from my Commodore 128D<= /span>

PGP Fingerprint: 6= 3B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050<= /div>

On Jul 23, 2019, at 11:10 PM, Tommy Jensen &= lt;Jensen.Thomas@microsoft.co= m> wrote:

There was talk about this in the Jabber thread today. Ekr suggested having a= drop down of server suggestions was a possibility. While I=E2=80=99m person= ally a fan of promoting DNS server choice to the user=E2=80=99s attention, i= t=E2=80=99s also very important to make that choice optional as users shouldn=E2=80=99t have to understand the question to get online. <= br>
Perhaps having the default choice be random (or geolocation driven, or any o= ther function) per install to distribute the lion=E2=80=99s share of traffic= which will never open DNS UI as much as possible? Apps could also defer to t= he platform=E2=80=99s DNS if we can establish a contract under which the app gains assurance the platform DNS is user/adm= in blessed as opposed to user/admin not-blessed configuration such as public= WiFi.

Thanks,
Tommy
From: Add <add-bounces@ietf.org> on behalf of Bret Jord= an <jordan.ietf@gmail.com>= ;
Sent: Tuesday, July 23, 2019 7:14:55 PM
To: Arnaud Taddei <Arnaud.Taddei.IETF@protonmail.com>
Cc: add@ietf.org <add@ietf.org>; Barry Leiba <barryleiba.mailing.lists@gmail.com&g= t;
Subject: Re: [Add] Followup from ADD session today
 
You touch on a point that I think is critical. All of this provides the pot= ential for massive centralization and tracking of DNS data, on a scale much m= ore severe than anything we have today. The internet and privacy works best when we are very decentralized.&= nbsp;

Imaging an app being installed on a device that allows a use= r to browse the web. It has a hard coded DoH server that it wants to use, th= at points to the DoH server of its choice.  The app can add as many oth= er headers it wants to ensure that it can fully track that user and application, no matter where they are.  = So no matter where that client is, you will always be able to have a perfect= telemetry of everything they have done and when they do it. 

Thanks,
Bret
PGP Fingerprint:&= nbsp;63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the on= ly thing that can not be unscrambled is an egg."

On Jul 23, 2019, at 9:38 PM, Arnaud.Taddei.IETF <Arn= aud.Taddei.IETF=3D40protonmail.com@dmarc.ietf.org> wrote:

As a matter of fact today I was cut on th= e mic and yet after me, Barry had the chance to speak and then another person had the chance to speak so it gives me the continue= d appearance that it is difficult to work in the IETF.<= /span>
 =
So if I would have had the chance to spea= k, I would have asked the question regarding David's presentation that the approach taken here seems to particularly increase th= e centralisation effect and I would have asked clarification questions on th= e UX implications on how the user would chose the right DoH server from the v= etted hard coded one vs the proposed new one, etc. which UX was expected, wondering how could it be don= e with a good UX in a situation of a expansion of modalities (this app is us= ing this DoH server, this browser another one, my OS another one and now I a= m asked to make a choice !?! are we =E2=80=98customer centric=E2=80=99 ?). Not saying at all it is impos= sible, nor whether I like it or not but what was considered.
 =
The other aspects are, as Vasily Dolmatov= said, the fact that we are implicitly accepting a default of configuration at application level for 1.1.1.1, etc. is going t= o have a number of consequences that we probably do not measure yet complete= ly in particular, I backup Vasily, that it will create interesting semantic i= ssues between domains (application level vs infrastructure level) and I share his concern about the potential i= mplications.
 =
Another person made the good remark that i= t is a change on the architecture for applications and services overall and we should pause and discuss it and Jari pointed th= e problem of centralization which is a real problem to me too<= /span>

So my question on another= alternative to what David is proposing, is why don't we try to recognise that here we have general application configuration iss= ue and this situation reminded me the infancy 25 years ago when mail an= d DNS where basically the 2 only services that could be offered to customers= , citizens etc. and when we were missing so many pieces and it had many side effects on what we were trying to do li= ke how to get clients to understand their own configuration. In this vein an= application access protocol was created called ACAP which is still https://tools.ietf.org= /html/rfc2244. it didn't meet any big success perhaps for the similar centralisation issues a= s we have today but in a different context at that time=

I am surely very naive here but if what w= e are facing here are applications that need to find their DoH server and perhaps other resources, why are we not more ambitious= and why don't we reconsider a protocol that is for application configuratio= n and thus it could be managed by service providers, would keep the alignmen= t to infrastructure semantics, would help to distribute the deployment, could avoid centralisation and cou= ld help the architecture? 

My 0.02 CHF=


Sent with ProtonMail Secure Email.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/m= ailman/listinfo/add

= --Apple-Mail-A75EEDBB-1EBC-482B-9234-1EA506A57BAF-- From nobody Tue Jul 23 20:37:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E76212008A for ; Tue, 23 Jul 2019 20:37:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yVeg-EtClk4s for ; Tue, 23 Jul 2019 20:37:43 -0700 (PDT) Received: from mail-qk1-x736.google.com (mail-qk1-x736.google.com [IPv6:2607:f8b0:4864:20::736]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E4EBE120046 for ; Tue, 23 Jul 2019 20:37:42 -0700 (PDT) Received: by mail-qk1-x736.google.com with SMTP id r4so32711814qkm.13 for ; Tue, 23 Jul 2019 20:37:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=xx36vSA93ZIGJvqomx6pT2Ikhc92JQ1rNCDOjp9yQzE=; b=ubeU3ZIDuZpMugDEOVJ8/J0J55TCExPtkSgNFqFZD1DhCR0UC4Fq2dg6eOoJSmPEKp zPrIFYybscBmMJxRwn5gQo4e/bo+FAOEHWKHCnSD+FJclkNTPsU2hoAcd7MFWuDF0lN7 /SsJLO4+bzOpqzfzrYmkPyWOJ4IDplMYeBgQ2fxzyRF8GzhbhQ9ZpRS3622KgFL+3M+T zTLgoChBKH1ybaFIVwR+gApPXFD6QqteyolNjO+W3Kznot1BNyz+kYFTBbJeVbTBDSFp bfBfgs6A54C3BJQlV9CPlyFTmHk/Hc7fNp101JmCC4js8ouGGWuQN99YrKkaemn+YJlN QORA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=xx36vSA93ZIGJvqomx6pT2Ikhc92JQ1rNCDOjp9yQzE=; b=VEAHdhzUXbf2BZ5ELqtm+8sy7XLjO9+/a3dxsK/KyPYrhWTsBeiNOYMiUs6pTGfEG/ dddKWA5dyVLLKWKEZFt53Hi7ecK9sZ8Lm/f4dqNXqiiPo8BeZXabIkHIqjw15VbAAgiO hFrp3rmGadgzKRNjv1e43vrwxPlU8OgFNwNhI1rTYatZ5w+ZgnFTx/6mKrie0+FkGqOG 0VquF8Rmc4/Ti1XfhH0M7t+esCpQHwiO+9JmhH9bXLEczpb/yW/RupRaJHXUQLX8DEV2 dc4bdJOHHGLvB4t3/ibXd3rTSDDiXYoeQZ1hQr3he7X7UwhyZAhsl6hPncQOAtbNHabi 9AMw== X-Gm-Message-State: APjAAAUD9Hq/PTYHgIrJkzZbzmE4wzVExAHtY090xXKYQarczRulWSSJ LKNIT1sjWhQY3oDbQnP2p3BVCLW/ X-Google-Smtp-Source: APXvYqwT0Vch9PxhJdx+uaDKLXWB1nU9omdm4ZwsxDhxHQeonWKG0wjczStBJbqR/pgJLne3xddZFA== X-Received: by 2002:a37:660d:: with SMTP id a13mr25031009qkc.36.1563939461791; Tue, 23 Jul 2019 20:37:41 -0700 (PDT) Received: from [172.20.0.236] ([216.113.24.76]) by smtp.gmail.com with ESMTPSA id q3sm26144274qta.74.2019.07.23.20.37.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 23 Jul 2019 20:37:41 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-5B8393A9-C1E4-4FE7-A7E6-4B6AD253AB17 Mime-Version: 1.0 (1.0) From: Bret Jordan X-Mailer: iPhone Mail (16F203) In-Reply-To: Date: Tue, 23 Jul 2019 23:37:40 -0400 Cc: Rob Sayre , Jim Reid , "add@ietf.org" Content-Transfer-Encoding: 7bit Message-Id: <0AAD2E5F-B46F-4582-BC24-F0A731102FED@gmail.com> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> To: Tommy Jensen Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 03:37:45 -0000 --Apple-Mail-5B8393A9-C1E4-4FE7-A7E6-4B6AD253AB17 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable We need to calmly and completely document the issues, the risks, and the ram= ifications. We need to do a design where we take input from all sides. Wher= e we rationally understand the various use cases and work together. =20 Bret=20 Sent from my Commodore 128D PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > On Jul 23, 2019, at 11:17 PM, Tommy Jensen w= rote: >=20 > I appreciate the feedback. If I bring an I-D it will be more broad than th= is particular point. The point of =E2=80=9CDNS filtering isn=E2=80=99t dead=E2= =80=9D is small potatoes compared to the larger =E2=80=9Chow we can collabor= ate as ecosystem components on providing the most ideal DNS experience=E2=80= =9D I think we=E2=80=99re all trying to go for. I=E2=80=99m listening and pa= rticipating on these threads to see if I can even convince myself of such a d= raft.=20 >=20 > Thanks, > Tommy=20 > From: Rob Sayre > Sent: Tuesday, July 23, 2019 8:02:42 PM > To: Tommy Jensen > Cc: Bret Jordan ; Jim Reid ; add@i= etf.org > Subject: Re: [Add] fixing coffee shop brokenness with DoH > =20 > On Tue, Jul 23, 2019 at 7:57 PM Tommy Jensen = wrote: > I don=E2=80=99t agree that the email was =E2=80=9Cincoherent=E2=80=9D as i= t pointed out the flaw in insisting that DNS filtering is a dead technology,= the conflict being that DNS tampering is effective enough by bad actors to d= eserve work and attention but not effective enough by good actors to deserve= consideration.=20 >=20 > Ah, now this sounds like a good idea for an Internet-Draft. Why not write u= p this idea? That way, it can be evaluated outside of a message thread. >=20 > thanks, > Rob > =20 --Apple-Mail-5B8393A9-C1E4-4FE7-A7E6-4B6AD253AB17 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable We need to calmly and completely document t= he issues, the risks, and the ramifications. We need to do a design where we= take input from all sides.  Where we rationally understand the various= use cases and work together.  

Bret 

Sent from my Commodore 128D

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 &= nbsp;F2C0 74F8 ACAE 7415 0050

On Jul 23, 2019, at 11:17 PM, Tommy Jensen <Jensen.Thomas@microsoft.com> wrote:

<= /div>
I appreciate the feedback. If I bring an I-D it will be more broad than this= particular point. The point of =E2=80=9CDNS filtering isn=E2=80=99t dead=E2= =80=9D is small potatoes compared to the larger =E2=80=9Chow we can collabor= ate as ecosystem components on providing the most ideal DNS experience=E2=80= =9D I think we=E2=80=99re all trying to go for. I=E2=80=99m listening and parti= cipating on these threads to see if I can even convince myself of such a dra= ft.

Thanks,
Tommy
From: Rob Sayre <sayrer@gmail.com>
Sent: Tuesday, July 23, 2019 8:02:42 PM
To: Tommy Jensen <J= ensen.Thomas@microsoft.com>
Cc: Bret Jordan <jordan.i= etf@gmail.com>; Jim Reid <jim@r= fc1035.com>; add@ietf.org <add@ietf.org>
Subject: Re: [Add] fixing coffee shop brokenness with DoH
 
On Tue, Jul 23, 2019 at 7:57 PM Tommy Jensen <Jensen.Thomas@microsoft.com> wro= te:
I don=E2=80=99t agree that the email was =E2=80=9Cincoherent=E2=80=9D a= s it pointed out the flaw in insisting that DNS filtering is a dead technolo= gy, the conflict being that DNS tampering is effective enough by bad actors t= o deserve work and attention but not effective enough by good actors to deserve consideration.

Ah, now this sounds like a good idea for an Internet-Draft. Why not wri= te up this idea? That way, it can be evaluated outside of a message thread.<= /div>

thanks,
Rob
 
= --Apple-Mail-5B8393A9-C1E4-4FE7-A7E6-4B6AD253AB17-- From nobody Tue Jul 23 20:41:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0BE9012008A for ; Tue, 23 Jul 2019 20:41:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ivcBTkR7j5fF for ; Tue, 23 Jul 2019 20:41:02 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56B25120046 for ; Tue, 23 Jul 2019 20:41:02 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id e20so56175365iob.9 for ; Tue, 23 Jul 2019 20:41:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=O1GSmo3PJt7cQrFx6yxnHz7HKnGg/I5rp3XsssUz8l8=; b=jXoWkrIZKsKlTZ6ofUQe/Q9mJQYw85IbQdSjNPDCsfHfa2sxSncWHLJhG7Rhv4oiwu X+vDCAePA74T/0RQI6wtdLTEUm5byb+sbvb2UM4djDd0vBHyZB23iHfEVsS/YuC372RY NihITc1yo7KW2jBa4RLqWk7xa8nuAfXbhKig8kiN9mF4k/mTkrUjL08cKTAcCwjL5foA 2f0Y4jUr3SGVBKo21Bijg85jYwEEmuIQUxUY+AO0i1gMrGxPUuECAdhudMokeUe6kD5z XluBK/6Z9mVqg/WnZkuKQ5X7mrUS9LvaOcBC9YzvJuJULhuvDlGSXCCyM1uPXWnjKS5E ozAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=O1GSmo3PJt7cQrFx6yxnHz7HKnGg/I5rp3XsssUz8l8=; b=RzXG8wz4QsMIVlc+drFeK4+nE0NK+9nszmaBWrn33TxR6vcCZa0qz6zdzEI9XfVonT NPRpy2jAptOhCKiNK4B/pHBA2XMgalcQGDAhmQ4b78E2ZhMPyiYbE3kFvJ/bzDSvPp8+ e5boW18k/FNPxrT2mF5dwaYwM1hj9+NLkqaBkWzJ9eBRDpBwo2iNBXYBujfHqrW/70ef fYlp0Y24xVsBY9V/MoRI+31nCzdA2S9/AkgKghMe2h+Qdi/Fg+axztsKV1955ROrsMgj vO7PQ6Rx7D3ymVjkvLucUv44G87ZAUbpMMruVAaC4Oy1wNR7yjc9jCzU7+UPEZKUS21T iGqg== X-Gm-Message-State: APjAAAWNlgoVdEjrssjcb1sySoe7FT5ugaXFIT8yphgDv2OWN5qIb7ml QCZ+XiDJ7oFd6jXjXwfAwLhzidrrGmUZWnLDIOg= X-Google-Smtp-Source: APXvYqwEHmEULOHjXSUSR1Y8w17Lj5vdR4LcdcYqjpJ2D41AtWrpX2fIta+zSEtygt43uGfbkr5YXRtOmA304oQSOvY= X-Received: by 2002:a6b:bc42:: with SMTP id m63mr59482329iof.189.1563939661508; Tue, 23 Jul 2019 20:41:01 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <0AAD2E5F-B46F-4582-BC24-F0A731102FED@gmail.com> In-Reply-To: <0AAD2E5F-B46F-4582-BC24-F0A731102FED@gmail.com> From: Rob Sayre Date: Tue, 23 Jul 2019 20:40:50 -0700 Message-ID: To: Bret Jordan Cc: Tommy Jensen , Jim Reid , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000f97607058e65137b" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 03:41:04 -0000 --000000000000f97607058e65137b Content-Type: text/plain; charset="UTF-8" On Tue, Jul 23, 2019 at 8:37 PM Bret Jordan wrote: > We need to calmly and completely document the issues, the risks, and the > ramifications. We need to do a design where we take input from all sides. > Where we rationally understand the various use cases and work together. > That's how the IETF works, right? The RFC is done: https://tools.ietf.org/html/rfc8484 I don't believe there is a special process for people who didn't like the result, but I could be wrong. I don't know every last letter of each process document. thanks, Rob --000000000000f97607058e65137b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 23, 2019 at 8:37 PM Bret Jord= an <jordan.ietf@gmail.com&g= t; wrote:
We need to calmly and completely doc= ument the issues, the risks, and the ramifications. We need to do a design = where we take input from all sides.=C2=A0 Where we rationally understand th= e various use cases and work together.=C2=A0=C2=A0

That's how the IETF works, right? The RFC is done:


I don't be= lieve there is a special process for people who didn't like the result,= but I could=C2=A0be wrong. I don't know every last letter of each proc= ess document.

thanks,
Rob
--000000000000f97607058e65137b-- From nobody Tue Jul 23 21:31:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AACA3120119 for ; Tue, 23 Jul 2019 21:31:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QKFAz-IN2hZT for ; Tue, 23 Jul 2019 21:31:30 -0700 (PDT) Received: from mail-yw1-xc31.google.com (mail-yw1-xc31.google.com [IPv6:2607:f8b0:4864:20::c31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E5A8412001E for ; Tue, 23 Jul 2019 21:31:29 -0700 (PDT) Received: by mail-yw1-xc31.google.com with SMTP id q128so17719221ywc.1 for ; Tue, 23 Jul 2019 21:31:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=xaNfc0Jq5npacpYXNXEzAoESpqirQObjYB5kOc0F0qc=; b=VlkXgPvObzLZCBrUx8dgEBh2Kdt53xAHKWVFUM0Bve3OrZIUCUb7/yt6Gypmk0smKJ pMNEpkMgCqPvBJz0BYsrBvOttRGabktEAHbtMfORGoPfucMvmHuB2eLZqnEMTEg8h23A rSkZW4uQ+mZuB2Vz8iq66r97l6M6bK/Cf+0+mgkXymkuW6ZSOIp/VvUupAsxbP2VxmH3 RW3BZ1OxGqn8PXV/aIPh+/wFs8IR0IY2dXtsM2QH4euZhtrhQ3hu9DV1Q1X5Cck4FJsZ WrTERGhEU4YUZ14VIkZX2Qckmns7aZ5hMjCZgCR/vEToaaz1/7jIKuv5Z7JO1KxnX2Tm B/zg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=xaNfc0Jq5npacpYXNXEzAoESpqirQObjYB5kOc0F0qc=; b=DH+ca72gu4qwiMM9MZifY9pfjgQnBBxoRlRoc3AVHgcHeqcn00aqNMq9oS3vYPGFI0 xMaRQgJHIKmI1Jj9Cly7TElonyuBTiJYw0l9uJ4hWQkggbrklneSc6/mbmO1TaeMSrKv Wkki9OCKDtZo70ttzGgZcM3fJWk0qn0mpOLnjTuzZNXJSuhaEkFu696ieSWN/2kCpIad vVOWA01YmNzq/rYpAmcoRYr0ScYpBBWdl2c3DFAGaD0hMBX/kPLG7zTLByzcxvxIarbm /9DsuV54c3D8QRpBruqsV3WMltHQNWd1xDynF//xU8B6bvCVCKAmo5x/UlnK7O7zkmLl QIPQ== X-Gm-Message-State: APjAAAVUrFpY13h44AHE8TalWowCUAqBlRTfbiubaIjIHZDpm9NMEYr6 F63q7GG+tsnA7wH9ufyk4gEO5gks3XRhnZkwTX8= X-Google-Smtp-Source: APXvYqySymclK//R2NgwyWtaSnZ0XV4Yr49BrlK+egBK0y7sU6oAO3AIRguru3FmsNmJSwnLG/Ol9OUTgeBEB21Uyzw= X-Received: by 2002:a0d:e6cb:: with SMTP id p194mr48982759ywe.83.1563942689001; Tue, 23 Jul 2019 21:31:29 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> In-Reply-To: <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> From: Alec Muffett Date: Wed, 24 Jul 2019 05:31:18 +0100 Message-ID: To: Bret Jordan Cc: Rob Sayre , Jim Reid , "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000006d5382058e65c8ef" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 04:31:32 -0000 --0000000000006d5382058e65c8ef Content-Type: text/plain; charset="UTF-8" On Wed, 24 Jul 2019, 03:16 Bret Jordan, wrote: > Well to use the argument that others have used, why not just use VPN in > your coffee shop? > Because good privacy and integrity of DNS lookups should be by default and should respect the choices of the user. See also the essay referred to in: https://mailarchive.ietf.org/arch/msg/add/LHDXjeYUwoSzzARloeywdo59Sew ... albeit that that is a rather long post. - alec --0000000000006d5382058e65c8ef Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, 24 Jul 2019, 03:16 Bret Jordan, <jordan.ietf@gmail.com> wrote:
Well to use the argument that others have used, why not just= use VPN in your coffee shop?

Because good privacy and integrity of DNS lo= okups should be by default and should respect the choices of the user.

See also the essay referred = to in:


... albeit that that is a rathe= r long post.

- alec


=

--0000000000006d5382058e65c8ef-- From nobody Tue Jul 23 22:34:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4476412011D for ; Tue, 23 Jul 2019 22:34:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jwWkrfCwHxGx for ; Tue, 23 Jul 2019 22:34:05 -0700 (PDT) Received: from bizet.nethelp.no (bizet.nethelp.no [195.1.209.33]) by ietfa.amsl.com (Postfix) with ESMTP id 700A412003F for ; Tue, 23 Jul 2019 22:34:05 -0700 (PDT) Received: from localhost (bizet.nethelp.no [IPv6:2001:8c0:9e04:500::1]) by bizet.nethelp.no (Postfix) with ESMTP id E046FE6079; Wed, 24 Jul 2019 07:34:02 +0200 (CEST) Date: Wed, 24 Jul 2019 07:34:02 +0200 (CEST) Message-Id: <20190724.073402.150860322.sthaug@nethelp.no> To: alec.muffett@gmail.com Cc: add@ietf.org From: sthaug@nethelp.no In-Reply-To: References: <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> X-Mailer: Mew version 6.7 on Emacs 26 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 05:34:07 -0000 > Because good privacy and integrity of DNS lookups should be by default and > should respect the choices of the user. I have chosen my resolvers carefully and configured my resolv.conf accordingly. If Mozilla and/or Google "upgrade" my browsers to use DoH, without asking me, they are not respecting my choices. Steinar Haug, AS2116 From nobody Tue Jul 23 22:36:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0E3F12007C for ; Tue, 23 Jul 2019 22:36:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KYtCWed5PNAG for ; Tue, 23 Jul 2019 22:36:45 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21E4A12003F for ; Tue, 23 Jul 2019 22:36:45 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id o9so87032682iom.3 for ; Tue, 23 Jul 2019 22:36:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=iAhijaeq0moH6y53DaJMtg6y6BDDTgS83/NecNUYIDQ=; b=gYXc3Pq0eTuae8BV5Z9KT4b6Rm2Ia7am9duxisvKmwJ4AoadJddFq4fSbPELehK1op 89NLnLR9i3Et6ZmficelGBeW/PgqwoIMrlQtBd+3PbSiK5kA0IqIrw8ijDxadzaUpm7c IsECLhSFfNjtaGcFxZ03rUjHimwFsqLVHRfB7i8RqN4q8WHX5MwTzqYKVvu2WtysINdc Ee6vXbrzKdOy1BAIMEk7DRsRV/zDljUMXzmidKJgF7hSZ62V1Hhe7+mTEtaLD8KclFNL Xpm8aOc0l4MrUopISvbACCGKrVOD3ydGOI2NYEjrMWteIMAtXyFyTKPN9F5iHzOynHms h32A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=iAhijaeq0moH6y53DaJMtg6y6BDDTgS83/NecNUYIDQ=; b=IIF6fT40i3BMvxuQIdQ5s5Qzh2uaG5ymwJuy/aVD0vx9rlUlCwqlDufXbC4YA/eqn9 rDE/BliN5xgIehpMmiwwJliMTYZYrkdgD+n9MKuwXqWkwvNXOUluTT/Sn/RQJJ5kS29H CFtMPCGwn0jHr0NFeJD92JmyZY6U2ZzMIravW6CI8S4aO1K+Gxgq293oVYQa7TyGhu4g AMbzplz+Aoiz0AOOZwdB8n3zHPH7ECDt9+39PO0ZFiBuzobG2fbB/MitTiXBzPlNGgR3 blZ0egB4fJfE8zN+BstOzUwK6kDZOZ1TtWr2UPVXmGgmg+NNpIDHf4I0nSeprpLp5pEr kPOQ== X-Gm-Message-State: APjAAAWHwQHPkvcfMF/ijZby8pxKwqZFHE2OcjYeUKFSP+VDkWNzb7Pc +wGbJxQ6iWHKaVZpjVx47Anm4e1jDIEEzIQWlFA= X-Google-Smtp-Source: APXvYqxl4qBh0xz1wk5I0eP2DHaH1hTfP5tlg3i4tKZhGRHjnLmac4kkDe76B8Jt90K1lyh1mUoFq/JwSYlkoua2DHE= X-Received: by 2002:a5e:c00e:: with SMTP id u14mr42479146iol.196.1563946604283; Tue, 23 Jul 2019 22:36:44 -0700 (PDT) MIME-Version: 1.0 References: <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <20190724.073402.150860322.sthaug@nethelp.no> In-Reply-To: <20190724.073402.150860322.sthaug@nethelp.no> From: Rob Sayre Date: Tue, 23 Jul 2019 22:36:33 -0700 Message-ID: To: sthaug@nethelp.no Cc: Alec Muffett , add@ietf.org Content-Type: multipart/alternative; boundary="000000000000cbcc95058e66b1b8" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 05:36:47 -0000 --000000000000cbcc95058e66b1b8 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 23, 2019 at 10:34 PM wrote: > I have chosen my resolvers carefully and configured my resolv.conf > accordingly. > I don't think anyone would override that intentionally. Which secure DNS protocol are you using? thanks, Rob --000000000000cbcc95058e66b1b8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 23, 2019 at 10:34 PM <sthaug@nethelp.no>= ; wrote:
I have chosen my resolvers carefully and configured my resolv.conf
accordingly.=C2=A0

I don't think an= yone would override that intentionally.

Which secu= re DNS protocol are you using?

thanks,
R= ob=C2=A0
--000000000000cbcc95058e66b1b8-- From nobody Wed Jul 24 01:51:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64373120048 for ; Wed, 24 Jul 2019 01:51:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wHVymajupvGl for ; Wed, 24 Jul 2019 01:51:15 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.70.35]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 480EA120105 for ; Wed, 24 Jul 2019 01:51:14 -0700 (PDT) Received: from opfednr07.francetelecom.fr (unknown [xx.xx.xx.71]) by opfednr27.francetelecom.fr (ESMTP service) with ESMTP id 45tpwc328qz4wnr for ; Wed, 24 Jul 2019 10:51:12 +0200 (CEST) Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.60]) by opfednr07.francetelecom.fr (ESMTP service) with ESMTP id 45tpwb6Nt8zFpXQ; Wed, 24 Jul 2019 10:51:11 +0200 (CEST) Received: from OPEXCAUBMA1.corporate.adroot.infra.ftgroup ([fe80::f04d:ad3c:61de:a175]) by OPEXCAUBM5D.corporate.adroot.infra.ftgroup ([::1]) with mapi id 14.03.0439.000; Wed, 24 Jul 2019 10:51:12 +0200 From: To: "andrew.fidler@bt.com" , "chris.box@bt.com" CC: "add@ietf.org" Thread-Topic: Thoughts on a DoH (and DoT) BCP? Thread-Index: AdUx1uEEFvBhHUWqSHedXSRbiDMGggQJZbkQ Date: Wed, 24 Jul 2019 08:51:11 +0000 Message-ID: <30950_1563958271_5D381BFF_30950_9_1_B5939C6860701C49AA39C5DA5189448B939E9268@OPEXCAUBMA1.corporate.adroot.infra.ftgroup> References: In-Reply-To: Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.247] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 08:51:17 -0000 Chris, Andy, regarding your call for call for inputs yesterday, we would support this wo= rk and be happy to contribute on some of these items. =20 I think the IETF should provide guidance to ISPs/operators on how this may = impact their cache sever infrastructures and ultimately how we can deploy t= he technology. I share the concerns expressed at the mic by Barbara and oth= ers regarding the operational issues related to this.=20 Regards, Philippe Fouquart Orange Labs Networks From: Add [mailto:add-bounces@ietf.org] On Behalf Of andrew.fidler@bt.com Sent: Wednesday, July 03, 2019 9:41 PM To: add@ietf.org Subject: [Add] Thoughts on a DoH (and DoT) BCP? There are many challenges facing enterprise and internet service provider /= operator networks that intend to deploy and operate DoH (and DoT) resolver= services. The IETF should consider developing a BCP which documents these = concerns and provide appropriate guidance. Some of these issues include: -=A0=A0=A0=A0=A0=A0=A0=A0=A0 server performance & measurement considerations -=A0=A0=A0=A0=A0=A0=A0=A0=A0 network performance, capacity and resilience p= lanning -=A0=A0=A0=A0=A0=A0=A0=A0=A0 impact on existing infrastructure: load balanc= ers, captive portals, NAT, proxies and on-net content caches/CDNs -=A0=A0=A0=A0=A0=A0=A0=A0=A0 CPE provisioning - first connection set-up -=A0=A0=A0=A0=A0=A0=A0=A0=A0 CPE DoH proxy and certificate options -=A0=A0=A0=A0=A0=A0=A0=A0=A0 Interactions between applications and OS/Kerne= l DNS settings -=A0=A0=A0=A0=A0=A0=A0=A0=A0 providing DoH and DoT services in split DNS en= vironments -=A0=A0=A0=A0=A0=A0=A0=A0=A0 authentication requirements for DoH and DoT re= solvers -=A0=A0=A0=A0=A0=A0=A0=A0=A0 management of TLS sessions at DNS query rates = - ticket duration, restarts, etc. -=A0=A0=A0=A0=A0=A0=A0=A0=A0 minimising TLS overheads for DoT and DoH traff= ic -=A0=A0=A0=A0=A0=A0=A0=A0=A0 protection of application-specific DoH and DoT= resolver configuration I'd be willing to work on a BCP on this topic. Is anyone else? What other k= ey issues should be considered? Andy Fidler andrew.fidler@bt.com This email contains information from BT that might be privileged or confide= ntial. And it's only meant for the person above.=A0If that's not you, we're= sorry - we must have sent it to you by mistake. Please email us to let us = know, and don't copy or forward it to anyone else. Thanks. We monitor our email systems and may record all our emails. British Telecommunications plc R/O : 81 Newgate Street, London EC1A 7AJ Registered in England: No 1800000 ___________________________________________________________________________= ______________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confiden= tielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu= ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages el= ectroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou = falsifie. Merci. This message and its attachments may contain confidential or privileged inf= ormation that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and dele= te this message and its attachments. As emails may be altered, Orange is not liable for messages that have been = modified, changed or falsified. Thank you. From nobody Wed Jul 24 01:59:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E4A512010E for ; Wed, 24 Jul 2019 01:59:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0gasEb8_goc7 for ; Wed, 24 Jul 2019 01:59:29 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 522F4120044 for ; Wed, 24 Jul 2019 01:59:29 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id j6so12807425ioa.5 for ; Wed, 24 Jul 2019 01:59:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=edy2u3xVqL1R/PMEcyTYQAHiVZsvM8C3ZvNHOFpb1/0=; b=ZUCKV4EInPew8C8ed4oxmYHAyoebZjjXquEZUfbz1eqoX6Rm/FLfgGIjob3OrS8ZHl tS/6SeBQ+BTc9Vuxa6rcjmgb5vZMCFtX9rTyofkqRbi+OSiH9xr1iJOuFFVomlovcaGE jpBz92WwS2RxyV65l/b3eN/Ar4xKsSFy02MdkN63M/zq8LEAn6JNYsMkfK5idebcyHi1 lpf13Gc2z993QGSYZ/pMBmvi7MCsx099paCEsL4ILLolfRQMpQpwFnx1Z8fHi35/ye17 OMAu0UBAsxoZwA2h+nOgVDLRrqtuzUHfH3kwuxs/jn0JLkWqXKaqxwelB65dqE7D9jEF gZuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=edy2u3xVqL1R/PMEcyTYQAHiVZsvM8C3ZvNHOFpb1/0=; b=dW9YAZdmQyZO6dyxUKSonVewZ1dcRBolmLUDHASUqM2rnSwepm47/QvNAe/gLsEuQt CzG7oy9sCuhfhbPsTD/QEd2El476lbCCZdKmcTQXBPt101RLJ33nw1KRAHZGzQja3VED rbWjRDQ8fwvTCrNel15rU+pWtkXKqON/BSmCSbStbKbHDN3L0wEyY5l3JTqhw7m/ZsqP js0vfFD9pxDvu5IJhlPkAhPUiptgAd+YDU1JL6vuofdcBNGVXr9MHqpuok0IdN+kK1SG 1Ey+Phi8g7fX75p4YSSskHS2KaED/TxkM4Z80aZjp+jNz2ZY9aBYczeSAOhWUwIhLB7s 3dKA== X-Gm-Message-State: APjAAAW51/erzLTq6wsKIOBGG4nLYRRbcC3LM8/5T3DxtMp8tVX1KWQU fuwfm7r5RgHpK9XkQNd1/Jc28NDMQYiZ/KZSO3k= X-Google-Smtp-Source: APXvYqyX+Mu7OXHWU+KYf+c+spo7dYxMEJOqLWQEwTP/xTkVAy+Tto7fCsdT2xuDP0xharlWu2Cfw3vgLujl9nebWjE= X-Received: by 2002:a6b:b602:: with SMTP id g2mr74325668iof.54.1563958768496; Wed, 24 Jul 2019 01:59:28 -0700 (PDT) MIME-Version: 1.0 References: <30950_1563958271_5D381BFF_30950_9_1_B5939C6860701C49AA39C5DA5189448B939E9268@OPEXCAUBMA1.corporate.adroot.infra.ftgroup> In-Reply-To: <30950_1563958271_5D381BFF_30950_9_1_B5939C6860701C49AA39C5DA5189448B939E9268@OPEXCAUBMA1.corporate.adroot.infra.ftgroup> From: Rob Sayre Date: Wed, 24 Jul 2019 01:59:17 -0700 Message-ID: To: philippe.fouquart@orange.com Cc: "andrew.fidler@bt.com" , "chris.box@bt.com" , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000d6f8fa058e69863a" Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 08:59:31 -0000 --000000000000d6f8fa058e69863a Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 1:51 AM wrote: > I share the concerns expressed at the mic by Barbara and others regarding > the operational issues related to this. > Everyone's concerns should be considered. But that doesn't make the IETF the ITU. thanks, Rob --000000000000d6f8fa058e69863a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 24, 2019 at 1:51 AM <philippe.fouquart@orange.com= > wrote:
=C2=A0I share the concerns expressed at the mic by B= arbara and others regarding the operational issues related to this.

Everyone's concerns should be considered.= But that doesn't make the IETF the ITU.

thank= s,
Rob=C2=A0
--000000000000d6f8fa058e69863a-- From nobody Wed Jul 24 02:19:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36597120132 for ; Wed, 24 Jul 2019 02:19:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OqR8OIVxNLqy for ; Wed, 24 Jul 2019 02:19:40 -0700 (PDT) Received: from mail-io1-xd29.google.com (mail-io1-xd29.google.com [IPv6:2607:f8b0:4864:20::d29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A28D12012E for ; Wed, 24 Jul 2019 02:19:40 -0700 (PDT) Received: by mail-io1-xd29.google.com with SMTP id s7so87961742iob.11 for ; Wed, 24 Jul 2019 02:19:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=SaJLeJFOpwaPtt+TxOdpjALlx2ScCkVM0hk1xuOkg7U=; b=P5KgIohD5Ph+VzobQeJtsvC1zHVwQKyOnMwxqqSh1pWzMqFRoPq7dD6PMaKzSvItuO yvdGzlmoBlROxceE+EPly23bIKpo9/rQppXY1Bv5pocgzq9EJQrd0uV5g45qIWqjTNGx xELl/xuBzt8jvbhDI8ACqt49TiNGsBc58PRbYzDl/mJ9q/XtWITJHY+g9ExtOoZwsxRa cw6advt6ruHtTyzMm0qyxkm0brUA/QCyYAV4kNoIB4UZ/k1n5JSkgLR5oM+CG4jHMGwu eFc9wbD+yhpxtXmNY8wyOSXb2SppbJ+StA0fhcBRvXpNPtKwMByBPGlDQw8SSYfjSovV mWpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=SaJLeJFOpwaPtt+TxOdpjALlx2ScCkVM0hk1xuOkg7U=; b=VAs7LH/Uox7Eli1ZkaV1TS3jW1XqbjbhcvGIRHmmv1mHFN41cA6y2u3j7Dzn4aq8X3 5SYzwLm8W4fDMaJbGc6q48gq6JML/LhCHvlNKVlAaK9DJPaQ/3z4pm2O/cYKGucIovu7 hC7x71G8ln2G1PzTg7/6YeA0CihmWPBXMc8qOIiPl5tsZy4XW2pXx/mEGKlNEsexTUhm v1r837GtFkMGbj/WmzRVsMIqZzuNFLXqzb3YPBsWKWd/7k2fRDfReBqdoISogmxSFVmq 7DS7/CNStJGTwXAkXJ3iFwTRLe9nyBNea3qkXggZnQYozGTiZy7C9LSLiRnbAh2Qv2ec jOVg== X-Gm-Message-State: APjAAAVKM1vWhrw1QgploCRnrjd84/aJX5VBCNURi0EI4NCNUYp1CWjn OqW18eIr0IRUpGxk6En91Dcd5q5uGTkzv7e5cVQ= X-Google-Smtp-Source: APXvYqxoqrfRprJ/2faF/JUqgAbg1E88hjb1FoNrtsTHaTb/NNsyapdod+FYmwJRdQgNFH0C/hioqRg+RTne7MHzW7c= X-Received: by 2002:a02:5a02:: with SMTP id v2mr82017287jaa.124.1563959979721; Wed, 24 Jul 2019 02:19:39 -0700 (PDT) MIME-Version: 1.0 References: <30950_1563958271_5D381BFF_30950_9_1_B5939C6860701C49AA39C5DA5189448B939E9268@OPEXCAUBMA1.corporate.adroot.infra.ftgroup> In-Reply-To: From: Rob Sayre Date: Wed, 24 Jul 2019 02:19:28 -0700 Message-ID: To: philippe.fouquart@orange.com Cc: "andrew.fidler@bt.com" , "chris.box@bt.com" , "add@ietf.org" Content-Type: multipart/alternative; boundary="00000000000008c8e3058e69cf09" Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 09:19:42 -0000 --00000000000008c8e3058e69cf09 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 1:59 AM Rob Sayre wrote: > On Wed, Jul 24, 2019 at 1:51 AM wrote: > >> I share the concerns expressed at the mic by Barbara and others >> regarding the operational issues related to this. >> > > Everyone's concerns should be considered. But that doesn't make the IETF > the ITU. > More constructively, maybe the ITU is the perfect place for these discussions! The folks from BT, AT&T, Orange, etc can all discuss their policies in some other venue, and I think that would be great. thanks, Rob --00000000000008c8e3058e69cf09 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 1:59 AM Rob S= ayre <sayrer@gmail.com> wrote= :
On Wed, Jul 24, 2019 at 1:51 AM <philippe.fouquart@orange.com= > wrote:
=C2=A0I share the concerns expressed at the mic = by Barbara and others regarding the operational issues related to this.

Everyone's concerns should be conside= red. But that doesn't make the IETF the ITU.

=C2=A0More constructively, maybe the ITU is the per= fect place for these discussions!

The folks from B= T, AT&T, Orange, etc can all discuss their policies in some other venue= , and I think that would be great.

thanks,
Rob
=C2=A0
--00000000000008c8e3058e69cf09-- From nobody Wed Jul 24 02:30:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E03DD120129 for ; Wed, 24 Jul 2019 02:30:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=nominet.uk header.b=B4GC/YYx; dkim=pass (1024-bit key) header.d=nominetuk.onmicrosoft.com header.b=j326zUgJ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t2gsCZWOiVqy for ; Wed, 24 Jul 2019 02:30:08 -0700 (PDT) Received: from mx1.nominet.org.uk (mail.nominet.org.uk [213.248.242.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 99DCE1200E7 for ; Wed, 24 Jul 2019 02:30:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nominet.uk; i=@nominet.uk; q=dns/txt; s=nominetuk.dkim.nominet.selector; t=1563960608; x=1595496608; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=XO+OgLaS1lva01hR+B8XLbSg+aSiiR6YApl62USZJkU=; b=B4GC/YYxYKI1sr4N09KQJjj+RGrzQGE7bX0EgeACU1qoSjLs8WhHqWTG QNPgMbA977xD9t2Gwfrxe0NfeH4BpDk1W2EcjFO1oF66/nQAmFGf1wyBc oMHcj4iS8oofFAWQDPZ9/gB8qRRqWQY7v5u18vEDhn81V6QsdqMAMzMJI NGgJji3Xwe1TkIcE3AWf7PrTbRmLJ6RH2KXv7Hew3U4KubDQv9jbT9q/T F5Am3CyXIgkmTSSjIbKx9isALzYPp; IronPort-SDR: UecRvZlZKQbPFljdivZx+cSwNYyuqSgpl+IIUaJN7xO6nMzie5l4cc8kAx8zbZR9Fkan8Qiurb LskGmSkQSo80hABBXs2huxU1mcOeuktnv70Ti/cM1DVyeQjNLogvfbvVbyXaeFrHNXssnDXfOb c095mthQvHV9ZFNXnXh5XuAB2iize8TP0qAeuIty+hgwhdu4B/lBC0uNATcyXAqABrNBBLH4dX d1y9gJZv/DXnRqqD5edB3Op6cSShJgaH3ydDPZPHjlCjpub3tbQWL52j0Gd4NCxhoO/2Kf2vUY SKA= IronPort-PHdr: =?us-ascii?q?9a23=3AeVdI3hd0X84eAs/JPhyZoCsulGMj4e+mNxMJ6p?= =?us-ascii?q?chl7NFe7ii+JKnJkHE+PFxlwGVD57D5adCjOzb++D7VGoM7IzJkUhKcYcEFn?= =?us-ascii?q?pnwd4TgxRmBceEDUPhK/u/ZTY3ANgEX1Z/5Vm9Nk1UHsviIUDR8TW/?= X-IPAS-Result: =?us-ascii?q?A2A8AQDEIzhdhzUJL2hmHAEBAQQBAQcEAQGBZ4FEUIFiA?= =?us-ascii?q?wQLKgqEE4NHA4UxiE+CW4NkhXCQTgNUCQEBAQEBAQEBAQcBLQIBAYRAAheCY?= =?us-ascii?q?jgTAQMBAQEEAQEBAQUBFAEBAQgNCQgphSUMhUoBAQEBAgESEREMAQE3AQsEA?= =?us-ascii?q?gEIEQMBAgECAiYCAgIfERUICAIEAQ0FIoMAgWsDDg8BAgGhRgKBOIhfAQFwg?= =?us-ascii?q?TKCeQEBBYJHgkENC1SBPwmBDCiNNj+BEScME4JMPoIahTUygiaOeJsyQAcCg?= =?us-ascii?q?htdBI83hBKYCo03iT6OFAIEAgQFAg4BAQWBZ4F5Mxo0aQGCQYJCDA4Jg06KU?= =?us-ascii?q?0ExgSmLUQGBIAEB?= Received: from mail-ve1eur03lp2053.outbound.protection.outlook.com (HELO EUR03-VE1-obe.outbound.protection.outlook.com) ([104.47.9.53]) by mx1.nominet.org.uk with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Jul 2019 10:30:06 +0100 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=KfGcFSSqMFH5Y7rEPdRTdxU8RMy/FSEwpW1f5mPZs/7sFJj3C9GtCPJXyVJ0BBRjGPkokLVFW4GhjNNpolFRZecpLiZgF8rXJ8xKbPa00fw7Dsd2Gbik60PjVEskhxsDbO2cgXvl91vq72cD5ilD992+22OaZGa9QmdDqVRnBbSPWEACu1IlSza4xVO8x1w8CYghhYUyMKnigIHDfJl3c6zR7EBoUql/nQbc7T8E1FAnP6tQlMVvao2FG7SlwBtq9ZasZAMJVMrIyFsHlvd5pkc082c+edxRNK2wmNcKXPIjgHblDnN6oe/sWO8BGC8q2S5kyZxQqbNmptLRREIwMw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XO+OgLaS1lva01hR+B8XLbSg+aSiiR6YApl62USZJkU=; b=E5UYGY+nkBvR12MZCNaMkYyBNDkKLzIPm6fEIgvpE/VzxO0NpyhMKwbSPMDxXplNNdRqjSGg6oRV9wl2RqXyd1X0bEXMy2jPRvIxQB65cccdcVeTGBXc5pBmSlHk+6QuFpwKmvP53mBMrW4jWuIc3z9L0In5/GE8bSNdNX1KjFRj2kjhwmkfCqhfnhLCCWe8I7Z97YhR0gf2NQoq2Mf3/j11B6pr8BYK0Smd615ka3ZnL1CNqOZPEHHs8+8IoNJxzDiPiFeBmc5TR4dSuNtbhLR8MJqfjQy6ooADbnScCLPyehogkHXH77nLkAP8PQ8weYHsiluuQxyGsolyI5Gtcg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=nominet.uk;dmarc=pass action=none header.from=nominet.uk;dkim=pass header.d=nominet.uk;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NominetUK.onmicrosoft.com; s=selector1-NominetUK-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XO+OgLaS1lva01hR+B8XLbSg+aSiiR6YApl62USZJkU=; b=j326zUgJaIAkD5gUTmkSSTi9leXfz1ZDlPN5MmmV1va02qiZrb4yiZRMpSH7+vqCUfLbkWBm/NjBhTl3VvSRqXpgIZY93rH+xb73pM8MdxfE4CCGSWofTLzW7iFuP76aRkSxUdtoazVt4tEtOr//brR9iZe4tS71KT6tfbjlp0g= Received: from DB3PR0502MB4025.eurprd05.prod.outlook.com (52.134.68.25) by DB3PR0502MB3964.eurprd05.prod.outlook.com (52.134.65.161) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.16; Wed, 24 Jul 2019 09:30:03 +0000 Received: from DB3PR0502MB4025.eurprd05.prod.outlook.com ([fe80::158f:930f:c256:7020]) by DB3PR0502MB4025.eurprd05.prod.outlook.com ([fe80::158f:930f:c256:7020%4]) with mapi id 15.20.2094.013; Wed, 24 Jul 2019 09:30:03 +0000 From: Brett Carr To: Jim Reid , Rob Sayre CC: "add@ietf.org" Thread-Topic: [Add] meeting hum: should the IETF take up this work? Thread-Index: AQHVQaOJfPKzx1JAx0uOoPyguUdhM6bYx7wAgAABXACAAAQtgIAAxPQA Date: Wed, 24 Jul 2019 09:30:03 +0000 Message-ID: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> In-Reply-To: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> Accept-Language: en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=brett.carr@nominet.uk; x-originating-ip: [213.248.246.165] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 4a86b322-5941-4baa-2bc0-08d7101981b4 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DB3PR0502MB3964; x-ms-traffictypediagnostic: DB3PR0502MB3964: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 0108A997B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(136003)(346002)(39850400004)(376002)(366004)(13464003)(199004)(189003)(66446008)(14454004)(53546011)(25786009)(6506007)(66066001)(99286004)(76176011)(256004)(91956017)(6486002)(76116006)(11346002)(446003)(4326008)(64756008)(2616005)(8936002)(2906002)(53936002)(44832011)(486006)(33656002)(66946007)(476003)(81156014)(26005)(66556008)(66476007)(229853002)(102836004)(81166006)(71190400001)(3846002)(305945005)(6246003)(71200400001)(86362001)(7736002)(36756003)(110136005)(186003)(8676002)(5660300002)(6116002)(478600001)(6512007)(68736007)(6436002)(316002); DIR:OUT; SFP:1102; SCL:1; SRVR:DB3PR0502MB3964; H:DB3PR0502MB4025.eurprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: nominet.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 8vbUJFPpCt7LtrKuPqgOQ8Z4xbb/jl0oQ/jIqe6AbT3xbnDOPTtk6RWOEjNJIITGQ+gzI8l8dc6+YBU+n0FRrijS/oaUtendBVpPXoDmEBp0TXmsFni6oKke1UR/HCN2GbhDxhnJbAvCSvRG3oCaH9fCPHQ1BdPfxmuImeXWj9UhJOkUjEE8eIUjUid0RnW96Qa6R1sCJRk1uC9QMOx85EhpACH3euAoQWQd6S65/ka+BDOZ/G+bmJCSwWmm8jgavDtDgNZEm6I6JNF0Z9QbjuzdzC7lhnJaax5+tF7vXcEeCDEqlMuLfybnHrX5f4YDJrWFKYGj/De2XWcE6DZO1s5KGUxz/beJOdb54xE1Uf1D/OZTWP0MawSKa67yuFI0PMxMSeSQAyYEyE2USEBOnh69RKcFFPDAnxHJp4biTP8= Content-Type: text/plain; charset="utf-8" Content-ID: <993C89288357CF418C125108BC6ACF8E@eurprd05.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: nominet.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 4a86b322-5941-4baa-2bc0-08d7101981b4 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2019 09:30:03.0291 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 797b4183-8c85-46bd-ba6d-6371cfdf5059 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: brett.carr@nominet.uk X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB3PR0502MB3964 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 09:30:10 -0000 DQrvu78tLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogQWRkIDxhZGQtYm91bmNlc0Bp ZXRmLm9yZz4gb24gYmVoYWxmIG9mIEppbSBSZWlkIDxqaW1AcmZjMTAzNS5jb20+DQpEYXRlOiBU dWVzZGF5LCAyMyBKdWx5IDIwMTkgYXQgMjM6NDUNClRvOiBSb2IgU2F5cmUgPHNheXJlckBnbWFp bC5jb20+DQpDYzogImFkZEBpZXRmLm9yZyIgPGFkZEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBb QWRkXSBtZWV0aW5nIGh1bTogc2hvdWxkIHRoZSBJRVRGIHRha2UgdXAgdGhpcyB3b3JrPw0KDQog ICAgDQogICAgDQogICAgPiBPbiAyMyBKdWwgMjAxOSwgYXQgMjM6MzAsIFJvYiBTYXlyZSA8c2F5 cmVyQGdtYWlsLmNvbT4gd3JvdGU6DQogICAgPiANCiAgICA+IElmIGFkb3B0aW9uIG9mIERvSCBp cyBoYXJtZnVsIGFsb25nIHRoZSBsaW5lcyB5b3UgZGVzY3JpYmUsIGl0IHdvbid0IHN1Y2NlZWQu IEkgZG9uJ3QgdGhpbmsgdGhlIElFVEYgaGFzIGEgcm9sZSBpbiBkZWNpZGluZyB0aGF0IHByZWVt cHRpdmVseSwgdGhvdWdoLg0KICAgIA0KICA+ICBZb3UncmUgYmFkbHksIGJhZGx5IG1pc3Rha2Vu LiBBRkFJQ1Qgbm9ib2R5IGlzIHNheWluZyBEb0ggYWRvcHRpb24gaXMgaGFybWZ1bC4gSSdtIGNl cnRhaW5seSBub3Qgc2F5aW5nIHRoYXQuIElzIERvSCBkZXBsb3ltZW50IGRpc3J1cHRpdmU/IC0g eWVzLiBIYXJtZnVsPyAtIG5vLiBEb2VzIGl0IGhhdmUgaW1wYWN0IG9uIGV4aXN0aW5nIG5ldHdv cmtzIGFuZCBJVCBpbmZyYXN0cnVjdHVyZT8gWWVzLg0KICAgIA0KICA+ICBJIGhvcGUgdGhlIElF VEYgaXMgd2lsbGluZyB0byBkb2N1bWVudCB0aGVzZSBpbXBhY3RzLg0KICAgIA0KICA+ICBBbmQg RldJVyB0aGUgc3VjY2VzcyBvZiBEb0ggZGVwbG95bWVudCAtLSBmb3Igc29tZSBkZWZpbml0aW9u IG9mIHN1Y2Nlc3MgLS0gc2VlbXMgdG8gcmVzdCBzb2xlbHkgaW4gdGhlIGhhbmRzIG9mIGEgdmVy eSBzbWFsbCBudW1iZXIgb2YgZG9taW5hbnQgcGxheWVycy4gVGhhdCdzIHVuaGVhbHRoeS4gWU1N Vi4NCiAgICANCkkgY29tcGxldGVseSBhZ3JlZSB3aXRoIEppbXMgcG9zaXRpb24gaGVyZS4gRE9I L0RPVCBhcmUgaGVyZSB0byBzdGF5IGFuZCBnb29kIHRoaW5ncyBidXQgdGhleSBhcmUgZGlzcnVw dGl2ZSBhbmQgaGVuY2UgSSB0aGluayBvcGVyYXRvcnMgd291bGQgYmVuZWZpdCBmcm9tIHNvbWUg Z3VpZGFuY2UgZnJvbSB0aGUgSUVURi4NCg0KSSB3b3VsZCBsaWtlIHRvIHNlZSBsb3RzIG9mIG9w ZXJhdG9ycyBydW5uaW5nIERPSC9ET1QgaW4gYW4gaW50ZXJvcGVyYWJsZSBzdGFuZGFyZCB3YXkg YW5kIG5vdCBsZWF2ZSBpdCB0byBhIGZldyBsYXJnZSBvcmdhbmlzYXRpb25zLg0KDQpCcmV0dA0K DQoNCi0tDQpCcmV0dCBDYXJyDQpNYW5hZ2VyIEROUyBhbmQgTmV0d29yayBFbmdpbmVlcmluZw0K Tm9taW5ldCBVSw0KDQoNCiANCg0K From nobody Wed Jul 24 03:10:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4442C1200D7 for ; Wed, 24 Jul 2019 03:10:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h1vEUYNE6FW0 for ; Wed, 24 Jul 2019 03:10:16 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.66.41]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 069D112002F for ; Wed, 24 Jul 2019 03:10:16 -0700 (PDT) Received: from opfedar07.francetelecom.fr (unknown [xx.xx.xx.9]) by opfedar24.francetelecom.fr (ESMTP service) with ESMTP id 45trgp186fz5w3C; Wed, 24 Jul 2019 12:10:14 +0200 (CEST) Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.67]) by opfedar07.francetelecom.fr (ESMTP service) with ESMTP id 45trgn6v8dz5vPG; Wed, 24 Jul 2019 12:10:13 +0200 (CEST) Received: from OPEXCAUBMA1.corporate.adroot.infra.ftgroup ([fe80::f04d:ad3c:61de:a175]) by OPEXCAUBM43.corporate.adroot.infra.ftgroup ([::1]) with mapi id 14.03.0439.000; Wed, 24 Jul 2019 12:10:13 +0200 From: To: Rob Sayre CC: "andrew.fidler@bt.com" , "chris.box@bt.com" , "add@ietf.org" Thread-Topic: [Add] Thoughts on a DoH (and DoT) BCP? Thread-Index: AdUx1uEEFvBhHUWqSHedXSRbiDMGggQJZbkQ///hroCAAAWkAP//2hjg Date: Wed, 24 Jul 2019 10:10:13 +0000 Message-ID: <332_1563963014_5D382E85_332_316_1_B5939C6860701C49AA39C5DA5189448B939E95E1@OPEXCAUBMA1.corporate.adroot.infra.ftgroup> References: <30950_1563958271_5D381BFF_30950_9_1_B5939C6860701C49AA39C5DA5189448B939E9268@OPEXCAUBMA1.corporate.adroot.infra.ftgroup> In-Reply-To: Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.247] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 10:10:18 -0000 Um9iLCANCg0KVGhhbmtzIGZvciB0aGlzLiBJ4oCZbSBhIGJpdCBoZXNpdGFudCB0byBkcmF3IHRo aXMgdG8gd2hhdCBzZWVtcyB0byBiZSBzb21ld2hhdCBvZmYtdG9waWMsIGJ1dCBvbmx5IG9uIHRo ZSBwb2ludCBvZiB0ZXJtaW5vbG9neSBhbmQgSSdsbCBzdG9wOiB0aGUgaXNzdWVzIGRpc2N1c3Nl ZCBpbiBDaHJpc+KAmXMgcHJlc2VudGF0aW9uIHllc3RlcmRheSBkb27igJl0IHNlZW0gdG8gYmUg cG9saWN5LXJlbGF0ZWQgdG8gbWUsIHRoZXnigJlyZSBvcGVyYXRpb25hbCwgYXQgbGVhc3QgZnJv bSBhbiBJU1DigJlzIHBlcnNwZWN0aXZlLiANCg0KT25lIGV4YW1wbGUgb2Ygd2hhdCBpcyDigJxw b2xpY3nigJ0gaG93ZXZlciwgaXMgd2hhdCB3YXMgcmVmZXJyZWQgdG8gYXMg4oCcSG9ub3VyaW5n IHRoZSBJQU5BIHJvb3Qgb24gdGhlIHB1YmxpYyBJbnRlcm5ldOKAnSBpbiBKaW3igJlzIHByZXNl bnRhdGlvbiBvbiDigJxEb0ggQ2xpZW50ICYgU2VydmVyIEJlaGF2aW91cuKAnSwgYnV0IEnigJlk IHN1cnByaXNlZCBhbnlvbmUgb2YgdGhvc2UgeW91IGxpc3RlZCB3b3VsZCBjb25zaWRlciB0aGUg SVRVIHRvIGJlIHRoZSBhcHByb3ByaWF0ZSByZW1pdCBmb3IgdGhpcy4gSSB3b3VsZG7igJl0LiAN Cg0KUmVnYXJkcywNClBoaWxpcHBlIA0KDQpGcm9tOiBSb2IgU2F5cmUgW21haWx0bzpzYXlyZXJA Z21haWwuY29tXSANClNlbnQ6IFdlZG5lc2RheSwgSnVseSAyNCwgMjAxOSAxMToxOSBBTQ0KVG86 IEZPVVFVQVJUIFBoaWxpcHBlIFRHSS9PTE4NCkNjOiBhbmRyZXcuZmlkbGVyQGJ0LmNvbTsgY2hy aXMuYm94QGJ0LmNvbTsgYWRkQGlldGYub3JnDQpTdWJqZWN0OiBSZTogW0FkZF0gVGhvdWdodHMg b24gYSBEb0ggKGFuZCBEb1QpIEJDUD8NCg0KDQoNCk9uIFdlZCwgSnVsIDI0LCAyMDE5IGF0IDE6 NTkgQU0gUm9iIFNheXJlIDxzYXlyZXJAZ21haWwuY29tPiB3cm90ZToNCk9uIFdlZCwgSnVsIDI0 LCAyMDE5IGF0IDE6NTEgQU0gPHBoaWxpcHBlLmZvdXF1YXJ0QG9yYW5nZS5jb20+IHdyb3RlOg0K wqBJIHNoYXJlIHRoZSBjb25jZXJucyBleHByZXNzZWQgYXQgdGhlIG1pYyBieSBCYXJiYXJhIGFu ZCBvdGhlcnMgcmVnYXJkaW5nIHRoZSBvcGVyYXRpb25hbCBpc3N1ZXMgcmVsYXRlZCB0byB0aGlz LiANCg0KRXZlcnlvbmUncyBjb25jZXJucyBzaG91bGQgYmUgY29uc2lkZXJlZC4gQnV0IHRoYXQg ZG9lc24ndCBtYWtlIHRoZSBJRVRGIHRoZSBJVFUuDQoNCsKgTW9yZSBjb25zdHJ1Y3RpdmVseSwg bWF5YmUgdGhlIElUVSBpcyB0aGUgcGVyZmVjdCBwbGFjZSBmb3IgdGhlc2UgZGlzY3Vzc2lvbnMh DQoNClRoZSBmb2xrcyBmcm9tIEJULCBBVCZULCBPcmFuZ2UsIGV0YyBjYW4gYWxsIGRpc2N1c3Mg dGhlaXIgcG9saWNpZXMgaW4gc29tZSBvdGhlciB2ZW51ZSwgYW5kIEkgdGhpbmsgdGhhdCB3b3Vs ZCBiZSBncmVhdC4NCg0KdGhhbmtzLA0KUm9iDQrCoA0KCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNlIG1lc3NhZ2UgZXQg c2VzIHBpZWNlcyBqb2ludGVzIHBldXZlbnQgY29udGVuaXIgZGVzIGluZm9ybWF0aW9ucyBjb25m aWRlbnRpZWxsZXMgb3UgcHJpdmlsZWdpZWVzIGV0IG5lIGRvaXZlbnQgZG9uYwpwYXMgZXRyZSBk aWZmdXNlcywgZXhwbG9pdGVzIG91IGNvcGllcyBzYW5zIGF1dG9yaXNhdGlvbi4gU2kgdm91cyBh dmV6IHJlY3UgY2UgbWVzc2FnZSBwYXIgZXJyZXVyLCB2ZXVpbGxleiBsZSBzaWduYWxlcgphIGwn ZXhwZWRpdGV1ciBldCBsZSBkZXRydWlyZSBhaW5zaSBxdWUgbGVzIHBpZWNlcyBqb2ludGVzLiBM ZXMgbWVzc2FnZXMgZWxlY3Ryb25pcXVlcyBldGFudCBzdXNjZXB0aWJsZXMgZCdhbHRlcmF0aW9u LApPcmFuZ2UgZGVjbGluZSB0b3V0ZSByZXNwb25zYWJpbGl0ZSBzaSBjZSBtZXNzYWdlIGEgZXRl IGFsdGVyZSwgZGVmb3JtZSBvdSBmYWxzaWZpZS4gTWVyY2kuCgpUaGlzIG1lc3NhZ2UgYW5kIGl0 cyBhdHRhY2htZW50cyBtYXkgY29udGFpbiBjb25maWRlbnRpYWwgb3IgcHJpdmlsZWdlZCBpbmZv cm1hdGlvbiB0aGF0IG1heSBiZSBwcm90ZWN0ZWQgYnkgbGF3Owp0aGV5IHNob3VsZCBub3QgYmUg ZGlzdHJpYnV0ZWQsIHVzZWQgb3IgY29waWVkIHdpdGhvdXQgYXV0aG9yaXNhdGlvbi4KSWYgeW91 IGhhdmUgcmVjZWl2ZWQgdGhpcyBlbWFpbCBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2Vu ZGVyIGFuZCBkZWxldGUgdGhpcyBtZXNzYWdlIGFuZCBpdHMgYXR0YWNobWVudHMuCkFzIGVtYWls cyBtYXkgYmUgYWx0ZXJlZCwgT3JhbmdlIGlzIG5vdCBsaWFibGUgZm9yIG1lc3NhZ2VzIHRoYXQg aGF2ZSBiZWVuIG1vZGlmaWVkLCBjaGFuZ2VkIG9yIGZhbHNpZmllZC4KVGhhbmsgeW91LgoK From nobody Wed Jul 24 03:13:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FE8E12013E for ; Wed, 24 Jul 2019 03:13:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gxCa0M2ZFCfO for ; Wed, 24 Jul 2019 03:13:06 -0700 (PDT) Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E4B82120137 for ; Wed, 24 Jul 2019 03:13:05 -0700 (PDT) Received: by mail-qk1-x72f.google.com with SMTP id r21so33352426qke.2 for ; Wed, 24 Jul 2019 03:13:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=IaNnXk1Ckr/+vNPXiQcbCyFimzE0Ei9xt89MSBAVF3U=; b=TCLXSIWs4Ba7s4bo9EMezoKVgThTDP3xWNcce0uuDPoUSAhVNfEV9yNTGBvt4BTCnb Amfhvp7d3I8D5DXg16nzTkxMVNiti0SNj0R0S01FfAxlbesseSMe2CoWAjyk+/Xak0WQ VRN6gxaiiydewyHzGVmDX/4U9bpi1ryzqqDclyVCCP6iSt5V+OK7LfnJpi4ROLT4AKMC Yf617v9254/8GCMfcD93qYg8sfvjdnQje5S3ottWJ6EvQjCR4ShWMWojKcAxZ57vtvoM RQX0ZfdQyCg/SFTpp3aFM630DUniTtKlLdQJrfc8vNiGNkc1HHDVDvhpwbHKf6Aktcfk VXoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=IaNnXk1Ckr/+vNPXiQcbCyFimzE0Ei9xt89MSBAVF3U=; b=aiAOyt46bGQ+WCYrRcq9NBgIA7NdRQKPSlgn1op5+BOapCqkLtp6NRL2TFsZtsPsI1 oPET0sEfC+SyMEyDtfBNqAbPNxsl5VDfoYdKpO/JQ97lgKFfISkTe/VxiBSGOP4P2Ccj L6Dy5dmAGReCEtwN2kfz/07c6bUQ1j7PWSyqiysBWjEoFyUqgyRKYnh9a1Bc6bW6RNGL Z7WfD16EJ+K7GWzntU7MPfWJE+Sder51EUOoZeoSszcZFXym7PgyxsIESxtnGu67uQht 6jX1FdCopCcxFbyjY80TrWKAlCGXRoYLQ7PSuS181qmIY6jwDAwQ95nGGFR962BpA9iK EF2A== X-Gm-Message-State: APjAAAWq17Fs3CGU5MIIjMgPaGrtQDAO8ZAt+4HRoOO8aJvaPEQbl+pO MAaKq52w8sTfzXgLjzlCxE6bSJV9toY6Tw== X-Google-Smtp-Source: APXvYqzVH3jG/JWxOg/E22Lo+ao0fpt1tHOgmLUPdWY5dL4HHuNhweAlQe2EnFOKN2TJacTnnsOlEw== X-Received: by 2002:a37:a80d:: with SMTP id r13mr46114679qke.209.1563963184797; Wed, 24 Jul 2019 03:13:04 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:10f0:5c18:b29:4401? ([2001:67c:1232:144:10f0:5c18:b29:4401]) by smtp.gmail.com with ESMTPSA id r26sm19824802qkm.57.2019.07.24.03.13.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 03:13:04 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: <06B41162-5936-4BF7-A9D6-3D864BB93ED2@gmail.com> Date: Wed, 24 Jul 2019 06:13:03 -0400 Cc: Arnaud Taddei , "add@ietf.org" , Barry Leiba Content-Transfer-Encoding: quoted-printable Message-Id: References: <06B41162-5936-4BF7-A9D6-3D864BB93ED2@gmail.com> To: Bret Jordan Archived-At: Subject: Re: [Add] Followup from ADD session today X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 10:13:08 -0000 On Jul 23, 2019, at 10:14 PM, Bret Jordan wrote: > Imaging an app being installed on a device that allows a user to browse th= e web. It has a hard coded DoH server that it wants to use, that points to t= he DoH server of its choice. The app can add as many other headers it wants= to ensure that it can fully track that user and application, no matter wher= e they are. So no matter where that client is, you will always be able to h= ave a perfect telemetry of everything they have done and when they do it.=20= Do you know of a way to detect such a client and prevent it from behaving in= this way?= From nobody Wed Jul 24 03:17:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE7FA1200DE for ; Wed, 24 Jul 2019 03:17:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WDxh3AxpLkph for ; Wed, 24 Jul 2019 03:17:07 -0700 (PDT) Received: from emh04.mail.saunalahti.fi (emh04.mail.saunalahti.fi [62.142.5.110]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E7B512002F for ; Wed, 24 Jul 2019 03:17:07 -0700 (PDT) Received: from eggert.org (unknown [62.248.255.8]) by emh04.mail.saunalahti.fi (Postfix) with ESMTP id C0F3230084; Wed, 24 Jul 2019 13:17:04 +0300 (EEST) Received: from [172.20.4.41] (unknown [72.138.80.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by eggert.org (Postfix) with ESMTPSA id 5032164C90C; Wed, 24 Jul 2019 13:16:58 +0300 (EEST) From: Lars Eggert Message-Id: <093DF50A-009F-404F-BE6C-01C4D0E6E36E@eggert.org> Content-Type: multipart/signed; boundary="Apple-Mail=_F3E250ED-751F-418B-B882-C85673ACC364"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 24 Jul 2019 06:16:55 -0400 In-Reply-To: Cc: "add@ietf.org" , Barry Leiba To: "Arnaud.Taddei.IETF" References: X-MailScanner-ID: 5032164C90C.A3C39 X-MailScanner: Found to be clean X-MailScanner-From: lars@eggert.org Archived-At: Subject: [Add] on being cut from the mic (Re: Followup from ADD session today) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 10:17:09 -0000 --Apple-Mail=_F3E250ED-751F-418B-B882-C85673ACC364 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Arnaud, On 2019-7-23, at 21:38, Arnaud.Taddei.IETF = wrote: > As a matter of fact today I was cut on the mic and yet after me, Barry = had the chance to speak and then another person had the chance to speak = so it gives me the continued appearance that it is difficult to work in = the IETF. as I started to explain when you complained to me after the session and = then walked away, I had closed the lines long before you got up to = queue. Barry is the AD sponsoring the BOF. It's his show. Of course he gets to = speak, he is expected to figure out what to take forward out of the BOF, = and in which shape. If he wants to make a statement or ask the room a = question, that's his prerogative. Lucy got up to queue after Barry, and I asked Barry if he wanted to = grant Lucy a minute after he was done. He seemed to indicate to me that = he wanted to do this, which is why Lucy got to speak. Lars --Apple-Mail=_F3E250ED-751F-418B-B882-C85673ACC364 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEDrrUO3PMwKM8fddaHbmKvSnuNPgFAl04MBcACgkQHbmKvSnu NPhvChAAtK8P/rn1UnJ8Bf6Ja1V43YsLw3wj0tpw6zyzWsGDIChgyTGYf3QQAzaf pBvonFi+/zvqs1ALXEucQ5+DevGGfSRNhpCZv0W8hhndY7aEppbvbgM5r07LhsZ+ +zq527FhLLMkGu0W7DONN0Rxe0S8YZuz6MoTd7Xjc8m3wvOLTi2doZtOWjb/89Yx 4bgdYSR/rStcCci3B7Mne0gFXvF6vgc2aV6cilsM67RSzlPj9bH1YrubI0Bin5dH HaDPDIK72ZGmOJtaVwro4au0JhWzsh6j1gd3xXSM3Uc+XbQ28/nAiQgw2oTHWXmA ffIg+gwexAECyJA7PmuUgVmcLCeAnupcXI4LqyzJ5nmq9T9FcE803KKgQN39Qsxm FhYKYgnHXPzIk9eAPALtXKE5Y5rkY9MASbdmAZAMVLAFmie7P57CV3UBYsh3jCAW 8NxJiUyl7qpV87LONNVb0226dBENJeo20TIuCpJec6iViEeP1s/AOnmM3KPh5VmY gp1kSnPhjPJI6nJjS0UAn6NYtjAzPWfSjucB+aQFrEhPMklOstasaz6263ad1/kT pJgE1Nh4unGshNInk2stGueX/n9xnj6JiyBWq/8m+4dB49hCSWrriTI7Gx3qX6vq vTnUlv3/eJBSTaUN18loXE/CZrbJsT9Pfd1NLyxJqgNzIpBdCBA= =olt9 -----END PGP SIGNATURE----- --Apple-Mail=_F3E250ED-751F-418B-B882-C85673ACC364-- From nobody Wed Jul 24 03:19:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ACACA12013E for ; Wed, 24 Jul 2019 03:19:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cdt.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mmKhppswwJ7n for ; Wed, 24 Jul 2019 03:19:20 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9284E120139 for ; Wed, 24 Jul 2019 03:19:20 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id e20so58044821iob.9 for ; Wed, 24 Jul 2019 03:19:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cdt.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5k66BQr+2qUf93hsZrmWsW7VO0mpCv1aymTRqFLmzME=; b=d3UK+TcVSe1ximzPghyoeP/PWSZB2pEp40gobyY8+660eHZjPaaRBbIgO9B20StSAo LZU+9jIvsQDHfGOFNxu1vif+Cq4VGGOu6hQ8oZ0MOs6LUo1pYe+P09r0BWIpQ3suIWK6 0u8zX2dW80qr5N3uoMOAamcg05PuomWQE4UTg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5k66BQr+2qUf93hsZrmWsW7VO0mpCv1aymTRqFLmzME=; b=mYOaQ5qhO9sUopX1LRTfBuB/7EDLRbF3M4HPy7L72Og5x30c497Ma29J190I6v5mE2 b+mCz2n7o9KA2Ipg85ZEkHEzG7J74BjMEntazMce9tDDuozUdBF5eA3mUfg0iD4FfLFV drZTHb5GuvArxMJK8LmvC1RQYqEKIC1o+r/ODYjjaMxbLyLb/E6fL5XLVm01PSDYjuWM gJGTYfBOb+8j7DLJtlHNWcjefA6kuoLKeFmBkdq21rv1Unuv0+3q92sSyTbJRlSvKG+6 zPVMUyXfxZYBnZxkfKz53YeDCH7E9ewrJ74dL0jhnfJdOXNvn3OMqz8cBa5/JHC6/gZT eh2Q== X-Gm-Message-State: APjAAAXWvBvIsmSLiSq9qsM7xGjm+n99MmnKnbSAJadftz8d71QAc2eY RGPIXqhKY7GdEk9Zreig+Bb1DLBaQRQEoNr54WvIXA== X-Google-Smtp-Source: APXvYqw0USw8LpJvq0K4oGwH4SwvRm9Th7kVXhrcjiz7LJxpehUuC2OdUYM/Q3hHBAkZMJDZxWK5llg8fM+rMlbbCP8= X-Received: by 2002:a6b:dc08:: with SMTP id s8mr29717168ioc.209.1563963559670; Wed, 24 Jul 2019 03:19:19 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> In-Reply-To: From: Joseph Lorenzo Hall Date: Wed, 24 Jul 2019 06:19:09 -0400 Message-ID: To: Tommy Jensen Cc: Bret Jordan , Jim Reid , Rob Sayre , "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000006a8fe8058e6aa4d4" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 10:19:23 -0000 --0000000000006a8fe8058e6aa4d4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 23, 2019 at 22:26 Tommy Jensen wrote: > > Are people selling DNS logs to ad tech companies? Is that the ecosystem > being disrupted? > > Given how many valid points have been brought up in the last few weeks > about the drawbacks of centralized app-configured DNS, I don=E2=80=99t th= ink the > glib tone is constructive. > Tone aside, to some users, centralization is a benefit in that they don't have a bunch of unknown privacy policies applying to the resolution of the names they need. For example, the privacy policy of 1.1.1.1 is pretty amazing from the perspective of data retention, secondary uses, etc. (e.g., I know my resolutions will be removed from their logs within 24 hours). This may seem small but it seems to be lost in the centralization/choice discussion. > -- Joseph Lorenzo Hall Chief Technologist, Center for Democracy & Technology [https://www.cdt.org] 1401 K ST NW STE 200, Washington DC 20005-3497 e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 --0000000000006a8fe8058e6aa4d4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Tue, Jul 23, 2019 at 22:26 Tommy Jensen <Jensen.Thoma= s=3D40microsoft.com@dmarc= .ietf.org> wrote:
> Are people selling DNS logs to ad tech companies? Is that the ecosyste= m being disrupted?

Given how many valid points have been brought up in the last few weeks abou= t the drawbacks of centralized app-configured DNS, I don=E2=80=99t think th= e glib tone is constructive.

=
Tone aside, to some users, centralization is a benefit in= that they don't have a bunch of unknown privacy policies applying to t= he resolution of the names they need. For example, the privacy policy of 1.= 1.1.1 is pretty amazing from the perspective of data retention, secondary u= ses, etc. (e.g., I know my resolutions will be removed from their logs with= in 24 hours).

This may s= eem small but it seems to be lost in the centralization/choice discussion.<= /div>
-- =
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy &= ; Technology [https://www.cdt.org]
1= 401 K ST NW STE 200, Washington DC 20005-3497
e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B= 9F6D DBD3 4B10=C2=A0 1607 5F86 6987 40A9 A871
--0000000000006a8fe8058e6aa4d4-- From nobody Wed Jul 24 03:24:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2348120142 for ; Wed, 24 Jul 2019 03:24:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f6PNizchro8B for ; Wed, 24 Jul 2019 03:24:45 -0700 (PDT) Received: from emh04.mail.saunalahti.fi (emh04.mail.saunalahti.fi [62.142.5.110]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83BF61200D7 for ; Wed, 24 Jul 2019 03:24:45 -0700 (PDT) Received: from eggert.org (unknown [62.248.255.8]) by emh04.mail.saunalahti.fi (Postfix) with ESMTP id 20D2A3000E; Wed, 24 Jul 2019 13:24:43 +0300 (EEST) Received: from [172.20.4.41] (unknown [72.138.80.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by eggert.org (Postfix) with ESMTPSA id 27FB864DE90; Wed, 24 Jul 2019 13:24:37 +0300 (EEST) From: Lars Eggert Message-Id: <6DEE1859-6F28-414D-A746-191CB4501695@eggert.org> Content-Type: multipart/signed; boundary="Apple-Mail=_716A218C-62C3-48FD-9717-DE8266CD995A"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 24 Jul 2019 06:24:35 -0400 In-Reply-To: Cc: philippe.fouquart@orange.com, "andrew.fidler@bt.com" , "chris.box@bt.com" , "add@ietf.org" To: Rob Sayre References: <30950_1563958271_5D381BFF_30950_9_1_B5939C6860701C49AA39C5DA5189448B939E9268@OPEXCAUBMA1.corporate.adroot.infra.ftgroup> X-MailScanner-ID: 27FB864DE90.A61E1 X-MailScanner: Found to be clean X-MailScanner-From: lars@eggert.org Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 10:24:47 -0000 --Apple-Mail=_716A218C-62C3-48FD-9717-DE8266CD995A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Rob, On 2019-7-24, at 5:19, Rob Sayre wrote: > The folks from BT, AT&T, Orange, etc can all discuss their policies in = some other venue, and I think that would be great. please keep the discussion professional. IETF results strongest when they receive the broadest possible input and = review. This is often a difficult and sometimes painful (and long) = process, but in the end, this is what makes our output stronger and more = relevant than that of many other organizations. Lars --Apple-Mail=_716A218C-62C3-48FD-9717-DE8266CD995A Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEDrrUO3PMwKM8fddaHbmKvSnuNPgFAl04MeMACgkQHbmKvSnu NPhbzQ/+Kt5qxY/f+sPZ6Kv46WbaQhU+pEaxcSaEo2eMAEMF8Vfh51qcPRiAa7Ah FoRFYLwSkSaeQda0/2znTyyOjaf9h7AScGe16tOyWMdN2UOMfbIXOznPXfUs/UT8 WgA3zUbctmXHtF+sgdXkNwctfS18UvxCkd06AEBojdrCoL4K6fznIXyJAJIWVrRK dEOAKcDLabe2OaEOB77elHjXv0Tb9WRBOsXfJpfdUPEtfq9Amq4YaCVCjSJW78+9 39Ie5lASFTfv1bejYzUGqigIMvWiunKUkzky6PMe7tnWMkHp5ghNAsgPJquhNgc/ uUccJ066aN+Vv2Qf1HBTiiCXzXaWkkXvutIU9Dt3rZXH8r/MLsi3GHvkPONTqSDI bquqaRvv5cL0N6VY8ioAc+mH2WJAToYrJQCo40fmU9DAtCQBCBCnQ8D33hiQZRCk LL/stJZcQ653X8XNClwtOLc0saLJb7oUgF8c0s+SNxhevtlJ60YS+lAxQLvmmIyk u6CTM7KakgVPBY386v4JrEacmeTdAV8Tr+V/ZPgkYJX/5clEPHskolIwMumr826v nIUL62TsP+p16DI7E/YtjJ1NE1n04k6A3tjt5YM4S2S4Y2su16JUUE8O9aBkTNxb 3OOKYmiSDHAtObGAb2F6FGdpwrpaR0mfpRaHB6R25g3cOLoYaQw= =zUip -----END PGP SIGNATURE----- --Apple-Mail=_716A218C-62C3-48FD-9717-DE8266CD995A-- From nobody Wed Jul 24 03:27:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C5341200D7 for ; Wed, 24 Jul 2019 03:27:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8E-JWDgg_XUV for ; Wed, 24 Jul 2019 03:27:40 -0700 (PDT) Received: from emh06.mail.saunalahti.fi (emh06.mail.saunalahti.fi [62.142.5.116]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1058120151 for ; Wed, 24 Jul 2019 03:27:39 -0700 (PDT) Received: from eggert.org (unknown [62.248.255.8]) by emh06.mail.saunalahti.fi (Postfix) with ESMTP id E9661302D4; Wed, 24 Jul 2019 13:27:37 +0300 (EEST) Received: from [172.20.4.41] (unknown [72.138.80.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by eggert.org (Postfix) with ESMTPSA id B980864DEA6; Wed, 24 Jul 2019 13:27:32 +0300 (EEST) From: Lars Eggert Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_728DB461-71BD-4A8C-A937-437C03200939"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 24 Jul 2019 06:27:30 -0400 In-Reply-To: Cc: Rob Sayre , Jim Reid , "add@ietf.org" , Bret Jordan To: Tommy Jensen References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> X-MailScanner-ID: B980864DEA6.A48D3 X-MailScanner: Found to be clean X-MailScanner-From: lars@eggert.org Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 10:27:42 -0000 --Apple-Mail=_728DB461-71BD-4A8C-A937-437C03200939 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Rob, On 2019-7-23, at 22:57, Tommy Jensen = wrote: > You just sent me an email that said your thoughts were very well = represented by an incoherent email about terrorists and encryption [0]. >=20 > Spare me the tone policing. second reminder to keep the discussion civil. Lars --Apple-Mail=_728DB461-71BD-4A8C-A937-437C03200939 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEDrrUO3PMwKM8fddaHbmKvSnuNPgFAl04MpIACgkQHbmKvSnu NPgDlA//dmGJdC0HkP5iY0+Xc4tKIWbKf9EAQ6K0tOXSZ8KVe6vWPYzSD3mIpcMp 1jkal1OPszbri9Ut4eXvpxF/uadPZpk8odubGBLQzHVSYaj2lHwxiE/8pTcz23xh ZYVuUCquH8S3ZKdomEH8oZ65kwFvEtWzLVG4mOlVD5Kn4wxGVVgymgyqdobb7wFA 2SjsR/mKz99uIllnmSdWCbkmI6Tl6O+MoVADFoXQ8+T7BO7dz+SLj3JVxx/SkeVU xP6RjoVQvm6zMIrsP+Bi7Px9aHVSzF7C/UJsoO3abZSLlsuhTpta/tFYJ+7W6CiY TpnhOcloSEdpfqpoWraXzr033a79n62B/NHCBlwhbWtP/g9h+bPa/BkNaD+YZPsB NpL9J8bKC4TEAhh2cjuLzGQRfdPZYA3CmbPUDLjDx28SLxWk3STRBaiQMJfgYNrW LOj3wnSpqpK1W8gMiqf3ablaZn0DTLB6ULQBkah9IcinmivsMBRCop5Rw9kAljsZ qrF7iYp/D0T55+sPiXg6TPNT+p27hBiksbFaO1I1HWA4V/hfzDBQE6n1Ja4Cw4Z9 lqkg6//aw+YKf3u1d/W3zDLChaxNjIG3R0eTRshmcTpNcRdS81hFZbJlh5Ri0mux 9XRuCUd+EvQ4Zread6zbHLSQVHqA42QRelsw5rZ1zVYAbllPvWE= =qzSh -----END PGP SIGNATURE----- --Apple-Mail=_728DB461-71BD-4A8C-A937-437C03200939-- From nobody Wed Jul 24 03:35:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F61F120151 for ; Wed, 24 Jul 2019 03:35:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FN5Z-Z_0n8VG for ; Wed, 24 Jul 2019 03:35:30 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B4E712014B for ; Wed, 24 Jul 2019 03:35:30 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id i10so88423797iol.13 for ; Wed, 24 Jul 2019 03:35:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=mZGah4l1UzcQgjL/ssDSQE8d9K2oFMzHdq6AJuY49Ts=; b=X8ppu8qR3xcy7XBkPVVSS1HURp70vyNxsnkk51WSXB3RSjYqJsLoTfxOJDbZ/5Cc7T jg5KWri/SYYGhvzT+ZF5dBOlPTyM+AhFS4ZJU7i6iE7TBthffvCbGDzx3EHf+uAvYDQb 00Iz7ydE/SNNbbsQgUtQ/sXHdoOintgV5FPHLDWneYet46r0AMt1in5YU7tzAaO5XxaP LVYkzCJZgtjNzFVBvBdBHPLo5fRFPC3RNfXxDDzycB34ZizUZkffXyZlkOpUYjs+5O6q B1giZR17K2AEAlbHjYFBMAals8YIeamaYCPUo2SFatnC1+9Sx4TpbQcuGDfzse9A5VyJ h48A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=mZGah4l1UzcQgjL/ssDSQE8d9K2oFMzHdq6AJuY49Ts=; b=G4cQaKS2MPhcwIG2aBAoZS+rJhiBcW7D8wvsKzpAcz72oE4H/K/ubahDIDAgk6+Vxp UZXdQrU7uuiK9ke3nfOhfU/thleMd5lBGJzjjuyuaA3eXMY4FI7AiarOCfak/B71pfIY gfgo33zVmrz+jCV+1xegnW76dgmmhMLlHoSUqog4hF2FyGARRgFpb9fNkJ5+TX76IbSr XUwpY6WRJT8Zf666m+g5zrBpFlHOcm7tcRl4ls3gcpKdc3msjHQcE00vZ+c65FouI1rJ EUMIl9J33b5voYpSVEF73JoN/oTNApDuIn/rcT5uC0MMNE8nb4cUkNe/pPfPLxl8CnhD RPlw== X-Gm-Message-State: APjAAAXpoVhuNS9D+EUr089WQWk8mWY2qoYdCPCnVjmlti51wQ8KMNub H9Ljg6h01PbZI1ZXyITyb0VNQn/vZI4sTdll2Jo= X-Google-Smtp-Source: APXvYqxm8rTU+DOkoRNWjX6F4hkpihVXI8kCS1wue0tK+02fsETHNxwa0DQEtdj7c3TO7MzyVuMeYhSBs4lsTbKhoj8= X-Received: by 2002:a05:6602:98:: with SMTP id h24mr12633143iob.49.1563964529535; Wed, 24 Jul 2019 03:35:29 -0700 (PDT) MIME-Version: 1.0 References: <30950_1563958271_5D381BFF_30950_9_1_B5939C6860701C49AA39C5DA5189448B939E9268@OPEXCAUBMA1.corporate.adroot.infra.ftgroup> <6DEE1859-6F28-414D-A746-191CB4501695@eggert.org> In-Reply-To: <6DEE1859-6F28-414D-A746-191CB4501695@eggert.org> From: Rob Sayre Date: Wed, 24 Jul 2019 03:35:17 -0700 Message-ID: To: Lars Eggert Cc: philippe.fouquart@orange.com, "andrew.fidler@bt.com" , "chris.box@bt.com" , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000396e93058e6ade6d" Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 10:35:32 -0000 --000000000000396e93058e6ade6d Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 3:24 AM Lars Eggert wrote: > Rob, > > On 2019-7-24, at 5:19, Rob Sayre wrote: > > The folks from BT, AT&T, Orange, etc can all discuss their policies in > some other venue, and I think that would be great. > > please keep the discussion professional. > Oh, yes, I'm very aware that "operational concerns" are very important. I thought some other venue might be better, though. thanks, Rob --000000000000396e93058e6ade6d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 3:24 AM Lars = Eggert <lars@eggert.org> wrote= :
Rob,

On 2019-7-24, at 5:19, Rob Sayre <sayrer@gmail.com> wrote:
> The folks from BT, AT&T, Orange, etc can all discuss their policie= s in some other venue, and I think that would be great.

please keep the discussion professional.

Oh, yes, I'm very aware that "operational concerns" are ver= y important. I thought some other venue might be better, though.
=
thanks,
Rob=C2=A0
--000000000000396e93058e6ade6d-- From nobody Wed Jul 24 03:40:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3FC8120157 for ; Wed, 24 Jul 2019 03:40:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5CQgsi4OxFJN for ; Wed, 24 Jul 2019 03:40:47 -0700 (PDT) Received: from mail-lf1-x135.google.com (mail-lf1-x135.google.com [IPv6:2a00:1450:4864:20::135]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3457E12014F for ; Wed, 24 Jul 2019 03:40:47 -0700 (PDT) Received: by mail-lf1-x135.google.com with SMTP id b29so24366481lfq.1 for ; Wed, 24 Jul 2019 03:40:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=42DfZTFCQ4Ry6lI2XfdDeLQsjhSYUDFyWfnEFutjfwA=; b=xnoa9UNz5yxAZ2zNwKSxbWN4UN8QBfGMXS1Ow9lRP3TO2UuWD4u3KfYMFYqwtwhRsy Da+G/gpy85F6ZK2UfRvYRu4i3waxYjDkB3L2tJ6kPpmozrQB6qOV1+Y367Bpl6FxH2YP sgARgSJkxGSFar+Rz3967ggHkpxhfitazSKMIS47WDfDDCJHo+81PNuXhFeoVSjV0xs2 GaG304AMHPph3GfqVre3FYzE+aORdiD/gktxfadU3KX6q3MN336iFx7d1CoMXFY6UOCe tKiHISsTEMUOFPXUPny9i2W/DFHmf6ASSjXJ9DYVQTmHCEiKq9uzZnHLItICdBwW5tQ4 TWxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=42DfZTFCQ4Ry6lI2XfdDeLQsjhSYUDFyWfnEFutjfwA=; b=d9VJehddSjLHd41swpPY2gtjfjqaol53BwOjG9/X64X2po9H5gZAtd+GwNB5HWeiEo zBBs59HNjpSMbFhyLMlMieooUB3+GPKC/0pcQe/xgZ9o044i0lct5Nhljlv4lMiOhuCM m5HMoh4SkWi8GWZUGX4n2xJqr+R8VPtTTcWhNzHsUgNrtssHjpRFDEqnnELHK9ykrzeX O5oZIRB4QQr/+XAp4eqRD1NOGQ6bKELfGOnKTDa1TUjZNwU913K2xaE+xyPQovAjrvNl hHNUaNzKnLnSmyC9fBucwyehKVv0q/WuDvQxN1x+zgLmAI518XsV739K1OYvFt5zH1F9 y63Q== X-Gm-Message-State: APjAAAVmajtRTwfe0gSc4+Uux4wXJNwsnIvoxmjXsR37TSvWMHxlhgWX ow+P6Hjiau9nQcsyWoqmbKdydnBXFFCs525oQL4= X-Google-Smtp-Source: APXvYqxrikADmvkiM9+n6WX2vrNQ2wpm1xvxC8R4Bf14wAp+IL8z6sqLyev5hFeJaQrh7P2jvTQZjiJ0FdHYRXRf3aA= X-Received: by 2002:ac2:4202:: with SMTP id y2mr3675379lfh.178.1563964845411; Wed, 24 Jul 2019 03:40:45 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> In-Reply-To: From: Eric Rescorla Date: Wed, 24 Jul 2019 03:40:08 -0700 Message-ID: To: Jim Reid Cc: Rob Sayre , "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000000d6654058e6af1ff" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 10:40:50 -0000 --0000000000000d6654058e6af1ff Content-Type: text/plain; charset="UTF-8" On Tue, Jul 23, 2019 at 6:51 PM Jim Reid wrote: > > > > On 24 Jul 2019, at 01:16, Rob Sayre wrote: > > > > DNS is insecure in a coffee shop, and that is going to be fixed. > > It didn't/doesn't take or need DoH (or DoT) to fix that problem. > Can you expand on this point? I'm guessing you're referring to DNSSEC, but if so, DNSSEC does not address two security issues that we are concerned with: - Surveillance by actors on the user's network (including, perhaps, the recursive resolver) - Blocking by the recursive resolver. (see below) Though of course I'm glad we've got DoT and DoH as new weapons in the > on-going security arms race. > > BTW, using DoH or DoT in the above scenario doesn't necessarily make > things "secure". It just changes the security landscape by swapping one set > of concerns for another. A cynic (or realist) would say they'd just > replaced one DNS resolver they probably didn't/shouldn't trust to another > that isn't necessarily more trustworthy. Unless DNSSEC validation is used, > a client can never tell if its resolving server is telling the truth or not > -- irrespective of whether that answer got sent from port 53, port 443 or > port 853. > In many cases, whether you are being told the truth by your recursive resolver is a less interesting property than whether you can get the correct answer. For instance, if the recursive resolver replaces the A record you want with NXDOMAIN even if you know that it's done so, you're still blocked from going where you wanted to go. -Ekr > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000000d6654058e6af1ff Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 23, 2019 at 6:51 PM Jim R= eid <jim@rfc1035.com> wrote:


> On 24 Jul 2019, at 01:16, Rob Sayre <sayrer@gmail.com> wrote:
>
> DNS is insecure in a coffee shop, and that is going to be fixed.

It didn't/doesn't take or need DoH (or DoT) to fix that problem.

Can you expand on this point?=C2=A0 I'= ;m guessing you're referring to DNSSEC, but if so, DNSSEC does not addr= ess two security issues that we are concerned with:

- Surveillance by actors on the user's network (including, perhaps, t= he recursive resolver)
- Blocking by the recursive resolver. (see= below)


Though of course I'm glad we've got DoT and DoH as new weapons in t= he on-going security arms race.

BTW, using DoH or DoT in the above scenario doesn't necessarily make th= ings "secure". It just changes the security landscape by swapping= one set of concerns for another. A cynic (or realist) would say they'd= just replaced one DNS resolver they probably didn't/shouldn't trus= t to another that isn't necessarily more trustworthy. Unless DNSSEC val= idation is used, a client can never tell if its resolving server is telling= the truth or not -- irrespective of whether that answer got sent from port= 53, port 443 or port 853.

In many case= s, whether you are being told the truth by your recursive resolver is a les= s interesting property than whether you can get the correct answer. For ins= tance, if the recursive resolver replaces the A record you want with NXDOMA= IN even if you know that it's done so, you're still blocked from go= ing where you wanted to go.

-Ekr
--0000000000000d6654058e6af1ff-- From nobody Wed Jul 24 03:54:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0960E1200B7 for ; Wed, 24 Jul 2019 03:54:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nzM2isfQJBIk for ; Wed, 24 Jul 2019 03:54:14 -0700 (PDT) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE527120025 for ; Wed, 24 Jul 2019 03:54:14 -0700 (PDT) Received: by mail-qt1-x834.google.com with SMTP id y26so44974050qto.4 for ; Wed, 24 Jul 2019 03:54:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=z/U2h39VVpRWTzP0nVUgDubl8MMiOTMM96MJll/+oEE=; b=HmYD8xUEPyI8Eo8/liHASoki3TEb2BuhCw+hUqJ37U6J90DCivemDLARGqIjla0rdW Xckklt+3Pmlt1PppOo0zZ2unsYu6cunIb808ntAWPxwH8Jjw+Y2UKYViBsyHXQNIgJeo R5YXumE6flpWhyXzCLyitCndqmQyr0lGQGITO+XfWbyn9YxZtwlDECI5xbtOev43lDTz gTIerCVJ3zvov/ArhZ2/O7sXuD0jDLmxIzzUcaozlflBk4WRZ36S53ffWdDp5EuAHAHc QOks78ih4bxt+GWINnAtEOe/CmztYCLMkgW56BveoBZVkrk1L+ZEGXr0Q8PCBLkz3yV5 sGWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=z/U2h39VVpRWTzP0nVUgDubl8MMiOTMM96MJll/+oEE=; b=TyKlWZMEMy5tUu+0PYz45biG6cR44q2QsFIE/iGDtgoVXuPCj+HE+ADuqHmRCcdyAX rPHaSbaKrF8UoyrT1QSVSnIReuza+aa7liE6zrXIt4beJKB7inEaUBwZYXS5yTx2s9+J gk8lTsRnsD+1MDGrb37vOdudDUToh3pSOm2fD4hoAylYQ/NgxavIOcxGAtXcLQzis34R 1TEZ9o8TiRGKo0BMkKxrj1WOzs6mIPngB9cGOQycWxKU+3910oXjvb3JeGLWksihQY4v 0930fquXR3NJaiHuJpHxm4gwQHsUxwUqOqzmCVU1ZDkgwoiTTcaP7a9vDS+BoLN/GT3t eCaQ== X-Gm-Message-State: APjAAAW39s8PWEHlAvbUmWzdr2uR61S29SUoWRKaFeuKNTV1CqYNUXeE f3ogxY0mFCaBlcDO6Lx6hWYuutULtUducw== X-Google-Smtp-Source: APXvYqwm/EG4/vtNaj+OmAGZmIHF6zin1RJrgq5M3Iqv14SPF52CDLZIuI8hDvnQs1cg1Vmy3xOikA== X-Received: by 2002:a0c:e5c6:: with SMTP id u6mr40330910qvm.102.1563965653455; Wed, 24 Jul 2019 03:54:13 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:10f0:5c18:b29:4401? ([2001:67c:1232:144:10f0:5c18:b29:4401]) by smtp.gmail.com with ESMTPSA id c5sm28571154qta.5.2019.07.24.03.54.12 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 03:54:12 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Wed, 24 Jul 2019 06:54:11 -0400 Cc: Jim Reid , "add@ietf.org" , Rob Sayre Content-Transfer-Encoding: quoted-printable Message-Id: <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> To: Eric Rescorla Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 10:54:16 -0000 On Jul 24, 2019, at 6:40 AM, Eric Rescorla wrote: >> In many cases, whether you are being told the truth by your recursive res= olver is a less interesting property than whether you can get the correct an= swer. For instance, if the recursive resolver replaces the A record you want= with NXDOMAIN even if you know that it's done so, you're still blocked from= going where you wanted to go. However, even if you are not blocked, without DNSSEC you do not know that th= e resolver gave you the right answer. So ideally you want both: not to be b= locked, and also to be able to validate the result you got.=20 I know you already know this but I want to make it explicit because I=E2=80=99= ve seen at least one person on this thread say that with DoH, DNSSEC isn=E2=80= =99t needed.=20= From nobody Wed Jul 24 03:58:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A8F6212014B for ; Wed, 24 Jul 2019 03:58:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telefonica.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qyaHdC9kq4zl for ; Wed, 24 Jul 2019 03:58:19 -0700 (PDT) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10097.outbound.protection.outlook.com [40.107.1.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 715141200B7 for ; Wed, 24 Jul 2019 03:58:18 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=RVVMjJ7AJm3XeiTA7KDp1n2VZgAdqIhDqb3qYhX46iwCmBdc2eVrdR+4KIslSmQ72u3lV+0zmbbbbq4qDQZCXKhIEA0NCQ4z8F+UmNT4zkE7wIBxiu6au7KbbM4hQvvfT5xfW4F6V02INCvsfy+jLMrt+juJ6ev2UXBbJXFbt2JVn+iApPoUBULWfZuyvf5OUzN5oV6ZUKJIGcRek/ZvE40g1d6D0JTe/uV8GxY2Yka90uEdD9OlRpqtdiX+aN6Vf2OBUOLs0ZE3483eyjYWlFn/KkWIlHfOBkOVcNDEfiJbNPCZ4ICQyweSMCtjadPw4OqzFnrrsXp0iUEQ3izMDQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=O7ZfNe5SICmnmCW2bik6YgE0lmLMNOQejATp9uKpFPg=; b=fRyhb01K1gzLanuntDR+aJgrbVTW79pJLzQkkxf10K3qfcYYRcewBmZX7sqYSwAZ7rl98y/2Qg71OGQMIDq/x2JmO4+VqAzjmrgAu/15OdOJV6HAJLRo20CRryQe5ZMOXVl1KZvHP8LnCnwrinHHW5ONU6iS4L+ShkTvQ1H6ejkrqQWhueWAMGzaTTJa7GikyHEK43701x7azkBKEbYK/75oqaKBkbpnPHYqCqu0NBNyTHSrb/AwE7ZSrUTXDH3zVZ55ocwWNhOGoRMKy8MFLsnzInOrByGAJ5/oJEXdDxxVMV0di1PFtF1tnR26G3d0ZY2Ao+j1uzQRcncQMX46Iw== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=telefonica.com;dmarc=pass action=none header.from=telefonica.com;dkim=pass header.d=telefonica.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telefonica.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=O7ZfNe5SICmnmCW2bik6YgE0lmLMNOQejATp9uKpFPg=; b=j1MNnZs390xIdMRAbnshHPX3ybejcqsBwixMT5wAOvqqVJOxhsXwa938tBsSufSZfigBsw/2eZsmVV7Pf1wL5xTu4bfWyPy8dF0H3Ue7vEUcIN7xYY6Y3u57uGQE1Mq3hmSfV2NNCwaf8WAmpOKXM0nP8asxkFa/YCkMnAp1WD0= Received: from DB3PR0602MB3788.eurprd06.prod.outlook.com (52.134.70.148) by DB3PR0602MB3801.eurprd06.prod.outlook.com (52.134.72.24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Wed, 24 Jul 2019 10:58:15 +0000 Received: from DB3PR0602MB3788.eurprd06.prod.outlook.com ([fe80::9c53:d10:400e:c71]) by DB3PR0602MB3788.eurprd06.prod.outlook.com ([fe80::9c53:d10:400e:c71%5]) with mapi id 15.20.2094.013; Wed, 24 Jul 2019 10:58:15 +0000 From: "Diego R. Lopez" To: Eric Rescorla , Jim Reid CC: "add@ietf.org" , Rob Sayre Thread-Topic: [Add] fixing coffee shop brokenness with DoH Thread-Index: AQHVQcJG30FrGkaCR0+8FlNKTjcBRabZlM4A///B/4A= Date: Wed, 24 Jul 2019 10:58:15 +0000 Message-ID: <43D882F2-DB9E-4E56-A0F4-D21CC4D1382B@telefonica.com> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.c.190715 authentication-results: spf=none (sender IP is ) smtp.mailfrom=diego.r.lopez@telefonica.com; x-originating-ip: [207.115.96.130] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 27a43993-78a4-47ce-e562-08d71025d42b x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:DB3PR0602MB3801; x-ms-traffictypediagnostic: DB3PR0602MB3801: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 0108A997B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(376002)(396003)(346002)(136003)(39860400002)(366004)(189003)(199004)(40134004)(256004)(11346002)(2616005)(790700001)(186003)(14444005)(3846002)(606006)(6116002)(66574012)(45080400002)(446003)(478600001)(8676002)(5660300002)(476003)(8936002)(786003)(81166006)(7736002)(81156014)(6246003)(110136005)(229853002)(54906003)(58126008)(2906002)(316002)(236005)(68736007)(6306002)(66066001)(6512007)(54896002)(76176011)(25786009)(64756008)(66446008)(66556008)(66476007)(486006)(66946007)(6486002)(99286004)(86362001)(966005)(14454004)(102836004)(33656002)(53936002)(91956017)(53546011)(4326008)(6506007)(26005)(71190400001)(71200400001)(36756003)(76116006)(6436002); DIR:OUT; SFP:1102; SCL:1; SRVR:DB3PR0602MB3801; H:DB3PR0602MB3788.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: telefonica.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: SbE/X0LA8gCdw1dZKOUZ5a9fwanqPiq4NnBJfoNGgZ/w6NO/byPmiiy5Ue2Jh3nQknO/28UDpBvp3Lrz59x8I76uYtpL1aFhHj90bCVJjYrEPkCID01jexk2WDytDE4/dON75M6+6rJllymsAKqpgt6H+nrHF3XdW1WXCahhcphA5AxLHEa6Q17e4+ilidap6dyjQRFKEyBpyoD89HTPXQ7vKG3l406DnBpj2rKEfdQZyFht3Vg03qcSB0/KTptvharztBGCfqE73sXO0jy07CVzvrN063tF3mzy8guSvmW09U6cI+rmjuI4FIVk+hNhowA4XpDz0DuADhNqiytBoosqQQN1aT2I2l0H9/ub7kg6X/OsdLJSqRVi0Tzyb/eAqgxUl/irC40/V7b6ykgZ+pxQVWCiaFaripoVn4ep71A= Content-Type: multipart/alternative; boundary="_000_43D882F2DB9E4E56A0F4D21CC4D1382Btelefonicacom_" MIME-Version: 1.0 X-OriginatorOrg: telefonica.com X-MS-Exchange-CrossTenant-Network-Message-Id: 27a43993-78a4-47ce-e562-08d71025d42b X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2019 10:58:15.5035 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9744600e-3e04-492e-baa1-25ec245c6f10 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: diego.r.lopez@telefonica.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB3PR0602MB3801 Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 10:58:23 -0000 --_000_43D882F2DB9E4E56A0F4D21CC4D1382Btelefonicacom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNCk9uIDI0LzA3LzIwMTksIDA2OjQxLCAiQWRkIG9uIGJlaGFsZiBvZiBFcmljIFJlc2Nv cmxhIiA8YWRkLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmFkZC1ib3VuY2VzQGlldGYub3JnPiBv biBiZWhhbGYgb2YgZWtyQHJ0Zm0uY29tPG1haWx0bzpla3JAcnRmbS5jb20+PiB3cm90ZToNCg0K Q2FuIHlvdSBleHBhbmQgb24gdGhpcyBwb2ludD8gIEknbSBndWVzc2luZyB5b3UncmUgcmVmZXJy aW5nIHRvIEROU1NFQywgYnV0IGlmIHNvLCBETlNTRUMgZG9lcyBub3QgYWRkcmVzcyB0d28gc2Vj dXJpdHkgaXNzdWVzIHRoYXQgd2UgYXJlIGNvbmNlcm5lZCB3aXRoOg0KDQotIFN1cnZlaWxsYW5j ZSBieSBhY3RvcnMgb24gdGhlIHVzZXIncyBuZXR3b3JrIChpbmNsdWRpbmcsIHBlcmhhcHMsIHRo ZSByZWN1cnNpdmUgcmVzb2x2ZXIpDQotIEJsb2NraW5nIGJ5IHRoZSByZWN1cnNpdmUgcmVzb2x2 ZXIuIChzZWUgYmVsb3cpDQoNCkFzIGZhciBhcyBJIGNhbiB0ZWxsLCBib3RoIGNhbiBiZSByZWR1 Y2VkIHRvIGEgdHJ1c3QgaXNzdWUgKG1vZHVsbyB0aGUgdXNlIG9mIGVuY3J5cHRpb24gdG8gYXZv aWQgc3VydmVpbGxhbmNlIG9uIHRoZSB3aXJlKSwgYXMgaXQgaGFzIHRvIGRlYWwgd2l0aCBob3cg bXVjaCB5b3UgdHJ1c3QgeW91ciByZXNvbHZlci4gRE9IIGRvZXMgbm90IHN0b3AgdGhlIHJlc29s dmVyIGZyb20gcmVjb3JkaW5nIG9yIGJsb2NraW5nIHF1ZXJpZXMsIG9yIHByb3ZpZGluZyB3aGF0 ZXZlciB0aGUga2luZCBvZiBiaWFzZWQgcmVwbGllcy4gTXkgdGFrZSBmcm9tIHRoZSBkaXNjdXNz aW9uIHllc3RlcmRheSB3YXMgdGhhdCB0aGUgZ2lzdCBvZiB0aGUgZGlzY3Vzc2lvbiB3YXMgbm90 IGFib3V0IEROUyBlbmNyeXB0aW9uIGJ1dCBhYm91dCByZXNvbHZlciBkZXNpZ25hdGlvbi4NCg0K QmUgZ29vZGUsDQoNCi0tDQoiRXN0YSB2ZXogbm8gZmFsbGFyZW1vcywgRG9jdG9yIEluZmllcm5v Ig0KDQpEciBEaWVnbyBSLiBMb3Bleg0KVGVsZWZvbmljYSBJK0QNCmh0dHBzOi8vd3d3Lmxpbmtl ZGluLmNvbS9pbi9kcjJsb3Blei8NCg0KZS1tYWlsOiBkaWVnby5yLmxvcGV6QHRlbGVmb25pY2Eu Y29tPG1haWx0bzpkaWVnby5yLmxvcGV6QHRlbGVmb25pY2EuY29tPg0KVGVsOiAgICAgICAgICsz NCA5MTMgMTI5IDA0MQ0KTW9iaWxlOiAgKzM0IDY4MiAwNTEgMDkxDQotLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tDQoNCg0KDQotLQ0KQWRkIG1haWxpbmcgbGlzdA0KQWRkQGlldGYu b3JnPG1haWx0bzpBZGRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2FkZA0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KDQpFc3RlIG1l bnNhamUgeSBzdXMgYWRqdW50b3Mgc2UgZGlyaWdlbiBleGNsdXNpdmFtZW50ZSBhIHN1IGRlc3Rp bmF0YXJpbywgcHVlZGUgY29udGVuZXIgaW5mb3JtYWNpw7NuIHByaXZpbGVnaWFkYSBvIGNvbmZp ZGVuY2lhbCB5IGVzIHBhcmEgdXNvIGV4Y2x1c2l2byBkZSBsYSBwZXJzb25hIG8gZW50aWRhZCBk ZSBkZXN0aW5vLiBTaSBubyBlcyB1c3RlZC4gZWwgZGVzdGluYXRhcmlvIGluZGljYWRvLCBxdWVk YSBub3RpZmljYWRvIGRlIHF1ZSBsYSBsZWN0dXJhLCB1dGlsaXphY2nDs24sIGRpdnVsZ2FjacOz biB5L28gY29waWEgc2luIGF1dG9yaXphY2nDs24gcHVlZGUgZXN0YXIgcHJvaGliaWRhIGVuIHZp cnR1ZCBkZSBsYSBsZWdpc2xhY2nDs24gdmlnZW50ZS4gU2kgaGEgcmVjaWJpZG8gZXN0ZSBtZW5z YWplIHBvciBlcnJvciwgbGUgcm9nYW1vcyBxdWUgbm9zIGxvIGNvbXVuaXF1ZSBpbm1lZGlhdGFt ZW50ZSBwb3IgZXN0YSBtaXNtYSB2w61hIHkgcHJvY2VkYSBhIHN1IGRlc3RydWNjacOzbi4NCg0K VGhlIGluZm9ybWF0aW9uIGNvbnRhaW5lZCBpbiB0aGlzIHRyYW5zbWlzc2lvbiBpcyBwcml2aWxl Z2VkIGFuZCBjb25maWRlbnRpYWwgaW5mb3JtYXRpb24gaW50ZW5kZWQgb25seSBmb3IgdGhlIHVz ZSBvZiB0aGUgaW5kaXZpZHVhbCBvciBlbnRpdHkgbmFtZWQgYWJvdmUuIElmIHRoZSByZWFkZXIg b2YgdGhpcyBtZXNzYWdlIGlzIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCB5b3UgYXJlIGhl cmVieSBub3RpZmllZCB0aGF0IGFueSBkaXNzZW1pbmF0aW9uLCBkaXN0cmlidXRpb24gb3IgY29w eWluZyBvZiB0aGlzIGNvbW11bmljYXRpb24gaXMgc3RyaWN0bHkgcHJvaGliaXRlZC4gSWYgeW91 IGhhdmUgcmVjZWl2ZWQgdGhpcyB0cmFuc21pc3Npb24gaW4gZXJyb3IsIGRvIG5vdCByZWFkIGl0 LiBQbGVhc2UgaW1tZWRpYXRlbHkgcmVwbHkgdG8gdGhlIHNlbmRlciB0aGF0IHlvdSBoYXZlIHJl Y2VpdmVkIHRoaXMgY29tbXVuaWNhdGlvbiBpbiBlcnJvciBhbmQgdGhlbiBkZWxldGUgaXQuDQoN CkVzdGEgbWVuc2FnZW0gZSBzZXVzIGFuZXhvcyBzZSBkaXJpZ2VtIGV4Y2x1c2l2YW1lbnRlIGFv IHNldSBkZXN0aW5hdMOhcmlvLCBwb2RlIGNvbnRlciBpbmZvcm1hw6fDo28gcHJpdmlsZWdpYWRh IG91IGNvbmZpZGVuY2lhbCBlIMOpIHBhcmEgdXNvIGV4Y2x1c2l2byBkYSBwZXNzb2Egb3UgZW50 aWRhZGUgZGUgZGVzdGluby4gU2UgbsOjbyDDqSB2b3NzYSBzZW5ob3JpYSBvIGRlc3RpbmF0w6Fy aW8gaW5kaWNhZG8sIGZpY2Egbm90aWZpY2FkbyBkZSBxdWUgYSBsZWl0dXJhLCB1dGlsaXphw6fD o28sIGRpdnVsZ2HDp8OjbyBlL291IGPDs3BpYSBzZW0gYXV0b3JpemHDp8OjbyBwb2RlIGVzdGFy IHByb2liaWRhIGVtIHZpcnR1ZGUgZGEgbGVnaXNsYcOnw6NvIHZpZ2VudGUuIFNlIHJlY2ViZXUg ZXN0YSBtZW5zYWdlbSBwb3IgZXJybywgcm9nYW1vcy1saGUgcXVlIG5vcyBvIGNvbXVuaXF1ZSBp bWVkaWF0YW1lbnRlIHBvciBlc3RhIG1lc21hIHZpYSBlIHByb2NlZGEgYSBzdWEgZGVzdHJ1acOn w6NvDQo= --_000_43D882F2DB9E4E56A0F4D21CC4D1382Btelefonicacom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlv bjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcwLjg1cHQgMy4wY20gNzAuODVw dCAzLjBjbTt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwv c3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJl ZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0i ZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwv aGVhZD4NCjxib2R5IGxhbmc9IkVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYg Y2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdCI+SGksPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPk9uIDI0LzA3LzIwMTksIDA2OjQxLCAmcXVv dDtBZGQgb24gYmVoYWxmIG9mIEVyaWMgUmVzY29ybGEmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0 bzphZGQtYm91bmNlc0BpZXRmLm9yZyI+YWRkLWJvdW5jZXNAaWV0Zi5vcmc8L2E+IG9uIGJlaGFs ZiBvZg0KPGEgaHJlZj0ibWFpbHRvOmVrckBydGZtLmNvbSI+ZWtyQHJ0Zm0uY29tPC9hPiZndDsg d3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Q2FuIHlvdSBleHBhbmQg b24gdGhpcyBwb2ludD8mbmJzcDsNCjwvc3Bhbj5JJ20gZ3Vlc3NpbmcgeW91J3JlIHJlZmVycmlu ZyB0byBETlNTRUMsIGJ1dCBpZiBzbywgRE5TU0VDIGRvZXMgbm90IGFkZHJlc3MgdHdvIHNlY3Vy aXR5IGlzc3VlcyB0aGF0IHdlIGFyZSBjb25jZXJuZWQgd2l0aDo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+LSBTdXJ2ZWlsbGFuY2UgYnkgYWN0b3Jz IG9uIHRoZSB1c2VyJ3MgbmV0d29yayAoaW5jbHVkaW5nLCBwZXJoYXBzLCB0aGUgcmVjdXJzaXZl IHJlc29sdmVyKTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+LSBCbG9ja2luZyBieSB0aGUgcmVjdXJz aXZlIHJlc29sdmVyLiAoc2VlIGJlbG93KTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdCI+QXMgZmFyIGFzIEkgY2FuIHRlbGwsIGJvdGggY2FuIGJlIHJlZHVj ZWQgdG8gYSB0cnVzdCBpc3N1ZSAobW9kdWxvIHRoZSB1c2Ugb2YgZW5jcnlwdGlvbiB0byBhdm9p ZCBzdXJ2ZWlsbGFuY2Ugb24gdGhlIHdpcmUpLCBhcyBpdCBoYXMgdG8gZGVhbCB3aXRoIGhvdyBt dWNoIHlvdSB0cnVzdCB5b3VyIHJlc29sdmVyLiBET0ggZG9lcyBub3QNCiBzdG9wIHRoZSByZXNv bHZlciBmcm9tIHJlY29yZGluZyBvciBibG9ja2luZyBxdWVyaWVzLCBvciBwcm92aWRpbmcgd2hh dGV2ZXIgdGhlIGtpbmQgb2YgYmlhc2VkIHJlcGxpZXMuIE15IHRha2UgZnJvbSB0aGUgZGlzY3Vz c2lvbiB5ZXN0ZXJkYXkgd2FzIHRoYXQgdGhlIGdpc3Qgb2YgdGhlIGRpc2N1c3Npb24gd2FzIG5v dCBhYm91dCBETlMgZW5jcnlwdGlvbiBidXQgYWJvdXQgcmVzb2x2ZXIgZGVzaWduYXRpb24uPG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij5CZSBnb29kZSw8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPi0tPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZxdW90O0VzdGEg dmV6IG5vIGZhbGxhcmVtb3MsIERvY3RvciBJbmZpZXJubyZxdW90OzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+RHIgRGllZ28gUi4gTG9wZXo8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdCI+VGVsZWZvbmljYSBJJiM0MztEPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPjxhIGhyZWY9Imh0dHBz Oi8vd3d3LmxpbmtlZGluLmNvbS9pbi9kcjJsb3Blei8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDU2 M0MxIj5odHRwczovL3d3dy5saW5rZWRpbi5jb20vaW4vZHIybG9wZXovPC9zcGFuPjwvYT4mbmJz cDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPmUtbWFpbDombmJz cDs8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij48YSBo cmVmPSJtYWlsdG86ZGllZ28uci5sb3BlekB0ZWxlZm9uaWNhLmNvbSI+PHNwYW4gbGFuZz0iRU4t VVMiIHN0eWxlPSJjb2xvcjojMDU2M0MxIj48c3BhbiBsYW5nPSJFTi1VUyI+ZGllZ28uci5sb3Bl ekB0ZWxlZm9uaWNhLmNvbTwvc3Bhbj48L3NwYW4+PC9hPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij5UZWw6Jm5ic3A7 Jm5ic3A7Jm5ic3A7ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmIzQzOzM0IDkxMyAxMjkgMDQx PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij5Nb2JpbGU6ICZuYnNwOyYjNDM7MzQgNjgy IDA1MSAwOTE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPi0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS08L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNp emU6MTAuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjM2LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGNt IDBjbSAwY20gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBjbSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48YnI+DQotLSA8YnI+ DQpBZGQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOkFkZEBpZXRmLm9yZyIgdGFy Z2V0PSJfYmxhbmsiPkFkZEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9j a3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJyPg0KPGhyPg0KPGZvbnQgZmFjZT0i QXJpYWwiIGNvbG9yPSJHcmF5IiBzaXplPSIxIj48YnI+DQpFc3RlIG1lbnNhamUgeSBzdXMgYWRq dW50b3Mgc2UgZGlyaWdlbiBleGNsdXNpdmFtZW50ZSBhIHN1IGRlc3RpbmF0YXJpbywgcHVlZGUg Y29udGVuZXIgaW5mb3JtYWNpw7NuIHByaXZpbGVnaWFkYSBvIGNvbmZpZGVuY2lhbCB5IGVzIHBh cmEgdXNvIGV4Y2x1c2l2byBkZSBsYSBwZXJzb25hIG8gZW50aWRhZCBkZSBkZXN0aW5vLiBTaSBu byBlcyB1c3RlZC4gZWwgZGVzdGluYXRhcmlvIGluZGljYWRvLCBxdWVkYSBub3RpZmljYWRvIGRl IHF1ZSBsYQ0KIGxlY3R1cmEsIHV0aWxpemFjacOzbiwgZGl2dWxnYWNpw7NuIHkvbyBjb3BpYSBz aW4gYXV0b3JpemFjacOzbiBwdWVkZSBlc3RhciBwcm9oaWJpZGEgZW4gdmlydHVkIGRlIGxhIGxl Z2lzbGFjacOzbiB2aWdlbnRlLiBTaSBoYSByZWNpYmlkbyBlc3RlIG1lbnNhamUgcG9yIGVycm9y LCBsZSByb2dhbW9zIHF1ZSBub3MgbG8gY29tdW5pcXVlIGlubWVkaWF0YW1lbnRlIHBvciBlc3Rh IG1pc21hIHbDrWEgeSBwcm9jZWRhIGEgc3UgZGVzdHJ1Y2Npw7NuLjxicj4NCjxicj4NClRoZSBp bmZvcm1hdGlvbiBjb250YWluZWQgaW4gdGhpcyB0cmFuc21pc3Npb24gaXMgcHJpdmlsZWdlZCBh bmQgY29uZmlkZW50aWFsIGluZm9ybWF0aW9uIGludGVuZGVkIG9ubHkgZm9yIHRoZSB1c2Ugb2Yg dGhlIGluZGl2aWR1YWwgb3IgZW50aXR5IG5hbWVkIGFib3ZlLiBJZiB0aGUgcmVhZGVyIG9mIHRo aXMgbWVzc2FnZSBpcyBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgeW91IGFyZSBoZXJlYnkg bm90aWZpZWQgdGhhdCBhbnkgZGlzc2VtaW5hdGlvbiwNCiBkaXN0cmlidXRpb24gb3IgY29weWlu ZyBvZiB0aGlzIGNvbW11bmljYXRpb24gaXMgc3RyaWN0bHkgcHJvaGliaXRlZC4gSWYgeW91IGhh dmUgcmVjZWl2ZWQgdGhpcyB0cmFuc21pc3Npb24gaW4gZXJyb3IsIGRvIG5vdCByZWFkIGl0LiBQ bGVhc2UgaW1tZWRpYXRlbHkgcmVwbHkgdG8gdGhlIHNlbmRlciB0aGF0IHlvdSBoYXZlIHJlY2Vp dmVkIHRoaXMgY29tbXVuaWNhdGlvbiBpbiBlcnJvciBhbmQgdGhlbiBkZWxldGUgaXQuPGJyPg0K PGJyPg0KRXN0YSBtZW5zYWdlbSBlIHNldXMgYW5leG9zIHNlIGRpcmlnZW0gZXhjbHVzaXZhbWVu dGUgYW8gc2V1IGRlc3RpbmF0w6FyaW8sIHBvZGUgY29udGVyIGluZm9ybWHDp8OjbyBwcml2aWxl Z2lhZGEgb3UgY29uZmlkZW5jaWFsIGUgw6kgcGFyYSB1c28gZXhjbHVzaXZvIGRhIHBlc3NvYSBv dSBlbnRpZGFkZSBkZSBkZXN0aW5vLiBTZSBuw6NvIMOpIHZvc3NhIHNlbmhvcmlhIG8gZGVzdGlu YXTDoXJpbyBpbmRpY2FkbywgZmljYSBub3RpZmljYWRvIGRlIHF1ZSBhDQogbGVpdHVyYSwgdXRp bGl6YcOnw6NvLCBkaXZ1bGdhw6fDo28gZS9vdSBjw7NwaWEgc2VtIGF1dG9yaXphw6fDo28gcG9k ZSBlc3RhciBwcm9pYmlkYSBlbSB2aXJ0dWRlIGRhIGxlZ2lzbGHDp8OjbyB2aWdlbnRlLiBTZSBy ZWNlYmV1IGVzdGEgbWVuc2FnZW0gcG9yIGVycm8sIHJvZ2Ftb3MtbGhlIHF1ZSBub3MgbyBjb211 bmlxdWUgaW1lZGlhdGFtZW50ZSBwb3IgZXN0YSBtZXNtYSB2aWEgZSBwcm9jZWRhIGEgc3VhIGRl c3RydWnDp8Ojbzxicj4NCjwvZm9udD4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_43D882F2DB9E4E56A0F4D21CC4D1382Btelefonicacom_-- From nobody Wed Jul 24 04:33:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 878261200A4 for ; Wed, 24 Jul 2019 04:33:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 89nJCnwslhsT for ; Wed, 24 Jul 2019 04:33:52 -0700 (PDT) Received: from mail-qk1-x731.google.com (mail-qk1-x731.google.com [IPv6:2607:f8b0:4864:20::731]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 62633120180 for ; Wed, 24 Jul 2019 04:33:52 -0700 (PDT) Received: by mail-qk1-x731.google.com with SMTP id g18so33444387qkl.3 for ; Wed, 24 Jul 2019 04:33:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=l76J49J++b1qHoyYOF+xCwrqxxQPnI444BbR3aGY2JI=; b=ESo2EJuID5b8B0C+BSVwijUds4jO+KXbxzicn388zosSLSAxPch4qUEgR6yleskmcn QbiNVOiIfww54Ngdl6WZy3yw/AG4QcylMOFoofMi74Jm86KGmu3iU+WZ88syWYM2dtiZ 5KodFzqh6V/xc44EQPbQo1ZkrqADvhVpNSy4+J+KfaQuk6bWLo3Oct7kV7lYqJhlALyl tAu/cokUdv44jzMSPZDXG5H/VIE9t8/GaXJYKgo2xixfgAcvQyW1er+nfDw5JoSSJejs ktbBiqSJx3AInx3LCyP8LHgeZdHgrifMDT8S4rnbGxNcjKwJpBIKIqt5eZ4bMbvI12Rf 6/Ag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=l76J49J++b1qHoyYOF+xCwrqxxQPnI444BbR3aGY2JI=; b=ubSgo63G35q/ElV5ICijkXXqoyngB+BqUCrJ2Q1DDKnhb2BNXwxsEcvNsHvxTx1cY3 lFlhMENIViozSy0bt4d2/oZlxhHiFxgU+f2I5Qhtug0jBZVu1/OBhSSkymRAF0Jl89n3 R9VVbnfr34uxzJQBUr9N+VUk4EYISrQE6c4aNqeYGJdKXTGdka21ZmDQWDZ5FBtKp5K/ pcQjPlVLBc8VODYO6RzkzipTv+TmdTmIgRBd/F3H6NeuqEp7W1o4v41MuCRsvIUnBMUY aqA1ZkoHgfizalZq/u7kUhifAuHgk/+/jg6cb1q37FG8Zq2oPEKiXMszeRJO1gNNHVDW COKA== X-Gm-Message-State: APjAAAVuE0Eb+QtZ7/6SWGHCO0gZERe88Fat0TsCDq9sB+wZGhR7HOB3 +ebF5W367mzg5i2wXqvjTQss4/mi X-Google-Smtp-Source: APXvYqwMpLnMwLznFaqnFokZjfKPjN0VU9NvDhYGdXELE5zcMC4B19xZlvdAf9lWxbnxfCX0puok6Q== X-Received: by 2002:a05:620a:102e:: with SMTP id a14mr54844766qkk.7.1563968031302; Wed, 24 Jul 2019 04:33:51 -0700 (PDT) Received: from [172.20.0.236] ([216.113.24.76]) by smtp.gmail.com with ESMTPSA id z33sm21250604qtc.56.2019.07.24.04.33.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 04:33:50 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-266DA914-FA37-4156-92E5-A270E85ADAAF Mime-Version: 1.0 (1.0) From: Bret Jordan X-Mailer: iPhone Mail (16F203) In-Reply-To: Date: Wed, 24 Jul 2019 07:33:48 -0400 Cc: Tommy Jensen , Jim Reid , Rob Sayre , "add@ietf.org" Content-Transfer-Encoding: 7bit Message-Id: <343D8DDD-CCEC-4DAB-85D9-B6ED8ABAB91B@gmail.com> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> To: Joseph Lorenzo Hall Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 11:33:54 -0000 --Apple-Mail-266DA914-FA37-4156-92E5-A270E85ADAAF Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable If you are really worried about it, run your own. I do, and have for 25+ ye= ars. =20 Bret=20 Sent from my Commodore 128D PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > On Jul 24, 2019, at 6:19 AM, Joseph Lorenzo Hall wrote: >=20 >=20 >=20 >> On Tue, Jul 23, 2019 at 22:26 Tommy Jensen wrote: >> > Are people selling DNS logs to ad tech companies? Is that the ecosystem= being disrupted? >>=20 >> Given how many valid points have been brought up in the last few weeks ab= out the drawbacks of centralized app-configured DNS, I don=E2=80=99t think t= he glib tone is constructive. >=20 > Tone aside, to some users, centralization is a benefit in that they don't h= ave a bunch of unknown privacy policies applying to the resolution of the na= mes they need. For example, the privacy policy of 1.1.1.1 is pretty amazing f= rom the perspective of data retention, secondary uses, etc. (e.g., I know my= resolutions will be removed from their logs within 24 hours). >=20 > This may seem small but it seems to be lost in the centralization/choice d= iscussion. > --=20 > Joseph Lorenzo Hall > Chief Technologist, Center for Democracy & Technology [https://www.cdt.org= ] > 1401 K ST NW STE 200, Washington DC 20005-3497 > e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key > Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 --Apple-Mail-266DA914-FA37-4156-92E5-A270E85ADAAF Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable If you are really worried about it, run you= r own.  I do, and have for 25+ years.  

Bret&nb= sp;

Sent from my Commodore 128D
<= span style=3D"background-color: rgba(255, 255, 255, 0);">
PGP Fingerprint: 63B4 FC53 680= A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
<= div dir=3D"ltr">
On Jul 24, 2019, at 6:19 AM, Joseph Lorenzo Hall <joe@cdt.org> wrote:



On Tue, Jul 23, 2019 at 22:26= Tommy Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org> wrote:
> Are people selling DNS logs to ad tech companies? Is that the ecosystem= being disrupted?

Given how many valid points have been brought up in the last few weeks about= the drawbacks of centralized app-configured DNS, I don=E2=80=99t think the g= lib tone is constructive.

Tone aside, to some users, centralization is a benefit in that= they don't have a bunch of unknown privacy policies applying to the resolut= ion of the names they need. For example, the privacy policy of 1.1.1.1 is pr= etty amazing from the perspective of data retention, secondary uses, etc. (e= .g., I know my resolutions will be removed from their logs within 24 hours).=

This may seem small but i= t seems to be lost in the centralization/choice discussion.
--
Joseph Loren= zo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, W= ashington DC 20005-3497
e: joe@cdt.org= , p: 202.407.8825, pgp: https://j= osephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  160= 7 5F86 6987 40A9 A871
= --Apple-Mail-266DA914-FA37-4156-92E5-A270E85ADAAF-- From nobody Wed Jul 24 04:36:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E04812018C for ; Wed, 24 Jul 2019 04:36:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cdt.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fWLPqMbeu6Ux for ; Wed, 24 Jul 2019 04:36:44 -0700 (PDT) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DAE961202B8 for ; Wed, 24 Jul 2019 04:36:43 -0700 (PDT) Received: by mail-io1-xd31.google.com with SMTP id j5so84663041ioj.8 for ; Wed, 24 Jul 2019 04:36:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cdt.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=E7FN/iiR1AK3aNFQ730yBGoqzzRXE1UF0XxdSP6Yr1g=; b=OVSeLNjPkjrz2Kr4HLtH575aK8b6x/2h3YQOpdZRSAbGzGiub+pFhPTXigBrFnYzIa E3ym5p0/v9lBAKevYUZki2//+VJ2eYabZXAttWBZr4H1OxNxsmUoK4h+s7heHOsBx0uT g+wj2hz/IAwGDVTHyv8wFawy/uWlIHWAJXRMg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=E7FN/iiR1AK3aNFQ730yBGoqzzRXE1UF0XxdSP6Yr1g=; b=mX/vam4MpsDo4lKQ222n/Y0aLfY7QIHE4jOHBZ9zSVSx9ALU2fgrrLudLMUliptUI8 i8vJKBJlRxQJ2oKQOW/leNjgpUbhldLTU5mxdVteFIOoZlN3p9XJoUVRxkfUAI5oXQ7X fzT9qn3WQ9UB2WUmeDvaNTtR8Z7MYXai965O8+8Qrh5gjC1azLxHhOP8FndC4M3KmKPM +z6Wl/1BiW4igOAc9E15KLNq3bAUXfEqjO5hLUVXZUMD4Yf2ZHGs4vRlt6jdiBgRmMYu 1OMNzAphqH8fjtKS4emmdKWaSUO49f28/gQrkO9aiY+5wL3YWHlAnEE2P7SDRvV/2/f1 /nYA== X-Gm-Message-State: APjAAAU5M6soZDHGUg9+PdlsZ0hsBEfbqveEHs/DjUfSy9zmG82hY+qw mb/ZOTRAKUxbqYiZgFHLFXRCRItty3iokzOk/4MLFw== X-Google-Smtp-Source: APXvYqwc8vb9AYReHIZqqlcx6/BIrOh/kKV/lJtPQbXaaJNhuhVyNs0KtdXwDSGpHDBe463aZQqQ45VM94wEEXkq9Fc= X-Received: by 2002:a5e:9506:: with SMTP id r6mr11234974ioj.219.1563968202961; Wed, 24 Jul 2019 04:36:42 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <343D8DDD-CCEC-4DAB-85D9-B6ED8ABAB91B@gmail.com> In-Reply-To: <343D8DDD-CCEC-4DAB-85D9-B6ED8ABAB91B@gmail.com> From: Joseph Lorenzo Hall Date: Wed, 24 Jul 2019 07:36:29 -0400 Message-ID: To: Bret Jordan Cc: Jim Reid , Rob Sayre , Tommy Jensen , "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000002d8e8b058e6bb9e0" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 11:36:50 -0000 --0000000000002d8e8b058e6bb9e0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I can do that but the user base we represent at CDT cannot. So not an answer. On Wed, Jul 24, 2019 at 07:33 Bret Jordan wrote: > If you are really worried about it, run your own. I do, and have for 25+ > years. > > Bret > > Sent from my Commodore 128D > > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > > On Jul 24, 2019, at 6:19 AM, Joseph Lorenzo Hall wrote: > > > > On Tue, Jul 23, 2019 at 22:26 Tommy Jensen 40microsoft.com@dmarc.ietf.org> wrote: > >> > Are people selling DNS logs to ad tech companies? Is that the ecosyste= m >> being disrupted? >> >> Given how many valid points have been brought up in the last few weeks >> about the drawbacks of centralized app-configured DNS, I don=E2=80=99t t= hink the >> glib tone is constructive. >> > > Tone aside, to some users, centralization is a benefit in that they don't > have a bunch of unknown privacy policies applying to the resolution of th= e > names they need. For example, the privacy policy of 1.1.1.1 is pretty > amazing from the perspective of data retention, secondary uses, etc. (e.g= ., > I know my resolutions will be removed from their logs within 24 hours). > > This may seem small but it seems to be lost in the centralization/choice > discussion. > >> -- > Joseph Lorenzo Hall > Chief Technologist, Center for Democracy & Technology [https://www.cdt.or= g > ] > 1401 K ST NW STE 200, Washington DC 20005 > > -3497 > e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key > Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 > > -- Joseph Lorenzo Hall Chief Technologist, Center for Democracy & Technology [https://www.cdt.org] 1401 K ST NW STE 200, Washington DC 20005-3497 e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 --0000000000002d8e8b058e6bb9e0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I can do that but the user base we represent at CDT = cannot. So not an answer.

On Wed, Jul 24, 2019 at 07:33 Bret Jord= an <jordan.ietf@gmail.com&g= t; wrote:
If you = are really worried about it, run your own.=C2=A0 I do, and have for 25+ yea= rs. =C2=A0

Bret=C2=A0

Sent from my Commodore 128D
PGP Fingerprin= t:=C2=A063B4 FC53 680A= 6B7D 1447 =C2=A0F2C0 74F8 ACAE 7415 0050
<= div dir=3D"ltr">
On Jul 24, 2019, at 6:19 AM, Joseph Lorenzo Hall <joe@cdt.org> wrote:

=
On Tue= , Jul 23, 2019 at 22:26 Tommy Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.iet= f.org> wrote:
> Are people selling DNS logs to ad tech companies? Is that the ecosyste= m being disrupted?

Given how many valid points have been brought up in the last few weeks abou= t the drawbacks of centralized app-configured DNS, I don=E2=80=99t think th= e glib tone is constructive.

=
Tone aside, to some users, centralization is a benefit in= that they don't have a bunch of unknown privacy policies applying to t= he resolution of the names they need. For example, the privacy policy of 1.= 1.1.1 is pretty amazing from the perspective of data retention, secondary u= ses, etc. (e.g., I know my resolutions will be removed from their logs with= in 24 hours).

This may s= eem small but it seems to be lost in the centralization/choice discussion.<= /div>
-- =
Joseph Lorenzo Hall
Chief Technologist, Cent= er for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497
e: joe@cdt.org, p: 202.407.8825, pg= p: https://jos= ephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10=C2=A0 1607= 5F86 6987 40A9 A871
--
Joseph Lo= renzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE = 200, Washington DC 20005-3497
e: joe@cdt.= org, p: 202.407.8825, pgp: h= ttps://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10= =C2=A0 1607 5F86 6987 40A9 A871
--0000000000002d8e8b058e6bb9e0-- From nobody Wed Jul 24 04:42:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE99C12018B for ; Wed, 24 Jul 2019 04:42:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kvnybq5YFeIi for ; Wed, 24 Jul 2019 04:42:04 -0700 (PDT) Received: from mail-qk1-x730.google.com (mail-qk1-x730.google.com [IPv6:2607:f8b0:4864:20::730]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CEB71200D5 for ; Wed, 24 Jul 2019 04:42:04 -0700 (PDT) Received: by mail-qk1-x730.google.com with SMTP id d15so33453223qkl.4 for ; Wed, 24 Jul 2019 04:42:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=wlNUGRouNJLShYGi6objfkYI50trtLdbKrISwLDyC3Q=; b=UWTCglplOjyEIWuBACQgvvFmBBZ41Hgi5g3kRPzsxuNpFY2fyEDso+1Pbc6oQ3AtgU o4IGJNA+6aGe8qLqbbwZC4jrLpKGhJP70Tg9rXaFxSyebwuRf0B03z6KBddKeqFUJX8I D1C4Ul5YF2og39Aq5jsof+CLeV69h+iYWCT3UYEsRjZLUX655Bim8/jXTgD5lEjLUm0r tS0zRnWk3PMofekbpuw/PEc2sy2HLrcPKCpygDpn5L+J/2DTWMxljxdMSv9swK+BffyD lVxfCUbwyS5cF+uZH5ALkiYOiEG7N1xC0w/KS/BRMyw7jzIKs2tkeQlCLXsfyG+poLch XTJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=wlNUGRouNJLShYGi6objfkYI50trtLdbKrISwLDyC3Q=; b=BiV6Bgb9+0hpaNEKs7XMbxNCbzNssFoTd4l7u6DgJN4aUnRYfKGujlyQFXcr5IIQ47 1i8CysKxtPaqbCvpU+59xxBo5RlbC/d8htfPai49II5M68juYwYSyFMjEqB3GW7BZHek ay6SgfQAQ8JZaWMxXV3Dtx0wd10T+wcM2Yux0iwrbgBo3NId0ulq+smDl8ZaUu+k+tJN KRBFM0B5v+bfUuwH+HmhbvpbntwGo80Ai4v6DP0q60KtmTNokP+C3EedWP8lxRWwIbhh wvWoMnUR2oAx9RDExnE/RU4NbXuztOHlP7ttoa+EhRfm0SDaQquAw59BqJapKZAArIyS Vwrw== X-Gm-Message-State: APjAAAXpAUAcO26pG/Ysh6AY85ElEgIXOKRgPocQNq65+ENDm+xzKilg y9BjNNnSjsYcpYxPRjoCLjy3QNgn X-Google-Smtp-Source: APXvYqw7Mbw8dLRq5pNL1zilCHbzDz86DtQdsnb5xIvDeEQ6F4ToCMx2EHcOTVkR5ldKXA30HwS3oA== X-Received: by 2002:a37:a6d8:: with SMTP id p207mr49190618qke.387.1563968522922; Wed, 24 Jul 2019 04:42:02 -0700 (PDT) Received: from [172.20.0.236] ([216.113.24.76]) by smtp.gmail.com with ESMTPSA id x23sm18861483qtp.37.2019.07.24.04.42.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 04:42:02 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-A3A92C12-6CD9-46B9-9185-CFEC606608F8 Mime-Version: 1.0 (1.0) From: Bret Jordan X-Mailer: iPhone Mail (16F203) In-Reply-To: Date: Wed, 24 Jul 2019 07:42:01 -0400 Cc: Jim Reid , Rob Sayre , Tommy Jensen , "add@ietf.org" Content-Transfer-Encoding: 7bit Message-Id: <10762BA8-491F-474B-B23A-B7E5BD94F480@gmail.com> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <343D8DDD-CCEC-4DAB-85D9-B6ED8ABAB91B@gmail.com> To: Joseph Lorenzo Hall Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 11:42:07 -0000 --Apple-Mail-A3A92C12-6CD9-46B9-9185-CFEC606608F8 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable My point is centralization of dns queries seems like a far larger potential p= roblem. Especially when the query is over http and can easily allow extra h= eaders so the end user can be fully tracked. =20 Bret Sent from my Commodore 128D PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > On Jul 24, 2019, at 7:36 AM, Joseph Lorenzo Hall wrote: >=20 > I can do that but the user base we represent at CDT cannot. So not an answ= er. >=20 >> On Wed, Jul 24, 2019 at 07:33 Bret Jordan wrote: >> If you are really worried about it, run your own. I do, and have for 25+= years. =20 >>=20 >> Bret=20 >>=20 >> Sent from my Commodore 128D >>=20 >> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 >>=20 >>> On Jul 24, 2019, at 6:19 AM, Joseph Lorenzo Hall wrote: >>>=20 >>>=20 >>>=20 >>>> On Tue, Jul 23, 2019 at 22:26 Tommy Jensen wrote: >>>> > Are people selling DNS logs to ad tech companies? Is that the ecosyst= em being disrupted? >>>>=20 >>>> Given how many valid points have been brought up in the last few weeks a= bout the drawbacks of centralized app-configured DNS, I don=E2=80=99t think t= he glib tone is constructive. >>>=20 >>> Tone aside, to some users, centralization is a benefit in that they don'= t have a bunch of unknown privacy policies applying to the resolution of the= names they need. For example, the privacy policy of 1.1.1.1 is pretty amazi= ng from the perspective of data retention, secondary uses, etc. (e.g., I kno= w my resolutions will be removed from their logs within 24 hours). >>>=20 >>> This may seem small but it seems to be lost in the centralization/choice= discussion. >>> --=20 >>> Joseph Lorenzo Hall >>> Chief Technologist, Center for Democracy & Technology [https://www.cdt.o= rg] >>> 1401 K ST NW STE 200, Washington DC 20005-3497 >>> e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key >>> Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 > --=20 > Joseph Lorenzo Hall > Chief Technologist, Center for Democracy & Technology [https://www.cdt.org= ] > 1401 K ST NW STE 200, Washington DC 20005-3497 > e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key > Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 --Apple-Mail-A3A92C12-6CD9-46B9-9185-CFEC606608F8 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable My point is centralization of dns queries s= eems like a far larger potential problem.  Especially when the query is= over http and can easily allow extra headers so the end user can be fully t= racked.  

Bret

Sent f= rom my Commodore 128D

PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

On Jul 24, 2019, at 7:36= AM, Joseph Lorenzo Hall <joe@cdt.org&= gt; wrote:

I can do that but the user base we represent at CDT cannot. So= not an answer.

On Wed, Jul 24, 2019 at 07:33 Bret Jordan <jordan.ietf@gmail.com> wrote:
=
If you are really worr= ied about it, run your own.  I do, and have for 25+ years.  
=

Bret 

Sent from my Commodore 128D

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74= F8 ACAE 7415 0050

On Ju= l 24, 2019, at 6:19 AM, Joseph Lorenzo Hall <joe@cdt.org> wrote:



On Tue, Jul 23, 2019 at 22:26 Tommy= Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #= ccc solid;padding-left:1ex">
> Are people selling DNS logs to ad tech companies? Is that the ecosystem= being disrupted?

Given how many valid points have been brought up in the last few weeks about= the drawbacks of centralized app-configured DNS, I don=E2=80=99t think the g= lib tone is constructive.

Tone aside, to some users, centralization is a benefit in that= they don't have a bunch of unknown privacy policies applying to the resolut= ion of the names they need. For example, the privacy policy of 1.1.1.1 is pr= etty amazing from the perspective of data retention, secondary uses, etc. (e= .g., I know my resolutions will be removed from their logs within 24 hours).=

This may seem small but i= t seems to be lost in the centralization/choice discussion.
--
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy &am= p; Technology [https://www= .cdt.org]
1401 K ST NW STE 2= 00, Washington DC 20005-3497
e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fi= ngerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871
--
Joseph Lore= nzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200,= Washington DC 20005-3497
e: joe@cdt.org, p: 202.407.8825, pgp: https:/= /josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1= 607 5F86 6987 40A9 A871
= --Apple-Mail-A3A92C12-6CD9-46B9-9185-CFEC606608F8-- From nobody Wed Jul 24 04:52:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BCEEE120183 for ; Wed, 24 Jul 2019 04:52:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cdt.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3s0wnN2-eUeL for ; Wed, 24 Jul 2019 04:52:39 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A3B1A12018B for ; Wed, 24 Jul 2019 04:52:36 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id i10so88848076iol.13 for ; Wed, 24 Jul 2019 04:52:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cdt.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=iOK1nfJpDLtKircc4jUBJ/TCUWO6Duc3/0kQCvCokco=; b=N/nhNsvrjjM+7Zego6CpqymMSiLll/qNub0qaw7DGJVPHKB1JQQeTVI5cImrE1rjVE /tX6vsUtD2CYihExFNFA6CZ0C7eJCCrR1Bb5UuXa6AfN3U5ssoD5PRf01orua9AaXWjO F5dlOY0/ndHfNieKaVdDR//UOL+DHb2XYJJws= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=iOK1nfJpDLtKircc4jUBJ/TCUWO6Duc3/0kQCvCokco=; b=LQQtW4S98PeyesQYO2IqzYglPylCnIDLJ98t26qe1mOTled2p7Ee8J0XCaSc1B1sul 4UZ9WqlU0D1ir0wm3bxLtnwf+as2bTHdGxPDySLARU9sXSBbMjRPD1gi4tvsotQbLRsM 46zpm5As7CY6yMwS9UrC2cFN/FlQLNr/WAkkBFw/prz8zL+XlrwfLaWXjYUCn0sbqFZ+ qZPhen3RLmnUfQqA/lLm4QdbQGp5l313x715Sm6+/MRBVx1iEpk/vkuYXfV4RI9BlFm/ qS9nwkqCSm9BDUw+//xrsMct7IiJyAkOG1L5v25owEc9Rso6g5U6vxnIdZhNVwE3p3+q qbuA== X-Gm-Message-State: APjAAAXxkwu0EZHBKVr6saTWPPzA4fbcu+J6rCp2lXv/AnzgYxXA3WD2 r1Wnv9ZJcD0RjAM/UpeyloiVgv0k2d+HMCs7prs74w== X-Google-Smtp-Source: APXvYqwpwCK3UJJQ3ZF7SGrB5TmaQCG4GV2jhg32bY+mH8IKcXzhMPEbBICTK52RAGkH/L0oddYd+AHEwQVT1HUgiH4= X-Received: by 2002:a5d:8195:: with SMTP id u21mr76806236ion.260.1563969155584; Wed, 24 Jul 2019 04:52:35 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <343D8DDD-CCEC-4DAB-85D9-B6ED8ABAB91B@gmail.com> <10762BA8-491F-474B-B23A-B7E5BD94F480@gmail.com> In-Reply-To: <10762BA8-491F-474B-B23A-B7E5BD94F480@gmail.com> From: Joseph Lorenzo Hall Date: Wed, 24 Jul 2019 07:52:23 -0400 Message-ID: To: Bret Jordan Cc: Jim Reid , Rob Sayre , Tommy Jensen , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000f56f73058e6bf136" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 11:52:42 -0000 --000000000000f56f73058e6bf136 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Sure, and there are countervailing considerations... e.g., that same privacy policy (legally) limits what tracking that endpoint can do. Plus, I'm not as confident in my own ability to protect that resolver and associated data as I am about Cloudflare (or Google, etc.) On Wed, Jul 24, 2019 at 07:42 Bret Jordan wrote: > My point is centralization of dns queries seems like a far larger > potential problem. Especially when the query is over http and can easily > allow extra headers so the end user can be fully tracked. > > Bret > > Sent from my Commodore 128D > > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > > On Jul 24, 2019, at 7:36 AM, Joseph Lorenzo Hall wrote: > > I can do that but the user base we represent at CDT cannot. So not an > answer. > > On Wed, Jul 24, 2019 at 07:33 Bret Jordan wrote: > >> If you are really worried about it, run your own. I do, and have for 25= + >> years. >> >> Bret >> >> Sent from my Commodore 128D >> >> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 >> >> On Jul 24, 2019, at 6:19 AM, Joseph Lorenzo Hall wrote: >> >> >> >> On Tue, Jul 23, 2019 at 22:26 Tommy Jensen > 40microsoft.com@dmarc.ietf.org> wrote: >> >>> > Are people selling DNS logs to ad tech companies? Is that the >>> ecosystem being disrupted? >>> >>> Given how many valid points have been brought up in the last few weeks >>> about the drawbacks of centralized app-configured DNS, I don=E2=80=99t = think the >>> glib tone is constructive. >>> >> >> Tone aside, to some users, centralization is a benefit in that they don'= t >> have a bunch of unknown privacy policies applying to the resolution of t= he >> names they need. For example, the privacy policy of 1.1.1.1 is pretty >> amazing from the perspective of data retention, secondary uses, etc. (e.= g., >> I know my resolutions will be removed from their logs within 24 hours). >> >> This may seem small but it seems to be lost in the centralization/choice >> discussion. >> >>> -- >> Joseph Lorenzo Hall >> Chief Technologist, Center for Democracy & Technology [ >> https://www.cdt.org] >> 1401 K ST NW STE 200, Washington DC 20005 >> >> -3497 >> e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key >> Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 >> >> -- > Joseph Lorenzo Hall > Chief Technologist, Center for Democracy & Technology [https://www.cdt.or= g > ] > 1401 K ST NW STE 200, Washington DC 20005 > > -3497 > e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key > Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 > > -- Joseph Lorenzo Hall Chief Technologist, Center for Democracy & Technology [https://www.cdt.org] 1401 K ST NW STE 200, Washington DC 20005-3497 e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 --000000000000f56f73058e6bf136 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Sure, and there are countervailing considerations...= e.g., that same privacy policy (legally) limits what tracking that endpoin= t can do. Plus, I'm not as confident in my own ability to protect that = resolver and associated data as I am about Cloudflare (or Google, etc.)

On Wed, Jul 24, 2019 at 07:42 Bret Jordan <jordan.ietf@gmail.com> wrote:
My point is centralization of dns qu= eries seems like a far larger potential problem.=C2=A0 Especially when the = query is over http and can easily allow extra headers so the end user can b= e fully tracked. =C2=A0

Bret

Sent from my Comm= odore 128D
=
= PGP Fingerprint:=C2=A0<= font>63B4 FC53 680A 6B7D 1447 =C2=A0F2C0 74F8 ACAE 7415 0050<= /span>

On Jul 24, 2019, at 7:36 AM, Joseph = Lorenzo Hall <joe@cdt.o= rg> wrote:

<= div>
I can do that but the user base we represent at CDT c= annot. So not an answer.

On Wed, Jul 24, 2019 at 07:33 Bret Jorda= n <jordan.iet= f@gmail.com> wrote:
If you are really worried about it, run your own.=C2=A0 I do, and= have for 25+ years. =C2=A0

Bret= =C2=A0

Sent from my Commodore 128D

PGP Fingerprint:=C2=A063B4 FC53 680A 6B7D 1447 =C2=A0F2C0 74F8 ACAE 7415= 0050

On Jul 24, 2019,= at 6:19 AM, Joseph Lorenzo Hall <joe@cdt.org> wrote:



On Tue, Jul 23, 2019 at 22:26 Tommy Jense= n <Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org> wrote:
> Are people selling DNS logs to ad tech companies? Is that the ecosyste= m being disrupted?

Given how many valid points have been brought up in the last few weeks abou= t the drawbacks of centralized app-configured DNS, I don=E2=80=99t think th= e glib tone is constructive.

=
Tone aside, to some users, centralization is a benefit in= that they don't have a bunch of unknown privacy policies applying to t= he resolution of the names they need. For example, the privacy policy of 1.= 1.1.1 is pretty amazing from the perspective of data retention, secondary u= ses, etc. (e.g., I know my resolutions will be removed from their logs with= in 24 hours).

This may s= eem small but it seems to be lost in the centralization/choice discussion.<= /div>
-- =
Joseph Lorenzo Hall
Ch= ief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washing= ton DC 20005-3497
e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprin= t: 3CA2 8D7B 9F6D DBD3 4B10=C2=A0 1607 5F86 6987 40A9 A871
--
Joseph Lorenzo Hall
Chief Technologist, Center for Democrac= y & Technology [https= ://www.cdt.org]
1401 K ST= NW STE 200, Washington DC 20005-3497
e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-k= ey
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10=C2=A0 1607 5F86 6987 40A9 A= 871
--
Joseph Lo= renzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE = 200, Washington DC 20005-3497
e: joe@cdt.= org, p: 202.407.8825, pgp: h= ttps://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10= =C2=A0 1607 5F86 6987 40A9 A871
--000000000000f56f73058e6bf136-- From nobody Wed Jul 24 04:53:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DA7B12002E for ; Wed, 24 Jul 2019 04:53:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DZDSd1Lrl2TS for ; Wed, 24 Jul 2019 04:53:02 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [62.239.224.234]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40E661200A4 for ; Wed, 24 Jul 2019 04:53:02 -0700 (PDT) Received: from tpw09926dag17h.domain1.systemhost.net (10.9.212.41) by RDW083A012ED68.bt.com (10.187.98.38) with Microsoft SMTP Server (TLS) id 14.3.439.0; Wed, 24 Jul 2019 12:52:19 +0100 Received: from tpw09926dag12f.domain1.systemhost.net (10.9.212.20) by tpw09926dag17h.domain1.systemhost.net (10.9.212.41) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 24 Jul 2019 12:52:58 +0100 Received: from bwp09926077.bt.com (10.36.82.108) by tpw09926dag12f.domain1.systemhost.net (10.9.212.20) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Wed, 24 Jul 2019 12:52:58 +0100 Received: from GBR01-LO2-obe.outbound.protection.outlook.com (104.47.21.58) by smtpe1.intersmtp.com (10.36.82.108) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Wed, 24 Jul 2019 12:52:51 +0100 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=i89mD2t9NWzUGGg5gG32kb6XYI/hzJEGB1DYNL/S6RSLUHU6GqqKqBbNBKpiOmKNbAJyZX/L/uYRfBbCjdQECv7svCd/sqWYD21kpCM1ngJXjUZW2DOD8dAgyJ67D6+QdlcyrJp0OYZWufhMtwV7r+5bpgE9wDkDmE/NASmjDUdbBHlFPS85vIkRfKH1q3lYWc18/uLLa1q3PxzaFSo0hSuVrAoOyUNBCg6/BKnlclBCZ/uxCPbStwBcXz2P88CSet86RF4Vus0utP1yEI2sLY2Tuowa9Twx8a4KgqNqoudAWJPiqIMkuKaxxzf4YHqPpzNJKI+JoZlY7oYVtWSXPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=u3DKMlH8jtpLQSQ4M/wSrA2I9QZpkYD/q1MzmaEEfJg=; b=Hi+L2YBfSEl7LvjcWB0VRE/p4fnaLNBNjtDPKVoMLdNCR9yYjrbKFVmSmfvyJW9dveDpwHAvfwDLd8DOBlI1VDH8QQ/qSJRVKCtrTp2PFHQU+kd3CSu4mzsZ4M1mFE7LT6eDi43wFU8M/GCZx7ssXqRIUZk+842vwQ2prg/XdyoDAs4QoC+ipkx0MBWZwwd3F/jh29jzOKFd3Z/Ae+Z0WXLUiXXDP6c1HQSBKai6lAf9LVNI2fRi4afQmzehDEzhVMSjuIz/jj5e+N+EDNLQgHgbhRSHnvovtcwJNRzA0KlaV2KpqFujExT+kyD3Gk+Gl0f17BboDJzVPlDVFL/d2A== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=bt.com;dmarc=pass action=none header.from=bt.com;dkim=pass header.d=bt.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=u3DKMlH8jtpLQSQ4M/wSrA2I9QZpkYD/q1MzmaEEfJg=; b=f/ZHPenXmzIUgF8Y6EL5+aGY64zrDWgzs0x67fKgBEioXGBP997UjeNMACPJXADOzopw4nmDvdPJhSvew14KMQ6EnXeufJZqf5335Z4S7CIxxxbiJkrYakilfo/zXzfs3mbb16lxVg8Ok3aUeL8v7cMJz+TJkFneYJqcXMsEnic= Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM (20.176.158.15) by LO2P123MB2144.GBRP123.PROD.OUTLOOK.COM (20.176.157.80) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Wed, 24 Jul 2019 11:52:57 +0000 Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::4061:47b7:52f1:6836]) by LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::4061:47b7:52f1:6836%3]) with mapi id 15.20.2094.013; Wed, 24 Jul 2019 11:52:57 +0000 From: To: Thread-Topic: [Add] fixing coffee shop brokenness with DoH Thread-Index: AQHVQcJI+jqXeCJLjU2M+OG81Si+56bZBa+AgAACZgCAAADiAIAAAcuAgACEL4CAABWygA== Date: Wed, 24 Jul 2019 11:52:57 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=chris.box@bt.com; x-originating-ip: [2001:67c:1232:144:98f1:6764:e181:fb3a] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ee307c8a-78b4-4179-4b2c-08d7102d785c x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P123MB2144; x-ms-traffictypediagnostic: LO2P123MB2144: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-antispam-2: 1 x-ms-oob-tlc-oobclassifiers: OLM:6108; x-forefront-prvs: 0108A997B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(376002)(366004)(136003)(346002)(396003)(39860400002)(189003)(199004)(1730700003)(2906002)(2351001)(71200400001)(71190400001)(8676002)(6116002)(790700001)(2501003)(64756008)(256004)(76176011)(14444005)(52536014)(14454004)(966005)(6916009)(478600001)(5660300002)(229853002)(6436002)(86362001)(7736002)(99286004)(74316002)(316002)(7696005)(25786009)(11346002)(102836004)(53936002)(186003)(53546011)(6506007)(476003)(76116006)(486006)(5640700003)(33656002)(81156014)(66446008)(66556008)(66476007)(81166006)(8936002)(55016002)(46003)(9686003)(54896002)(6306002)(6246003)(68736007)(606006)(66946007)(446003)(236005); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P123MB2144; H:LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: bt.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: yvTSRIVswo8u3HJrxDvbm8JmDv5q1YCxze2dLf6FHtN6X6fBNLVm9SQueE+EdaJlRmJLxvgqU9pwQGslHEJn9S3JWw6xqxhRZa79z5r9LtfT3TSbji3Xqh/TBTqidWesiQ5fJQhNkGjRFn7BDiVXK25gufaK1XW594//YT/dUFKe8H9ZrfHAmeHQLqGV9h3nvfMWymKxpJXD2kG1ncFYxz7WCBx32IquupBzwy1Xog0XtnsfdsMQdHeXEM37WqDnNb+iiRxY9lzIfRVZeMhixQo42wkWMZjc6vpwl4X7KI4w8/LpG7OIBRL4QFdA2F0tOtRq52zUbzJGISRd6jKYJ+n5Zu8z34P9wlVuwXLB8/5fgZiTb5IDv+b87JDbZAMK7HLVSlH5Q6k+l8ktr1jie4TUPHQJxmO0xHC0ydSjWjs= Content-Type: multipart/alternative; boundary="_000_LO2P123MB22569D3F3476B913EDC8F8D69BC60LO2P123MB2256GBRP_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: ee307c8a-78b4-4179-4b2c-08d7102d785c X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2019 11:52:57.3352 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a7f35688-9c00-4d5e-ba41-29f146377ab0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: chris.box@bt.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB2144 X-NAI-Spam-Flag: NO X-NAI-Spam-Level: X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0.6 X-NAI-Spam-Report: 4 Rules triggered * 0.6 -- TS_MSG_REP_20 * 0 -- EDT_SDHA_ADR_FRG * 0 -- EDT_SDHA_DMN_FRG * 0 -- RV6597 X-NAI-Spam-Version: 2.2.0.9309 : core <6597> : inlines <7125> : streams <1828280> : uri <2871837> X-OriginatorOrg: bt.com Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 11:53:05 -0000 --_000_LO2P123MB22569D3F3476B913EDC8F8D69BC60LO2P123MB2256GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhpcyBpcyBhIGdvb2QgcG9pbnQ7IHRoZXJlIGFyZSB2YWxpZCByZWFzb25zIHdoeSAxLjEuMS4x IGNhbiBiZSB0aGUgcmlnaHQgcHJvdmlkZXIgZm9yIHNvbWUgdXNlcnMuIFBsZWFzZSBhbGxvdyBt ZSB0byBjbGFyaWZ5IHNvbWUgcG9zc2libGUgbWlzdW5kZXJzdGFuZGluZ3MuDQoNCknigJltIG5v dCBhZ2FpbnN0IERvSC4NCknigJltIG5vdCBhZ2FpbnN0IHByaXZhY3kgYW5kIHNlY3VyaXR5Lg0K SeKAmW0gbm90IGFnYWluc3QgdXNlciBjaG9pY2UuDQoNClRoZXNlIGFyZSBhbGwgdmFsdWFibGUg dGhpbmdzIHdlIHNob3VsZCBzdHJpdmUgZm9yLiBMZXTigJlzIGRvIGl0IGluIGEgd2F5IHRoYXQg d29ya3MgZm9yIGV2ZXJ5b25lLCBieSBpZGVudGlmeWluZyBhbmQgZG9jdW1lbnRpbmcgYmVzdCBw cmFjdGljZS4NCg0KQ2hyaXMNCg0KRnJvbTogQWRkIDxhZGQtYm91bmNlc0BpZXRmLm9yZz4gT24g QmVoYWxmIE9mIEpvc2VwaCBMb3JlbnpvIEhhbGwNClNlbnQ6IDI0IEp1bHkgMjAxOSAwNjoxOQ0K VG86IFRvbW15IEplbnNlbiA8SmVuc2VuLlRob21hcz00MG1pY3Jvc29mdC5jb21AZG1hcmMuaWV0 Zi5vcmc+DQpDYzogSmltIFJlaWQgPGppbUByZmMxMDM1LmNvbT47IGFkZEBpZXRmLm9yZzsgQnJl dCBKb3JkYW4gPGpvcmRhbi5pZXRmQGdtYWlsLmNvbT47IFJvYiBTYXlyZSA8c2F5cmVyQGdtYWls LmNvbT4NClN1YmplY3Q6IFJlOiBbQWRkXSBmaXhpbmcgY29mZmVlIHNob3AgYnJva2VubmVzcyB3 aXRoIERvSA0KDQpbc25pcF0NCg0KVG9uZSBhc2lkZSwgdG8gc29tZSB1c2VycywgY2VudHJhbGl6 YXRpb24gaXMgYSBiZW5lZml0IGluIHRoYXQgdGhleSBkb24ndCBoYXZlIGEgYnVuY2ggb2YgdW5r bm93biBwcml2YWN5IHBvbGljaWVzIGFwcGx5aW5nIHRvIHRoZSByZXNvbHV0aW9uIG9mIHRoZSBu YW1lcyB0aGV5IG5lZWQuIEZvciBleGFtcGxlLCB0aGUgcHJpdmFjeSBwb2xpY3kgb2YgMS4xLjEu MSBpcyBwcmV0dHkgYW1hemluZyBmcm9tIHRoZSBwZXJzcGVjdGl2ZSBvZiBkYXRhIHJldGVudGlv biwgc2Vjb25kYXJ5IHVzZXMsIGV0Yy4gKGUuZy4sIEkga25vdyBteSByZXNvbHV0aW9ucyB3aWxs IGJlIHJlbW92ZWQgZnJvbSB0aGVpciBsb2dzIHdpdGhpbiAyNCBob3VycykuDQoNClRoaXMgbWF5 IHNlZW0gc21hbGwgYnV0IGl0IHNlZW1zIHRvIGJlIGxvc3QgaW4gdGhlIGNlbnRyYWxpemF0aW9u L2Nob2ljZSBkaXNjdXNzaW9uLg0KLS0NCkpvc2VwaCBMb3JlbnpvIEhhbGwNCkNoaWVmIFRlY2hu b2xvZ2lzdCwgQ2VudGVyIGZvciBEZW1vY3JhY3kgJiBUZWNobm9sb2d5IFtodHRwczovL3d3dy5j ZHQub3JnXQ0KMTQwMSBLIFNUIE5XIFNURSAyMDAsIFdhc2hpbmd0b24gREMgMjAwMDUtMzQ5Nw0K ZTogam9lQGNkdC5vcmc8bWFpbHRvOmpvZUBjZHQub3JnPiwgcDogMjAyLjQwNy44ODI1LCBwZ3A6 IGh0dHBzOi8vam9zZXBoaGFsbC5vcmcvZ3BnLWtleQ0KRmluZ2VycHJpbnQ6IDNDQTIgOEQ3QiA5 RjZEIERCRDMgNEIxMCAgMTYwNyA1Rjg2IDY5ODcgNDBBOSBBODcxDQo= --_000_LO2P123MB22569D3F3476B913EDC8F8D69BC60LO2P123MB2256GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJ bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6 NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0K ZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1h eD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9 IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9k eSBsYW5nPSJFTi1HQiIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJX b3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJl YXN0LWxhbmd1YWdlOkVOLVVTIj5UaGlzIGlzIGEgZ29vZCBwb2ludDsgdGhlcmUgYXJlIHZhbGlk IHJlYXNvbnMgd2h5IDEuMS4xLjEgY2FuIGJlIHRoZSByaWdodCBwcm92aWRlciBmb3Igc29tZSB1 c2Vycy4gUGxlYXNlIGFsbG93IG1lIHRvIGNsYXJpZnkgc29tZSBwb3NzaWJsZSBtaXN1bmRlcnN0 YW5kaW5ncy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1s YW5ndWFnZTpFTi1VUyI+SeKAmW0gbm90IGFnYWluc3QgRG9ILjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFn ZTpFTi1VUyI+SeKAmW0gbm90IGFnYWluc3QgcHJpdmFjeSBhbmQgc2VjdXJpdHkuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJl YXN0LWxhbmd1YWdlOkVOLVVTIj5J4oCZbSBub3QgYWdhaW5zdCB1c2VyIGNob2ljZS48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZh cmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+ VGhlc2UgYXJlIGFsbCB2YWx1YWJsZSB0aGluZ3Mgd2Ugc2hvdWxkIHN0cml2ZSBmb3IuIExldOKA mXMgZG8gaXQgaW4gYSB3YXkgdGhhdCB3b3JrcyBmb3IgZXZlcnlvbmUsIGJ5IGlkZW50aWZ5aW5n IGFuZCBkb2N1bWVudGluZyBiZXN0IHByYWN0aWNlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1V UyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5DaHJpczxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1s YW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiPkZyb206PC9zcGFuPjwvYj48c3BhbiBsYW5n PSJFTi1VUyI+IEFkZCAmbHQ7YWRkLWJvdW5jZXNAaWV0Zi5vcmcmZ3Q7DQo8Yj5PbiBCZWhhbGYg T2YgPC9iPkpvc2VwaCBMb3JlbnpvIEhhbGw8YnI+DQo8Yj5TZW50OjwvYj4gMjQgSnVseSAyMDE5 IDA2OjE5PGJyPg0KPGI+VG86PC9iPiBUb21teSBKZW5zZW4gJmx0O0plbnNlbi5UaG9tYXM9NDBt aWNyb3NvZnQuY29tQGRtYXJjLmlldGYub3JnJmd0Ozxicj4NCjxiPkNjOjwvYj4gSmltIFJlaWQg Jmx0O2ppbUByZmMxMDM1LmNvbSZndDs7IGFkZEBpZXRmLm9yZzsgQnJldCBKb3JkYW4gJmx0O2pv cmRhbi5pZXRmQGdtYWlsLmNvbSZndDs7IFJvYiBTYXlyZSAmbHQ7c2F5cmVyQGdtYWlsLmNvbSZn dDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtBZGRdIGZpeGluZyBjb2ZmZWUgc2hvcCBicm9r ZW5uZXNzIHdpdGggRG9IPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5bc25pcF08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ VG9uZSBhc2lkZSwgdG8gc29tZSB1c2VycywgY2VudHJhbGl6YXRpb24gaXMgYSBiZW5lZml0IGlu IHRoYXQgdGhleSBkb24ndCBoYXZlIGEgYnVuY2ggb2YgdW5rbm93biBwcml2YWN5IHBvbGljaWVz IGFwcGx5aW5nIHRvIHRoZSByZXNvbHV0aW9uIG9mIHRoZSBuYW1lcyB0aGV5IG5lZWQuIEZvciBl eGFtcGxlLCB0aGUgcHJpdmFjeSBwb2xpY3kgb2YgMS4xLjEuMSBpcyBwcmV0dHkgYW1hemluZyBm cm9tIHRoZQ0KIHBlcnNwZWN0aXZlIG9mIGRhdGEgcmV0ZW50aW9uLCBzZWNvbmRhcnkgdXNlcywg ZXRjLiAoZS5nLiwgSSBrbm93IG15IHJlc29sdXRpb25zIHdpbGwgYmUgcmVtb3ZlZCBmcm9tIHRo ZWlyIGxvZ3Mgd2l0aGluIDI0IGhvdXJzKS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhpcyBtYXkgc2VlbSBzbWFsbCBidXQgaXQgc2VlbXMg dG8gYmUgbG9zdCBpbiB0aGUgY2VudHJhbGl6YXRpb24vY2hvaWNlIGRpc2N1c3Npb24uPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4t LSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Kb3NlcGggTG9y ZW56byBIYWxsPGJyPg0KQ2hpZWYgVGVjaG5vbG9naXN0LCBDZW50ZXIgZm9yIERlbW9jcmFjeSAm YW1wOyBUZWNobm9sb2d5IFs8YSBocmVmPSJodHRwczovL3d3dy5jZHQub3JnIj5odHRwczovL3d3 dy5jZHQub3JnPC9hPl08YnI+DQoxNDAxIEsgU1QgTlcgU1RFIDIwMCwgV2FzaGluZ3RvbiBEQyAy MDAwNS0zNDk3PGJyPg0KZTogPGEgaHJlZj0ibWFpbHRvOmpvZUBjZHQub3JnIj5qb2VAY2R0Lm9y ZzwvYT4sIHA6IDIwMi40MDcuODgyNSwgcGdwOiA8YSBocmVmPSJodHRwczovL2pvc2VwaGhhbGwu b3JnL2dwZy1rZXkiPg0KaHR0cHM6Ly9qb3NlcGhoYWxsLm9yZy9ncGcta2V5PC9hPjxicj4NCkZp bmdlcnByaW50OiAzQ0EyIDhEN0IgOUY2RCBEQkQzIDRCMTAmbmJzcDsgMTYwNyA1Rjg2IDY5ODcg NDBBOSBBODcxPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1s Pg0K --_000_LO2P123MB22569D3F3476B913EDC8F8D69BC60LO2P123MB2256GBRP_-- From nobody Wed Jul 24 06:05:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F7B9120148 for ; Wed, 24 Jul 2019 06:05:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OOVqrBJBqce9 for ; Wed, 24 Jul 2019 06:05:42 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B31EB1200EC for ; Wed, 24 Jul 2019 06:05:41 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 0C9856A27D; Wed, 24 Jul 2019 15:05:39 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563973539; bh=JKvZGmyZ3OL4lnOv78jRrwJ5JSKb9HtGhasQUuu0MM4=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=8Pq/kssUUMRjLWg88mDBAhqOSA2MhiqRGVF31wtTA3swiq9W0qVdJLABIdS2g6LWb EN6jkgfQZ5SgKKzB7UHVVFDAlkOxX/plcTlLYNZek3z0RnZxXNTGMuX6VocZxLSd+0 xeSQ/tKBSPRgMHt1eWNUZiweA8EhN1L4n2tCcSlVxNmoxZUE37hIoCgRZbMd06wkdL VZro5rL7BiM1Pi3zz+V+qqnrBa/6TLDVqq5+HY2P5qVgI3fVvwQAjO5uHm3tSgEd3P 01NkWCsXwEgq5dzh8C/Eo7lqhTwpQJogtTHy9S9vUXk89mYqvjlCxTevXXMCqoVSmL BbTsPesuu9Z7w== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id F216F3C03AA; Wed, 24 Jul 2019 15:05:38 +0200 (CEST) Date: Wed, 24 Jul 2019 15:05:38 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Joseph Lorenzo Hall Cc: "add@ietf.org" Message-ID: <520325278.24189.1563973538937@appsuite-gw1.open-xchange.com> In-Reply-To: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev8 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:05:44 -0000 =20 =20

Il 24 luglio 2019 12:19 Joseph Lorenzo Hall <joe@cdt.org> ha scri= tto:




On Tue, Jul 23, 2019 at 22:26 Tommy Jensen <Jensen.Thomas=3D 40microsoft.com@dma= rc..ietf.org> wrote:
> Are people selling DNS logs to ad tech companies? Is that the e= cosystem being disrupted?

Given how many valid points have been brought up in the last few= weeks about the drawbacks of centralized app-configured DNS, I don=E2=80= =99t think the glib tone is constructive.

Tone aside, to some users, centralization is a benefit in that they d= on't have a bunch of unknown privacy policies applying to the resolution of= the names they need. For example, the privacy policy of 1.1.1.1 is pretty = amazing from the perspective of data retention, secondary uses, etc. (e.g.,= I know my resolutions will be removed from their logs within 24 hours).

This may seem small but it seems to be lost in the centralization/cho= ice discussion.
What you seem to want above, however, is not made possible by centraliza= tion, but by user choice, i.e. the user being able to tell all the applicat= ions to use a specific resolver that has a privacy policy they like. Centra= lization might make your choice easier, since you have less privacy policie= s to compare, but might also make it impossible for you to find one that yo= u actually like - the fewer they are, the easier it is for them to form a c= artel and impose conditions that are only good for them.=20

Moreover, the above is already possible today over unencrypted DNS(*) - = just enter "1.1.1.1" or whatever other IP address in the configuration of y= our operating system. And DoH could even make it go away, if applications s= tarted to tell you that you are "not technical enough" to even deserve a co= nfiguration option, and started sending your DNS queries to a resolver that= you did not choose and that maybe does not have the privacy policy you wan= t.

(I will also note that all this focus on privacy policies is a U.S. bias= - in Europe, all resolvers have a pretty restrictive basic privacy policy = which is mandated by the requirements of the GDPR, though of course there s= till are differences that deserve giving users a choice.)


(*) bar transparent proxying etc, which encrypted DNS will make impossib= le and I don't think anyone has objections to that, as long as in the overa= ll we build a system that works for everyone.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open=
-Xchange
vittorio.b=
ertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Ital=
y
=20 From nobody Wed Jul 24 06:15:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E77361201EC for ; Wed, 24 Jul 2019 06:15:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H6bdDUwHPuWK for ; Wed, 24 Jul 2019 06:15:16 -0700 (PDT) Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com [IPv6:2a00:1450:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1CF11201D7 for ; Wed, 24 Jul 2019 06:15:15 -0700 (PDT) Received: by mail-lj1-x22b.google.com with SMTP id m23so44393279lje.12 for ; Wed, 24 Jul 2019 06:15:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=WQ2W8mYaRBLbxFVhM01HGqqWDPD8hnM1icc+BtKtktc=; b=N8c7Z0wyi2NhOV/CMmzg5xgC0vsty85jUEceC2cwMcTeaD4wilit35HqnogPc9+yis fGpNLX5W2nfIVapMtcmnNkdOiBGjltqBzarDhYhjqFtmt1TeVdBhvz7MV5zwpSD6XElN oFtgxMC0y2Csya17WQYGPCpff2CbCNtbaENrwnqJxC+jDSKo0BoPcbQIMbLmQylX/Oaa VOCQWPqTl8tCceS9v2Yuwgg4mmSferge7aixnYppn3w+b8NVE9SV37kbsEGM0zkgOKz8 pYhiP8KpxcrTkxeo4Id14DgJo3jvN6Ab+aot3Z04CgUd5tIji1ev62IDGale4ZIDX8gX skwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=WQ2W8mYaRBLbxFVhM01HGqqWDPD8hnM1icc+BtKtktc=; b=f1w0EpTuub3IB04aJch5+SKfRVsqxkKfkMT77Yb+nWfI/IRk7mTknDtB77xZ+Oe4QD Kbjq/AdZ4VAR9C06nn3lH8s9tHxRhxoAgoUTFQ5NWz9nOY4KJO1U0wHxgqpoHLykDycp BuofWPF0q9LIq7cQPx0nXjwtQjHXtfdUHayJWIAHPKlfUqsB/lnkPX/8YsjGEBlq+3/h oGX+zstjtG7OIamiFNjIl0S2OFjxv7olnJaSRRPj3cE8/sEvZuu4GrY0JcOOxb/KH4jk cjzCrkoFCUmrQUFJd+nytWR89oIvybQuecgNzoCYVD7+JRRTRK6AQYncVjmDljbLeqqi BJYQ== X-Gm-Message-State: APjAAAWvoZYCS/PFUZI0sim+v7Z0t00s08Fp9pdC+hThe7nRDrkmNwAJ GGdsXQVw39rAYf3eDPjdN2a3ZJvtMOgAHAY0ssY= X-Google-Smtp-Source: APXvYqz/TWiQV4Z/p7X2YCex4BpOtXphayRtPn4lPTP3SUh+R9IMP4GoBX1YZyfEUWQsYRUV7wAb43hJ9OuTqXF/j7M= X-Received: by 2002:a2e:9cd4:: with SMTP id g20mr20412933ljj.205.1563974113971; Wed, 24 Jul 2019 06:15:13 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> In-Reply-To: <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> From: Eric Rescorla Date: Wed, 24 Jul 2019 06:14:37 -0700 Message-ID: To: Ted Lemon Cc: Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="00000000000080624c058e6d19c8" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:15:18 -0000 --00000000000080624c058e6d19c8 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 3:54 AM Ted Lemon wrote: > On Jul 24, 2019, at 6:40 AM, Eric Rescorla wrote: > >> In many cases, whether you are being told the truth by your recursive > resolver is a less interesting property than whether you can get the > correct answer. For instance, if the recursive resolver replaces the A > record you want with NXDOMAIN even if you know that it's done so, you're > still blocked from going where you wanted to go. > > However, even if you are not blocked, without DNSSEC you do not know that > the resolver gave you the right answer. So ideally you want both: not to > be blocked, and also to be able to validate the result you got. > Well, this is true, but in the Web context, as we move towards 100% HTTPS, the importance of getting the right IP starts to decrease quite a bit: if you get the wrong IP address, then this turns into a connection failure. -Ekr --00000000000080624c058e6d19c8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 3:54 AM Ted L= emon <mellon@fugue.com> wrote= :
On Jul 24, 201= 9, at 6:40 AM, Eric Rescorla <ekr@rtfm.com> wrote:
>> In many cases, whether you are being told the truth by your recurs= ive resolver is a less interesting property than whether you can get the co= rrect answer. For instance, if the recursive resolver replaces the A record= you want with NXDOMAIN even if you know that it's done so, you're = still blocked from going where you wanted to go.

However, even if you are not blocked, without DNSSEC you do not know that t= he resolver gave you the right answer.=C2=A0 So ideally you want both: not = to be blocked, and also to be able to validate the result you got.

Well, this is true, but in the Web context, as= we move towards 100% HTTPS, the importance of getting the right IP starts = to decrease quite a bit: if you get the wrong IP address, then this turns i= nto a connection failure.

-Ekr

<= /div>

--00000000000080624c058e6d19c8-- From nobody Wed Jul 24 06:20:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 640621201F2 for ; Wed, 24 Jul 2019 06:20:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FXbCxtkjy9o4 for ; Wed, 24 Jul 2019 06:20:37 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 679361203B9 for ; Wed, 24 Jul 2019 06:20:37 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id E5C9D6A27D; Wed, 24 Jul 2019 15:20:35 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563974435; bh=Q467eymg+Ujndy4KnO/XHFjw6HHpmsGzR6zrYLqtM7U=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=wIxhGATzVNaqLZrkoqzJzNwKBxdUtgfm/LZ3pMUWrMKKLsn5QVuWaJKcAUFh/95Mq OciEp7svJy/GfE12ZAu63yePUa+a78tACpTJtvZxzAQefQ1DwnnhIPc0IJB5fRNM8W fNLoTPFzvcKru5jNFpjn/AZvkga9ZBv7RBHFy3YYmoBk1i43NQ9XvKYX/IF3V/YFPC aUR8ye8NHOt/+KCAB47ZihSjC7J4sVo3vQ8j6RZBP+Z9gbhaQqTDWrDnSjafisSXFI 6I0Blfs5AGESb7fzIjKFbr/kexJLgQpIJ4SI7yWpn/afAJ8f4qhwmFlU11tDnwGIdG TOTVjk9riSP7A== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id D8D343C03AA; Wed, 24 Jul 2019 15:20:35 +0200 (CEST) Date: Wed, 24 Jul 2019 15:20:35 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Rob Sayre Cc: "add@ietf.org" Message-ID: <475222798.24238.1563974435834@appsuite-gw1.open-xchange.com> In-Reply-To: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev8 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:20:47 -0000

Il 24 luglio 2019 00:58 Rob Sayre <sayrer@gmail.com> ha scritto:

The bottom line is this: the IETF has been unable to secure DNS in a successful way for 31 years. I think people are losing patience.
Well, if the Web and OTT industry is "losing patience" about a presumed lack of security in DNS, perhaps they could start by actually deploying DNSSEC and DANE in browsers, in their big email platforms and the likes, isn't it?

Rather than on a blame game, I think it would be much better if we could focus on imagining how the DNS should work in the future and be a great naming system for the 21st century. Both DNSSEC and encrypted transport are part of this, and possibly other pieces that still need to be developed, such as a way to discover and negotiate policies between the client and the network.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
From nobody Wed Jul 24 06:33:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4242120384 for ; Wed, 24 Jul 2019 06:33:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nIbIzcN8HRgc for ; Wed, 24 Jul 2019 06:33:40 -0700 (PDT) Received: from mail-lf1-x131.google.com (mail-lf1-x131.google.com [IPv6:2a00:1450:4864:20::131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25776120376 for ; Wed, 24 Jul 2019 06:33:40 -0700 (PDT) Received: by mail-lf1-x131.google.com with SMTP id z15so27701359lfh.13 for ; Wed, 24 Jul 2019 06:33:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5SmeJ/vUjQWA+H9L8hzVJfjiPbUJsdq6ONZL3bXTYG0=; b=fvMTNwVlScC+mpqI3h0BtOI0GijYgK3Mcb1r5JwvVnOzxjruumf9yrbwBB7bNFUSnz NTGddi01QUQU4oicdX837nPsdhahguGO3dtNVPxqRqqN2XNCzBZor8kYyiZ/6L9f4sF7 ff5gx8TLdYhJ5WAdvI0gsec3cTZS+jpGuo8ngHNvQs3cU4gJvbF74A0wRDNcQTEkiROS qINSQ81sYPGHdNElfjbsynE56Do1u3PVDBcFgvp5/++q36hjiQx348cBREl8DsvoKMZn BM9pOsCDWVOoMIPwL302xLpmU6e9u8i4MFAf0VvvV3mRtutdWWnCJ8Ii67HIh7JQGtRK P0Ww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5SmeJ/vUjQWA+H9L8hzVJfjiPbUJsdq6ONZL3bXTYG0=; b=lFJVQbR40d1bY/yS2dFuTxqwUcrW7gnmgW8dC/TDomrUpM/93X4LZbNv6908THKsQg xmS+omrg+BUc/bhR68CnjX5Mo5RCNxvl5Hif7ajF0lvD5fOqufo28Q7XuxhkIan3YzT5 Dm9vLwV/6gnuA5V5jv7s9nZJXL9dXGsUGBP2Tluk9KbkLS42kqfucGv48FmuDsm+yJN1 W5l46gwVhbjDWHmybx9sC00bW9GrbzbbIvDDPmDnX43G2rPqwiTQ61BTd1wuZsuoXpdB lpRv8TBIkIGkF6dNKXZQZquB/Ct4LT9PRE6ixPZb5HVzBa12lY46STDLzJ1x4KIBsVUz GHrA== X-Gm-Message-State: APjAAAV7K+LvnXbugobe+AedN75p+uRBBELhtCuyEqtSVh+dRy6ZRrA3 D+thk3sskJRbcVHWISrvmno8tyPABuc/azrTcfk= X-Google-Smtp-Source: APXvYqwjgyoiimyUYzwCGdoB7rIoPiz5WxNGIQyaG18mgn+gpt0COQuR9mcEykDgmk/yghG55reSZ5woB5hnICy5d3Y= X-Received: by 2002:ac2:4202:: with SMTP id y2mr4064366lfh.178.1563975218411; Wed, 24 Jul 2019 06:33:38 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <475222798.24238.1563974435834@appsuite-gw1.open-xchange.com> In-Reply-To: <475222798.24238.1563974435834@appsuite-gw1.open-xchange.com> From: Eric Rescorla Date: Wed, 24 Jul 2019 06:33:02 -0700 Message-ID: To: Vittorio Bertola Cc: Rob Sayre , "add@ietf.org" Content-Type: multipart/alternative; boundary="00000000000054cd09058e6d5bd6" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:33:48 -0000 --00000000000054cd09058e6d5bd6 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 6:21 AM Vittorio Bertola wrote: > > Il 24 luglio 2019 00:58 Rob Sayre ha scritto: > > The bottom line is this: the IETF has been unable to secure DNS in a > successful way for 31 years. I think people are losing patience. > > Well, if the Web and OTT industry is "losing patience" about a presumed > lack of security in DNS, perhaps they could start by actually deploying > DNSSEC and DANE in browsers, in their big email platforms and the likes, > isn't it? > As I indicated in a previous message: DNSSEC does not address a number of the security issues that we are concerned with. DANE is an orthogonal issue. -Ekr > Rather than on a blame game, I think it would be much better if we could > focus on imagining how the DNS should work in the future and be a great > naming system for the 21st century. Both DNSSEC and encrypted transport are > part of this, and possibly other pieces that still need to be developed, > such as a way to discover and negotiate policies between the client and the > network. > > -- > > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com > Office @ Via Treviso 12, 10144 Torino, Italy > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000054cd09058e6d5bd6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 6:21 AM Vitto= rio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:
=20 =20 =20

Il 24 luglio 2019 00:58 Rob Sayre <sayrer@gmail.com> ha scritto:

The bottom line is this: the IETF has been unable to secure DNS in a = successful way for 31 years. I think people are losing patience.
Well, if the Web and OTT industry is "losing patience" about a= presumed lack of security in DNS, perhaps they could start by actually dep= loying DNSSEC and DANE in browsers, in their big email platforms and the li= kes, isn't it?

As I indicated in a pre= vious message: DNSSEC does not address a number of the security issues that= we are concerned with. DANE is an orthogonal issue.

-Ekr


Rather than on a blame game, I think it would be much better if we could= focus on imagining how the DNS should work in the future and be a great na= ming system for the 21st century. Both DNSSEC and encrypted transport are p= art of this, and possibly other pieces that still need to be developed, suc= h as a way to discover and negotiate policies between the client and the ne= twork.=20

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchangevit=
torio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torin=
o, Italy
=20
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--00000000000054cd09058e6d5bd6-- From nobody Wed Jul 24 06:53:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16F8F120362 for ; Wed, 24 Jul 2019 06:53:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ou6oTuTBqaTz for ; Wed, 24 Jul 2019 06:53:15 -0700 (PDT) Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 375E8120311 for ; Wed, 24 Jul 2019 06:53:15 -0700 (PDT) Received: by mail-qk1-x735.google.com with SMTP id s22so33803374qkj.12 for ; Wed, 24 Jul 2019 06:53:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=poO6xBmPmSSXweVDvNH+GQDs5VS2ifItBszpodp4B8k=; b=l6k0p39UuT/TjABy3WmsMy1DH5ha15Y1zxSGvK/cpRGIZigYdcet6S5OUnlhpyHKK8 XDES6W0Vxncfa6x/QjvI6hY+WK8w9PWyRA8yzpA4uaahRE4qhtuabOGNLJI6Ag32RyIn DX5rZ/6GwUKKTgdTiODbjeAQWj8i8P706tgpkdXdT+0qVBNMemhAZ+U8I4rq2OvPomUY HqHCPgnOMrzAfgeen1A/Aieigc4xsy52joPfa9nFaUn62LZe9mq8s4nigZ8jNsfC515W rub+b1CWExYXlBZfHHNn+VK7Y9hSXSs/+6d6E7GYsOirk21U0cZoEDUFSQ2cxOmKD749 cLAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=poO6xBmPmSSXweVDvNH+GQDs5VS2ifItBszpodp4B8k=; b=HHe2kSgpPLy8mpWyeR3K2Wk0+u+tsFpt2P+ESsg89GJTvGJHaGdGo3zz0hP0DBvr6L vI+aSCuOmagOgAmSJEs5buqBUhqNvu8T29gwL6FPPKrHVt1GbQIA7rXcNPJxGarby9hT NM+wIvVqVTdyhlu5VulqKfW+jXdwHIgytDrObbDeI28qWmX9UEuhaoPy/0otzzTmzG+z s2Ft03sUTRFBVVgv7z1yFsTM9U6GW3SHpOSp+UjbBzZ2NjrSDnfGBhhI077qS+ESW4kW TCfc/3GF4fBnKMncWr6IqCMRGCwM+CHtPal05m4QnY12v1QE2/um2g/A2yU3nHJ3aqsm 6T8g== X-Gm-Message-State: APjAAAV0yJbhzorXiw8zmsjwkWb/ydC9GDRc2DmN+4zWtXbmgj3T5I7F SaqIldzpt9any24QR/3rnJLZ7lfN+YNNMg== X-Google-Smtp-Source: APXvYqwNArcsJujrqlOUWsJ81It30cCWLDoLPuTByq4CumYnjoJQ0Alx/QZCSJsRmdNGsadotVHl/g== X-Received: by 2002:a37:7cf:: with SMTP id 198mr55165248qkh.450.1563976394136; Wed, 24 Jul 2019 06:53:14 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:88a5:33f4:e4fc:78c6? ([2001:67c:1232:144:88a5:33f4:e4fc:78c6]) by smtp.gmail.com with ESMTPSA id n93sm21769777qte.1.2019.07.24.06.53.13 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 06:53:13 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Wed, 24 Jul 2019 09:53:12 -0400 Cc: Jim Reid , "add@ietf.org" , Rob Sayre Content-Transfer-Encoding: quoted-printable Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> To: Eric Rescorla Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:53:21 -0000 On Jul 24, 2019, at 9:14 AM, Eric Rescorla wrote: >=20 > Well, this is true, but in the Web context, as we move towards 100% HTTPS,= the importance of getting the right IP starts to decrease quite a bit: if y= ou get the wrong IP address, then this turns into a connection failure. Sort of like a fake NXDOMAIN, then?= From nobody Wed Jul 24 07:04:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A61012032A for ; Wed, 24 Jul 2019 07:03:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cdt.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qq1EGDkdV0WZ for ; Wed, 24 Jul 2019 07:03:56 -0700 (PDT) Received: from mail-io1-xd33.google.com (mail-io1-xd33.google.com [IPv6:2607:f8b0:4864:20::d33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0669512033C for ; Wed, 24 Jul 2019 07:03:51 -0700 (PDT) Received: by mail-io1-xd33.google.com with SMTP id f4so89827608ioh.6 for ; Wed, 24 Jul 2019 07:03:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cdt.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Trv1y6VOhENWa50rcMgZHUaDTB6VrNen0VZw94eMR6c=; b=lZ+OO0qstgz3XAdhKg+r8fFXxi/rW5zEBdw+nGRJ2JhBAKSxDpwCqrX7r8O5gHOJQQ 5AKYaKdKnFdx40ZPKuZpaOsN5EfxcL4Nw+ZUJT2WH0XozM0kE7//f48XvtDGc15jSWyd zsFjT6pYuL6uhBtR8rYayiBzrVnwnohXJiv2g= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Trv1y6VOhENWa50rcMgZHUaDTB6VrNen0VZw94eMR6c=; b=t0Q0DNvFwR3zvCxg2ItT5eyUmB7K7kRkPZ/l6BmOYDu6Ep3ymMtExSpetRI386VtZP WjGCMFTOxIWfagBM+sMf3KkbORIxUbAaTd2eC3c2o49iSV4YHJ+tVpZT0Dci/QHfIvqD 7IAG/RxnykkI0Iq9T1CFaGo/lw9q+lMiZ/gpc4u7B20A/wwacwSQMtUJBbkIQ7rQqhFl rBeNm4ACejiYCM9tO0PyJnuNfKLRx1XiJyiszkRnPzKCUXYTQlu3Rx8laKmSoMCdXgLQ WoAPx2GXjbdQfaQLUzZxYG0krkd4vL/MLRhJOBRenlvC6/c1tsOOHRqs65k2OgEypaGf ESuQ== X-Gm-Message-State: APjAAAXeLaG8FiiLPw7H4yZXaLjv4k2rc9yVmQfmKNNMUIw1MTbWBwGs xBZmm13JKJDbeYEIdZdafyepqN/ZWnMkOgXlbBO+niYmvbj2ZA== X-Google-Smtp-Source: APXvYqztKYOlHVYa7FhTysAamJsUZknng/sXRmqJ6axu2w6OIEKxwGBBMeVDuLYA+0MKSHhQR8NXX8VvFc6nD987o0g= X-Received: by 2002:a6b:5115:: with SMTP id f21mr27648294iob.173.1563977029795; Wed, 24 Jul 2019 07:03:49 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <520325278.24189.1563973538937@appsuite-gw1.open-xchange.com> In-Reply-To: <520325278.24189.1563973538937@appsuite-gw1.open-xchange.com> From: Joseph Lorenzo Hall Date: Wed, 24 Jul 2019 10:03:38 -0400 Message-ID: To: Vittorio Bertola Cc: "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000004c8624058e6dc75e" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:04:03 -0000 --0000000000004c8624058e6dc75e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 9:05 AM Vittorio Bertola < vittorio.bertola@open-xchange.com> wrote: > > Il 24 luglio 2019 12:19 Joseph Lorenzo Hall ha scritto: > > > > > On Tue, Jul 23, 2019 at 22:26 Tommy Jensen 40microsoft.com@dmarc..ietf.org <40microsoft.com@dmarc.ietf.org>> wrote: > > > Are people selling DNS logs to ad tech companies? Is that the ecosystem > being disrupted? > > Given how many valid points have been brought up in the last few weeks > about the drawbacks of centralized app-configured DNS, I don=E2=80=99t th= ink the > glib tone is constructive. > > > Tone aside, to some users, centralization is a benefit in that they don't > have a bunch of unknown privacy policies applying to the resolution of th= e > names they need. For example, the privacy policy of 1.1.1.1 is pretty > amazing from the perspective of data retention, secondary uses, etc. (e.g= ., > I know my resolutions will be removed from their logs within 24 hours). > > This may seem small but it seems to be lost in the centralization/choice > discussion. > > What you seem to want above, however, is not made possible by > centralization, but by user choice, i.e. the user being able to tell all > the applications to use a specific resolver that has a privacy policy the= y > like. Centralization might make your choice easier, since you have less > privacy policies to compare, but might also make it impossible for you to > find one that you actually like - the fewer they are, the easier it is fo= r > them to form a cartel and impose conditions that are only good for them. > > These are good points... in the case I'm talking about it's definitely having user choice, having understandable privacy policies (to people like me, not end-users necessarily), and having usable ways of turning this on (e.g., the 1.1.1.1 app from Cloudflare or the Intra app from Google for older Android to use DoT). > (I will also note that all this focus on privacy policies is a U.S. bias = - > in Europe, all resolvers have a pretty restrictive basic privacy policy > which is mandated by the requirements of the GDPR, though of course there > still are differences that deserve giving users a choice.) > So true... We're actively working on generic data protection laws in the USA, wish us luck! best, Joe --0000000000004c8624058e6dc75e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 9:05 AM Vitto= rio Bertola <vittor= io.bertola@open-xchange.com> wrote:
=20 =20 =20

Il 24 luglio 2019 12:19 Joseph Lorenzo Hall <joe@cdt.org> ha scritto:




On Tue, Jul 23, 2019 at 22:26 Tommy Jensen <Jensen.Thomas=3D 4= 0microsoft.com@dmarc..ietf.org> wrote:
> Are people selling DNS logs to ad tech companies? Is that the e= cosystem being disrupted?

Given how many valid points have been brought up in the last few= weeks about the drawbacks of centralized app-configured DNS, I don=E2=80= =99t think the glib tone is constructive.

Tone aside, to some users, centralization is a benefit in that they d= on't have a bunch of unknown privacy policies applying to the resolutio= n of the names they need. For example, the privacy policy of 1.1.1.1 is pre= tty amazing from the perspective of data retention, secondary uses, etc. (e= .g., I know my resolutions will be removed from their logs within 24 hours)= .

This may seem small but it seems to be lost in the centralization/cho= ice discussion.
What you seem to want above, however, is not made possible by centraliza= tion, but by user choice, i.e. the user being able to tell all the applicat= ions to use a specific resolver that has a privacy policy they like. Centra= lization might make your choice easier, since you have less privacy policie= s to compare, but might also make it impossible for you to find one that yo= u actually like - the fewer they are, the easier it is for them to form a c= artel and impose conditions that are only good for them.=20


These are good points..= . in the case I'm talking about it's definitely having user choice,= having understandable privacy policies (to people like me, not end-users n= ecessarily), and having usable ways of turning this on (e.g., the 1.1.1.1 a= pp from Cloudflare or the Intra app from Google for older Android to use Do= T).
=C2=A0
(I will also note that all this focus on privacy policies is a U.S.= bias - in Europe, all resolvers have a pretty restrictive basic privacy po= licy which is mandated by the requirements of the GDPR, though of course th= ere still are differences that deserve giving users a choice.)

So true... We're actively w= orking on generic data protection laws in the USA, wish us luck! best, Joe<= br>

--0000000000004c8624058e6dc75e-- From nobody Wed Jul 24 07:15:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 94D54120165 for ; Wed, 24 Jul 2019 07:15:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u59KhTZFRUKn for ; Wed, 24 Jul 2019 07:15:37 -0700 (PDT) Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A07661202EE for ; Wed, 24 Jul 2019 07:15:37 -0700 (PDT) Received: by mail-qt1-x82e.google.com with SMTP id 44so14595378qtg.11 for ; Wed, 24 Jul 2019 07:15:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=jWj0mnWOOg86yDTy+NMDiwteiXMrus2Jj/qZMynfRzQ=; b=1P9493di6zqpf2TpJbgSJPoR+v7xgMzzr2ZXheKF9SlZrkjqlWcrCFQ4swRDUVpHe6 xMRkR3Cizr9bFemMfRO6fXlsz0bmXvLs9XKx+d3Kcwx2QU1Vzpg2hxzSt/iQlBm11XVR AAOGm2IyIWqZws8Yxqf8o4bq8rmwvN3FJ0OngsdzYttrtyFtcbZ+8wclRO4EXxWto7pD w3nsdOi1IEruBFNP9/0K1r6QdwqB35P3iMCu27KM23hEoY/jSmhtL5eL7G83Tp92n7Al Ztm2KE35FJNN1/8AqXKs5+vfxTFsFq5MhXh/s0oBx3hU7ykrx4SL3mhX/kbRwjpSnD1u AG3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=jWj0mnWOOg86yDTy+NMDiwteiXMrus2Jj/qZMynfRzQ=; b=jcHFHCaUpaZF9jinn/+Ta6DmY1ECSm0s+KCGVaCUrpPa7EFN4aoGVC11KjUU18pIvJ nfhKHlNZ4ak+F+US599B3vkL9SpB1kuduQGETgfl9kdhzI+NeDt3TMDFJR6rbTPvLLmc 2JMFipiWwdWFnWssWhOMYX7xj+d3b92i9Wz4qAWcn1Ha90U5FApWAF3wYRs5SJrzg7Lq qrokp08Tn1Rqs/R1WjF/7qlEpEQMm0qnwVIhbdYjp9kx5HhD7bO/35AcfoScD5cON8ud QjCcjbzQz4VMM15lBaN7Vo8PmobRZ8mJP3IUnK9Vgi+OouX8hjAldDhK4v613W3RBFSA vkPg== X-Gm-Message-State: APjAAAX8SlIB/fNCySwnszPi48Fc1+hT0wRcuv/+od7Msu9w3qDqXSSe DmlGcIwJ7Vk+aj7oWzvDpJLHhQ== X-Google-Smtp-Source: APXvYqx5c95NlBCINnvHFkkwS6tMrFhVMFlLK2rjTpT6QR+Q7uF7MrTPXTNKfEXXpxGd3Kyu2YNHPA== X-Received: by 2002:a0c:aede:: with SMTP id n30mr59026892qvd.152.1563977736685; Wed, 24 Jul 2019 07:15:36 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:b954:d2fe:7e59:68aa? ([2001:67c:370:128:b954:d2fe:7e59:68aa]) by smtp.gmail.com with ESMTPSA id m27sm22857717qtu.31.2019.07.24.07.15.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 07:15:36 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_21DE8653-20AC-49EB-8FFF-C78DD7127AF4" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Ted Lemon X-Priority: 3 In-Reply-To: <520325278.24189.1563973538937@appsuite-gw1.open-xchange.com> Date: Wed, 24 Jul 2019 10:15:33 -0400 Cc: Joseph Lorenzo Hall , "add@ietf.org" Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <520325278.24189.1563973538937@appsuite-gw1.open-xchange.com> To: Vittorio Bertola X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:15:43 -0000 --Apple-Mail=_21DE8653-20AC-49EB-8FFF-C78DD7127AF4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 24, 2019, at 9:05 AM, Vittorio Bertola = wrote: > What you seem to want above, however, is not made possible by = centralization, but by user choice, i.e. the user being able to tell all = the applications to use a specific resolver that has a privacy policy = they like. I asked this question earlier and nobody answered, so I=E2=80=99ll ask = it again. How do we ensure that the user has a choice and that the = choice is honored? Or to put it differently, suppose a malicious app = wants to funnel all user DNS requests to a tracker. How can we detect = that this is happening? How can we prevent it? I think there=E2=80=99s a tendency to not talk about this problem = because I think it=E2=80=99s an extremely hard problem. It pretty much = boils down to this: who can the user trust? Can the user even = meaningfully evaluate their determination of trust? At present, the = trust model is =E2=80=9Cif I download the browser from Mozilla, I can = trust it,=E2=80=9D or some variation on that model. This maybe works = for something like Firefox, but, if pretty much any app is doing DoH, = can we even tell that this is happening? I can think of ways of making it hard for the app to misbehave in this = way, but no way to completely prevent it. This is important for two reasons. First, we should not pretend that = we can prevent what we can=E2=80=99t prevent. Secondly, we should = actually come up with a mitigation strategy. --Apple-Mail=_21DE8653-20AC-49EB-8FFF-C78DD7127AF4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 24, 2019, at 9:05 AM, Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> = wrote:
What you seem to want above, = however, is not made possible by centralization, but by user choice, = i.e. the user being able to tell all the applications to use a specific = resolver that has a privacy policy they = like.

I = asked this question earlier and nobody answered, so I=E2=80=99ll ask it = again.  How do we ensure that the user has a choice and that the = choice is honored?   Or to put it differently, suppose a malicious = app wants to funnel all user DNS requests to a tracker.   How can = we detect that this is happening?   How can we prevent = it?

I think = there=E2=80=99s a tendency to not talk about this problem because I = think it=E2=80=99s an extremely hard problem.   It pretty much = boils down to this: who can the user trust?  Can the user even = meaningfully evaluate their determination of trust?   At present, = the trust model is =E2=80=9Cif I download the browser from Mozilla, I = can trust it,=E2=80=9D or some variation on that model.  This maybe = works for something like Firefox, but, if pretty much any app is doing = DoH, can we even tell that this is happening?

I can think of ways of making it hard = for the app to misbehave in this way, but no way to completely prevent = it.

This is = important for two reasons.   First, we should not pretend that we = can prevent what we can=E2=80=99t prevent.   Secondly, we should actually come up with a mitigation = strategy.

= --Apple-Mail=_21DE8653-20AC-49EB-8FFF-C78DD7127AF4-- From nobody Wed Jul 24 07:21:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5E64120272 for ; Wed, 24 Jul 2019 07:21:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RYIufqIjf3FL for ; Wed, 24 Jul 2019 07:21:08 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 194A51201AF for ; Wed, 24 Jul 2019 07:21:08 -0700 (PDT) Received: from dhcp-8a04.meeting.ietf.org (dhcp-8a04.meeting.ietf.org [31.133.138.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id A295D242109D; Wed, 24 Jul 2019 14:21:05 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 24 Jul 2019 15:21:03 +0100 Cc: "add@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <2AF0C756-82D5-4541-A2F2-40CE55052789@rfc1035.com> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> To: Rob Sayre X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:21:23 -0000 > On 24 Jul 2019, at 03:19, Rob Sayre wrote: >=20 > It's a fair point. It seems like this isn't really about security. Earlier in this thread you said "DNS is insecure in a coffee shop, and = that is going to be fixed.". Can you please explain this apparent = contradiction? From nobody Wed Jul 24 07:22:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E1BF12024B for ; Wed, 24 Jul 2019 07:22:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telefonica.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4lsce2yL9wlo for ; Wed, 24 Jul 2019 07:22:07 -0700 (PDT) Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-eopbgr70119.outbound.protection.outlook.com [40.107.7.119]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF442120111 for ; Wed, 24 Jul 2019 07:22:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=MBYz5OsRTNq88Ja2tdHmafGgbONYGh3C5yhENge71lP9wEV7YPSXykZkBkCjXnbnAD5K6eU44CZGl5mUxy5uqFkGfRq4pCd/WurOvBy7/8GCYo3DcsV0xtV+gRrkVL/ung5IrUf6XGiMgtfdtBSbkIu34oVHfmvs4TVTiHKzC6PX2Vu2KiPD1tMkN76uGc2ynSRk1SZxpqIuqX+v2N/WzZzbSqPPUuelibcMEqd4O8kUacsTKhq9YsmdB7/8P6K0aP5rlUgJXXpJUNgiJbSpeMwhBKcKmnzkDDwEGg5JSpJ4gnTqv4LnopYpo1teQgkhCfqQBsdq9Wxa00mNa+2ywg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=udHbUo7glDQifxnOwXUmavGMGDSPXQ0Fw/EU7xAjl2I=; b=aMhedjSt8cj4hXDwzfl7nvdgYb8Dhgpq1lAyuchaGxT/sh4ZNeINjfL4/YPiBJYZG8/Q13YauSx0t2KoigKCwDPiYBxLuN7fZoDhygQqLZi/7/UCGCe0f3/jKhIfWSIQJtu2A+YY6MxnhA1nm1LB9jdHSo7xdpFGyVcr0gxxvbebEXmGqSHY3XkJtWjA9U7v2XYx26JjbuvYR5Q6XyTjsj0Ni00BsS08+Cvkoveg4I2Wd737SzPoxIwg6zHWqZ7ZQQsQSDvw09S7VNWTQ4YqfqyUDvF1WIIjD65v3NBDyR9sRA6jBptGj6Rx/kA8ix9gQC070Vm6Jpt45kZimrV9Xg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=telefonica.com;dmarc=pass action=none header.from=telefonica.com;dkim=pass header.d=telefonica.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telefonica.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=udHbUo7glDQifxnOwXUmavGMGDSPXQ0Fw/EU7xAjl2I=; b=fcLaquTkuyfWte220GAes8rRBxt/bTK092XmkFcSq9oS9216llo7H4xRyxP7ThnVHwL4Se4kRhSIyIArV0NG5BEo8T2Jsz3p/DMxPRD/19391IIx1+KQHM2/ZeFBpC78qcHFSGxlDj2yhSmW9Kl9UcFV0RYctfFw1gaS5P2Lz58= Received: from DB3PR0602MB3788.eurprd06.prod.outlook.com (52.134.70.148) by DB3PR0602MB3771.eurprd06.prod.outlook.com (52.134.68.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.14; Wed, 24 Jul 2019 14:22:04 +0000 Received: from DB3PR0602MB3788.eurprd06.prod.outlook.com ([fe80::9c53:d10:400e:c71]) by DB3PR0602MB3788.eurprd06.prod.outlook.com ([fe80::9c53:d10:400e:c71%5]) with mapi id 15.20.2094.013; Wed, 24 Jul 2019 14:22:04 +0000 From: "Diego R. Lopez" To: Ted Lemon , Vittorio Bertola CC: "add@ietf.org" , Joseph Lorenzo Hall Thread-Topic: [Add] fixing coffee shop brokenness with DoH Thread-Index: AQHVQcJG30FrGkaCR0+8FlNKTjcBRabZBa+AgAACZgCAAADiAIAAAcuAgACEL4CAAC6EAIAAE4mA//++woA= Date: Wed, 24 Jul 2019 14:22:04 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <520325278.24189.1563973538937@appsuite-gw1.open-xchange.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.c.190715 authentication-results: spf=none (sender IP is ) smtp.mailfrom=diego.r.lopez@telefonica.com; x-originating-ip: [2001:67c:1232:144:14bc:e6a8:5e5:5538] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d017c47e-c929-498c-5aca-08d710424d13 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:DB3PR0602MB3771; x-ms-traffictypediagnostic: DB3PR0602MB3771: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 0108A997B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(136003)(346002)(366004)(39860400002)(376002)(396003)(199004)(189003)(40134004)(54906003)(2906002)(4326008)(66556008)(64756008)(66476007)(14444005)(256004)(186003)(53546011)(25786009)(76116006)(91956017)(66446008)(66946007)(58126008)(110136005)(102836004)(66574012)(478600001)(5660300002)(486006)(6506007)(11346002)(76176011)(71200400001)(71190400001)(2616005)(46003)(45080400002)(446003)(476003)(99286004)(33656002)(6486002)(7736002)(6246003)(6116002)(236005)(606006)(8936002)(6436002)(86362001)(53936002)(8676002)(68736007)(229853002)(81166006)(81156014)(966005)(316002)(786003)(36756003)(6512007)(14454004)(54896002)(6306002); DIR:OUT; SFP:1102; SCL:1; SRVR:DB3PR0602MB3771; H:DB3PR0602MB3788.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: telefonica.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: apOuyuhfFtTLgD8VY9z/aXAQhQlWrvc5dJBRyDq1HN0Gvjy7xCb7wVgJ0ocI4gy9wzE+f2+zA1K5f8Klf266kuGiyPGxH+rZ6R6OqtPTJKAZ/vT99XXrNKVf3rvPlDdA1IF0MnjIlB/Oi6GUuqwLsTzmL1YdAeh1rk2RZsLWH34ycCQafgEGKCxu93dziBJZh7hQkQ88vnPa9jOV63AUI0ocTfu4/VIkAJVeqHZIum/SbRJnZwfp1twjQk7Y3XurvUjCGAEqfOcUC54TCKOQf4GvEa838AkbWmeRJIJCkgb+CFk59Cxnto+Myoxn/QdJAEc9Ql/yEymP0/n506k9MSYQiadSRxoK3UO0eIB8Jnofb/lNfuznKATqQFYp4Xe8OIT7QnPXy6yqmYbsxN5GY/1SnoIz82FtiplPII7zfTM= Content-Type: multipart/alternative; boundary="_000_D36D62503B75433EB37BBEC73F7C92DFtelefonicacom_" MIME-Version: 1.0 X-OriginatorOrg: telefonica.com X-MS-Exchange-CrossTenant-Network-Message-Id: d017c47e-c929-498c-5aca-08d710424d13 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2019 14:22:04.2235 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9744600e-3e04-492e-baa1-25ec245c6f10 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: diego.r.lopez@telefonica.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB3PR0602MB3771 Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:22:18 -0000 --_000_D36D62503B75433EB37BBEC73F7C92DFtelefonicacom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SnVzdCB0byB3aG9sZWhlYXJ0ZWRseSBzZWNvbmQgVGVk4oCZcyBwb2ludC4gQXMgSSB0cmllZCB0 byBleHByZXNzIGJlZm9yZSwgbXkgdGFrZSBvZiB0aGUgZGlzY3Vzc2lvbiB5ZXN0ZXJkYXkgaXMg dGhhdCB3ZSBoYXZlIHRvIGRlYWwgd2l0aCBhIChxdWl0ZSBzZXJpb3VzKSB0cnVzdCBpc3N1ZS4N Cg0KLS0NCiJFc3RhIHZleiBubyBmYWxsYXJlbW9zLCBEb2N0b3IgSW5maWVybm8iDQoNCkRyIERp ZWdvIFIuIExvcGV6DQpUZWxlZm9uaWNhIEkrRA0KaHR0cHM6Ly93d3cubGlua2VkaW4uY29tL2lu L2RyMmxvcGV6Lw0KDQplLW1haWw6IGRpZWdvLnIubG9wZXpAdGVsZWZvbmljYS5jb208bWFpbHRv OmRpZWdvLnIubG9wZXpAdGVsZWZvbmljYS5jb20+DQpUZWw6ICAgICAgICAgKzM0IDkxMyAxMjkg MDQxDQpNb2JpbGU6ICArMzQgNjgyIDA1MSAwOTENCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0NCg0KT24gMjQvMDcvMjAxOSwgMTA6MTUsICJBZGQgb24gYmVoYWxmIG9mIFRlZCBM ZW1vbiIgPGFkZC1ib3VuY2VzQGlldGYub3JnPG1haWx0bzphZGQtYm91bmNlc0BpZXRmLm9yZz4g b24gYmVoYWxmIG9mIG1lbGxvbkBmdWd1ZS5jb208bWFpbHRvOm1lbGxvbkBmdWd1ZS5jb20+PiB3 cm90ZToNCg0KT24gSnVsIDI0LCAyMDE5LCBhdCA5OjA1IEFNLCBWaXR0b3JpbyBCZXJ0b2xhIDx2 aXR0b3Jpby5iZXJ0b2xhPTQwb3Blbi14Y2hhbmdlLmNvbUBkbWFyYy5pZXRmLm9yZzxtYWlsdG86 dml0dG9yaW8uYmVydG9sYT00MG9wZW4teGNoYW5nZS5jb21AZG1hcmMuaWV0Zi5vcmc+PiB3cm90 ZToNCldoYXQgeW91IHNlZW0gdG8gd2FudCBhYm92ZSwgaG93ZXZlciwgaXMgbm90IG1hZGUgcG9z c2libGUgYnkgY2VudHJhbGl6YXRpb24sIGJ1dCBieSB1c2VyIGNob2ljZSwgaS5lLiB0aGUgdXNl ciBiZWluZyBhYmxlIHRvIHRlbGwgYWxsIHRoZSBhcHBsaWNhdGlvbnMgdG8gdXNlIGEgc3BlY2lm aWMgcmVzb2x2ZXIgdGhhdCBoYXMgYSBwcml2YWN5IHBvbGljeSB0aGV5IGxpa2UuDQoNCkkgYXNr ZWQgdGhpcyBxdWVzdGlvbiBlYXJsaWVyIGFuZCBub2JvZHkgYW5zd2VyZWQsIHNvIEnigJlsbCBh c2sgaXQgYWdhaW4uICBIb3cgZG8gd2UgZW5zdXJlIHRoYXQgdGhlIHVzZXIgaGFzIGEgY2hvaWNl IGFuZCB0aGF0IHRoZSBjaG9pY2UgaXMgaG9ub3JlZD8gICBPciB0byBwdXQgaXQgZGlmZmVyZW50 bHksIHN1cHBvc2UgYSBtYWxpY2lvdXMgYXBwIHdhbnRzIHRvIGZ1bm5lbCBhbGwgdXNlciBETlMg cmVxdWVzdHMgdG8gYSB0cmFja2VyLiAgIEhvdyBjYW4gd2UgZGV0ZWN0IHRoYXQgdGhpcyBpcyBo YXBwZW5pbmc/ICAgSG93IGNhbiB3ZSBwcmV2ZW50IGl0Pw0KDQpJIHRoaW5rIHRoZXJl4oCZcyBh IHRlbmRlbmN5IHRvIG5vdCB0YWxrIGFib3V0IHRoaXMgcHJvYmxlbSBiZWNhdXNlIEkgdGhpbmsg aXTigJlzIGFuIGV4dHJlbWVseSBoYXJkIHByb2JsZW0uICAgSXQgcHJldHR5IG11Y2ggYm9pbHMg ZG93biB0byB0aGlzOiB3aG8gY2FuIHRoZSB1c2VyIHRydXN0PyAgQ2FuIHRoZSB1c2VyIGV2ZW4g bWVhbmluZ2Z1bGx5IGV2YWx1YXRlIHRoZWlyIGRldGVybWluYXRpb24gb2YgdHJ1c3Q/ICAgQXQg cHJlc2VudCwgdGhlIHRydXN0IG1vZGVsIGlzIOKAnGlmIEkgZG93bmxvYWQgdGhlIGJyb3dzZXIg ZnJvbSBNb3ppbGxhLCBJIGNhbiB0cnVzdCBpdCzigJ0gb3Igc29tZSB2YXJpYXRpb24gb24gdGhh dCBtb2RlbC4gIFRoaXMgbWF5YmUgd29ya3MgZm9yIHNvbWV0aGluZyBsaWtlIEZpcmVmb3gsIGJ1 dCwgaWYgcHJldHR5IG11Y2ggYW55IGFwcCBpcyBkb2luZyBEb0gsIGNhbiB3ZSBldmVuIHRlbGwg dGhhdCB0aGlzIGlzIGhhcHBlbmluZz8NCg0KSSBjYW4gdGhpbmsgb2Ygd2F5cyBvZiBtYWtpbmcg aXQgaGFyZCBmb3IgdGhlIGFwcCB0byBtaXNiZWhhdmUgaW4gdGhpcyB3YXksIGJ1dCBubyB3YXkg dG8gY29tcGxldGVseSBwcmV2ZW50IGl0Lg0KDQpUaGlzIGlzIGltcG9ydGFudCBmb3IgdHdvIHJl YXNvbnMuICAgRmlyc3QsIHdlIHNob3VsZCBub3QgcHJldGVuZCB0aGF0IHdlIGNhbiBwcmV2ZW50 IHdoYXQgd2UgY2Fu4oCZdCBwcmV2ZW50LiAgIFNlY29uZGx5LCB3ZSBzaG91bGQgYWN0dWFsbHkg Y29tZSB1cCB3aXRoIGEgbWl0aWdhdGlvbiBzdHJhdGVneS4NCg0KDQpfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXw0KDQpFc3RlIG1lbnNhamUgeSBzdXMgYWRqdW50b3Mgc2UgZGlyaWdl biBleGNsdXNpdmFtZW50ZSBhIHN1IGRlc3RpbmF0YXJpbywgcHVlZGUgY29udGVuZXIgaW5mb3Jt YWNpw7NuIHByaXZpbGVnaWFkYSBvIGNvbmZpZGVuY2lhbCB5IGVzIHBhcmEgdXNvIGV4Y2x1c2l2 byBkZSBsYSBwZXJzb25hIG8gZW50aWRhZCBkZSBkZXN0aW5vLiBTaSBubyBlcyB1c3RlZC4gZWwg ZGVzdGluYXRhcmlvIGluZGljYWRvLCBxdWVkYSBub3RpZmljYWRvIGRlIHF1ZSBsYSBsZWN0dXJh LCB1dGlsaXphY2nDs24sIGRpdnVsZ2FjacOzbiB5L28gY29waWEgc2luIGF1dG9yaXphY2nDs24g cHVlZGUgZXN0YXIgcHJvaGliaWRhIGVuIHZpcnR1ZCBkZSBsYSBsZWdpc2xhY2nDs24gdmlnZW50 ZS4gU2kgaGEgcmVjaWJpZG8gZXN0ZSBtZW5zYWplIHBvciBlcnJvciwgbGUgcm9nYW1vcyBxdWUg bm9zIGxvIGNvbXVuaXF1ZSBpbm1lZGlhdGFtZW50ZSBwb3IgZXN0YSBtaXNtYSB2w61hIHkgcHJv Y2VkYSBhIHN1IGRlc3RydWNjacOzbi4NCg0KVGhlIGluZm9ybWF0aW9uIGNvbnRhaW5lZCBpbiB0 aGlzIHRyYW5zbWlzc2lvbiBpcyBwcml2aWxlZ2VkIGFuZCBjb25maWRlbnRpYWwgaW5mb3JtYXRp b24gaW50ZW5kZWQgb25seSBmb3IgdGhlIHVzZSBvZiB0aGUgaW5kaXZpZHVhbCBvciBlbnRpdHkg bmFtZWQgYWJvdmUuIElmIHRoZSByZWFkZXIgb2YgdGhpcyBtZXNzYWdlIGlzIG5vdCB0aGUgaW50 ZW5kZWQgcmVjaXBpZW50LCB5b3UgYXJlIGhlcmVieSBub3RpZmllZCB0aGF0IGFueSBkaXNzZW1p bmF0aW9uLCBkaXN0cmlidXRpb24gb3IgY29weWluZyBvZiB0aGlzIGNvbW11bmljYXRpb24gaXMg c3RyaWN0bHkgcHJvaGliaXRlZC4gSWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyB0cmFuc21pc3Np b24gaW4gZXJyb3IsIGRvIG5vdCByZWFkIGl0LiBQbGVhc2UgaW1tZWRpYXRlbHkgcmVwbHkgdG8g dGhlIHNlbmRlciB0aGF0IHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgY29tbXVuaWNhdGlvbiBpbiBl cnJvciBhbmQgdGhlbiBkZWxldGUgaXQuDQoNCkVzdGEgbWVuc2FnZW0gZSBzZXVzIGFuZXhvcyBz ZSBkaXJpZ2VtIGV4Y2x1c2l2YW1lbnRlIGFvIHNldSBkZXN0aW5hdMOhcmlvLCBwb2RlIGNvbnRl ciBpbmZvcm1hw6fDo28gcHJpdmlsZWdpYWRhIG91IGNvbmZpZGVuY2lhbCBlIMOpIHBhcmEgdXNv IGV4Y2x1c2l2byBkYSBwZXNzb2Egb3UgZW50aWRhZGUgZGUgZGVzdGluby4gU2UgbsOjbyDDqSB2 b3NzYSBzZW5ob3JpYSBvIGRlc3RpbmF0w6FyaW8gaW5kaWNhZG8sIGZpY2Egbm90aWZpY2FkbyBk ZSBxdWUgYSBsZWl0dXJhLCB1dGlsaXphw6fDo28sIGRpdnVsZ2HDp8OjbyBlL291IGPDs3BpYSBz ZW0gYXV0b3JpemHDp8OjbyBwb2RlIGVzdGFyIHByb2liaWRhIGVtIHZpcnR1ZGUgZGEgbGVnaXNs YcOnw6NvIHZpZ2VudGUuIFNlIHJlY2ViZXUgZXN0YSBtZW5zYWdlbSBwb3IgZXJybywgcm9nYW1v cy1saGUgcXVlIG5vcyBvIGNvbXVuaXF1ZSBpbWVkaWF0YW1lbnRlIHBvciBlc3RhIG1lc21hIHZp YSBlIHByb2NlZGEgYSBzdWEgZGVzdHJ1acOnw6NvDQo= --_000_D36D62503B75433EB37BBEC73F7C92DFtelefonicacom_ Content-Type: text/html; charset="utf-8" Content-ID: <344A870AD4366A4DB1836208A70E922E@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow Y207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXtt c28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFy Z2luLXJpZ2h0OjBjbTsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVm dDowY207DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBs eTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0 O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQt c2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0 Ow0KCW1hcmdpbjo3MC44NXB0IDMuMGNtIDcwLjg1cHQgMy4wY207fQ0KZGl2LldvcmRTZWN0aW9u MQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFu Zz0iRVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rp b24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdCI+SnVzdCB0byB3aG9sZWhlYXJ0ZWRseSBzZWNvbmQgVGVk4oCZcyBwb2lu dC4gQXMgSSB0cmllZCB0byBleHByZXNzIGJlZm9yZSwgbXkgdGFrZSBvZiB0aGUgZGlzY3Vzc2lv biB5ZXN0ZXJkYXkgaXMgdGhhdCB3ZSBoYXZlIHRvIGRlYWwgd2l0aCBhIChxdWl0ZSBzZXJpb3Vz KSB0cnVzdCBpc3N1ZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjBwdCI+LS08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+JnF1b3Q7RXN0YSB2ZXog bm8gZmFsbGFyZW1vcywgRG9jdG9yIEluZmllcm5vJnF1b3Q7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZu YnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTAuMHB0Ij5EciBEaWVnbyBSLiBMb3BlejxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 Ij5UZWxlZm9uaWNhIEkmIzQzO0Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+PGEgaHJlZj0iaHR0cHM6Ly93 d3cubGlua2VkaW4uY29tL2luL2RyMmxvcGV6LyI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwNTYzQzEi Pmh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9pbi9kcjJsb3Blei88L3NwYW4+PC9hPiZuYnNwOzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+ZS1tYWlsOiZuYnNwOzwv c3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPjxhIGhyZWY9 Im1haWx0bzpkaWVnby5yLmxvcGV6QHRlbGVmb25pY2EuY29tIj48c3BhbiBsYW5nPSJFTi1VUyIg c3R5bGU9ImNvbG9yOiMwNTYzQzEiPjxzcGFuIGxhbmc9IkVOLVVTIj5kaWVnby5yLmxvcGV6QHRl bGVmb25pY2EuY29tPC9zcGFuPjwvc3Bhbj48L2E+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPlRlbDombmJzcDsmbmJz cDsmbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICYjNDM7MzQgOTEzIDEyOSAwNDE8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPk1vYmlsZTogJm5ic3A7JiM0MzszNCA2ODIgMDUx IDA5MTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tPC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPk9uIDI0LzA3LzIwMTksIDEwOjE1LCAmcXVvdDtBZGQg b24gYmVoYWxmIG9mIFRlZCBMZW1vbiZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFkZC1ib3Vu Y2VzQGlldGYub3JnIj5hZGQtYm91bmNlc0BpZXRmLm9yZzwvYT4gb24gYmVoYWxmIG9mDQo8YSBo cmVmPSJtYWlsdG86bWVsbG9uQGZ1Z3VlLmNvbSI+bWVsbG9uQGZ1Z3VlLmNvbTwvYT4mZ3Q7IHdy b3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ T24gSnVsIDI0LCAyMDE5LCBhdCA5OjA1IEFNLCBWaXR0b3JpbyBCZXJ0b2xhICZsdDs8YSBocmVm PSJtYWlsdG86dml0dG9yaW8uYmVydG9sYT00MG9wZW4teGNoYW5nZS5jb21AZG1hcmMuaWV0Zi5v cmciPnZpdHRvcmlvLmJlcnRvbGE9NDBvcGVuLXhjaGFuZ2UuY29tQGRtYXJjLmlldGYub3JnPC9h PiZndDsgd3JvdGU6DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0i bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjVwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPldoYXQgeW91IHNlZW0gdG8gd2FudCBh Ym92ZSwgaG93ZXZlciwgaXMgbm90IG1hZGUgcG9zc2libGUgYnkgY2VudHJhbGl6YXRpb24sIGJ1 dCBieSB1c2VyIGNob2ljZSwgaS5lLiB0aGUgdXNlciBiZWluZyBhYmxlIHRvIHRlbGwgYWxsIHRo ZSBhcHBsaWNhdGlvbnMgdG8gdXNlDQogYSBzcGVjaWZpYyByZXNvbHZlciB0aGF0IGhhcyBhIHBy aXZhY3kgcG9saWN5IHRoZXkgbGlrZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv YmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+SSBhc2tlZCB0aGlzIHF1ZXN0aW9uIGVh cmxpZXIgYW5kIG5vYm9keSBhbnN3ZXJlZCwgc28gSeKAmWxsIGFzayBpdCBhZ2Fpbi4gJm5ic3A7 SG93IGRvIHdlIGVuc3VyZSB0aGF0IHRoZSB1c2VyIGhhcyBhIGNob2ljZSBhbmQgdGhhdCB0aGUg Y2hvaWNlIGlzIGhvbm9yZWQ/ICZuYnNwOyBPciB0byBwdXQgaXQgZGlmZmVyZW50bHksIHN1cHBv c2UgYSBtYWxpY2lvdXMgYXBwIHdhbnRzIHRvDQogZnVubmVsIGFsbCB1c2VyIEROUyByZXF1ZXN0 cyB0byBhIHRyYWNrZXIuICZuYnNwOyBIb3cgY2FuIHdlIGRldGVjdCB0aGF0IHRoaXMgaXMgaGFw cGVuaW5nPyAmbmJzcDsgSG93IGNhbiB3ZSBwcmV2ZW50IGl0PzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5JIHRoaW5rIHRoZXJl4oCZcyBhIHRlbmRl bmN5IHRvIG5vdCB0YWxrIGFib3V0IHRoaXMgcHJvYmxlbSBiZWNhdXNlIEkgdGhpbmsgaXTigJlz IGFuIGV4dHJlbWVseSBoYXJkIHByb2JsZW0uICZuYnNwOyBJdCBwcmV0dHkgbXVjaCBib2lscyBk b3duIHRvIHRoaXM6IHdobyBjYW4gdGhlIHVzZXIgdHJ1c3Q/ICZuYnNwO0NhbiB0aGUgdXNlciBl dmVuIG1lYW5pbmdmdWxseSBldmFsdWF0ZSB0aGVpcg0KIGRldGVybWluYXRpb24gb2YgdHJ1c3Q/ ICZuYnNwOyBBdCBwcmVzZW50LCB0aGUgdHJ1c3QgbW9kZWwgaXMg4oCcaWYgSSBkb3dubG9hZCB0 aGUgYnJvd3NlciBmcm9tIE1vemlsbGEsIEkgY2FuIHRydXN0IGl0LOKAnSBvciBzb21lIHZhcmlh dGlvbiBvbiB0aGF0IG1vZGVsLiAmbmJzcDtUaGlzIG1heWJlIHdvcmtzIGZvciBzb21ldGhpbmcg bGlrZSBGaXJlZm94LCBidXQsIGlmIHByZXR0eSBtdWNoIGFueSBhcHAgaXMgZG9pbmcgRG9ILCBj YW4gd2UgZXZlbiB0ZWxsIHRoYXQNCiB0aGlzIGlzIGhhcHBlbmluZz88bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoz Ni4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+SSBjYW4gdGhpbmsgb2Ygd2F5cyBv ZiBtYWtpbmcgaXQgaGFyZCBmb3IgdGhlIGFwcCB0byBtaXNiZWhhdmUgaW4gdGhpcyB3YXksIGJ1 dCBubyB3YXkgdG8gY29tcGxldGVseSBwcmV2ZW50IGl0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5UaGlzIGlzIGltcG9ydGFudCBmb3IgdHdvIHJl YXNvbnMuICZuYnNwOyBGaXJzdCwgd2Ugc2hvdWxkIG5vdCBwcmV0ZW5kIHRoYXQgd2UgY2FuIHBy ZXZlbnQgd2hhdCB3ZSBjYW7igJl0IHByZXZlbnQuICZuYnNwOyBTZWNvbmRseSwgd2UNCjxpPnNo b3VsZDwvaT4mbmJzcDthY3R1YWxseSBjb21lIHVwIHdpdGggYSBtaXRpZ2F0aW9uIHN0cmF0ZWd5 LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGJyPg0KPGhyPg0KPGZvbnQgZmFjZT0iQXJpYWwiIGNvbG9yPSJHcmF5IiBzaXplPSIx Ij48YnI+DQpFc3RlIG1lbnNhamUgeSBzdXMgYWRqdW50b3Mgc2UgZGlyaWdlbiBleGNsdXNpdmFt ZW50ZSBhIHN1IGRlc3RpbmF0YXJpbywgcHVlZGUgY29udGVuZXIgaW5mb3JtYWNpw7NuIHByaXZp bGVnaWFkYSBvIGNvbmZpZGVuY2lhbCB5IGVzIHBhcmEgdXNvIGV4Y2x1c2l2byBkZSBsYSBwZXJz b25hIG8gZW50aWRhZCBkZSBkZXN0aW5vLiBTaSBubyBlcyB1c3RlZC4gZWwgZGVzdGluYXRhcmlv IGluZGljYWRvLCBxdWVkYSBub3RpZmljYWRvIGRlIHF1ZSBsYQ0KIGxlY3R1cmEsIHV0aWxpemFj acOzbiwgZGl2dWxnYWNpw7NuIHkvbyBjb3BpYSBzaW4gYXV0b3JpemFjacOzbiBwdWVkZSBlc3Rh ciBwcm9oaWJpZGEgZW4gdmlydHVkIGRlIGxhIGxlZ2lzbGFjacOzbiB2aWdlbnRlLiBTaSBoYSBy ZWNpYmlkbyBlc3RlIG1lbnNhamUgcG9yIGVycm9yLCBsZSByb2dhbW9zIHF1ZSBub3MgbG8gY29t dW5pcXVlIGlubWVkaWF0YW1lbnRlIHBvciBlc3RhIG1pc21hIHbDrWEgeSBwcm9jZWRhIGEgc3Ug ZGVzdHJ1Y2Npw7NuLjxicj4NCjxicj4NClRoZSBpbmZvcm1hdGlvbiBjb250YWluZWQgaW4gdGhp cyB0cmFuc21pc3Npb24gaXMgcHJpdmlsZWdlZCBhbmQgY29uZmlkZW50aWFsIGluZm9ybWF0aW9u IGludGVuZGVkIG9ubHkgZm9yIHRoZSB1c2Ugb2YgdGhlIGluZGl2aWR1YWwgb3IgZW50aXR5IG5h bWVkIGFib3ZlLiBJZiB0aGUgcmVhZGVyIG9mIHRoaXMgbWVzc2FnZSBpcyBub3QgdGhlIGludGVu ZGVkIHJlY2lwaWVudCwgeW91IGFyZSBoZXJlYnkgbm90aWZpZWQgdGhhdCBhbnkgZGlzc2VtaW5h dGlvbiwNCiBkaXN0cmlidXRpb24gb3IgY29weWluZyBvZiB0aGlzIGNvbW11bmljYXRpb24gaXMg c3RyaWN0bHkgcHJvaGliaXRlZC4gSWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyB0cmFuc21pc3Np b24gaW4gZXJyb3IsIGRvIG5vdCByZWFkIGl0LiBQbGVhc2UgaW1tZWRpYXRlbHkgcmVwbHkgdG8g dGhlIHNlbmRlciB0aGF0IHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgY29tbXVuaWNhdGlvbiBpbiBl cnJvciBhbmQgdGhlbiBkZWxldGUgaXQuPGJyPg0KPGJyPg0KRXN0YSBtZW5zYWdlbSBlIHNldXMg YW5leG9zIHNlIGRpcmlnZW0gZXhjbHVzaXZhbWVudGUgYW8gc2V1IGRlc3RpbmF0w6FyaW8sIHBv ZGUgY29udGVyIGluZm9ybWHDp8OjbyBwcml2aWxlZ2lhZGEgb3UgY29uZmlkZW5jaWFsIGUgw6kg cGFyYSB1c28gZXhjbHVzaXZvIGRhIHBlc3NvYSBvdSBlbnRpZGFkZSBkZSBkZXN0aW5vLiBTZSBu w6NvIMOpIHZvc3NhIHNlbmhvcmlhIG8gZGVzdGluYXTDoXJpbyBpbmRpY2FkbywgZmljYSBub3Rp ZmljYWRvIGRlIHF1ZSBhDQogbGVpdHVyYSwgdXRpbGl6YcOnw6NvLCBkaXZ1bGdhw6fDo28gZS9v dSBjw7NwaWEgc2VtIGF1dG9yaXphw6fDo28gcG9kZSBlc3RhciBwcm9pYmlkYSBlbSB2aXJ0dWRl IGRhIGxlZ2lzbGHDp8OjbyB2aWdlbnRlLiBTZSByZWNlYmV1IGVzdGEgbWVuc2FnZW0gcG9yIGVy cm8sIHJvZ2Ftb3MtbGhlIHF1ZSBub3MgbyBjb211bmlxdWUgaW1lZGlhdGFtZW50ZSBwb3IgZXN0 YSBtZXNtYSB2aWEgZSBwcm9jZWRhIGEgc3VhIGRlc3RydWnDp8Ojbzxicj4NCjwvZm9udD4NCjwv Ym9keT4NCjwvaHRtbD4NCg== --_000_D36D62503B75433EB37BBEC73F7C92DFtelefonicacom_-- From nobody Wed Jul 24 07:33:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FED912031A for ; Wed, 24 Jul 2019 07:33:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6wAE2aNHxj0P for ; Wed, 24 Jul 2019 07:33:36 -0700 (PDT) Received: from mail-ua1-x92a.google.com (mail-ua1-x92a.google.com [IPv6:2607:f8b0:4864:20::92a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74C43120318 for ; Wed, 24 Jul 2019 07:33:36 -0700 (PDT) Received: by mail-ua1-x92a.google.com with SMTP id j21so18552100uap.2 for ; Wed, 24 Jul 2019 07:33:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6L+0Zm8e1dowKVynUGk7cQpfAOKTPEiVTOZSwyzT9GM=; b=pKiG8mNBUcAl5pvZcZkDZ2tBv4xcuK5XAiKSMKXZjUmTmRlJcMbZOIJDs/ByZYwpkP N3U6ht8VbRBwOyR0kjuzwOc0g1RYV+AG1ZuAqvXhj9IjRpM1V1PhavwodgNlAJqvHuit INmEJV29owwn57rIZ23Ggr+vzB8YQVEmLhHQ5wdxvaVLQJItaK5FSe6ez1aq+JB2wW9J Ny59P6qzP/F60yJm0nDKvTA5LSPGPmJZM3BNFJu2Kqd8NHMJl8M25l2Sc5KIqfWjOSnP wSGXmUqsKBxLRggoe8beeyEE+tzfWNs+KUeF2UxnRtTVdFGB2BpvxwzqNtT7kGTNo/U6 j6FA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6L+0Zm8e1dowKVynUGk7cQpfAOKTPEiVTOZSwyzT9GM=; b=FeJQIOY0p4nOX68OTuLh1J0FOP5P5FaETSVK0gUp6GEC5LwTfnLQToe2cPwqK+GkXQ h705ma6/EvehQgg1NS+L2hfbYkcfGOCx380DnR7EqvzHZN+S5lc52DnaP7f4dUL8v9hc GxGndhREsDGInUTqw8XZ0pXxUIAQepiO4NpHzWaWfePn5F1MpYNpQz+LihxSNuHEhvjb Q0fsyMV9i+MFk9MQlwm76Qssm14JQJnvp+PKpawb7fgQ1xClHn5PXh7rj6hKi1x/2kFe cguREQg+wgsNK4WFSfmVBshmfr9Xg8jffcJBTXLYBJziCz8o7qm/kENYwnuXTYC9UbmP P/LA== X-Gm-Message-State: APjAAAWVbtb/MlTjiJ6fkJQiYHJGs3pFgFg7kVQ8T1a8ZXNvVhEd4mOF Vrr+PJrhigauZ1/rshBWOpo67knaq+u7YKnOY49jkhumlLM= X-Google-Smtp-Source: APXvYqzwZxBXpTY90PhUhDk2qT/lZ6qwrxZnKdbEbZC2zm1sHrxtKaajLcmdq2mJ9C50g9J5FFGjqPINcZNWNYB414g= X-Received: by 2002:ab0:168a:: with SMTP id e10mr5959748uaf.87.1563978815586; Wed, 24 Jul 2019 07:33:35 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> In-Reply-To: From: Brian Dickson Date: Wed, 24 Jul 2019 10:33:23 -0400 Message-ID: To: Eric Rescorla Cc: Ted Lemon , Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000bd4887058e6e311d" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:33:43 -0000 --000000000000bd4887058e6e311d Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 9:15 AM Eric Rescorla wrote: > > > On Wed, Jul 24, 2019 at 3:54 AM Ted Lemon wrote: > >> On Jul 24, 2019, at 6:40 AM, Eric Rescorla wrote: >> >> In many cases, whether you are being told the truth by your recursive >> resolver is a less interesting property than whether you can get the >> correct answer. For instance, if the recursive resolver replaces the A >> record you want with NXDOMAIN even if you know that it's done so, you're >> still blocked from going where you wanted to go. >> >> However, even if you are not blocked, without DNSSEC you do not know that >> the resolver gave you the right answer. So ideally you want both: not to >> be blocked, and also to be able to validate the result you got. >> > > Well, this is true, but in the Web context, as we move towards 100% HTTPS, > the importance of getting the right IP starts to decrease quite a bit: if > you get the wrong IP address, then this turns into a connection failure. > > -Ekr > This is an important assertion that requires refutation: this is incorrect. The importance of the correct IP is essential, because of the relatively weak system under which TLS certificates are (or can be) issued. While individual CAs may be extremely trustworthy, there has been instances of other CAs (retrospectively discovered as being untrustworthy) issuing TLS certificates to parties other than the domain owner. This is why DNSSEC, and DANE, are an important mechanism available for strengthening certificate/browser security. DANE allows domain owners to securely link a specific CA or specific certificate to a domain name. Only with DNSSEC and DANE, is it true that the IP address being wrong would a connection failure be guaranteed to occur. That is, in fact, one of the underpinnings for why bad actors have an interest in altering DNS caches to provide forged IP addresses. Thus, I assert that not only is DANE not strictly orthogonal, it is an essential part of securing the web, along with DNSSEC. This is true even in a 100% HTTPS environment. The security of DNS as provided by DNSSEC is both orthogonal to, and more important than, the privacy of DNS recursive queries, when it to achieving that 100% HTTPS environment. Brian --000000000000bd4887058e6e311d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 9:15 AM Eric = Rescorla <ekr@rtfm.com> wrote:
<= div dir=3D"ltr">

On Wed, Jul 24, 2019 at 3:54 AM Ted Lemon <mellon@fugue.com> wro= te:
On Jul 24, 2= 019, at 6:40 AM, Eric Rescorla <ekr@rtfm.com> wrote:
>> In many cases, whether you are being told the truth by your recurs= ive resolver is a less interesting property than whether you can get the co= rrect answer. For instance, if the recursive resolver replaces the A record= you want with NXDOMAIN even if you know that it's done so, you're = still blocked from going where you wanted to go.

However, even if you are not blocked, without DNSSEC you do not know that t= he resolver gave you the right answer.=C2=A0 So ideally you want both: not = to be blocked, and also to be able to validate the result you got.

Well, this is true, but in the Web context, as= we move towards 100% HTTPS, the importance of getting the right IP starts = to decrease quite a bit: if you get the wrong IP address, then this turns i= nto a connection failure.

-Ekr

This is an important assertion that requ= ires refutation: this is incorrect.

The importance= of the correct IP is essential, because of the relatively weak system unde= r which TLS certificates are (or can be) issued.
While individual= CAs may be extremely trustworthy, there has been instances of other CAs (r= etrospectively discovered as being untrustworthy) issuing TLS certificates = to parties other than the domain owner.

This is wh= y DNSSEC, and DANE, are an important mechanism available for strengthening = certificate/browser security.

DANE allows domain o= wners to securely link a specific CA or specific certificate to a domain na= me.

Only with DNSSEC and DANE, is it true that the= IP address being wrong would a connection failure be guaranteed to occur.<= /div>

That is, in fact, one of the underpinnings for why= bad actors have an interest in altering DNS caches to provide forged IP ad= dresses.

Thus, I assert that not only is DANE not = strictly orthogonal, it is an essential part of securing the web, along wit= h DNSSEC.

This is true even in a 100% HTTPS enviro= nment. The security of DNS as provided by DNSSEC is both orthogonal to, and= more important than, the privacy of DNS recursive queries, when it to achi= eving that 100% HTTPS environment.

Brian
--000000000000bd4887058e6e311d-- From nobody Wed Jul 24 07:37:49 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DDF812006D for ; Wed, 24 Jul 2019 07:37:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G93UhcghIhxQ for ; Wed, 24 Jul 2019 07:37:44 -0700 (PDT) Received: from mail-lf1-x12d.google.com (mail-lf1-x12d.google.com [IPv6:2a00:1450:4864:20::12d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8256312011F for ; Wed, 24 Jul 2019 07:37:44 -0700 (PDT) Received: by mail-lf1-x12d.google.com with SMTP id c19so32124468lfm.10 for ; Wed, 24 Jul 2019 07:37:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=c/AAUvZiJBfC31xUIVEebxabM5Rs93v/4tHf4Wze7Vk=; b=BQ/VcuXFS6KaqGSzbXUWnyQlQ/N81haw75IfkAPTuJ5c+hc+u7ph306MeiToxLjRDT os4Qz2eCg9MD3+awwlSCPrxhXh4xidHPl2xGjk/wWo2yp+ktbfgijLMasc7jlUU9N4Ik cMbRzbNpzi6pwiG/uPILf+SH4lIITk9qS63YJY4/E3/DlXbzxkdUlW3OwUkePL0orhKL ndEPC7GcB/0pGvbKdAKU8M4910STV9AyjUQMKufgk4tYqBzyKyjwjSXMpPE1xU29n43h 5E/0+2RfxrGjxW0Jwu6jb7Mqi3b63wZ2j8I4hu+1kQhr6TvSc3lDLHGkb5ndJ8NswmoM yDCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=c/AAUvZiJBfC31xUIVEebxabM5Rs93v/4tHf4Wze7Vk=; b=IKo4hljffOe8AEcSteIJQ7nuC1Khec2RUHUKzyh93/qEmUR/A02cMupy87wtzIxUMA LQddPSe+9ljboHxXznj51hn0Z0jXZjRONT8XZls3WYRvT9yYLY049NKu65NOUMZRHeJg Hb2OYf5AUEvQLuviH2PbbIqkI7UicgUpMUp9sTJdVD9EaacYbbk/x7dl8DxPPowAPHpU Dapm/n+nuWjdHod132mMaQBugXI+e0Bu68vw+aC9pilLYLzfW633IiQ5mcx6t9eHUFY8 jIj73n2505mtmLKK5d0VrsdF9OmN111X1B+u4njy3vdpKgRH5VulC8242eJDNZgeq27K lI6Q== X-Gm-Message-State: APjAAAWAVikQu+of592nf7HLdffIbi+lcpfennXzDyF9OIzztDjwRxaY nLeaa53OnthOMD2+ZiRGjJNiqYpkh4mJYrwHSgY= X-Google-Smtp-Source: APXvYqw97F03NtJkxGhrqr4EZ0n/jAgbF7cMcowqQCT4DoM+A0ArYNjEG6WG64FyplH+aYoobGIpBjz1Ma6oNpwohk0= X-Received: by 2002:a05:6512:1da:: with SMTP id f26mr37979965lfp.129.1563979062692; Wed, 24 Jul 2019 07:37:42 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> In-Reply-To: From: Eric Rescorla Date: Wed, 24 Jul 2019 07:37:05 -0700 Message-ID: To: Ted Lemon Cc: Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="00000000000077dee6058e6e4055" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:37:47 -0000 --00000000000077dee6058e6e4055 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 6:53 AM Ted Lemon wrote: > On Jul 24, 2019, at 9:14 AM, Eric Rescorla wrote: > > > > Well, this is true, but in the Web context, as we move towards 100% > HTTPS, the importance of getting the right IP starts to decrease quite a > bit: if you get the wrong IP address, then this turns into a connection > failure. > > Sort of like a fake NXDOMAIN, then? Yes. But that need not be cryptographically verifiable because the client really has no option but to abandon the connection at this point, even if it is suspicious of the DNSSEC status. -Ekr --00000000000077dee6058e6e4055 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 6:53 AM Ted L= emon <mellon@fugue.com> wrote= :
On Jul 24, 201= 9, at 9:14 AM, Eric Rescorla <ekr@rtfm.com> wrote:
>
> Well, this is true, but in the Web context, as we move towards 100% HT= TPS, the importance of getting the right IP starts to decrease quite a bit:= if you get the wrong IP address, then this turns into a connection failure= .

Sort of like a fake NXDOMAIN, then?

Yes. Bu= t that need not be cryptographically verifiable because the client really h= as no option but to abandon the connection at this point, even if it is sus= picious of the DNSSEC status.

-Ekr
<= br>
--00000000000077dee6058e6e4055-- From nobody Wed Jul 24 07:39:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA100120235 for ; Wed, 24 Jul 2019 07:39:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OrLXtIXEy-Dh for ; Wed, 24 Jul 2019 07:39:23 -0700 (PDT) Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98B36120345 for ; Wed, 24 Jul 2019 07:39:23 -0700 (PDT) Received: by mail-qt1-x82e.google.com with SMTP id y26so45703735qto.4 for ; Wed, 24 Jul 2019 07:39:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=GFTJKd2y5J8Toka1atA+Bax+ROyCdDUSvwjWI643LAo=; b=AYg05sw6/EXMj+to+mELudiQIX2fz9CL7+44sAJzS3Huruk4zsKNT2k+Td8TXBcvEU 4uUyf8d7q9kg9nGJyY9kvt9WKLsQgikxl5xWnrKeNJMxHDI77J0gpC6MlroZ2xXQlO82 wtVGXy2yZK15xkHwW9Uya9XUUOQHk8qq4C2lEnXncheqpCqEtHceEX3LGqqV6+EH5NgE PSEWBZaPeiiI49WUzyKkkULLBoOXEYrtzThhfFWNmAozc+Cw4hA2iYu3Rhk5ZB9Arwwm phoRB0O5y+t25bx7zcmY+szhF4vK0nffWlJH1XA66ZYH/fPujqnwey2l+orWBnrJvsfj GGkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=GFTJKd2y5J8Toka1atA+Bax+ROyCdDUSvwjWI643LAo=; b=ifpnHedBGZtlqFRXr6mybrcW5WANrBw9xyVm6LRUrKriyZcHQVnYqRTW9+rNlZlUvD iUzwrjDXASG7yya9SeCW1S9xcvEPxpnWc5DuVhy6DA4UkyMKS9ybshmrWdzPhpZpKhro /aBlv9yUDbKH0n382uiZXLTfHgLWIYz3pp5c+RlrMMLmMUijEICyuYZwnF6+JypMoVoZ rUJN0rBeI9fXuJD2ug4APwh0HCu2rDcxyLoEeGzZS93bhNmzIIAc6xyPTD4rmanUPQVp SMwDPUA8c8hd1GQMOg5phO4fq2Mf0FHZhkFvt27wmfFe/jydccFqQ8gumKagPo5hmPnE SkfQ== X-Gm-Message-State: APjAAAU5WLGzizhxxRANt9FvHto0NkKzMwbYTOjTF8tE+Qmh1qoBo3cq SLCULHmrq971USEHp/VhT3zheA== X-Google-Smtp-Source: APXvYqxmD8A7nfbsH4ngKadCfksn9BKhyA8FHGm5StTUDMrb2sXuyeUW9Xth3nh+5cauzG5hXlmj4w== X-Received: by 2002:a0c:efc1:: with SMTP id a1mr59652903qvt.137.1563979162766; Wed, 24 Jul 2019 07:39:22 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:b954:d2fe:7e59:68aa? ([2001:67c:370:128:b954:d2fe:7e59:68aa]) by smtp.gmail.com with ESMTPSA id d9sm20797279qke.136.2019.07.24.07.39.22 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 07:39:22 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_68DAD93D-2EDF-4DAE-A36C-857671A7CD08" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 24 Jul 2019 10:39:20 -0400 In-Reply-To: Cc: Jim Reid , "add@ietf.org" , Rob Sayre To: Eric Rescorla References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:39:26 -0000 --Apple-Mail=_68DAD93D-2EDF-4DAE-A36C-857671A7CD08 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Jul 24, 2019, at 10:37 AM, Eric Rescorla wrote: > Yes. But that need not be cryptographically verifiable because the = client really has no option but to abandon the connection at this point, = even if it is suspicious of the DNSSEC status. I think you reasoned a few steps faster than I am able to here, Eric. = Can you walk us through this step by step? --Apple-Mail=_68DAD93D-2EDF-4DAE-A36C-857671A7CD08 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On = Jul 24, 2019, at 10:37 AM, Eric Rescorla <ekr@rtfm.com> = wrote:
Yes. = But that need not be cryptographically verifiable because the client = really has no option but to abandon the connection at this point, even = if it is suspicious of the DNSSEC status.

I think you reasoned a few steps faster than I am = able to here, Eric.   Can you walk us through this step by = step?


= --Apple-Mail=_68DAD93D-2EDF-4DAE-A36C-857671A7CD08-- From nobody Wed Jul 24 07:43:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 232A01202A6 for ; Wed, 24 Jul 2019 07:43:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nICuZj3r1Ft8 for ; Wed, 24 Jul 2019 07:43:35 -0700 (PDT) Received: from mail-lj1-x22d.google.com (mail-lj1-x22d.google.com [IPv6:2a00:1450:4864:20::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 62AEE12026E for ; Wed, 24 Jul 2019 07:43:32 -0700 (PDT) Received: by mail-lj1-x22d.google.com with SMTP id x25so44821136ljh.2 for ; Wed, 24 Jul 2019 07:43:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=TLap8L92edzXNL5ruOiNw+Hb6Fd2COsgnkZAumoYM0A=; b=RbHRaxH0c/s5ONFomY1ZRZcP1E/Mx4vgRxriOm6E1X4S/EpA+HBJSsgQIdGt9BW+6+ qO1KO7ylPBJBCnf2DbfwPiPkTvUNhtsNq18Mrbn29+kbZv0NPXz2h8g4tpyoXm2smPJr UG/zhysINZg52z6tlfxsPEkO6emfg6F4rflHt73f3QC88fRSCeUnMGMuTVFPRyesJlZF DozxrKLFyHF+aORHkhIz5z20ihOVlVum68swrNVisx834jW9JPDNPyNW8lGAAdjec9I8 fWl9igjBwrA80OMGBEm+D9HtQ0jitoUtxDDE/xL23kNCu+IQpuROhZJTwLmDTo8MjbgV aXcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=TLap8L92edzXNL5ruOiNw+Hb6Fd2COsgnkZAumoYM0A=; b=FlY3vN6xHxLo82Gf/jTlhIqr3QUBQW7FmgTJmugK4xSfIB+ah/5krX2c48edIgacfX puJvO4J/PH4HADcDEqDh15jdxrcHsWUWysl5PiLLq5Anktpl8wvWaRU7f1UcC64iFxXK Zqu7nz3PArK0zgpIUSFZCmE740f/Bcm/4vsrU2zT0EU4m6P3AzetGCbM13ygZwR9VLnx FObLzaXCf5wqqaW9mf4EbkYNic2O51ViUAwx1ZqGCGQhkBdkg+JAPH4aC5zje2kBefmj +LP/m8hVrBFkeZcvpCQ+hptLZ9FRlK/lBVgAKjvUZCgvi9nORbE5Gxjmt8qsnf7H9vVe bGqQ== X-Gm-Message-State: APjAAAVNS20M7rhg/33Yhk8CXQOqfsiNdxeF9DIVrukvwC+hCPzAXJkr aqN14jayqLrUZlCHYMQmm9Os6whKt0qtF3gd/9M= X-Google-Smtp-Source: APXvYqzg3as4sd7UZA4B1fEyz3/aKx2KPsSf+xk1Rn6JxkYN20AWSS+ogvzrll+hSro5RdWX2lZdXMkYC3HjIERLK0I= X-Received: by 2002:a2e:8892:: with SMTP id k18mr43776947lji.239.1563979410600; Wed, 24 Jul 2019 07:43:30 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> In-Reply-To: From: Eric Rescorla Date: Wed, 24 Jul 2019 07:42:54 -0700 Message-ID: To: Brian Dickson Cc: Ted Lemon , Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000348c6f058e6e55a0" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:43:38 -0000 --000000000000348c6f058e6e55a0 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 7:33 AM Brian Dickson wrote: > > > On Wed, Jul 24, 2019 at 9:15 AM Eric Rescorla wrote: > >> >> >> On Wed, Jul 24, 2019 at 3:54 AM Ted Lemon wrote: >> >>> On Jul 24, 2019, at 6:40 AM, Eric Rescorla wrote: >>> >> In many cases, whether you are being told the truth by your recursive >>> resolver is a less interesting property than whether you can get the >>> correct answer. For instance, if the recursive resolver replaces the A >>> record you want with NXDOMAIN even if you know that it's done so, you're >>> still blocked from going where you wanted to go. >>> >>> However, even if you are not blocked, without DNSSEC you do not know >>> that the resolver gave you the right answer. So ideally you want both: not >>> to be blocked, and also to be able to validate the result you got. >>> >> >> Well, this is true, but in the Web context, as we move towards 100% >> HTTPS, the importance of getting the right IP starts to decrease quite a >> bit: if you get the wrong IP address, then this turns into a connection >> failure. >> >> -Ekr >> > > This is an important assertion that requires refutation: this is incorrect. > I think this is a topic on which we are going to have to agree to disagree. -Ekr > The importance of the correct IP is essential, because of the relatively > weak system under which TLS certificates are (or can be) issued. > While individual CAs may be extremely trustworthy, there has been > instances of other CAs (retrospectively discovered as being untrustworthy) > issuing TLS certificates to parties other than the domain owner. > > This is why DNSSEC, and DANE, are an important mechanism available for > strengthening certificate/browser security. > > DANE allows domain owners to securely link a specific CA or specific > certificate to a domain name. > > Only with DNSSEC and DANE, is it true that the IP address being wrong > would a connection failure be guaranteed to occur. > > That is, in fact, one of the underpinnings for why bad actors have an > interest in altering DNS caches to provide forged IP addresses. > > Thus, I assert that not only is DANE not strictly orthogonal, it is an > essential part of securing the web, along with DNSSEC. > > This is true even in a 100% HTTPS environment. The security of DNS as > provided by DNSSEC is both orthogonal to, and more important than, the > privacy of DNS recursive queries, when it to achieving that 100% HTTPS > environment. > > Brian > --000000000000348c6f058e6e55a0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 7:33 AM Brian= Dickson <brian.peter.d= ickson@gmail.com> wrote:


On Wed, Jul 24, 2019= at 9:15 AM Eric Rescorla <ekr@rtfm.com> wrote:


On Wed, Jul 24, 2019= at 3:54 AM Ted Lemon <mellon@fugue.com> wrote:
On Jul 24, 2019, at 6:40 AM, Eric Rescorla <ekr@rtfm.com> wrote:
>> In many cases, whether you are being told the truth by your recurs= ive resolver is a less interesting property than whether you can get the co= rrect answer. For instance, if the recursive resolver replaces the A record= you want with NXDOMAIN even if you know that it's done so, you're = still blocked from going where you wanted to go.

However, even if you are not blocked, without DNSSEC you do not know that t= he resolver gave you the right answer.=C2=A0 So ideally you want both: not = to be blocked, and also to be able to validate the result you got.

Well, this is true, but in the Web context, as= we move towards 100% HTTPS, the importance of getting the right IP starts = to decrease quite a bit: if you get the wrong IP address, then this turns i= nto a connection failure.

-Ekr

This is an important assertion that requ= ires refutation: this is incorrect.

=
I think this is a topic on which we are going to have to agree t= o disagree.

-Ekr


The importance of the correct IP is essential= , because of the relatively weak system under which TLS certificates are (o= r can be) issued.
While individual CAs may be extremely trustwort= hy, there has been instances of other CAs (retrospectively discovered as be= ing untrustworthy) issuing TLS certificates to parties other than the domai= n owner.

This is why DNSSEC, and DANE, are an impo= rtant mechanism available for strengthening certificate/browser security.

DANE allows domain owners to securely link a specif= ic CA or specific certificate to a domain name.

On= ly with DNSSEC and DANE, is it true that the IP address being wrong would a= connection failure be guaranteed to occur.

That i= s, in fact, one of the underpinnings for why bad actors have an interest in= altering DNS caches to provide forged IP addresses.

Thus, I assert that not only is DANE not strictly orthogonal, it is an e= ssential part of securing the web, along with DNSSEC.

<= div>This is true even in a 100% HTTPS environment. The security of DNS as p= rovided by DNSSEC is both orthogonal to, and more important than, the priva= cy of DNS recursive queries, when it to achieving that 100% HTTPS environme= nt.

Brian
--000000000000348c6f058e6e55a0-- From nobody Wed Jul 24 07:53:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2CAFF1200F4 for ; Wed, 24 Jul 2019 07:53:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GgxZat-1ndkj for ; Wed, 24 Jul 2019 07:53:02 -0700 (PDT) Received: from ppsw-30.csi.cam.ac.uk (ppsw-30.csi.cam.ac.uk [131.111.8.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73EFD12006F for ; Wed, 24 Jul 2019 07:53:02 -0700 (PDT) X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus Received: from grey.csi.cam.ac.uk ([131.111.57.57]:60576) by ppsw-30.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.136]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1hqIdY-001BjM-eY (Exim 4.92) (return-path ); Wed, 24 Jul 2019 15:53:00 +0100 Date: Wed, 24 Jul 2019 15:53:00 +0100 From: Tony Finch To: Eric Rescorla cc: Jim Reid , "add@ietf.org" , Rob Sayre In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:53:04 -0000 Eric Rescorla wrote: > > DNSSEC does not address two security issues that we are concerned with: > > - Surveillance by actors on the user's network (including, perhaps, the > recursive resolver) > > - Blocking by the recursive resolver. Whether these are problems or benefits is extremely context-dependent. In some situations they might be an attack when done without the consent of the end user; in others they might be part of the security infrastructure of a managed network that the user willingly trusts. An application cannot tell the difference. Tony. -- f.anthony.n.finch http://dotat.at/ Hebrides, Bailey: Cyclonic 3 to 5, becoming variable 2, then east 3 to 5 later. Moderate. Showers. Good occasionally poor. From nobody Wed Jul 24 07:56:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C03D11200E0 for ; Wed, 24 Jul 2019 07:56:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SaR0tTtdJGLL for ; Wed, 24 Jul 2019 07:56:48 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D51D12006F for ; Wed, 24 Jul 2019 07:56:48 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 6007A6A268; Wed, 24 Jul 2019 16:56:46 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1563980206; bh=so/0GFIKTyhKzo5mwkPMZkrN98V1zMHHhDLEyQR4YNM=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=gwMdr7MZr6PZURt6KlAwfIx0d7ZOVLkqSI97XCiy2cPUmYCJNcdO/Ya2TNH0TSTMn +9pAkgQl2JvN3ixvFAWq5A0aZGPBJukaqk1Wv1sUPkgT29Hmp25/YajJDqRoQE1Gj3 SXIxZjCaoLMlJ+vtqfKfp7xL7fBy+eNk3ILYonc1KTrtp8+pghkvpx5uOgSD4DKtEq 5Znn3oZQHPHIn+8C+em2o8tNl1CRHxYkieeEE5xDR9yB/FDqcOWwrjF+3k2fD7tWsl wTWLAe7kQdTbw+x/3J+16eznT3KSHvZY9xYf9TwiqUJ5JKw8gpm7FyXR2rSWpvQPiw S378nkqbhkMzg== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 51E833C047B; Wed, 24 Jul 2019 16:56:46 +0200 (CEST) Date: Wed, 24 Jul 2019 16:56:46 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: "Diego R. Lopez" Cc: "add@ietf.org" Message-ID: <555968666.24560.1563980206283@appsuite-gw1.open-xchange.com> In-Reply-To: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <520325278.24189.1563973538937@appsuite-gw1.open-xchange.com> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev8 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: [Add] Trust and control on the Internet (was Re: fixing coffee shop brokenness with DoH) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:56:51 -0000 =20 =20

Il 24 luglio 2019 16:22 Diego R. Lopez <diego.r.lopez@telefonica.com= > ha scritto:


Just to whole= heartedly second Ted=E2=80=99s point. As I tried to express before, my take= of the discussion yesterday is that we have to deal with a (quite serious)= trust issue.

Trust in the Internet infrastructure is a hard problem because the trus= t relationships are different depending on subjective judgements and prefer= ences. One user might trust the application and distrust the network, while= another user might trust the network and distrust the application, and a t= hird user might be uneducated and fail to make any decision or be easily fo= oled into trusting the wrong people. This last case leads to several partie= s claiming that they have to make decisions "on behalf of the users for the= ir own good", but then a struggle between the application, the network and = the government ensues, on who is actually entitled to do that, and to which= extent.

The other face of this problem is the "control plan" discussion: DoH su= pporters claim that the DNS is not a proper control plan for the Internet, = but then they do not provide alternatives to people that need one; they eit= her say "do that at the endpoints" (which is generally cumbersome for non-t= echnical users and even impossible in several legitimate cases, ranging fro= m adversarial endpoints - e.g. a bot-infected device - to endpoints that wo= n't have the necessary capabilities - e.g. IoT stuff), or "the Internet sha= ll be free, go get lost!". This is likely to result in an "arms race" - if = the protocol people do not provide a clear control plan, the operational pe= ople will just make one in some way, no matter how disruptive that will be.

While ADD already has more immediate points that deserve attention, suc= h as the best practices for configuring Do* servers, it would be good if we= could also have the architectural discussion above, which is broader and a= ffects the Internet way beyond the DNS, though it comes up when discussing = the DNS because that's where trust and control issues have been addressed u= ntil now. Perhaps this could be a separate working item or even a separate = working group.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open=
-Xchange
vittorio.b=
ertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Ital=
y
=20 From nobody Wed Jul 24 08:04:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13A8B1202DC for ; Wed, 24 Jul 2019 08:03:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2L2WS6qqwiM2 for ; Wed, 24 Jul 2019 08:03:51 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A18612031A for ; Wed, 24 Jul 2019 08:03:51 -0700 (PDT) Received: from dhcp-8a04.meeting.ietf.org (dhcp-8a04.meeting.ietf.org [31.133.138.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 5B10C2421249; Wed, 24 Jul 2019 15:03:49 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 24 Jul 2019 16:03:46 +0100 Cc: "add@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 15:03:59 -0000 > On 24 Jul 2019, at 11:40, Eric Rescorla wrote: >=20 > DNSSEC does not address two security issues that we are concerned = with: >=20 > - Surveillance by actors on the user's network (including, perhaps, = the recursive resolver) > - Blocking by the recursive resolver. DNSSEC *does* deal with recursive resolver blocking - provided the = blocked name is signed*. If the recursive resolver returns a lie -- fake = RRs or an NXDOMAIN -- a validating client can detect that and act = accordingly. * Sadly, far too many zones are not signed yet - including yours and = mine. From nobody Wed Jul 24 08:05:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 584EB12023D for ; Wed, 24 Jul 2019 08:05:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UmN1xbapWgp0 for ; Wed, 24 Jul 2019 08:05:12 -0700 (PDT) Received: from mail-qk1-x731.google.com (mail-qk1-x731.google.com [IPv6:2607:f8b0:4864:20::731]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 669991201D5 for ; Wed, 24 Jul 2019 08:05:12 -0700 (PDT) Received: by mail-qk1-x731.google.com with SMTP id r21so34030209qke.2 for ; Wed, 24 Jul 2019 08:05:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=AURlNvTIpBBNLG2BC0zw1zdZkVkSv2NIb4GGEG1UqVw=; b=kfYn3eRI2mVeygDcq+K/Qpi7kIhbCtXTnzUxFuVwsEhXC7nfsJCvyMTCd3xAyo7b+A Pak+K9+30SsgxyTleWbFWoY3bRp5aNp0eJ3ULXxX7siaW+SCDBmfwF0jjzvR9jrKFWJm YeX4oe5dwcofx6FEt+WiEB0LFvXioNcReRSWwt1ekU6YAGee8S2HU00CqUZybISdyo03 VP9p6En/PPjZkAHW74fmEckwuF+pZLJRwk/rVxHv+B8G7A57vsunl77IuXqcPUXISdVI o9pL5WrTVUUqzeuvA54px9jbsYXocbyr1zfdPahTDuhGYh+qSzKYuyQ5P2Rmiw9z4jxZ Ja/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=AURlNvTIpBBNLG2BC0zw1zdZkVkSv2NIb4GGEG1UqVw=; b=Yl0Yh8kJisSfgYWFhQ0obyL0/OFvKPZP4FplIMjpfNDKrWXHKP057x+rxhBjVEc8Sx nqdo3vkrmQyiUBhVgG5JfJSx4J5yj09dYob4CHcWYi4/F20i7/G0Fc/2hioF2O5+7teC vwtnS5zW29GOxRNoShO/i7FQyOoRZlwf6CJHxMEVu7q4hgHvylDBqnyyRb82Q6Qb1xwd Q5yHwJDRx2N90GgH6LrhZqfwaWI4fUDlsW/3oMkYZTOeYNIuK9y0Vs/XZm6LPIKQ7VVh al6+y58wkhqgzVK1BzzQsqqEqkwmqtflRb26FxwwRavKQqpQFGnCTvF/wU6B6GxDGX0a obAQ== X-Gm-Message-State: APjAAAUGhNHxKC8HrluyPz7eOAJwyM88Xd8h1mGvMWENvz76A5OGX2g3 3PDEnvcclmPeDPhx6kqGxby8W1tBX0+p6Q== X-Google-Smtp-Source: APXvYqwk6fEyB8QV49Gt5UCziHwW0E/RXeBTXQb7teynSuJV9sL6ue4ptYFxesY3tPkpVTVhPvXL7w== X-Received: by 2002:a37:815:: with SMTP id 21mr54388250qki.257.1563980711341; Wed, 24 Jul 2019 08:05:11 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:b954:d2fe:7e59:68aa? ([2001:67c:370:128:b954:d2fe:7e59:68aa]) by smtp.gmail.com with ESMTPSA id h18sm19526098qkk.93.2019.07.24.08.05.10 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 08:05:10 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_D89D8E0B-8E0B-4445-8276-48597DDEB2F1" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Ted Lemon X-Priority: 3 In-Reply-To: <555968666.24560.1563980206283@appsuite-gw1.open-xchange.com> Date: Wed, 24 Jul 2019 11:05:06 -0400 Cc: "Diego R. Lopez" , "add@ietf.org" Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <520325278.24189.1563973538937@appsuite-gw1.open-xchange.com> <555968666.24560.1563980206283@appsuite-gw1.open-xchange.com> To: Vittorio Bertola X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Trust and control on the Internet (was Re: fixing coffee shop brokenness with DoH) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 15:05:16 -0000 --Apple-Mail=_D89D8E0B-8E0B-4445-8276-48597DDEB2F1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 24, 2019, at 10:56 AM, Vittorio Bertola = wrote: > Trust in the Internet infrastructure is a hard problem because the = trust relationships are different depending on subjective judgements and = preferences.=20 Vittorio, I think it=E2=80=99s important to make a distinction between = =E2=80=9Cwho you might choose to trust=E2=80=9D and =E2=80=9Cwho you are = forced to trust.=E2=80=9D In order to run an app, if the app is able to make https connections, = you are forced to trust the app. This is true whether you are aware = that you are trusting it or not, and regardless of your attitude toward = your service provider. This is what I am getting at. This is completely orthogonal to the = question of =E2=80=9Cwhose resolver would I choose to trust?=E2=80=9D What DoH does, but what any app can do whether DoH is present or not, is = to make it possible to trust someone other than your service provider. = Without some covert channel that the service provider can=E2=80=99t = block, the user does not have this choice. But really, the user doesn=E2=80=99t have this choice anyway. It=E2=80=99= s the app that has this choice. The user may hope that the app does = what the user wants, but the user probably can=E2=80=99t validate that = leap of faith. We in the IETF do not have the ability to prevent the app from bypassing = the ISP=E2=80=99s resolver. It=E2=80=99s totally pointless to talk = about whether or not we should do this. --Apple-Mail=_D89D8E0B-8E0B-4445-8276-48597DDEB2F1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 24, 2019, at 10:56 AM, Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> = wrote:
Trust in the Internet = infrastructure is a hard problem because the trust relationships are = different depending on subjective judgements and preferences. 

Vittorio, I think it=E2=80=99s = important to make a distinction between =E2=80=9Cwho you might choose to = trust=E2=80=9D and =E2=80=9Cwho you are forced to trust.=E2=80=9D

In order to run an = app, if the app is able to make https connections, you are forced to = trust the app.   This is true whether you are aware that you are = trusting it or not, and regardless of your attitude toward your service = provider.

This = is what I am getting at.   This is completely orthogonal to the = question of =E2=80=9Cwhose resolver would I choose to = trust?=E2=80=9D

What DoH does, but what any app can do = whether DoH is present or not, is to make it possible to trust someone = other than your service provider.  Without some covert channel that = the service provider can=E2=80=99t block, the user does not have this = choice.

But = really, the user doesn=E2=80=99t have this choice anyway.   It=E2=80=99= s the app that has this choice.   The user may hope that the app does what the user wants, but the = user probably can=E2=80=99t validate that leap of faith.

We in the IETF do not = have the ability to prevent the app from bypassing the = ISP=E2=80=99s resolver.   It=E2=80=99s totally pointless to talk = about whether or not we should do this.

= --Apple-Mail=_D89D8E0B-8E0B-4445-8276-48597DDEB2F1-- From nobody Wed Jul 24 08:11:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A153E1202DC for ; Wed, 24 Jul 2019 08:10:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FEKVVSjiNWCQ for ; Wed, 24 Jul 2019 08:10:54 -0700 (PDT) Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2794E12027A for ; Wed, 24 Jul 2019 08:10:54 -0700 (PDT) Received: by mail-lj1-x22f.google.com with SMTP id v18so44821103ljh.6 for ; Wed, 24 Jul 2019 08:10:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4riK5znDxWGWc56MajjG5v4i76G9ApUDUXuMzPouRHg=; b=J/KyTGroojHadcwiFqNO8YnsS23nyZV1W9woTvz5ERO1TX6Kea1Z4inbJEYBsVLTyU iIPCF3c+UU3AJ5tQqWgokDRvG/KTlHBa8Qpw1U+/pbzeWb6II3c598/USt/vtK95xOWU URc8unqUWjvYTJVkHsBW014kIJiaA/9nbVpjrJUOLJKY+RJPHnslq+iJdfiN8lH/iwkc PWDzYd1j5vAJnaUrAJyY+BdPqYqDggDhrjAAq60b9kglR5xUExV7yy4nVxDl0rDThxMC wJC7gDIfZdryKOpRLk0Gu0z3YLdP1pd8qJSrbluQ4YnUokKkSpzdoKXlWlDVy4ilKbhc lchQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4riK5znDxWGWc56MajjG5v4i76G9ApUDUXuMzPouRHg=; b=ew36D9iR+HaJQfn8FXCNQKtpn/rGO2T5V3uMLjZu6sVUgiWcMIaBzp2o0aF/+0Fomi +zSLDZpdadVN5KpJKglZgyE2jBsyOqFfVEhGhWIajvWfrY+c3404BWuExE5oUG6Qs+iJ dWv+apCyw5qXwaXzxL6g4NKAkVFj77w2U7K5gXhvIB85kaOSGTnCYtA10IFukAZxUSYC JLjaYvIqSLW6x2rjkHBdKuuI81gEEoezNZc1S+HgUjHd2YeLvqc5cBbTfF9lfthdix+9 OSAmgvWxFWm/Th1usjkTSqU3xs5O3Pleqy921F4q8+1lnt0yIzZedu8kwedlpqYah/gL PJow== X-Gm-Message-State: APjAAAV+34/dedCSdDP4WG9In4nmVJssXCimb6GS57I9A7DBOCOELFeg MzyTQAqTKDudokNaMK+kGMzGYf6cWebAlzXM5rY= X-Google-Smtp-Source: APXvYqzR14Tu3EllgqyCqndfL40saCuergSnF1HWhp3mJCYf2txiwqFDjNOBdAw4BwpC0Ujsa5ONSrsoO7inWfPSM9g= X-Received: by 2002:a2e:9b84:: with SMTP id z4mr26657482lji.75.1563981052472; Wed, 24 Jul 2019 08:10:52 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> In-Reply-To: From: Eric Rescorla Date: Wed, 24 Jul 2019 08:10:16 -0700 Message-ID: To: Ted Lemon Cc: Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="0000000000001180bb058e6eb740" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 15:10:58 -0000 --0000000000001180bb058e6eb740 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 7:39 AM Ted Lemon wrote: > On Jul 24, 2019, at 10:37 AM, Eric Rescorla wrote: > > Yes. But that need not be cryptographically verifiable because the client > really has no option but to abandon the connection at this point, even if > it is suspicious of the DNSSEC status. > > > I think you reasoned a few steps faster than I am able to here, Eric. > Can you walk us through this step by step? > Sure. The case of interest here is that you have a client which wants to connect to domain A and the resolver (or a network attacker) wants to stop them. In the case where A is not DNSSEC signed, the attacker just sends NXDOMAIN, which the client accepts and refuses to connect. In the case where A *is* DNSSEC signed, the attacker can also inject an NXDOMAIN. DNSSEC of course won't validate, but the client still doesn't have an IP address to connect to, so it's only recourse is to error out. Now, it can show the user a different error than it did for NXDOMAIN, but these errors tend to be fairly generic anyway (Firefox, for instance, shows "Hmm. We=E2=80=99re having trouble finding that site."), so from the user perspective these aren't really very different. That's actually the best case scenario. As a practical matter, endpoint DNSSEC error rates are high enough that failure to validate DNSSEC records isn't a reliable indicator of attack, so as a practical matter, you would very likely just end up treating this as a simple resolution failure and show the same error -Ekr --0000000000001180bb058e6eb740 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 7:39 AM Ted L= emon <mellon@fugue= .com> wrote:
On Jul 24, 2019, at 10:37 AM, Eric Rescorla <ekr@rtfm.com> wrote:
Yes. But that need not be cryptogr= aphically verifiable because the client really has no option but to abandon= the connection at this point, even if it is suspicious of the DNSSEC statu= s.

I think you reasoned a few steps = faster than I am able to here, Eric. =C2=A0 Can you walk us through this st= ep by step?

Sure. The case of i= nterest here is that you have a client which wants to connect to domain A a= nd the resolver (or a network attacker) wants to stop them.

<= /div>
In the case where A is not DNSSEC signed, the attacker just sends= NXDOMAIN, which the client accepts and refuses to connect.

<= /div>
In the case where A *is* DNSSEC signed, the attacker can also inj= ect an NXDOMAIN. DNSSEC of course won't validate, but the client still = doesn't have an IP address to connect to, so it's only recourse is = to error out. Now, it can show the user a different error than it did for N= XDOMAIN, but these errors tend to be fairly generic anyway (Firefox, for in= stance, shows "Hmm. We=E2=80=99re having trouble finding that site.&qu= ot;), so from the user perspective these aren't really very different.<= /div>

That's actually the best case scenario. As a p= ractical matter, endpoint DNSSEC error rates are high enough that failure t= o validate DNSSEC records isn't a reliable indicator of attack, so as a= practical matter, you would very likely just end up treating this as a sim= ple resolution failure and show the same error

-Ekr

--0000000000001180bb058e6eb740-- From nobody Wed Jul 24 08:12:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2D75120391 for ; Wed, 24 Jul 2019 08:12:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8DVdhSfL7rq9 for ; Wed, 24 Jul 2019 08:12:00 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7923912038E for ; Wed, 24 Jul 2019 08:11:52 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id r9so44857215ljg.5 for ; Wed, 24 Jul 2019 08:11:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=RGxpga6RF4MvAh79zyYf9AhkzqY94dDHnqPjLXXx5ic=; b=rsY0vKNmEDBJrrIWEN8Dg7ej6li6K4d/iCp20KJzSoyCc41VtDti1iJO2f+D3batMn unl3RI4JdbYGNIhgtu0+nh3nI7m4utfaNsCI/ILdv5Z7lk62PDH/XWmHRfGRBN4tB7oJ eV5sT+GBzeNU4dxU4yUcNo+kVOQhA2eCF1rC+7/GPlObe4TYiNiI7yKOHh00NIZLZ6UX 0+r3xQRNTY3no1n1kD85UTgU94Dw2TsO+nKwQ/tUhf/oJejyXKr4U9ff9ziK5ul3a4+A MkWafPdmfJocOPJSAeDqToWbQThtYUXdfyuzliOzcOzgZwDKzCRQn1q5yGUp18SJ2jKv Kb/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=RGxpga6RF4MvAh79zyYf9AhkzqY94dDHnqPjLXXx5ic=; b=iVnIMl9uST7YT5+at3xzQ3Q2QjIxQCh4uhupDZ9aK0sIVIiu44V6351R6C0eSipGBb oV5v3kuai3pbW4G+yfMqxPq1SLcjzMX0oI8/hVqinFHwQ9t0+Q2LnqXSBeoIpNN8fWIV 7rjB4siSh2yAfYuAYc8NJ01LssmujDyOP0aAw+oyyi6jNTt+Ryt9JWOquQE4LvLL4P9n Ef8IPtccDC4Qby20QAkWSEX2SV0fzJMhX1VXKpy/FaKNUgjcgTPBFf1o+H7JBi9H/GeM rhVsuB1isYX7Z1zBfKTmxVbInkoUvAukSsFm38lzSe8pa+G54mF7kzEuQTEC2m0ZVE8d OVVg== X-Gm-Message-State: APjAAAWBpfS1OktAZKPb8mzHlKSFLCyDw9zdg1/zMIWnknLdhJB+vFJS 8y+7LVte0fPgYu2LlNMTrEutGtlpZxLi99FzG8s= X-Google-Smtp-Source: APXvYqwmw1ujHfpyPjZmPlXw51o2lZNcjs7Q+hDI7iS3YxAVszDKSRkxIEbp4sbBj4WDUuKU/U7eZ53Yqg5tLN4SPwo= X-Received: by 2002:a2e:8892:: with SMTP id k18mr43853642lji.239.1563981110827; Wed, 24 Jul 2019 08:11:50 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> In-Reply-To: <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> From: Eric Rescorla Date: Wed, 24 Jul 2019 08:11:14 -0700 Message-ID: To: Jim Reid Cc: "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000008be69c058e6eba00" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 15:12:06 -0000 --0000000000008be69c058e6eba00 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 8:03 AM Jim Reid wrote: > > > > On 24 Jul 2019, at 11:40, Eric Rescorla wrote: > > > > DNSSEC does not address two security issues that we are concerned with: > > > > - Surveillance by actors on the user's network (including, perhaps, the > recursive resolver) > > - Blocking by the recursive resolver. > > DNSSEC *does* deal with recursive resolver blocking - provided the blocked > name is signed*. If the recursive resolver returns a lie -- fake RRs or an > NXDOMAIN -- a validating client can detect that and act accordingly. > See my response to Ted. From the perspective of the client, acting accordingly looks basically identical to how you behave with a valid NXDOMAIN, and so DNSSEC doesn't change the situation very much. -Ekr > * Sadly, far too many zones are not signed yet - including yours and mine. > > --0000000000008be69c058e6eba00 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 8:03 AM Jim R= eid <jim@rfc1035.com> wrote:


> On 24 Jul 2019, at 11:40, Eric Rescorla <ekr@rtfm.com> wrote:
>
> DNSSEC does not address two security issues that we are concerned with= :
>
> - Surveillance by actors on the user's network (including, perhaps= , the recursive resolver)
> - Blocking by the recursive resolver.

DNSSEC *does* deal with recursive resolver blocking - provided the blocked = name is signed*. If the recursive resolver returns a lie -- fake RRs or an = NXDOMAIN -- a validating client can detect that and act accordingly.

See my response to Ted. From the perspective = of the client, acting accordingly looks basically identical to how you beha= ve with a valid NXDOMAIN, and so DNSSEC doesn't change the situation ve= ry much.

-Ekr


* Sadly, far too many zones are not signed yet - including yours and mine.<= br>
--0000000000008be69c058e6eba00-- From nobody Wed Jul 24 08:16:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CAA251201AF for ; Wed, 24 Jul 2019 08:16:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sAMX98fRuYs7 for ; Wed, 24 Jul 2019 08:16:37 -0700 (PDT) Received: from mail.hardakers.net (mail.hardakers.net [168.150.192.181]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4ECA61202E1 for ; Wed, 24 Jul 2019 08:16:37 -0700 (PDT) Received: from localhost (dhcp-9433.meeting.ietf.org [31.133.148.51]) by mail.hardakers.net (Postfix) with ESMTPA id 63F7929C43 for ; Wed, 24 Jul 2019 08:16:36 -0700 (PDT) From: Wes Hardaker To: add@ietf.org Date: Wed, 24 Jul 2019 08:16:32 -0700 Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 15:16:40 -0000 Below is the longer list of thoughts at questions about ADD that I started at the microphone. Thank you especially to those that encouraged me to write these up. # Thoughts: ## Protocols themselves are not evil They're just bits on a wire. It's only misuse of the bits that is a problem. DNS is not a problem. DoH is not a problem. It's ONE solution to an underlying problem: solving a privacy problem by encrypting DNS requests and responses help to ensure user privacy, and DoH is one mechanism to attempt to solve aspects of that problem. It does so by shifting who can see the traffic, which is all encryption can ever easily do. We have multiple choices in front of us, and I don't find any of them ideal with "no cons". ## Routing DNS requests Today, devices are already routing DNS requests to places different than the access point initially offered them. They do this sometimes by routing everything through a different network, such as when a VPN is in use. Split-tunnel VPNs are a bit more tricky, as typically all DNS requests are routed to the VPN's DNS server (for split-DNS "benefits") even though traffic sent to resolved addresses may not be. In both of these cases, users are typically aware that they're operating in a special environment. The average user does not, however, use a VPN. ADD technologies, which include DoH, DoT, global resolvers (e.g. google, cloudflare, quad9, opendns), and in-application full resolution required for in-app DNSSEC validation, all have the potential to change where resolution occurs at a much more granular level. DNS requests may be handled by completely different services based on the application type (e.g. web browser vs an email application displaying html) or even implementation (e.g. Firefox vs Opera). It is highly unlikely that the average user will be aware of this DNS request distribution architecture, however. Users will have trouble selecting where to send trouble ticket requests when "some aspect" of the Internet isn't working for them when "it's always the DNS". For example, a newly emerging issue may be a website that may suddenly not work under Chrome when it does under Safari, with the underlying reason being solely where DNS resolution happens. [Note: I'm not labeling this change as good or bad, just calling it out as something worth consideration] ## User understanding becomes tricky # Questions outstanding in my mind: The above has led me to a series of questions, that I would love community input and thought about. 1. Our primary goal in the IETF is standardization when interoperability over individually different implementation is beneficial. As multiple application stacks are trending toward their own initial implementations of DNS resolution, what are the goals of promoting interoperability and (hopefully) interchangeability? What features and benefits are we architecting for? What can we make simpler? What is the right/best architecture for the problem? 2. Does splitting the DNS resolution paths into small pieces (possibly with a potential side-effect of centralization if only a few resolution services are offered), have the potential to split the global name space (further)? If DNSSEC validation is only performed at the resolver, and never in the application, then resolvers have the freedom to answer for names that may not exist, or not answer for names that they are censoring by choice (spam, malware protection) or by force (government mandate through jurisdictional control). What concerns should we be focusing on in this area to ensure the continuation of a consistent global name space under the dual threat/benefit of possible centralization? 3. What other ramifications exist by promoting a per-protocol or per-application or per-vendor DNS resolution solution? 4. What operational impacts will there be from encrypting all DNS traffic, both good and bad? Just like TLS in the data-center issues have made debugging user problems difficult (and expensive), DoH and similar technologies may render ISP/access-point help desk's functionally unhelpful. 5. Do we and how do we inform users of this new architecture? Do users need to know what the resolution default path's are for of each OS, service and application? What are the ramifications of adding another service that makes it harder for them to provide support desks with the necessary details of issues they're observing. 6. If we were architecting this from scratch, what protocol would be select today? Would it be DoH? Would it be DoT? Would it be DNSCurve? If we didn't have the deployment impediments that are getting in the way today (e.g. forced filtering), what would we select? Are we architecting solutions for impediments over good engineering because we must? Is there a better middle ground? 7. Deployment optimization is always difficult, and with a distributed DNS resolution system/fragmentation, architecting effective resolution caching becomes even more challenging. What ramifications are likely to appear as a result of having multiple caches with different contents on end-user devices? What are the ramifications of such a system in a low-bandwidth, or high-loss environment? 8. How does application-centric resolution affect and get affected by localization efforts and constant mobility? Is centralization likely because a global-scale, low-latency resolution is difficult for small-scale deployments? Can we achieve localized, encrypted resolution that preserves user DNS resolution privacy without requiring centralization? [side thought this morning: I was imagining an airline attendant resetting the entire plane's network because of multiple complaints by passengers having network trouble, when the reality was they were all using a web browser pointing to a single (default?) DoH vendor and it had nothing to do with the local access point, but all passengers had to suffer the reset] -- Wes Hardaker USC/ISI From nobody Wed Jul 24 08:18:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F182F120321 for ; Wed, 24 Jul 2019 08:18:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RP7cgPOx-5V9 for ; Wed, 24 Jul 2019 08:18:48 -0700 (PDT) Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01DAA1202E1 for ; Wed, 24 Jul 2019 08:18:47 -0700 (PDT) Received: by mail-qk1-x72a.google.com with SMTP id s22so34044517qkj.12 for ; Wed, 24 Jul 2019 08:18:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=bxOSnaPQ4ApfCsc3+c+koVIq1sJQ+I4pBgpPxp5CsBk=; b=iwwoaMSNeGfAfoNeuB76Jskx9/B6EqJdEqZN2gJEIhQfLI2p80AwtXdTAzrmVfAJpk tFpgFCF849JN4Lf+3WeHrbhbyoh6wScXYTSS9/6g2UBujpz26BFnn0P+aDBgOlPWoWT1 ESs2ifajbAO8LKtGCqtZicC3koR6vzX/bEwk7/np1ByUPa5aDskkasLi16CWSG18Lq1v TpCEgOiCEmmVw0uV8ByveRRh9EJDsrz8ub3iSXPPZdNWRu4cVc5h9OnUXJ1KLuz80Kmd ZQq9o61xhvjpYJmbEGf6wbUAa9VN/LXoHf2VxFDXvmBgWHcTPp5OeqBeGdTRgvGLaik1 9vLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=bxOSnaPQ4ApfCsc3+c+koVIq1sJQ+I4pBgpPxp5CsBk=; b=eJF++syBNrKik/DY3s9x2r8L+ZisBZxA1tTRWS0z5m6qYsvo6TPztQSYq4XaGAHP5B r1s4vP5ci05OproOYkxivL7h4TzQfMi2Op6IA5Vb0agEvGTFOdmHmuyL8QSudNNLgy/N HkACGFkxHuLHtiUcVvJ2TBZFPhdlIhOtNKDRkPKfRSpR59Af51ZuU7r32+539EQ5hJ8O hfNd5PZGChiTvqiNd3WsCO48gPYgePPe0Iouw+zIQzXMMmAFDq2KICLImjfUK5FpQ/w9 o7WOuWGE9DLet8t49uXz4MfCD+F+7fYoSm6H3YiQ9MWrowoCG8odcWfWADa4fLj8kWi2 wZKA== X-Gm-Message-State: APjAAAVdVuY0t2KwLtPOAc322KgDJZfxQe9xPIjxhC5up9jviPLtDdFl ng5kQTA+FHQhllSrAvfC1R9Vvw== X-Google-Smtp-Source: APXvYqwSlbLpU+LxTsBAoXDO1+q+87M9W5vMQrv+e/qMft3mPXEaFRIqtcq1BTmviBXQisvKG4W2Fg== X-Received: by 2002:a37:7082:: with SMTP id l124mr49264708qkc.377.1563981527148; Wed, 24 Jul 2019 08:18:47 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:b954:d2fe:7e59:68aa? ([2001:67c:370:128:b954:d2fe:7e59:68aa]) by smtp.gmail.com with ESMTPSA id d31sm24514626qta.39.2019.07.24.08.18.44 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 08:18:45 -0700 (PDT) From: Ted Lemon Message-Id: <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_C492FF00-45EC-4E88-ADD3-91A93699D009" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 24 Jul 2019 11:18:42 -0400 In-Reply-To: Cc: Jim Reid , "add@ietf.org" , Rob Sayre To: Eric Rescorla References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 15:18:51 -0000 --Apple-Mail=_C492FF00-45EC-4E88-ADD3-91A93699D009 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 24, 2019, at 11:10 AM, Eric Rescorla wrote: > Sure. The case of interest here is that you have a client which wants = to connect to domain A and the resolver (or a network attacker) wants to = stop them. >=20 > In the case where A is not DNSSEC signed, the attacker just sends = NXDOMAIN, which the client accepts and refuses to connect. >=20 > In the case where A *is* DNSSEC signed, the attacker can also inject = an NXDOMAIN. DNSSEC of course won't validate, but the client still = doesn't have an IP address to connect to, so it's only recourse is to = error out. Now, it can show the user a different error than it did for = NXDOMAIN, but these errors tend to be fairly generic anyway (Firefox, = for instance, shows "Hmm. We=E2=80=99re having trouble finding that = site."), so from the user perspective these aren't really very = different. Ah, I see where the disconnect is. Yes, if the resolver and the = network are controlled by the same entity, then DNSSEC doesn=E2=80=99t = help you to get a connection. However, if you are able to tunnel to a resolver that is not controlled = by the network operator, then this equivalence no longer exists. In = this case, DNSSEC is useful for validating the NXDOMAIN, because the = network operator is not cooperating with the resolver operator. --Apple-Mail=_C492FF00-45EC-4E88-ADD3-91A93699D009 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 24, 2019, at 11:10 AM, Eric Rescorla <ekr@rtfm.com> = wrote:
Sure. = The case of interest here is that you have a client which wants to = connect to domain A and the resolver (or a network attacker) wants to = stop them.

In the case where A is not DNSSEC = signed, the attacker just sends NXDOMAIN, which the client accepts and = refuses to connect.

In = the case where A *is* DNSSEC signed, the attacker can also inject an = NXDOMAIN. DNSSEC of course won't validate, but the client still doesn't = have an IP address to connect to, so it's only recourse is to error out. = Now, it can show the user a different error than it did for NXDOMAIN, = but these errors tend to be fairly generic anyway (Firefox, for = instance, shows "Hmm. We=E2=80=99re having trouble finding that site."), = so from the user perspective these aren't really very = different.

Ah, I see = where the disconnect is.   Yes, if the resolver and the network are = controlled by the same entity, then DNSSEC doesn=E2=80=99t help you to = get a connection.

However, if you = are able to tunnel to a resolver that is not controlled by the network = operator, then this equivalence no longer exists.   In this case, = DNSSEC is useful for validating the NXDOMAIN, because the network = operator is not cooperating with the resolver operator.


= --Apple-Mail=_C492FF00-45EC-4E88-ADD3-91A93699D009-- From nobody Wed Jul 24 08:21:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F81F1202E1 for ; Wed, 24 Jul 2019 08:20:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GIJducv4WZ4K for ; Wed, 24 Jul 2019 08:20:57 -0700 (PDT) Received: from mail-lf1-x134.google.com (mail-lf1-x134.google.com [IPv6:2a00:1450:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59C8E120337 for ; Wed, 24 Jul 2019 08:20:56 -0700 (PDT) Received: by mail-lf1-x134.google.com with SMTP id z15so27964547lfh.13 for ; Wed, 24 Jul 2019 08:20:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=E9uqVOaEVHY7A/m4DURShfq/n1bg/uZ7Db+eXt33abM=; b=hLp6TuQyFjZdZtKMrmdAkj7sJulY3yCiuwrLFXiInzhHdo/iosEiy780VyVwyQ8vnq auiuVl++U8HhxmrT+AwP0ujb+4SMB3xscNhDmmyuysXpcmsAbc1+I/kdy2iXYr+1Ejxy q/iGSMZetnkS25Js07STAzej2zAXopYjKIdhtyXWLI26cEYtMXzPvOLVeA9zYzd9DiNK 0ByVkNknYf/RuE4WuWOyVqxL27xrZ5sZzpS8u7ycquWq5tF9DLbu1d24p9EwlUgstxy5 9BfXc5jwupO4xaoC9tdSj7D2ZP3jOQ/QXrdevVCl5DYj9C6gtoH8CYMJbGXcCX/7qX0Y 9SUw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=E9uqVOaEVHY7A/m4DURShfq/n1bg/uZ7Db+eXt33abM=; b=cT5axK3ihj9AbOddDSuIz95qLnWAKWAenrIfK3tppGk/cl9a/YqDrTSosnkKocnvDb MvIFCci+6SGy0z8KKy7mG6df3vFaH+fq2JgkT5q7lemXo7wXPkadifxsEK/Y4nTuRJ9S Rh9oaOjZ1pC880oaL4gwq2w2KwYIt2k7xTrycJIp4yuZl29tsSaJDFjjRyx1f6faSCmm sM18zSmaS033wszpoKrl1ObPB4Pe3fxbbTHnPnQyZ37bd4Zf2eEg47YkPFhyQ9IaWW0q h6xAjk+2GjTpsRQ0ZWhw/xRwZ/y2R/SfMwd5qhvAHKzK03AuDOfmt4jAxU+dGkCNdnBd EtNw== X-Gm-Message-State: APjAAAUco4S6LuscAmv4HqZtr6MmM9Nytvh8si4ZQ1uhopdIugprisAZ kPaNXqf9am7P8ysDA4c6p1cnWhQtGyYLqARVGBg= X-Google-Smtp-Source: APXvYqznMWsFzWWP5LfsV2bhom+8rcM35OBn+SRNuEalwJ0dCXJNExWElPcSCXEtrW0uod7uGXy5s+GPNTivWzztP3s= X-Received: by 2002:ac2:528e:: with SMTP id q14mr36213165lfm.17.1563981654592; Wed, 24 Jul 2019 08:20:54 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> In-Reply-To: <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> From: Eric Rescorla Date: Wed, 24 Jul 2019 08:20:18 -0700 Message-ID: To: Ted Lemon Cc: Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000f52a2f058e6eda6e" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 15:21:00 -0000 --000000000000f52a2f058e6eda6e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 8:18 AM Ted Lemon wrote: > On Jul 24, 2019, at 11:10 AM, Eric Rescorla wrote: > > Sure. The case of interest here is that you have a client which wants to > connect to domain A and the resolver (or a network attacker) wants to sto= p > them. > > In the case where A is not DNSSEC signed, the attacker just sends > NXDOMAIN, which the client accepts and refuses to connect. > > In the case where A *is* DNSSEC signed, the attacker can also inject an > NXDOMAIN. DNSSEC of course won't validate, but the client still doesn't > have an IP address to connect to, so it's only recourse is to error out. > Now, it can show the user a different error than it did for NXDOMAIN, but > these errors tend to be fairly generic anyway (Firefox, for instance, sho= ws > "Hmm. We=E2=80=99re having trouble finding that site."), so from the user > perspective these aren't really very different. > > > Ah, I see where the disconnect is. Yes, if the resolver and the network > are controlled by the same entity, then DNSSEC doesn=E2=80=99t help you t= o get a > connection. > > However, if you are able to tunnel to a resolver that is not controlled b= y > the network operator, then this equivalence no longer exists. In this > case, DNSSEC is useful for validating the NXDOMAIN, because the network > operator is not cooperating with the resolver operator. > I'm sorry, I think I'm confused. Where do you think the attacker is positioned? -Ekr --000000000000f52a2f058e6eda6e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 8:18 AM Ted L= emon <mellon@fugue.com> wrote= :
On Jul 24, 2019, at 11:10 AM, Eric Rescorla <= ;ekr@rtfm.com> wro= te:
Sure. The case = of interest here is that you have a client which wants to connect to domain= A and the resolver (or a network attacker) wants to stop them.

In the case where A is not DN= SSEC signed, the attacker just sends NXDOMAIN, which the client accepts and= refuses to connect.

In the case where A *is* DNSSEC signed, the attacker can also inject an = NXDOMAIN. DNSSEC of course won't validate, but the client still doesn&#= 39;t have an IP address to connect to, so it's only recourse is to erro= r out. Now, it can show the user a different error than it did for NXDOMAIN= , but these errors tend to be fairly generic anyway (Firefox, for instance,= shows "Hmm. We=E2=80=99re having trouble finding that site."), s= o from the user perspective these aren't really very different.

Ah, I see where the disconnect is. =C2=A0 Y= es, if the resolver and the network are controlled by the same entity, then= DNSSEC doesn=E2=80=99t help you to get a connection.

<= div>However, if you are able to tunnel to a resolver that is not controlled= by the network operator, then this equivalence no longer exists. =C2=A0 In= this case, DNSSEC is useful for validating the NXDOMAIN, because the netwo= rk operator is not cooperating with the resolver operator.

I'm sorry, I think I'm confused. Where = do you think the attacker is positioned?

-Ekr<= /div>

--000000000000f52a2f058e6eda6e-- From nobody Wed Jul 24 08:58:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 476DE12013B for ; Wed, 24 Jul 2019 08:58:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v5yXOfuke55v for ; Wed, 24 Jul 2019 08:58:39 -0700 (PDT) Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 101A21200B3 for ; Wed, 24 Jul 2019 08:58:38 -0700 (PDT) Received: by mail-qt1-x82a.google.com with SMTP id w17so1661890qto.10 for ; Wed, 24 Jul 2019 08:58:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=RUlYCCqmTUQKAhNuO0buskGODyVBUsirebklev9PqIY=; b=Ou7UcNSDRIIk0UZqdRL/nyYxyh0VT+FvCUwWE9eR7RD4bpj+aDeYWwQkI+1MqtFeCi Oz4LGWPUIxlj0NnTfszu62ziNa7Uxw/5myu0v/jP9XwqCmRMXbvXzNZ750XEkvb/nAZt Df0yTJFDNGdhWImgPL3Q1SbPoQsdSYonkoAeiDtLKmxIazgNJuTvjYc2INDPcRNdAGts KWyAARCTRttqz7EBqNu2P0GGv6X9d1/vFJ4zUF5GwFYCf7KDPWz10pbKcWF9uuGw0SKu H2iZXQ7CumC3pHq1ag8znpF0ihvBOMv8pY/opO+odrfFSGr+CJH+xElcC+eR7FO5cE4z pQhA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=RUlYCCqmTUQKAhNuO0buskGODyVBUsirebklev9PqIY=; b=W9v18EoLsoauynNycA+diAsnWVrAd2xUWnQsWQ9/xfiCPuqMTABedl7JWXgiQT4lWS PPzCFJP9crjd/3drpqogoO2QT6JDxCQYtF6bzMl+Lw8h5XBrxlJmaxyRtFQQf2XON7AL MErHom0I8whhHw1cdPaamujbGJq+nHZ1mXLAO9bX8LZo9IvpzsoHGKyv7Cb7WBRxFDbT CvnZ1h3i7tXQh1MwsEyVREp6a8qQqt4yTkHhHJfl3fYeRFstT+bqhvG3EeiAbpX6l+qG c0+fmSAF96zSAM3zs5E4QIakDFRp9VpVFTJ5fEGP1Lxr6wYDHpRVf92XFQn8YzTxSaGb NNaw== X-Gm-Message-State: APjAAAWDLLI1316jHKbZqcrsTU/mckp5vARFH78UitqDA9lQhqcyh8iR ppSCCLNQ1oXUWeOy7JDuagIsJ58mPmP12Q== X-Google-Smtp-Source: APXvYqzqwTvtgWmIXeN3TDZaM80uXE1OcdORguiNulRKKanGw2XXF3ITt2nGt8h23dQtzQndsv4yOw== X-Received: by 2002:a0c:8321:: with SMTP id j30mr3606396qva.171.1563983917853; Wed, 24 Jul 2019 08:58:37 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:e499:b675:19fb:320b? ([2001:67c:1232:144:e499:b675:19fb:320b]) by smtp.gmail.com with ESMTPSA id u1sm25982093qth.21.2019.07.24.08.58.37 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 08:58:37 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-26DD618C-C620-48A5-9604-5778BD42C604 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Wed, 24 Jul 2019 11:58:36 -0400 Cc: Jim Reid , "add@ietf.org" , Rob Sayre Content-Transfer-Encoding: 7bit Message-Id: <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> To: Eric Rescorla Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 15:58:41 -0000 --Apple-Mail-26DD618C-C620-48A5-9604-5778BD42C604 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable There are a variety of attack scenarios to account for. DNSSEC is not useful= for countering a fake NXDOMAIN attack when the attacker also controls the p= ath and can prevent connection establishment. However, if the attacker is the resolver, and the resolver isn=E2=80=99t und= er the control of the path, then detecting a fake NXDOMAIN is useful.=20 Sent from my iPhone > On Jul 24, 2019, at 11:20 AM, Eric Rescorla wrote: >=20 >=20 >=20 >> On Wed, Jul 24, 2019 at 8:18 AM Ted Lemon wrote: >>> On Jul 24, 2019, at 11:10 AM, Eric Rescorla wrote: >>> Sure. The case of interest here is that you have a client which wants to= connect to domain A and the resolver (or a network attacker) wants to stop t= hem. >>>=20 >>> In the case where A is not DNSSEC signed, the attacker just sends NXDOMA= IN, which the client accepts and refuses to connect. >>>=20 >>> In the case where A *is* DNSSEC signed, the attacker can also inject an N= XDOMAIN. DNSSEC of course won't validate, but the client still doesn't have a= n IP address to connect to, so it's only recourse is to error out. Now, it c= an show the user a different error than it did for NXDOMAIN, but these error= s tend to be fairly generic anyway (Firefox, for instance, shows "Hmm. We=E2= =80=99re having trouble finding that site."), so from the user perspective t= hese aren't really very different. >>=20 >> Ah, I see where the disconnect is. Yes, if the resolver and the network= are controlled by the same entity, then DNSSEC doesn=E2=80=99t help you to g= et a connection. >>=20 >> However, if you are able to tunnel to a resolver that is not controlled b= y the network operator, then this equivalence no longer exists. In this ca= se, DNSSEC is useful for validating the NXDOMAIN, because the network operat= or is not cooperating with the resolver operator. >=20 > I'm sorry, I think I'm confused. Where do you think the attacker is positi= oned? >=20 > -Ekr >=20 --Apple-Mail-26DD618C-C620-48A5-9604-5778BD42C604 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable There are a variety of attack scenarios to a= ccount for. DNSSEC is not useful for countering a fake NXDOMAIN attack when t= he attacker also controls the path and can prevent connection establishment.=

However, if the attacker is the resolver, and the resolv= er isn=E2=80=99t under the control of the path, then detecting a fake NXDOMA= IN is useful. 

Sent f= rom my iPhone

On Jul 24, 2019, at 11:20 AM, Eric R= escorla <ekr@rtfm.com> wrote:
<= br>


On Wed, Jul 24, 2019 at 8:18 AM Ted Lemon <mellon@fugue.com> wrote:
O= n Jul 24, 2019, at 11:10 AM, Eric Rescorla <ekr@rtfm.com> wrote:
Sure. The case of interest here is that you have a= client which wants to connect to domain A and the resolver (or a network at= tacker) wants to stop them.

In the case where A is not DNSSEC signed, the attacker just sends NXDOMAI= N, which the client accepts and refuses to connect.
<= br>
In the case where A *is* DNSSEC signed, the attac= ker can also inject an NXDOMAIN. DNSSEC of course won't validate, but the cl= ient still doesn't have an IP address to connect to, so it's only recourse i= s to error out. Now, it can show the user a different error than it did for N= XDOMAIN, but these errors tend to be fairly generic anyway (Firefox, for ins= tance, shows "Hmm. We=E2=80=99re having trouble finding that site."), so fro= m the user perspective these aren't really very different.

Ah, I see where the disconnect is.   Yes, if the r= esolver and the network are controlled by the same entity, then DNSSEC doesn= =E2=80=99t help you to get a connection.

However, i= f you are able to tunnel to a resolver that is not controlled by the network= operator, then this equivalence no longer exists.   In this case, DNSS= EC is useful for validating the NXDOMAIN, because the network operator is no= t cooperating with the resolver operator.

<= /div>
I'm sorry, I think I'm confused. Where do you think the attacker i= s positioned?

-Ekr

= --Apple-Mail-26DD618C-C620-48A5-9604-5778BD42C604-- From nobody Wed Jul 24 09:00:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C247E1200B3 for ; Wed, 24 Jul 2019 09:00:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pZQe0x5WL4ti for ; Wed, 24 Jul 2019 09:00:42 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 788E61202B1 for ; Wed, 24 Jul 2019 09:00:40 -0700 (PDT) Received: from dhcp-8a04.meeting.ietf.org (dhcp-8a04.meeting.ietf.org [31.133.138.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 6C428242109D; Wed, 24 Jul 2019 16:00:38 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 24 Jul 2019 17:05:50 +0100 Cc: "add@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 16:00:44 -0000 > On 24 Jul 2019, at 16:11, Eric Rescorla wrote: >=20 > See my response to Ted. =46rom the perspective of the client, acting = accordingly looks basically identical to how you behave with a valid = NXDOMAIN, and so DNSSEC doesn't change the situation very much. Not really. A validation failure is a fairly strong indication that the = resolver is lying to you. Or should be. So a security-aware application = would know the current resolver can't be trusted (or is at the very = least suspcious) and take suitable countermeasures. That's what I meant = by "act accordingly". From nobody Wed Jul 24 09:26:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9C4512042E for ; Wed, 24 Jul 2019 09:26:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pI5fIEjx4qdB for ; Wed, 24 Jul 2019 09:26:37 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0B38120417 for ; Wed, 24 Jul 2019 09:26:33 -0700 (PDT) Received: from dhcp-8a04.meeting.ietf.org (dhcp-8a04.meeting.ietf.org [31.133.138.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id B8EEC242109D; Wed, 24 Jul 2019 16:26:23 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 24 Jul 2019 17:26:21 +0100 Cc: "add@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <6C13E3DF-F40E-4866-8DF1-108F747B8CD4@rfc1035.com> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 16:26:39 -0000 > On 24 Jul 2019, at 11:40, Eric Rescorla wrote: >=20 >> On Tue, Jul 23, 2019 at 6:51 PM Jim Reid wrote: >>=20 >>> > On 24 Jul 2019, at 01:16, Rob Sayre wrote: >>> >=20 >>> > DNS is insecure in a coffee shop, and that is going to be fixed. >>>=20 >> It didn't/doesn't take or need DoH (or DoT) to fix that problem. >>=20 > Can you expand on this point? I'm guessing you're referring to = DNSSEC. Well DNSSEC is one option. There are others: using a VPN, IPec or some other encrypted tunnel pointing your (plaintext) queries at a resolver you consider = trusted run a validating resolver on your device use a "special" DNS client like Cisco Anyconnect or IBM Endpoint = Manager* =09 * These sorts of clients are very popular with roving enterprise users = who *cannot and must not* trust the coffee shop resolver. From nobody Wed Jul 24 10:00:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E8FA12028E for ; Wed, 24 Jul 2019 10:00:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.648 X-Spam-Level: X-Spam-Status: No, score=-1.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C97MoaP2aAnc for ; Wed, 24 Jul 2019 10:00:34 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [IPv6:2001:4b98:dc0:41:216:3eff:fe27:3d3f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 949C012027B for ; Wed, 24 Jul 2019 10:00:34 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id 9B621A052F; Wed, 24 Jul 2019 19:00:31 +0200 (CEST) Received: by godin (Postfix, from userid 1000) id F2477EC0AFD; Wed, 24 Jul 2019 18:59:51 +0200 (CEST) Date: Wed, 24 Jul 2019 12:59:51 -0400 From: Stephane Bortzmeyer To: Jim Reid Cc: Rob Sayre , add@ietf.org Message-ID: <20190724165951.GB29051@laperouse.bortzmeyer.org> References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:00:37 -0000 On Tue, Jul 23, 2019 at 11:45:07PM +0100, Jim Reid wrote a message of 16 lines which said: > And FWIW the success of DoH deployment -- for some definition of > success -- seems to rest solely in the hands of a very small number > of dominant players. It depends on us. Or, rather, on it depends on a more general group, the group of people who write, install and manage DoH resolvers. The more they will be, the less users will depend on a few servers. My hope is we will see many DoH resolvers (not always public). From nobody Wed Jul 24 10:00:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 872E512027B for ; Wed, 24 Jul 2019 10:00:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.648 X-Spam-Level: X-Spam-Status: No, score=-1.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8F_ZLhCTwLWU for ; Wed, 24 Jul 2019 10:00:34 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [IPv6:2001:4b98:dc0:41:216:3eff:fe27:3d3f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94931120226 for ; Wed, 24 Jul 2019 10:00:34 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id A75E8A0531; Wed, 24 Jul 2019 19:00:31 +0200 (CEST) Received: by godin (Postfix, from userid 1000) id 1613AEC0AFD; Wed, 24 Jul 2019 18:56:43 +0200 (CEST) Date: Wed, 24 Jul 2019 12:56:43 -0400 From: Stephane Bortzmeyer To: add@ietf.org Message-ID: <20190724165643.GA29051@laperouse.bortzmeyer.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: [Add] Not a good BoF meeting X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:00:37 -0000 In my opinion, the ADD BoF yesterday was not good. First, it did not stand by its name. The issue of Applications Doing DNS was just one point, lost among many others. This mailing list has the same issue, by the way, so I suggest to rename it, although I don't know to what, since people here seem to talk about a lot of unrelated subjects. (Remember that if you want to talk about DoH, there is doh@ietf.org, and if you want to talk about DNS operations, there is dnsop@ietf.org, the place where we overload camels.) I do not see anything serious coming from such confusion. A similar problem occured for the "operational issues" question. Under this umbrella, I've heard people talk about: * policy requirments, often outrageous (requiring DNSSEC validation or the use of the IANA root for DoH resolvers, as if we did anything like that for other DNS resolvers), * technical tuning of servers (a nice thing, although may be not something that should be done in the IETF), * discovery of local DoH resolvers (in my opinion, a flawed idea from the start: if you trust the local network, you don't need DoH, if you don't, you won't trust its DoH announces anyway), * various rants about how DoH would prevent a third-party to see and modify the DNS messages (which is DoH's main goal, so it's not a problem), * and many others. I suggest that this list does not do anything useful at this time. I have nothing about specific work on specific points, but I don't think general "everything I do not like about DoH" slides will help. From nobody Wed Jul 24 10:04:49 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F1356120112 for ; Wed, 24 Jul 2019 10:04:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.648 X-Spam-Level: X-Spam-Status: No, score=-1.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tGI1u4hwH7cS for ; Wed, 24 Jul 2019 10:04:46 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [IPv6:2001:4b98:dc0:41:216:3eff:fe27:3d3f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98E2A120059 for ; Wed, 24 Jul 2019 10:04:46 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id 49A17A0531; Wed, 24 Jul 2019 19:04:45 +0200 (CEST) Received: by godin (Postfix, from userid 1000) id EA510EC0AFD; Wed, 24 Jul 2019 19:03:02 +0200 (CEST) Date: Wed, 24 Jul 2019 13:03:02 -0400 From: Stephane Bortzmeyer To: Brett Carr Cc: Jim Reid , Rob Sayre , "add@ietf.org" Message-ID: <20190724170302.GC29051@laperouse.bortzmeyer.org> References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:04:48 -0000 On Wed, Jul 24, 2019 at 09:30:03AM +0000, Brett Carr wrote a message of 27 lines which said: > I would like to see lots of operators running DOH/DOT in an > interoperable standard way and not leave it to a few large > organisations. I fully agree (the more, the better), but it does not completely depend on IETF (we don't run network services). (See my paper at the last IAB workshop ) From nobody Wed Jul 24 10:15:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2334A12015B for ; Wed, 24 Jul 2019 10:15:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7GHIeu7fs5xn for ; Wed, 24 Jul 2019 10:15:06 -0700 (PDT) Received: from mail-lf1-x12b.google.com (mail-lf1-x12b.google.com [IPv6:2a00:1450:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A4573120112 for ; Wed, 24 Jul 2019 10:15:05 -0700 (PDT) Received: by mail-lf1-x12b.google.com with SMTP id v85so32454319lfa.6 for ; Wed, 24 Jul 2019 10:15:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=RwaEFKHhtZfVyP7U9PO0pWJSqWIYi8SxRRSKy37gnfk=; b=sVZ/jC8tTxcxl2XaFNyV3E2RjirhIbx+6Msg8wI7U8e50q7Cknf4DK/rDJtT+91XzU PS/Bt9XHPzg5wvZwKBZQx2xmqlsTi47c4LdeGHzLCFxeRBWok9AjOh0jzBj8veN7mTsO ptggi3FDLoP50zl92GmzhlxCxBdTltmc/pdbgU3PuEJwfklwk+KPqhQ/I1o+xY/4WPBW 3BvLD44+0m4iDyqKIG5VyAPr7W1676pMLZcG27/bLxCBOhbsWzU8PBDb3oRoC+rnezIX qaagzc8GCEP1tnq4RFSYdrpKhooCHEFpRaT47lQ/TBmTC4fDyuGm5xagho6CXrTBAuXO CUCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=RwaEFKHhtZfVyP7U9PO0pWJSqWIYi8SxRRSKy37gnfk=; b=fxalgA2hk77du10nVmPnXxm7Yxf51qPcZuN+kWDQRjPv0eC6ALW5pDG5CXasWEB7Rq qeFK8pLTz2qzxq+YGWwv9yQjxVwqWHEdx0Lkjlim9EySU2Wjz88s5ES86aOEHWHq3Noa XpwbYQinrP4EZB3D7++ThrI16tbeRpe5CDhj5feeHZj+K2Ye9vSWPaXxrS5WfoWT0o0t Bsx0PHJ/0k3DQ1pKBCeMQggBE04DOTBYN2R31SsVz51lX/XQGIlBQdcv3xextG4E4oYA bKe95L0KbYauAYz/CC4n+lZfZrnDuzGbxpnA7hNMlVmVo7IvglKz1+eJ/xz8sVxtgl1+ 61OA== X-Gm-Message-State: APjAAAX66Z3LPY0E1ZgmEMsOQpzfXIdbLK0rWOzp4NE2FTIJB5Zn5s85 KqwQiqGG4v13BtuxFSOHBo74VRnXZ/kR6B6YMzkBQA== X-Google-Smtp-Source: APXvYqxVDV5ZMZfhQ7vVJCJUV/PZp7xobo2I1h/ONpwLgSgd0A+nfTEdU9fTNiKGHrH9se8PumQo3SyZoFXy7Z4elnQ= X-Received: by 2002:ac2:51a3:: with SMTP id f3mr11063209lfk.94.1563988503853; Wed, 24 Jul 2019 10:15:03 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> In-Reply-To: From: Eric Rescorla Date: Wed, 24 Jul 2019 10:14:27 -0700 Message-ID: To: Jim Reid Cc: "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000348f7d058e707328" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:15:08 -0000 --000000000000348f7d058e707328 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 9:00 AM Jim Reid wrote: > > > > On 24 Jul 2019, at 16:11, Eric Rescorla wrote: > > > > See my response to Ted. From the perspective of the client, acting > accordingly looks basically identical to how you behave with a valid > NXDOMAIN, and so DNSSEC doesn't change the situation very much. > > Not really. A validation failure is a fairly strong indication that the > resolver is lying to you. Not really, no. Our current belief is that there is going to be quite a high rate of non-malicious validation failures. Or should be. So a security-aware application would know the current > resolver can't be trusted (or is at the very least suspcious) and take > suitable countermeasures. That's what I meant by "act accordingly". > What do you believe those countermeasures are? -Ekr --000000000000348f7d058e707328 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 9:00 AM Jim R= eid <jim@rfc1035.com> wrote:


> On 24 Jul 2019, at 16:11, Eric Rescorla <ekr@rtfm.com> wrote:
>
> See my response to Ted. From the perspective of the client, acting acc= ordingly looks basically identical to how you behave with a valid NXDOMAIN,= and so DNSSEC doesn't change the situation very much.

Not really. A validation failure is a fairly strong indication that the res= olver is lying to you.

Not really, no. Our = current belief is that there is going to be quite a high rate of non-malici= ous validation failures.


Or should be. So a security-aware appli= cation would know the current resolver can't be trusted (or is at the v= ery least suspcious) and take suitable countermeasures. That's what I m= eant by "act accordingly".
=C2=A0
What do you believe those countermeasures are?<= br>

-Ekr

=
--000000000000348f7d058e707328-- From nobody Wed Jul 24 10:15:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 914ED120112 for ; Wed, 24 Jul 2019 10:15:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ayMbvoVlETSm for ; Wed, 24 Jul 2019 10:15:29 -0700 (PDT) Received: from mail-lj1-x236.google.com (mail-lj1-x236.google.com [IPv6:2a00:1450:4864:20::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DAC01205E8 for ; Wed, 24 Jul 2019 10:15:29 -0700 (PDT) Received: by mail-lj1-x236.google.com with SMTP id v18so45204936ljh.6 for ; Wed, 24 Jul 2019 10:15:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=88p7wl58eAxTEZ+eBFCpS4cprWl9t35e8oPDDpZW5ys=; b=ohOQaaH56mgD2ramu88vTLeef2I3Qz7gfXJmC+3hjOpfBiktoVbaBi9LbpNV3reF4I ktBSpOTo/8pnOZTH8s4L/eBEg6FaFXl45MuShqGb3C1oBnWrL7XjQJLqHVfpaVmSNsL6 sSYE1yR0jHK2eBdjs8cf479W7ilYqkJ3oEmP/QmkZxOiEWifnKUWaxI4KFnlGkxUYrcX eB+YtHOTGf2TqB0f5D9rq4DMlidDV++Kv1XbqU5DsuvAv2ASKJFw8eXEtOnzWjQJ7Jbd QYPspIjemNYX4bJ9+i2xLc2xa9ImaLhxO+QHPAnzcoq+2IX57RdQhFGL3Ysn/j82cp2i 4z6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=88p7wl58eAxTEZ+eBFCpS4cprWl9t35e8oPDDpZW5ys=; b=Uq+JXTDzluw2Y6gsd6nTq7Da2v2MOS971stTmRbwt31V+XxaQDFPFuB9vPtlyJuPAU wWQr4tWgCU6OUcTbBA1Pzd+zCo1WsU8n8o8DnSXzWt7Z5XyLcfzmGbPwFQNm7N2zAVH5 Em7gCKUO3eBmn6wQ7+9CyKn1Mpx9qJLZTI6HRxKj+gMXYTUcmlbWBXetoVFiynto5uef mviZ6pMQJ4DDB6Pv1wzd6E+knjr/pwrstNTptURGeA3833IMf0N5u0xuHkQAFmtFodtq OVcB2dIeJ2EPhPoj5Vufx2HkVmgGKYc7f0fuSx2h1hgsT9JzjZ/lYyBv94oosyHeiXzq uarw== X-Gm-Message-State: APjAAAVbrgcvbJ1oTbllXsPfM+asS5VaLZ/ST8QGRg9y9T7a4QGAkA9z CR2blOhmNTtTtgBhALpBGg1y3t3WdQD1ZijszBY= X-Google-Smtp-Source: APXvYqx17ZlFSHCv38f5F1x6AGnZpsM/onmVoAKxX6zOVCZX1GpsbRu8UdgupcgiyO7sznDS6X2PknUgP7AuP/AOrns= X-Received: by 2002:a2e:9cd4:: with SMTP id g20mr20988382ljj.205.1563988527602; Wed, 24 Jul 2019 10:15:27 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> In-Reply-To: <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> From: Eric Rescorla Date: Wed, 24 Jul 2019 10:14:51 -0700 Message-ID: To: Ted Lemon Cc: Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="0000000000009ef6d9058e70740a" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:15:33 -0000 --0000000000009ef6d9058e70740a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 8:58 AM Ted Lemon wrote: > There are a variety of attack scenarios to account for. DNSSEC is not > useful for countering a fake NXDOMAIN attack when the attacker also > controls the path and can prevent connection establishment. > > However, if the attacker is the resolver, and the resolver isn=E2=80=99t = under the > control of the path, then detecting a fake NXDOMAIN is useful. > How? -Ekr > Sent from my iPhone > > On Jul 24, 2019, at 11:20 AM, Eric Rescorla wrote: > > > > On Wed, Jul 24, 2019 at 8:18 AM Ted Lemon wrote: > >> On Jul 24, 2019, at 11:10 AM, Eric Rescorla wrote: >> >> Sure. The case of interest here is that you have a client which wants to >> connect to domain A and the resolver (or a network attacker) wants to st= op >> them. >> >> In the case where A is not DNSSEC signed, the attacker just sends >> NXDOMAIN, which the client accepts and refuses to connect. >> >> In the case where A *is* DNSSEC signed, the attacker can also inject an >> NXDOMAIN. DNSSEC of course won't validate, but the client still doesn't >> have an IP address to connect to, so it's only recourse is to error out. >> Now, it can show the user a different error than it did for NXDOMAIN, bu= t >> these errors tend to be fairly generic anyway (Firefox, for instance, sh= ows >> "Hmm. We=E2=80=99re having trouble finding that site."), so from the use= r >> perspective these aren't really very different. >> >> >> Ah, I see where the disconnect is. Yes, if the resolver and the networ= k >> are controlled by the same entity, then DNSSEC doesn=E2=80=99t help you = to get a >> connection. >> >> However, if you are able to tunnel to a resolver that is not controlled >> by the network operator, then this equivalence no longer exists. In th= is >> case, DNSSEC is useful for validating the NXDOMAIN, because the network >> operator is not cooperating with the resolver operator. >> > > I'm sorry, I think I'm confused. Where do you think the attacker is > positioned? > > -Ekr > > --0000000000009ef6d9058e70740a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 8:58 AM Ted L= emon <mellon@fugue.com> wrote= :
There are a variety of attack scenarios to account for. DNSSEC is not u= seful for countering a fake NXDOMAIN attack when the attacker also controls= the path and can prevent connection establishment.

Howe= ver, if the attacker is the resolver, and the resolver isn=E2=80=99t under = the control of the path, then detecting a fake NXDOMAIN is useful.=C2=A0

How?

-Ekr


Sent from my iPhone

On Jul= 24, 2019, at 11:20 AM, Eric Rescorla <ekr@rtfm.com> wrote:



=
On Wed, Ju= l 24, 2019 at 8:18 AM Ted Lemon <mellon@fugue.com> wrote:
On Jul 24, 2019, at 11:10 AM, Eric Re= scorla <ekr@rtfm.com> wrote:
Sure.= The case of interest here is that you have a client which wants to connect= to domain A and the resolver (or a network attacker) wants to stop them.

In the case where A= is not DNSSEC signed, the attacker just sends NXDOMAIN, which the client a= ccepts and refuses to connect.

In the case where A *is* DNSSEC signed, the attacker can also = inject an NXDOMAIN. DNSSEC of course won't validate, but the client sti= ll doesn't have an IP address to connect to, so it's only recourse = is to error out. Now, it can show the user a different error than it did fo= r NXDOMAIN, but these errors tend to be fairly generic anyway (Firefox, for= instance, shows "Hmm. We=E2=80=99re having trouble finding that site.= "), so from the user perspective these aren't really very differen= t.

Ah, I see where the disconnect is= . =C2=A0 Yes, if the resolver and the network are controlled by the same en= tity, then DNSSEC doesn=E2=80=99t help you to get a connection.
<= br>
However, if you are able to tunnel to a resolver that is not = controlled by the network operator, then this equivalence no longer exists.= =C2=A0 In this case, DNSSEC is useful for validating the NXDOMAIN, because= the network operator is not cooperating with the resolver operator.
<= /div>


=
-Ekr

--0000000000009ef6d9058e70740a-- From nobody Wed Jul 24 10:17:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDB3A120112 for ; Wed, 24 Jul 2019 10:17:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.648 X-Spam-Level: X-Spam-Status: No, score=-1.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l027cNwI8Y_x for ; Wed, 24 Jul 2019 10:17:28 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [92.243.4.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C42B120059 for ; Wed, 24 Jul 2019 10:17:28 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id 976C9A0531; Wed, 24 Jul 2019 19:17:26 +0200 (CEST) Received: by godin (Postfix, from userid 1000) id 9BA43EC0AFD; Wed, 24 Jul 2019 19:15:49 +0200 (CEST) Date: Wed, 24 Jul 2019 13:15:49 -0400 From: Stephane Bortzmeyer To: "STARK, BARBARA H" Cc: 'Rob Sayre' , "'add@ietf.org'" , 'Barry Leiba' Message-ID: <20190724171549.GD29051@laperouse.bortzmeyer.org> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:17:30 -0000 On Tue, Jul 23, 2019 at 10:46:05PM +0000, STARK, BARBARA H wrote a message of 183 lines which said: > But I don’t think they have the operational experience/knowledge to > fully understand what might happen in various access networks > (especially mobile networks) It is not just a matter of experience and knowledge. People (and organisations) also have opinions and practical interests. Those in power do not want to relinquish this power, those who have access to data do not want to lose that access, etc. Framing the issue as "those who know" vs. "the ignorants" is not the right way to go, IMHO. > if they started defaulting all their application users to DNS > servers outside the local (ISP, enterprise, university, etc.) > network. The IETF is certainy welcome to discuss that trend (although, as I noted in a recent message , it has nothing to do with "Applications Doing DNS") but with some modesty: we design protocols, we can provide advices on how to use it, but people can make deployment choices of their own. Using the access network DNS resolver was never an IETF standard (or was it? Any references?) > The IETF is a place where we can and must have this discussion, so > all parties can participate in understanding and mitigating the > potential harm. As I said above, people have different opinions. Some call "harm" what some others call "privacy". Some people want to modify DNS requests and responses, some does not want their requests and responses to be modified. No amount of IETF discussion will solve this fundamental tussle. > I’m also trying to understand why there seems to be resistance to > providing ISPs with advice on deploying DoH. I'm tempted to say that I don't see the point for an access network to deploy DoH. If the network is safe, DoH is not really necessary (paranoid may use DoT, since the access network can ensure that port 853 is clear). If it is not, for instance because the resolver modifies the answers, then users will want to bypass it, anyway. My guess is that DoH operators will be different from access network operators. From nobody Wed Jul 24 10:23:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 819071202A5 for ; Wed, 24 Jul 2019 10:23:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TwDnGzIYoXTY for ; Wed, 24 Jul 2019 10:23:52 -0700 (PDT) Received: from mail-vs1-xe2b.google.com (mail-vs1-xe2b.google.com [IPv6:2607:f8b0:4864:20::e2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E82AF120112 for ; Wed, 24 Jul 2019 10:23:51 -0700 (PDT) Received: by mail-vs1-xe2b.google.com with SMTP id m8so31941539vsj.0 for ; Wed, 24 Jul 2019 10:23:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4CeLWBcRo1/jcsBpKawfi7sPkeP8m2d9IuaUS4EXiag=; b=lEOGg9BK25H8qidiCh4RiB2Mf6Tv56YXxJt5DbLkFAOZ576Dtky6wh/3S7gnEuk+iq WgOHsCdzqWoQW0ILPnjxaYE77wT32uYDV5xASjwN2HrHGC75uPeZHUWarATCrGPCJroQ x1rVyTcHQivkzf4pRhQHufQ8LeUfsLy3P/uTG7AhVdvSV0Dv9PEl8h/6fHj37tqZr1rp Am073vt3TCxGAnsLbRr1YVoaw9bG9hBnSfSvrzHW31GxzC28CF/NdRIs7WbloV4mYiqb 5epADgBdYomWEPyELkfc0/fXFn0RF0EvfbinzEGwnlmA80ZUoUAsTYSKNP3lft3RCVTh r96A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4CeLWBcRo1/jcsBpKawfi7sPkeP8m2d9IuaUS4EXiag=; b=p6rUScWcu4XwjqNnRTmN4245aunTHMp+ZbI1v7/22FDHLdzFysp/LWSTBaWOOKRzhX HsYfb5+RuMyk13FUSq81H/9BcM3Y58Xc9j8x31D3Xk7fM3HVEnN6jznupdaXPxymt7vv GIbUSY2PBd9KfRhTFRtC/CNhFmg0oKTULc5mdzGafzk2TGaS9FW8ojjLIJTo7edLKNOu CBfnjVEjGl98/5C+l/Iv901WIjzjNClaM/4daDaDIIc+FrOp1zU6wNTBSYo6IEqCUJb2 qVeJWJOU9z+sizwOAKQgeaUtzhpt90ZzqEa8LCUHApUU1kKA89pRiVbMjsNdJJNU1KhA tYEw== X-Gm-Message-State: APjAAAVc/j4r1zccpbrNsBGWhXUuu+IAKpfYklY0WLsrcBiN6IhL8Qwd t2pUeQTcN9an0A+ayK4DB+H0JNvrd6s9TUyjbM8= X-Google-Smtp-Source: APXvYqxNxi5WO97IVwOVjwMQSMkU3VsjLCsh+bk+rYAfEkwTOd56cM5aK6VAin7D6wyfthgEtL3BoPxfjxA81Yhc56I= X-Received: by 2002:a67:edcf:: with SMTP id e15mr52503339vsp.75.1563989030799; Wed, 24 Jul 2019 10:23:50 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> In-Reply-To: From: Brian Dickson Date: Wed, 24 Jul 2019 13:23:39 -0400 Message-ID: To: Eric Rescorla Cc: Ted Lemon , Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="0000000000009d13a8058e709220" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:23:55 -0000 --0000000000009d13a8058e709220 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 11:21 AM Eric Rescorla wrote: > > > I'm sorry, I think I'm confused. Where do you think the attacker is > positioned? > This is actually an important question. Apologies in advance for the length of this email. There are basically four places an attacker can be positioned: 1. on-path between the resolver and client 2. off-path (attacking the resolver->client channel) 3. on-path between an authority server and the resolver: DNS cache poisoning 4. off-path (attacking the authority->resolver channel): DNS cache poisoning Case 1 has already been discussed in this thread and/or is partially addressable via encrypted communications, but is contingent on not being impacted by cases 3 and 4. Case 2 is mostly moot, since there is only a very limited window, no predictability, and there is sufficient entropy to protect individual query/answer pairs. Case 3 turns NXDOMAIN injection into denial of service, IFF the resolver is doing DNSSEC validation, but otherwise is basically impossible to defend against. Case 4 is the important one to understand and to consider the impact of use of DNSSEC validation on both the resolver and on the client. The ability to attack a resolver from off-path is largely a function of the ability to send packets to that resolver, from both an apparent "client" viewpoint and an apparent "authority" viewpoint. This means that a public resolver is much more exposed to any poisoning attack, unless it is defending against such attacks (e.g. by doing DNSSEC validation). The original Kaminsky attack was temporarily/partially mitigated by adding more entropy (requiring more work, including number of packets which translates to more bandwidth and CPU). There are newer attacks which are substantially more effective (requiring much less effort and potentially much larger "blast radius"), particularly DNS fragmentation. The only viable defense against Case 4 is DNSSEC. It is important to understand the interaction between DNSSEC and a resolver's cache, from the perspective of a client. If the client validates but the resolver doesn't, the resolver might be poisoned, and the client is effectively unable to reach hosts whose DNS entry has been poisoned. (The poisoning is semi-permanent, for TTL length.) If the client doesn't validate and the resolver doesn't validate, any poisoned cache entries are used by the client, blindly. If the client validates and the resolver validates, the cache will never have any entries which fail validation by the client. The resolver will reject responses that fail DNSSEC validation, and never cache them. If the client does not validate, there is a conundrum: the client cannot distinguish between a resolver that validates and one that does not. The only way to detect a non-validating resolver is through the detection of cache entries that fail DNSSEC validation. The only logical position for a client with an arms-length relationship with the resolver operator is: trust, but validate (always). A validating resolver can only be blocked from getting valid responses by an on-path attacker, where on-path is towards a particular authoritative server. Authoritative zones served on disparate network paths, can significantly reduce this risk. A validating resolver cannot be blocked, and cannot be poisoned, by an off-path adversary. The only way to know a resolver is validating, demonstrably, is to have client-side validation. The interesting property of a validating resolver is, before it can return an answer, it has to validate it, which requires chasing DNSSEC proofs to/from the DNS root of trust. This means, in turn, that when a validating resolver provides an answer, it already has in its cache, everything required by a client for the client to perform validation. Performance optimization on obtaining all of that data is optional, but certainly feasible. Non-local, centralized DNS resolvers definitely should be doing validation. Clients of those resolvers also should be validating the responses from those resolvers. Brian --0000000000009d13a8058e709220 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 11:21 AM Eric= Rescorla <ekr@rtfm.com> wrote:
=


I= 'm sorry, I think I'm confused. Where do you think the attacker is = positioned?

This is actua= lly an important question.=C2=A0
Apologies in advance for the len= gth of this email.

There are basically four places= an attacker can be positioned:
  1. on-path between the resol= ver and client
  2. off-path (attacking the resolver->client channel)=
  3. on-path between an authority server and the resolver: DNS cache po= isoning
  4. off-path (attacking the authority->resolver channel): DN= S cache poisoning
Case 1 has already been discussed in this t= hread and/or is partially addressable via encrypted communications, but is = contingent on not being impacted by cases 3 and 4.
Case 2 is most= ly moot, since there is only a very limited window, no predictability, and = there is sufficient entropy to protect individual query/answer pairs.
=
Case 3 turns NXDOMAIN injection into denial of service, IFF the = resolver is doing DNSSEC validation, but otherwise is basically impossible = to defend against.

Case 4 is the important one to = understand and to consider the impact of use of DNSSEC validation on both t= he resolver and on the client.

The ability to atta= ck a resolver from off-path is largely a function of the ability to send pa= ckets to that resolver, from both an apparent "client" viewpoint = and an apparent "authority" viewpoint.

T= his means that a public resolver is much more exposed to any poisoning atta= ck, unless it is defending against such attacks (e.g. by doing DNSSEC valid= ation).

The original Kaminsky attack was temporari= ly/partially mitigated by adding more entropy (requiring more work, includi= ng number of packets which translates to more bandwidth and CPU).

There are newer attacks which are substantially more effect= ive (requiring much less effort and potentially much larger "blast rad= ius"), particularly DNS fragmentation.

The on= ly viable defense against Case 4 is DNSSEC.

It is = important to understand the interaction between DNSSEC and a resolver's= cache, from the perspective of a client.
If the client validates= but the resolver doesn't, the resolver might be poisoned, and the clie= nt is effectively unable to reach hosts whose DNS entry has been poisoned. = (The poisoning is semi-permanent, for TTL length.)
If the client = doesn't validate and the resolver doesn't validate, any poisoned ca= che entries are used by the client, blindly.
If the client valida= tes and the resolver validates, the cache will never have any entries which= fail validation by the client. The resolver will reject responses that fai= l DNSSEC validation, and never cache them.

If the = client does not validate, there is a conundrum: the client cannot distingui= sh between a resolver that validates and one that does not. The only way to= detect a non-validating resolver is through the detection of cache entries= that fail DNSSEC validation.

The only logical pos= ition for a client with an arms-length relationship with the resolver opera= tor is: trust, but validate (always).

A validating= resolver can only be blocked from getting valid responses by an on-path at= tacker, where on-path is towards a particular authoritative server. Authori= tative zones served on disparate network paths, can significantly reduce th= is risk.
A validating resolver cannot be blocked, and cannot be p= oisoned, by an off-path adversary.

The only way to= know a resolver is validating, demonstrably, is to have client-side valida= tion.

The interesting property of a validating res= olver is, before it can return an answer, it has to validate it, which requ= ires chasing DNSSEC proofs to/from the DNS root of trust.
This me= ans, in turn, that when a validating resolver provides an answer, it alread= y has in its cache, everything required by a client for the client to perfo= rm validation.
Performance optimization on obtaining all of that = data is optional, but certainly feasible.

Non-loca= l, centralized DNS resolvers definitely should be doing validation. Clients= of those resolvers also should be validating the responses from those reso= lvers.

Brian
--0000000000009d13a8058e709220-- From nobody Wed Jul 24 10:24:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C67A12028E for ; Wed, 24 Jul 2019 10:24:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 50Ojc7PU9vwv for ; Wed, 24 Jul 2019 10:24:33 -0700 (PDT) Received: from mail-oi1-x235.google.com (mail-oi1-x235.google.com [IPv6:2607:f8b0:4864:20::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD0F3120112 for ; Wed, 24 Jul 2019 10:24:33 -0700 (PDT) Received: by mail-oi1-x235.google.com with SMTP id m202so35601420oig.6 for ; Wed, 24 Jul 2019 10:24:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=/FchaHR6l0ZgS63b+eV+RtK+IhJrfpK5Bs59kNxgjmc=; b=SO2xAB6uLPeoH+KapI14tUM8+sxAbAT6K4dbanOq1U+796kAFrRylGA6rt4znXFiPB VA37j1lpmssEY+TEjOPU4F35Ibpb6S1hzXyMVhdbZFyC9gf42CxoX7Ts4g9psFfJ2SDi rwSa0oTLVBhi5ccGW75NdsyZA5HxzXyTHL4qGwC/kf700Gbw2tSngHOusAGe2WJz3jqw mj0ZD8So6mAWcAKQGgn8FHGs3A3nXl7ae5yRopeKaJpIp6pwjkkb2ryqgLRlo9ejNmix j6zdg8fmZctXI2wOhsd02gbNHJ/zYMpcDJ8KJSBAFjR4jNHmAWkFVg3SSwd/v+v2cA0L o9dA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=/FchaHR6l0ZgS63b+eV+RtK+IhJrfpK5Bs59kNxgjmc=; b=ECecDYxd6WIeBzVJGXTddW4Fl6yL/5uqLkCYET7arVN2Zddk4kML9cfAnUL4Mr6VPq 7XVg+M9KzFunfwae55Jm7zimdJjZ/kQRI2EsKZVrWmh4JqJbzkIwxBFWoh3I6kAUn7bv V7FNXaMpKeroslxD0nkQ0t+wYTwT/yRRFkcHDclM4BlcKouqVdiPZG5VVKFBh0VN65cT 3ZyU5NNqLeI15Mvn5komk+MOo9A+JQCc7h97D5LB/AGheA0j+ZlpNJnzA8DqA99TaQVm BA5TJjwYQ8q7JYOwElcbevOO1op3kKLlgcT2zRKN+E6zF0z7zMhx1UE3HNOAZWhMJu/U l1eQ== X-Gm-Message-State: APjAAAWTV/xEjgx+6N4a7YdcCSy09N3OHwUZ709e8zuGTiP/n52Cf7Qz vdrk5z3r87r+az3uW5yh4oftBobuyDvj0A== X-Google-Smtp-Source: APXvYqxa8e9AJJ7e2droR7g5z7lpMZrB91QBoEOV/EruHjseDod90xMRLIPh0Vi1NTSRKkqkDIL0+Q== X-Received: by 2002:aca:aad3:: with SMTP id t202mr44120600oie.158.1563989072931; Wed, 24 Jul 2019 10:24:32 -0700 (PDT) Received: from ?IPv6:2600:380:7d3e:cb8c:35a2:a993:a100:bb7e? ([2600:380:7d3e:cb8c:35a2:a993:a100:bb7e]) by smtp.gmail.com with ESMTPSA id 9sm14908009oij.25.2019.07.24.10.24.32 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 10:24:32 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-3A6047CD-3BC0-4B3D-8BDB-3DC383F3B8F6 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Wed, 24 Jul 2019 13:24:30 -0400 Cc: Jim Reid , "add@ietf.org" , Rob Sayre Content-Transfer-Encoding: 7bit Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> To: Eric Rescorla Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:24:37 -0000 --Apple-Mail-3A6047CD-3BC0-4B3D-8BDB-3DC383F3B8F6 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On Jul 24, 2019, at 1:14 PM, Eric Rescorla wrote: >> On Wed, Jul 24, 2019 at 8:58 AM Ted Lemon wrote: >> There are a variety of attack scenarios to account for. DNSSEC is not use= ful for countering a fake NXDOMAIN attack when the attacker also controls th= e path and can prevent connection establishment. >>=20 >> However, if the attacker is the resolver, and the resolver isn=E2=80=99t u= nder the control of the path, then detecting a fake NXDOMAIN is useful.=20 >=20 > How? It allows me to notice that the resolver I have chosen is not trustworthy. I= f E.g. Firefox did this, it would make lying public DoH resolvers untenable.= I think there=E2=80=99s also a belief that PKI is so trustworthy that we nee= d not backstop it. I think this is a mistake.= --Apple-Mail-3A6047CD-3BC0-4B3D-8BDB-3DC383F3B8F6 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable On Jul 24, 2019, at 1:14 PM, Eric Rescorla &= lt;ekr@rtfm.com> wrote:
On Wed, Jul 24, 2019 at 8:58 AM Ted L= emon <mellon@fugue.com> wrote:=
There are a variety of attack scenarios to account for. DNSSEC is not usefu= l for countering a fake NXDOMAIN attack when the attacker also controls the p= ath and can prevent connection establishment.

However, if= the attacker is the resolver, and the resolver isn=E2=80=99t under the cont= rol of the path, then detecting a fake NXDOMAIN is useful. 

How?

It allows me to notice that the resolver I have c= hosen is not trustworthy. If E.g. Firefox did this, it would make lying publ= ic DoH resolvers untenable.

I think there=E2=80=99s= also a belief that PKI is so trustworthy that we need not backstop it. I th= ink this is a mistake.
= --Apple-Mail-3A6047CD-3BC0-4B3D-8BDB-3DC383F3B8F6-- From nobody Wed Jul 24 10:27:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ABBB11202E3 for ; Wed, 24 Jul 2019 10:26:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TCVppmERtrCx for ; Wed, 24 Jul 2019 10:26:56 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110076.outbound.protection.outlook.com [40.107.11.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52649120112 for ; Wed, 24 Jul 2019 10:26:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OxgkLOzTUsPP+2MdZkQzJa4g1C93sKx9uMlSh2enEWr6LCufDJ1BLNrGpCJ4J6qBJoOMh0AFieLsOuDUk0bj63iPpEK7wY9sWHY2yyp0b8iJ6ai6tftvBIbS4jdAyy9PJjRKHVpt/bgBwFvG6MEUpbbrgeLeQ8a4H9Iv9M5C/NlOJkRXrNI8Vqk1vB+VJDvoQI4smnsFsspmmYA/dDE4D7uKA2vF8nIxVoKShahFZ03q7/yjOXQRLHCbnZR5maP2S6Ndf1rq4ZELVy69sCWC3LcXow2wGxmC5LbpgDV52GYqoK1blBhe9coMA/pYIbV4aWbiOS4IuY7kjNbt9/EcZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7JK0K8qXjrstPz9rDpHOe6P+Ovq4V0Y6xOp7l5Lz1BQ=; b=KVxj7Mtv3Wc6YMgkDV1XwIl1fSt2ZA8HG32FVGfFsSPrgiCNoxtjXW1ERMzx7ThTGcAK+QEkFgjF8BEVvwc6A0zzO3tgQQiYxAspdQZypsT3782DMnJ1PIoUoZV9UTyydSVbqBtk1kEG3wMwiwap4LeuED1ORccl3Rzw1Dcq3gQtVrDLxumJo6gwkm17l59IWSiH4XRu3HOOJnwdB46M0nDqM3/Tf3eK8JYcY6Gl2RvfFrWjFKMra3SShKawG3DcvF8nU6A09pJbqRCSnw2yCqoVrlgE0JwhLSr4NtAWZgVLN5mvNmNQRLtJKFOnH/BAV/6iBnvbc2ujrbGZ0Yjk0Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7JK0K8qXjrstPz9rDpHOe6P+Ovq4V0Y6xOp7l5Lz1BQ=; b=Yqwf++PWvo4D7ReqyPQZ3ExjMaEPS5iwnurqd1MQxlBb97sCkfdMeldBhOm4UseJUmLvqOkFkFsFWCAGXVi722uy4k50i8VI+KiGuiW7Rg6IgC70NZxP99Y6zT0iOYD+gQm1CC8n1FjvhYAO1WCwHPCx0mNtnU73aWlS6n2XEP0= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0461.GBRP265.PROD.OUTLOOK.COM (10.166.99.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Wed, 24 Jul 2019 17:26:54 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2094.013; Wed, 24 Jul 2019 17:26:54 +0000 From: Andrew Campling To: Vittorio Bertola , "Diego R. Lopez" CC: "add@ietf.org" Thread-Topic: [Add] Trust and control on the Internet (was Re: fixing coffee shop brokenness with DoH) Thread-Index: AQHVQkT5D6PaFV1IHkeon9N66zo/yA== Date: Wed, 24 Jul 2019 17:26:53 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <520325278.24189.1563973538937@appsuite-gw1.open-xchange.com> <555968666.24560.1563980206283@appsuite-gw1.open-xchange.com> In-Reply-To: <555968666.24560.1563980206283@appsuite-gw1.open-xchange.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:556b:1ff3:ab8e:d0bc] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 46d72459-6dcf-4864-6d4c-08d7105c1f18 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0461; x-ms-traffictypediagnostic: LO2P265MB0461: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0108A997B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(39830400003)(136003)(376002)(396003)(34096005)(366004)(199004)(189003)(229853002)(71190400001)(6436002)(4326008)(508600001)(7736002)(446003)(66574012)(11346002)(486006)(81156014)(14454004)(8676002)(71200400001)(81166006)(68736007)(52536014)(86362001)(53936002)(74316002)(5660300002)(6246003)(6116002)(790700001)(316002)(66946007)(110136005)(76116006)(236005)(66476007)(66446008)(64756008)(66556008)(25786009)(186003)(44832011)(8936002)(9686003)(55016002)(6306002)(54896002)(2906002)(102836004)(7696005)(99286004)(76176011)(256004)(53546011)(6506007)(476003)(46003)(33656002)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0461; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: lTMt8om4TbqHnm+v1AmdnxDGHZslEq7mlVfird4vdYo4AX2kt2BKK4HfSodvSc54zV+Z1ldm/LnGZXIDAJ4q0fA9Z04iMsY6SSWSaY9f4sYi5kDIlnSF3Xdi+zjpHR1KLf172ReAj7bFm5gLmlI3vaMQlmb7JyqBfMokztQLkgrnlGTK3TN5Qv/iOgkDVtWEB9aUozCUngZmVNBzaRZjppm7cMwDYuXog8FAU6chjoKYVeFK/PeIPCQdLa0w2oFmegy/q5OS2vvOAbA4uEkZK51zQT1T0Pl7nt+z4c2KVoMBnKRMGnbtIEAtqwTAZbyy3MKXdfNv1DZWLuvphKu7IWnmKh9Fe77COPADFRPGEpQYk8FzKl4sQMAJ8KnLo8iY8hx6d3bd3/edELpRliy0cvQS47YORUPaL1KM4BBJvpg= Content-Type: multipart/alternative; boundary="_000_LO2P265MB13273F602BB0D9C2A397AA5BC2C60LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 46d72459-6dcf-4864-6d4c-08d7105c1f18 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2019 17:26:53.9355 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0461 Archived-At: Subject: Re: [Add] Trust and control on the Internet (was Re: fixing coffee shop brokenness with DoH) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:27:00 -0000 --_000_LO2P265MB13273F602BB0D9C2A397AA5BC2C60LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQpPbiBKdWwgMjQsIDIwMTksIGF0IDQ6MjIgUE0sIFZpdHRvcmlvIEJlcnRvbGEgPCB2aXR0b3Jp by5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb208bWFpbHRvOnZpdHRvcmlvLmJlcnRvbGFAb3Blbi14 Y2hhbmdlLmNvbT4gPiB3cm90ZToNCg0KPiAgVHJ1c3QgaW4gdGhlIEludGVybmV0IGluZnJhc3Ry dWN0dXJlIGlzIGEgaGFyZCBwcm9ibGVtIGJlY2F1c2UgdGhlIHRydXN0IHJlbGF0aW9uc2hpcHMg YXJlIGRpZmZlcmVudCBkZXBlbmRpbmcgb24gc3ViamVjdGl2ZSBqdWRnZW1lbnRzIGFuZCBwcmVm ZXJlbmNlcy4gT25lIHVzZXIgbWlnaHQgdHJ1c3QgdGhlIGFwcGxpY2F0aW9uIGFuZCBkaXN0cnVz dCB0aGUgbmV0d29yaywgd2hpbGUgYW5vdGhlciB1c2VyIG1pZ2h0IHRydXN0IHRoZSBuZXR3b3Jr IGFuZCBkaXN0cnVzdCB0aGUgYXBwbGljYXRpb24sIGFuZCBhIHRoaXJkIHVzZXIgbWlnaHQgYmUg dW5lZHVjYXRlZCBhbmQgZmFpbCB0byBtYWtlIGFueSBkZWNpc2lvbiBvciBiZSBlYXNpbHkgZm9v bGVkIGludG8gdHJ1c3RpbmcgdGhlIHdyb25nIHBlb3BsZS4gVGhpcyBsYXN0IGNhc2UgbGVhZHMg dG8gc2V2ZXJhbCBwYXJ0aWVzIGNsYWltaW5nIHRoYXQgdGhleSBoYXZlIHRvIG1ha2UgZGVjaXNp b25zICJvbiBiZWhhbGYgb2YgdGhlIHVzZXJzIGZvciB0aGVpciBvd24gZ29vZCIsIGJ1dCB0aGVu IGEgc3RydWdnbGUgYmV0d2VlbiB0aGUgYXBwbGljYXRpb24sIHRoZSBuZXR3b3JrIGFuZCB0aGUg Z292ZXJubWVudCBlbnN1ZXMsIG9uIHdobyBpcyBhY3R1YWxseSBlbnRpdGxlZCB0byBkbyB0aGF0 LCBhbmQgdG8gd2hpY2ggZXh0ZW50Lg0KDQpJIHRoaW5rIHdlIHNob3VsZCBub3RlIHRoYXQgdGhl IHRoaXJkIGNhdGVnb3J5LCB0aGUg4oCcdW5lZHVjYXRlZOKAnSB1c2VyLCBpcyBieSBmYXIgdGhl IGxhcmdlc3QsIGF0IGxlYXN0IGluIHRoZSBjb250ZXh0IG9mIHVuZGVyc3RhbmRpbmcgbWF0dGVy cyBzdWNoIGFzIEROUy4gIEluIGFkZGl0aW9uLCB3ZSBzaG91bGQgYWxzbyBub3RlIHRoYXQsIGlu IHRoZSBjb250ZXh0IG9mIEdEUFIgaW4gRXVyb3BlLCBETlMgZGF0YSBpcyBjb25zaWRlcmVkIHRv IGJlIHBlcnNvbmFsIGRhdGEgYW5kIGl0IHdpbGwgYmUgcG9zc2libGUgZm9yIHNpZ25pZmljYW50 IHByb2ZpbGluZyB0byBiZSBjYXJyaWVkIG91dCBvbiB0aGUgYmFzaXMgb2YgdGhpcyBkYXRhOyB0 aGlzIG1heSBjb25zdHJhaW4gd2hhdCBkZWNpc2lvbnMgY2FuIGJlIG1hZGUgYW5kIGJ5IHdob20s IGF0IGxlYXN0IHdpdGhvdXQgdGhlIGtub3dsZWRnZSBhbmQgY29uc2VudCBvZiB0aGUgdXNlci4N Cg0KPiAgVGhlIG90aGVyIGZhY2Ugb2YgdGhpcyBwcm9ibGVtIGlzIHRoZSAiY29udHJvbCBwbGFu IiBkaXNjdXNzaW9uOiBEb0ggc3VwcG9ydGVycyBjbGFpbSB0aGF0IHRoZSBETlMgaXMgbm90IGEg cHJvcGVyIGNvbnRyb2wgcGxhbiBmb3IgdGhlIEludGVybmV0LCBidXQgdGhlbiB0aGV5IGRvIG5v dCBwcm92aWRlIGFsdGVybmF0aXZlcyB0byBwZW9wbGUgdGhhdCBuZWVkIG9uZTsgdGhleSBlaXRo ZXIgc2F5ICJkbyB0aGF0IGF0IHRoZSBlbmRwb2ludHMiICh3aGljaCBpcyBnZW5lcmFsbHkgY3Vt YmVyc29tZSBmb3Igbm9uLXRlY2huaWNhbCB1c2VycyBhbmQgZXZlbiBpbXBvc3NpYmxlIGluIHNl dmVyYWwgbGVnaXRpbWF0ZSBjYXNlcywgcmFuZ2luZyBmcm9tIGFkdmVyc2FyaWFsIGVuZHBvaW50 cyAtIGUuZy4gYSBib3QtaW5mZWN0ZWQgZGV2aWNlIC0gdG8gZW5kcG9pbnRzIHRoYXQgd29uJ3Qg aGF2ZSB0aGUgbmVjZXNzYXJ5IGNhcGFiaWxpdGllcyAtIGUuZy4gSW9UIHN0dWZmKSwgb3IgInRo ZSBJbnRlcm5ldCBzaGFsbCBiZSBmcmVlLCBnbyBnZXQgbG9zdCEiLiBUaGlzIGlzIGxpa2VseSB0 byByZXN1bHQgaW4gYW4gImFybXMgcmFjZSIgLSBpZiB0aGUgcHJvdG9jb2wgcGVvcGxlIGRvIG5v dCBwcm92aWRlIGEgY2xlYXIgY29udHJvbCBwbGFuLCB0aGUgb3BlcmF0aW9uYWwgcGVvcGxlIHdp bGwganVzdCBtYWtlIG9uZSBpbiBzb21lIHdheSwgbm8gbWF0dGVyIGhvdyBkaXNydXB0aXZlIHRo YXQgd2lsbCBiZS4NCg0KSXQgc2VlbXMgcmVhc29uYWJsZSB0byBhc3NlcnQgdGhhdCBhIGNvbnRy b2wgcGxhbmUgaXMgcmVxdWlyZWQgZm9yIG9wZXJhdGlvbmFsIHB1cnBvc2VzIGluY2x1ZGluZywg Zm9yIGV4YW1wbGUsIHRvIGltcGxlbWVudCB1c2VyIGNob2ljZXMgYW5kIGNvbXBseSB3aXRoIGxv Y2FsIGxlZ2lzbGF0aW9uLg0KDQo+ICBXaGlsZSBBREQgYWxyZWFkeSBoYXMgbW9yZSBpbW1lZGlh dGUgcG9pbnRzIHRoYXQgZGVzZXJ2ZSBhdHRlbnRpb24sIHN1Y2ggYXMgdGhlIGJlc3QgcHJhY3Rp Y2VzIGZvciBjb25maWd1cmluZyBEbyogc2VydmVycywgaXQgd291bGQgYmUgZ29vZCBpZiB3ZSBj b3VsZCBhbHNvIGhhdmUgdGhlIGFyY2hpdGVjdHVyYWwgZGlzY3Vzc2lvbiBhYm92ZSwgd2hpY2gg aXMgYnJvYWRlciBhbmQgYWZmZWN0cyB0aGUgSW50ZXJuZXQgd2F5IGJleW9uZCB0aGUgRE5TLCB0 aG91Z2ggaXQgY29tZXMgdXAgd2hlbiBkaXNjdXNzaW5nIHRoZSBETlMgYmVjYXVzZSB0aGF0J3Mg d2hlcmUgdHJ1c3QgYW5kIGNvbnRyb2wgaXNzdWVzIGhhdmUgYmVlbiBhZGRyZXNzZWQgdW50aWwg bm93LiBQZXJoYXBzIHRoaXMgY291bGQgYmUgYSBzZXBhcmF0ZSB3b3JraW5nIGl0ZW0gb3IgZXZl biBhIHNlcGFyYXRlIHdvcmtpbmcgZ3JvdXAuDQoNCkkgYWdyZWUgdGhhdCB0aGUgYXJjaGl0ZWN0 dXJhbCBkaXNjdXNzaW9uIG5lZWRzIHRvIGJlIGhhZCB0b28uDQoNCg0KDQpBbmRyZXcNCg== --_000_LO2P265MB13273F602BB0D9C2A397AA5BC2C60LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVk IENoYXIiOw0KCW1hcmdpbjowY207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpwLm1zb25vcm1hbDAsIGxp Lm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsN Cgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uSFRNTFByZWZvcm1h dHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1z by1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQi Ow0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4uRW1haWxTdHlsZTIyDQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6 ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7 c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBw dDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBz cGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIg ZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4N Cjxib2R5IGxhbmc9IkVOLUdCIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xh c3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJF Ti1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9iPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5PbiBKdWwgMjQsIDIwMTksIGF0IDQ6MjIgUE0sIFZpdHRvcmlvIEJlcnRvbGEg Jmx0OyA8YSBocmVmPSJtYWlsdG86dml0dG9yaW8uYmVydG9sYUBvcGVuLXhjaGFuZ2UuY29tIj4N CnZpdHRvcmlvLmJlcnRvbGFAb3Blbi14Y2hhbmdlLmNvbTwvYT4gPHNwYW4gbGFuZz0iRU4tVVMi PiZndDsgPC9zcGFuPndyb3RlOiA8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2tx dW90ZT4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+Jmd0OyZuYnNwOyBUcnVzdCBpbiB0aGUgSW50ZXJuZXQgaW5mcmFzdHJ1Y3R1 cmUgaXMgYSBoYXJkIHByb2JsZW0gYmVjYXVzZSB0aGUgdHJ1c3QgcmVsYXRpb25zaGlwcyBhcmUg ZGlmZmVyZW50IGRlcGVuZGluZyBvbiBzdWJqZWN0aXZlIGp1ZGdlbWVudHMgYW5kIHByZWZlcmVu Y2VzLiBPbmUgdXNlciBtaWdodCB0cnVzdCB0aGUgYXBwbGljYXRpb24gYW5kIGRpc3RydXN0IHRo ZQ0KIG5ldHdvcmssIHdoaWxlIGFub3RoZXIgdXNlciBtaWdodCB0cnVzdCB0aGUgbmV0d29yayBh bmQgZGlzdHJ1c3QgdGhlIGFwcGxpY2F0aW9uLCBhbmQgYSB0aGlyZCB1c2VyIG1pZ2h0IGJlIHVu ZWR1Y2F0ZWQgYW5kIGZhaWwgdG8gbWFrZSBhbnkgZGVjaXNpb24gb3IgYmUgZWFzaWx5IGZvb2xl ZCBpbnRvIHRydXN0aW5nIHRoZSB3cm9uZyBwZW9wbGUuIFRoaXMgbGFzdCBjYXNlIGxlYWRzIHRv IHNldmVyYWwgcGFydGllcyBjbGFpbWluZyB0aGF0IHRoZXkNCiBoYXZlIHRvIG1ha2UgZGVjaXNp b25zICZxdW90O29uIGJlaGFsZiBvZiB0aGUgdXNlcnMgZm9yIHRoZWlyIG93biBnb29kJnF1b3Q7 LCBidXQgdGhlbiBhIHN0cnVnZ2xlIGJldHdlZW4gdGhlIGFwcGxpY2F0aW9uLCB0aGUgbmV0d29y ayBhbmQgdGhlIGdvdmVybm1lbnQgZW5zdWVzLCBvbiB3aG8gaXMgYWN0dWFsbHkgZW50aXRsZWQg dG8gZG8gdGhhdCwgYW5kIHRvIHdoaWNoIGV4dGVudC4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdCI+SSB0aGluayB3ZSBzaG91bGQgbm90ZSB0aGF0IHRoZSB0aGlyZCBj YXRlZ29yeSwgdGhlIOKAnHVuZWR1Y2F0ZWTigJ0gdXNlciwgaXMgYnkgZmFyIHRoZSBsYXJnZXN0 LCBhdCBsZWFzdCBpbiB0aGUgY29udGV4dCBvZiB1bmRlcnN0YW5kaW5nIG1hdHRlcnMgc3VjaCBh cyBETlMuJm5ic3A7IEluIGFkZGl0aW9uLCB3ZSBzaG91bGQgYWxzbyBub3RlIHRoYXQsIGluIHRo ZSBjb250ZXh0DQogb2YgR0RQUiBpbiBFdXJvcGUsIEROUyBkYXRhIGlzIGNvbnNpZGVyZWQgdG8g YmUgcGVyc29uYWwgZGF0YSBhbmQgaXQgd2lsbCBiZSBwb3NzaWJsZSBmb3Igc2lnbmlmaWNhbnQg cHJvZmlsaW5nIHRvIGJlIGNhcnJpZWQgb3V0IG9uIHRoZSBiYXNpcyBvZiB0aGlzIGRhdGE7IHRo aXMgbWF5IGNvbnN0cmFpbiB3aGF0IGRlY2lzaW9ucyBjYW4gYmUgbWFkZSBhbmQgYnkgd2hvbSwg YXQgbGVhc3Qgd2l0aG91dCB0aGUga25vd2xlZGdlIGFuZCBjb25zZW50DQogb2YgdGhlIHVzZXIu Jm5ic3A7IDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYu MHB0Ij4mZ3Q7Jm5ic3A7IFRoZSBvdGhlciBmYWNlIG9mIHRoaXMgcHJvYmxlbSBpcyB0aGUgJnF1 b3Q7Y29udHJvbCBwbGFuJnF1b3Q7IGRpc2N1c3Npb246IERvSCBzdXBwb3J0ZXJzIGNsYWltIHRo YXQgdGhlIEROUyBpcyBub3QgYSBwcm9wZXIgY29udHJvbCBwbGFuIGZvciB0aGUgSW50ZXJuZXQs IGJ1dCB0aGVuIHRoZXkgZG8gbm90IHByb3ZpZGUgYWx0ZXJuYXRpdmVzIHRvIHBlb3BsZSB0aGF0 IG5lZWQNCiBvbmU7IHRoZXkgZWl0aGVyIHNheSAmcXVvdDtkbyB0aGF0IGF0IHRoZSBlbmRwb2lu dHMmcXVvdDsgKHdoaWNoIGlzIGdlbmVyYWxseSBjdW1iZXJzb21lIGZvciBub24tdGVjaG5pY2Fs IHVzZXJzIGFuZCBldmVuIGltcG9zc2libGUgaW4gc2V2ZXJhbCBsZWdpdGltYXRlIGNhc2VzLCBy YW5naW5nIGZyb20gYWR2ZXJzYXJpYWwgZW5kcG9pbnRzIC0gZS5nLiBhIGJvdC1pbmZlY3RlZCBk ZXZpY2UgLSB0byBlbmRwb2ludHMgdGhhdCB3b24ndCBoYXZlIHRoZSBuZWNlc3NhcnkNCiBjYXBh YmlsaXRpZXMgLSBlLmcuIElvVCBzdHVmZiksIG9yICZxdW90O3RoZSBJbnRlcm5ldCBzaGFsbCBi ZSBmcmVlLCBnbyBnZXQgbG9zdCEmcXVvdDsuIFRoaXMgaXMgbGlrZWx5IHRvIHJlc3VsdCBpbiBh biAmcXVvdDthcm1zIHJhY2UmcXVvdDsgLSBpZiB0aGUgcHJvdG9jb2wgcGVvcGxlIGRvIG5vdCBw cm92aWRlIGEgY2xlYXIgY29udHJvbCBwbGFuLCB0aGUgb3BlcmF0aW9uYWwgcGVvcGxlIHdpbGwg anVzdCBtYWtlIG9uZSBpbiBzb21lIHdheSwgbm8gbWF0dGVyIGhvdyBkaXNydXB0aXZlDQogdGhh dCB3aWxsIGJlLiA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+SXQgc2VlbXMg cmVhc29uYWJsZSB0byBhc3NlcnQgdGhhdCBhIGNvbnRyb2wgcGxhbmUgaXMgcmVxdWlyZWQgZm9y IG9wZXJhdGlvbmFsIHB1cnBvc2VzIGluY2x1ZGluZywgZm9yIGV4YW1wbGUsIHRvIGltcGxlbWVu dCB1c2VyIGNob2ljZXMgYW5kIGNvbXBseSB3aXRoIGxvY2FsIGxlZ2lzbGF0aW9uLjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jmd0OyZu YnNwOyBXaGlsZSBBREQgYWxyZWFkeSBoYXMgbW9yZSBpbW1lZGlhdGUgcG9pbnRzIHRoYXQgZGVz ZXJ2ZSBhdHRlbnRpb24sIHN1Y2ggYXMgdGhlIGJlc3QgcHJhY3RpY2VzIGZvciBjb25maWd1cmlu ZyBEbyogc2VydmVycywgaXQgd291bGQgYmUgZ29vZCBpZiB3ZSBjb3VsZCBhbHNvIGhhdmUgdGhl IGFyY2hpdGVjdHVyYWwgZGlzY3Vzc2lvbiBhYm92ZSwgd2hpY2ggaXMNCiBicm9hZGVyIGFuZCBh ZmZlY3RzIHRoZSBJbnRlcm5ldCB3YXkgYmV5b25kIHRoZSBETlMsIHRob3VnaCBpdCBjb21lcyB1 cCB3aGVuIGRpc2N1c3NpbmcgdGhlIEROUyBiZWNhdXNlIHRoYXQncyB3aGVyZSB0cnVzdCBhbmQg Y29udHJvbCBpc3N1ZXMgaGF2ZSBiZWVuIGFkZHJlc3NlZCB1bnRpbCBub3cuIFBlcmhhcHMgdGhp cyBjb3VsZCBiZSBhIHNlcGFyYXRlIHdvcmtpbmcgaXRlbSBvciBldmVuIGEgc2VwYXJhdGUgd29y a2luZyBncm91cC4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgYWdyZWUgdGhhdCB0aGUgYXJjaGl0ZWN0 dXJhbCBkaXNjdXNzaW9uIG5lZWRzIHRvIGJlIGhhZCB0b28uJm5ic3A7DQo8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8cD48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+QW5kcmV3IDxvOnA+PC9v OnA+PC9zcGFuPjwvYj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_LO2P265MB13273F602BB0D9C2A397AA5BC2C60LO2P265MB1327GBRP_-- From nobody Wed Jul 24 10:28:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A8CC12028E for ; Wed, 24 Jul 2019 10:28:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ODol6RdjoJST for ; Wed, 24 Jul 2019 10:28:27 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110089.outbound.protection.outlook.com [40.107.11.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 81535120112 for ; Wed, 24 Jul 2019 10:28:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=EVMVKctwMkzQvqYBLUBrUdkqxu/1hYM7VBcgbXnej+Zxx9lPTSG0+j80d+neV8HUjl8cXPmjtM1yXveQkU/KaKr7NqGtMhLwIR+NuzfNNf8D6vB1Ir4fOl/DzOMELq2l3gP8kTax/YmCVKBFsn9yaN54YjoG/EOMl1CmqnmsbYSceEpLZf/zLHyOeXWQx1dZyTqUSGJD0EpHyaxhC/ggUVRn4E6EomlcN/ZCTF8TfkphYKWu3J1dB+do//WjiDLp3ECo+jPX4TUL7EZSDv7rYA/MY9bjGal4sIdZ5+lrUk0kKdszXs5E99m6vvHhSW3wZrgDtAlujGrMRCGux/2NSw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rOipAXss9iRqEQuFA4hH4akwgtAB5H6Y2g0NXaKCizc=; b=OhQEWLPIw1v7L5ViJXjN/VKiSEQSMsbaTjdjHHnq4qxYvdkjwoGR5b2TiCBCaIWM0KNZp6NDlcWKOjRl2fEbLhzPg2XKV1ChvATiBHn2bNYBUxRO9HfbWzGDViY22XmJ/ugxL678j80VWFmlKtIHYUmwEelgZHl45o6ZPuRvB4FHHO3AsN4RUEVuTr3CVlcjd1PEhSUGaeTMVqKnH+s/dA8uHGbt39QmG1Wcw5OTrHJSonStZaKyy/MVO4+QUOZVORH1491eSFKqmrEdi6UZziY9TwKSa/e1SiKIvNjACcVLEEp1q2c0F1wgu2hRtGxdAzGJZOJF0AqftbDAiXFYBQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rOipAXss9iRqEQuFA4hH4akwgtAB5H6Y2g0NXaKCizc=; b=AxRQQUjvur5FmG2HZPo8qx5pPHsRL4esUP5XuybWKxty8xV57eOgiByWrrnOtdyKMsoGmZxAknVa5w9XD1Oij13GfBf4K/O3s4YFb3/lLNUUMH/ka/yaxNuG6YNLiZ4aRJNHVRG372Hmraty8zX8LCksdHxQr5oQbIp6/F3ZHXs= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1054.GBRP265.PROD.OUTLOOK.COM (20.176.142.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.16; Wed, 24 Jul 2019 17:28:24 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2094.013; Wed, 24 Jul 2019 17:28:24 +0000 From: Andrew Campling To: Ted Lemon , Vittorio Bertola CC: "Diego R. Lopez" , "add@ietf.org" Thread-Topic: [Add] Trust and control on the Internet (was Re: fixing coffee shop brokenness with DoH) Thread-Index: AQHVQjIHD6PaFV1IHkeon9N66zo/yKbZ+cBQ Date: Wed, 24 Jul 2019 17:28:23 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <520325278.24189.1563973538937@appsuite-gw1.open-xchange.com> <555968666.24560.1563980206283@appsuite-gw1.open-xchange.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:556b:1ff3:ab8e:d0bc] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 02e1c3e5-0759-434f-b054-08d7105c54b9 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1054; x-ms-traffictypediagnostic: LO2P265MB1054: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0108A997B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(376002)(396003)(346002)(39830400003)(366004)(34096005)(199004)(189003)(446003)(14454004)(508600001)(81156014)(486006)(99286004)(6436002)(53936002)(236005)(68736007)(25786009)(8936002)(11346002)(81166006)(476003)(9686003)(54896002)(6306002)(14444005)(790700001)(6116002)(2906002)(55016002)(256004)(44832011)(71200400001)(71190400001)(33656002)(186003)(66946007)(52536014)(4326008)(46003)(76116006)(110136005)(66556008)(66476007)(316002)(64756008)(66446008)(5660300002)(54906003)(76176011)(8676002)(6246003)(86362001)(7736002)(74316002)(53546011)(6506007)(102836004)(7696005)(229853002)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1054; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: +UNMwjxqJlgcsiqMs6QrkCpb4TEGWHmoQmYzh+7PIoSlDhIs5M8AHglxQwhKG1IxmvCTwEF/SClNAYzgVJCLXkM42ZUTlP0/FeY3DYNwQVQ1BsuJPFuEKJ62pQ6Gw3fVdjACzsv31po0l4I/CLLwlgcxh81V1q5qIzOK56vEQ+ehuZz0tf6vsQY4NvNAehFi8cUkp73ZpJVAWen8igqE+nJa7z5235ACQRit15vn0PblMGNOBi52OcfplRuJVe+VFFsVIvXNmboQ+QYZdXDUCyZGSveyvDa2/+F1aFBQ7/z+do76/jxKXtC/b/S3YA6V1PDbN6vYP7LL3TEI4s3QdFNHDZob5/YW0V6UUYiqHeUt0KAIAdiHpFvBbAm9Q/lqxbLTH40HlsxA6X4DO3ARu3aopX8HaXw6FJtVv7hWl2A= Content-Type: multipart/alternative; boundary="_000_LO2P265MB1327525D53227F9DE91EEBADC2C60LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 02e1c3e5-0759-434f-b054-08d7105c54b9 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2019 17:28:23.9376 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1054 Archived-At: Subject: Re: [Add] Trust and control on the Internet (was Re: fixing coffee shop brokenness with DoH) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:28:29 -0000 --_000_LO2P265MB1327525D53227F9DE91EEBADC2C60LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gSnVsIDI0LCAyMDE5LCBhdCA0OjA1IFBNLCBUZWQgTWVsbG9uIDxtZWxsb25AZnVndWUuY29t PG1haWx0bzptZWxsb25AZnVndWUuY29tPiA+IHdyb3RlOg0KDQo+ICBWaXR0b3JpbywgSSB0aGlu ayBpdOKAmXMgaW1wb3J0YW50IHRvIG1ha2UgYSBkaXN0aW5jdGlvbiBiZXR3ZWVuIOKAnHdobyB5 b3UgbWlnaHQgY2hvb3NlIHRvIHRydXN04oCdIGFuZCDigJx3aG8geW91IGFyZSBmb3JjZWQgdG8g dHJ1c3Qu4oCdDQoNCj4gIEluIG9yZGVyIHRvIHJ1biBhbiBhcHAsIGlmIHRoZSBhcHAgaXMgYWJs ZSB0byBtYWtlIGh0dHBzIGNvbm5lY3Rpb25zLCB5b3UgYXJlIGZvcmNlZCB0byB0cnVzdCB0aGUg YXBwLiAgIFRoaXMgaXMgdHJ1ZSB3aGV0aGVyIHlvdSBhcmUgYXdhcmUgdGhhdCB5b3UgYXJlIHRy dXN0aW5nIGl0IG9yIG5vdCwgYW5kIHJlZ2FyZGxlc3Mgb2YgeW91ciBhdHRpdHVkZSB0b3dhcmQg eW91ciBzZXJ2aWNlIHByb3ZpZGVyLg0KDQpXaGlsc3Qgbm90IGRpc3B1dGluZyB0aGUgbG9naWMg b2YgYmVpbmcgZm9yY2VkIHRvIHRydXN0IHRoZSBhcHAsIGV4cGVyaWVuY2UgdGVsbHMgdXMgdGhh dCB3ZSBhcmUgdW53aXNlIHRvIGRvIHNvIGFzIHRoZXJlIGFyZSBzYWRseSBudW1lcm91cyBpbnN0 YW5jZXMgd2hlcmUgdGhhdCB0cnVzdCBpcyBiZXRyYXllZDsgSSBub3RlIGZvciBleGFtcGxlIHRo ZSBzZXR0bGVtZW50IHRvZGF5IG9mIHRoZSBtb3N0IHJlY2VudCBGYWNlYm9vayBwcml2YWN5IGNh c2UgaW4gdGhlIFVTLiAgSW4gYSBudW1iZXIgKG1vc3Q/KSBjYXNlcyB3aGVyZSB0cnVzdCBpcyBi ZXRyYXllZCwgZGF0YSBtb25ldGlzYXRpb24gYXBwZWFycyB0byBiZSBhIG1vdGl2YXRpbmcgZmFj dG9yIGFuZCB3ZSBzaG91bGQgbm90ZSB0aGF0IGNlbnRyYWxpc2F0aW9uIGhhcyB0aGUgcG90ZW50 aWFsIHRvIG1hZ25pZnkgdGhlIGRhdGEgbW9uZXRpc2F0aW9uIG9wcG9ydHVuaXR5Lg0KDQo+ICBU aGlzIGlzIHdoYXQgSSBhbSBnZXR0aW5nIGF0LiAgIFRoaXMgaXMgY29tcGxldGVseSBvcnRob2dv bmFsIHRvIHRoZSBxdWVzdGlvbiBvZiDigJx3aG9zZSByZXNvbHZlciB3b3VsZCBJIGNob29zZSB0 byB0cnVzdD/igJ0NCg0KPiAgV2hhdCBEb0ggZG9lcywgYnV0IHdoYXQgYW55IGFwcCBjYW4gZG8g d2hldGhlciBEb0ggaXMgcHJlc2VudCBvciBub3QsIGlzIHRvIG1ha2UgaXQgcG9zc2libGUgdG8g dHJ1c3Qgc29tZW9uZSBvdGhlciB0aGFuIHlvdXIgc2VydmljZSBwcm92aWRlci4gIFdpdGhvdXQg c29tZSBjb3ZlcnQgY2hhbm5lbCB0aGF0IHRoZSBzZXJ2aWNlIHByb3ZpZGVyIGNhbuKAmXQgYmxv Y2ssIHRoZSB1c2VyIGRvZXMgbm90IGhhdmUgdGhpcyBjaG9pY2UuDQoNClRoZSBzZWNvbmQgc2Vu dGVuY2UgaW4gdGhpcyBwYXJhZ3JhcGggaXMgaW5jb3JyZWN0IOKAkyB0aGVyZSBhcmUgbWVjaGFu aXNtcyB0aGF0IGNhbiBwcm92aWRlIHRoZSB1c2VyIHdpdGggY2hvaWNlIG9mIEROUyByZXNvbHV0 aW9uIHdpdGhvdXQgYmVpbmcgY292ZXJ0LCBhbGJlaXQgYWxzbyBhbGxvd2luZyB0aGUgc2Vydmlj ZSBwcm92aWRlciB0byBibG9jayB0aGUgbWVjaGFuaXNtIHNob3VsZCBpdCBjaG9vc2UgdG8gZG8g c28uDQoNCj4gIEJ1dCByZWFsbHksIHRoZSB1c2VyIGRvZXNu4oCZdCBoYXZlIHRoaXMgY2hvaWNl IGFueXdheS4gICBJdOKAmXMgdGhlIGFwcCB0aGF0IGhhcyB0aGlzIGNob2ljZS4gICBUaGUgdXNl ciBtYXkgaG9wZSB0aGF0IHRoZSBhcHAgZG9lcyB3aGF0IHRoZSB1c2VyIHdhbnRzLCBidXQgdGhl IHVzZXIgcHJvYmFibHkgY2Fu4oCZdCB2YWxpZGF0ZSB0aGF0IGxlYXAgb2YgZmFpdGguDQoNCj4g IFdlIGluIHRoZSBJRVRGIGRvIG5vdCBoYXZlIHRoZSBhYmlsaXR5IHRvIHByZXZlbnQgdGhlIGFw cCBmcm9tIGJ5cGFzc2luZyB0aGUgSVNQ4oCZcyByZXNvbHZlci4gICBJdOKAmXMgdG90YWxseSBw b2ludGxlc3MgdG8gdGFsayBhYm91dCB3aGV0aGVyIG9yIG5vdCB3ZSBzaG91bGQgZG8gdGhpcy4N Cg0KV2hpbHN0IHRoZSBJRVRGIG1pZ2h0IG5vdCBoYXZlIHRoZSBhYmlsaXR5IHRvIHByZXZlbnQg YWJ1c2VzLCBJIGJlbGlldmUgdGhhdCBpdCBvdWdodCB0byBhdm9pZCBwcm92aWRpbmcgYSBzdGFu ZGFyZGlzZWQgd2F5IG9mIGVuYWJsaW5nIHRoZXNlIGFidXNlcyBpZiBhdCBhbGwgcG9zc2libGUg YW5kLCBhcyBhIG1pbmltdW0sIHNob3VsZCBlbnN1cmUgdGhhdCBpdCBhbHNvIHByb3ZpZGVzIG1l Y2hhbmlzbXMgdG8gYWxsb3cgdGhlIHVzZXIgKHNwZWNpZmljYWxseSB0aGUgZGV2aWNlIGFkbWlu aXN0cmF0b3IpIHRvIGV4cHJlc3MgdGhlaXIgcHJlZmVyZW5jZXMgYW5kIGNvbW11bmljYXRlIHRo b3NlIHByZWZlcmVuY2VzIHRvIGFwcHMuICBQdWJsaXNoZWQgYmVzdCBwcmFjdGljZSBzaG91bGQg YmUgdGhhdCB0aG9zZSBwcmVmZXJlbmNlcyBhcmUgcmVzcGVjdGVkIGJ5IGFwcHMgaW4gYWxsIGNp cmN1bXN0YW5jZXMgZXhjZXB0IHdoZXJlIHJlbGV2YW50IHJlZ3VsYXRpb25zL2xlZ2lzbGF0aW9u IG1ha2VzIHRoaXMgaW1wb3NzaWJsZSB0byBkbyBzbyBsZWdhbGx5Lg0KDQoNCkFuZHJldw0K --_000_LO2P265MB1327525D53227F9DE91EEBADC2C60LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlz dFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7 bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGNtOw0KCW1hcmdpbi1yaWdodDow Y207DQoJbWFyZ2luLWJvdHRvbTowY207DQoJbWFyZ2luLWxlZnQ6MzYuMHB0Ow0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1h bDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRv Ow0KCW1hcmdpbi1yaWdodDowY207DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFy Z2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5h bWU6YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6 ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7 c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBw dDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVm aW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjgwMjMwODcwNzsNCgltc28tbGlz dC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTQ3NzU4NTcwNiAyNTE4MDM3 NzggMTM0ODA3NTU1IDEzNDgwNzU1NyAxMzQ4MDc1NTMgMTM0ODA3NTU1IDEzNDgwNzU1NyAxMzQ4 MDc1NTMgMTM0ODA3NTU1IDEzNDgwNzU1Nzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVs LXN0YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6NTQuMHB0Ow0KCXRleHQtaW5kZW50Oi0xOC4w cHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OiJU aW1lcyBOZXcgUm9tYW4iOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KQGxpc3Qg bDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDo5MC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsN Cglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJn aW4tbGVmdDoxMjYuMHB0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2lu Z2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDoxNjIuMHB0Ow0KCXRl eHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVs NQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJbWFyZ2luLWxlZnQ6MTk4LjBwdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0 OjIzNC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7 fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjI3MC4wcHQ7DQoJdGV4dC1pbmRl bnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCglt YXJnaW4tbGVmdDozMDYuMHB0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6 IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6MzQyLjBw dDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlz dCBsMQ0KCXttc28tbGlzdC1pZDoxMzI3MDQ5ODM2Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0K CW1zby1saXN0LXRlbXBsYXRlLWlkczoxMzU1ODYzNTA2IDE3Njg4MjUyMzQgMTM0ODA3NTU1IDEz NDgwNzU1NyAxMzQ4MDc1NTMgMTM0ODA3NTU1IDEzNDgwNzU1NyAxMzQ4MDc1NTMgMTM0ODA3NTU1 IDEzNDgwNzU1Nzt9DQpAbGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjA7DQoJ bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+DmDsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJbXNvLWZh cmVhc3QtZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7DQoJbXNvLWJpZGktZm9udC1mYW1p bHk6Q2FsaWJyaTt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJ Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw0 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwxOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291cmll ciBOZXciO30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZv bnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6 bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCm9sDQoJe21hcmdpbi1ib3R0b206MGNtO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGNtO30N Ci0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6 ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBn dGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2 OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0t LT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLUdCIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxl Ij4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBK dWwgMjQsIDIwMTksIGF0IDQ6MDUgUE0sIFRlZCBNZWxsb24gJmx0OzxzcGFuIGxhbmc9IkVOLVVT Ij48YSBocmVmPSJtYWlsdG86bWVsbG9uQGZ1Z3VlLmNvbSI+bWVsbG9uQGZ1Z3VlLmNvbTwvYT4g Jmd0Ow0KPC9zcGFuPndyb3RlOiA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVT Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jmd0OyZuYnNwOyBWaXR0b3JpbywgSSB0aGlu ayBpdOKAmXMgaW1wb3J0YW50IHRvIG1ha2UgYSBkaXN0aW5jdGlvbiBiZXR3ZWVuIOKAnHdobyB5 b3UgbWlnaHQgY2hvb3NlIHRvIHRydXN04oCdIGFuZCDigJx3aG8geW91IGFyZSBmb3JjZWQgdG8g dHJ1c3Qu4oCdPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPiZndDsmbmJzcDsgSW4gb3JkZXIgdG8gcnVuIGFuIGFwcCwgaWYgdGhlIGFwcCBpcyBhYmxl IHRvIG1ha2UgaHR0cHMgY29ubmVjdGlvbnMsIHlvdSBhcmUgZm9yY2VkIHRvIHRydXN0IHRoZSBh cHAuICZuYnNwOyBUaGlzIGlzIHRydWUgd2hldGhlciB5b3UgYXJlIGF3YXJlIHRoYXQgeW91IGFy ZSB0cnVzdGluZyBpdCBvciBub3QsIGFuZCByZWdhcmRsZXNzIG9mIHlvdXIgYXR0aXR1ZGUgdG93 YXJkDQogeW91ciBzZXJ2aWNlIHByb3ZpZGVyLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdCI+V2hpbHN0IG5vdCBkaXNwdXRpbmcgdGhlIGxvZ2ljIG9mIGJlaW5nIGZvcmNl ZCB0byB0cnVzdCB0aGUgYXBwLCBleHBlcmllbmNlIHRlbGxzIHVzIHRoYXQgd2UgYXJlIHVud2lz ZSB0byBkbyBzbyBhcyB0aGVyZSBhcmUgc2FkbHkgbnVtZXJvdXMgaW5zdGFuY2VzIHdoZXJlIHRo YXQgdHJ1c3QgaXMgYmV0cmF5ZWQ7IEkgbm90ZSBmb3IgZXhhbXBsZSB0aGUgc2V0dGxlbWVudA0K IHRvZGF5IG9mIHRoZSBtb3N0IHJlY2VudCBGYWNlYm9vayBwcml2YWN5IGNhc2UgaW4gdGhlIFVT LiZuYnNwOyBJbiBhIG51bWJlciAobW9zdD8pIGNhc2VzIHdoZXJlIHRydXN0IGlzIGJldHJheWVk LCBkYXRhIG1vbmV0aXNhdGlvbiBhcHBlYXJzIHRvIGJlIGEgbW90aXZhdGluZyBmYWN0b3IgYW5k IHdlIHNob3VsZCBub3RlIHRoYXQgY2VudHJhbGlzYXRpb24gaGFzIHRoZSBwb3RlbnRpYWwgdG8g bWFnbmlmeSB0aGUgZGF0YSBtb25ldGlzYXRpb24gb3Bwb3J0dW5pdHkuJm5ic3A7DQogJm5ic3A7 PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPiZn dDsmbmJzcDsgVGhpcyBpcyB3aGF0IEkgYW0gZ2V0dGluZyBhdC4gJm5ic3A7IFRoaXMgaXMgY29t cGxldGVseSBvcnRob2dvbmFsIHRvIHRoZSBxdWVzdGlvbiBvZiDigJx3aG9zZSByZXNvbHZlciB3 b3VsZCBJIGNob29zZSB0byB0cnVzdD/igJ08bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jmd0OyZuYnNwOyBXaGF0IERvSCBkb2VzLCBidXQgd2hhdCA8 aT5hbnk8L2k+IGFwcCBjYW4gZG8gd2hldGhlciBEb0ggaXMgcHJlc2VudCBvciBub3QsIGlzIHRv IG1ha2UgaXQgcG9zc2libGUgdG8gdHJ1c3Qgc29tZW9uZSBvdGhlciB0aGFuIHlvdXIgc2Vydmlj ZSBwcm92aWRlci4gJm5ic3A7V2l0aG91dCBzb21lIGNvdmVydCBjaGFubmVsIHRoYXQgdGhlIHNl cnZpY2UgcHJvdmlkZXINCiBjYW7igJl0IGJsb2NrLCB0aGUgdXNlciBkb2VzIG5vdCBoYXZlIHRo aXMgY2hvaWNlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5UaGUgc2Vjb25k IHNlbnRlbmNlIGluIHRoaXMgcGFyYWdyYXBoIGlzIGluY29ycmVjdCDigJMgdGhlcmUgYXJlIG1l Y2hhbmlzbXMgdGhhdCBjYW4gcHJvdmlkZSB0aGUgdXNlciB3aXRoIGNob2ljZSBvZiBETlMgcmVz b2x1dGlvbiB3aXRob3V0IGJlaW5nIGNvdmVydCwgYWxiZWl0IGFsc28gYWxsb3dpbmcgdGhlIHNl cnZpY2UgcHJvdmlkZXIgdG8gYmxvY2sgdGhlDQogbWVjaGFuaXNtIHNob3VsZCBpdCBjaG9vc2Ug dG8gZG8gc28uJm5ic3A7IDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+Jmd0OyZuYnNwOyBCdXQgcmVhbGx5LCB0aGUgdXNlciBkb2VzbuKA mXQgaGF2ZSB0aGlzIGNob2ljZSBhbnl3YXkuICZuYnNwOyBJdOKAmXMgdGhlDQo8aT5hcHA8L2k+ Jm5ic3A7dGhhdCBoYXMgdGhpcyBjaG9pY2UuICZuYnNwOyBUaGUgdXNlciBtYXkgPGk+aG9wZTwv aT4mbmJzcDt0aGF0IHRoZSBhcHAgZG9lcyB3aGF0IHRoZSB1c2VyIHdhbnRzLCBidXQgdGhlIHVz ZXIgcHJvYmFibHkgY2Fu4oCZdCB2YWxpZGF0ZSB0aGF0IGxlYXAgb2YgZmFpdGguPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPiZndDsmbmJzcDsgV2Ug aW4gdGhlIElFVEYgZG8gbm90IGhhdmUgdGhlDQo8aT5hYmlsaXR5PC9pPiB0byBwcmV2ZW50IHRo ZSBhcHAgZnJvbSBieXBhc3NpbmcgdGhlIElTUOKAmXMgcmVzb2x2ZXIuICZuYnNwOyBJdOKAmXMg dG90YWxseSBwb2ludGxlc3MgdG8gdGFsayBhYm91dCB3aGV0aGVyIG9yIG5vdCB3ZSBzaG91bGQg ZG8gdGhpcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQiPldoaWxzdCB0aGUgSUVURiBtaWdodCBub3QgaGF2ZSB0aGUg YWJpbGl0eSB0byBwcmV2ZW50IGFidXNlcywgSSBiZWxpZXZlIHRoYXQgaXQgb3VnaHQgdG8gYXZv aWQgcHJvdmlkaW5nIGEgc3RhbmRhcmRpc2VkIHdheSBvZiBlbmFibGluZyB0aGVzZSBhYnVzZXMg aWYgYXQgYWxsIHBvc3NpYmxlIGFuZCwgYXMgYSBtaW5pbXVtLCBzaG91bGQgZW5zdXJlIHRoYXQN CiBpdCBhbHNvIHByb3ZpZGVzIG1lY2hhbmlzbXMgdG8gYWxsb3cgdGhlIHVzZXIgKHNwZWNpZmlj YWxseSB0aGUgZGV2aWNlIGFkbWluaXN0cmF0b3IpIHRvIGV4cHJlc3MgdGhlaXIgcHJlZmVyZW5j ZXMgYW5kIGNvbW11bmljYXRlIHRob3NlIHByZWZlcmVuY2VzIHRvIGFwcHMuJm5ic3A7IFB1Ymxp c2hlZCBiZXN0IHByYWN0aWNlIHNob3VsZCBiZSB0aGF0IHRob3NlIHByZWZlcmVuY2VzIGFyZSBy ZXNwZWN0ZWQgYnkgYXBwcyBpbiBhbGwgY2lyY3Vtc3RhbmNlcw0KIGV4Y2VwdCB3aGVyZSByZWxl dmFudCByZWd1bGF0aW9ucy9sZWdpc2xhdGlvbiBtYWtlcyB0aGlzIGltcG9zc2libGUgdG8gZG8g c28gbGVnYWxseS4mbmJzcDsNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPkFuZHJldyA8bzpwPjwvbzpwPjwvc3Bh bj48L2I+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_LO2P265MB1327525D53227F9DE91EEBADC2C60LO2P265MB1327GBRP_-- From nobody Wed Jul 24 10:32:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B2C312015B for ; Wed, 24 Jul 2019 10:32:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H0hup0N0TCrI for ; Wed, 24 Jul 2019 10:32:37 -0700 (PDT) Received: from mail-vs1-xe2f.google.com (mail-vs1-xe2f.google.com [IPv6:2607:f8b0:4864:20::e2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4FEFF120121 for ; Wed, 24 Jul 2019 10:32:37 -0700 (PDT) Received: by mail-vs1-xe2f.google.com with SMTP id u3so31866443vsh.6 for ; Wed, 24 Jul 2019 10:32:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=zfyEaWdh/B+Az2cvbQsQ9+iSTU7+HEGokz6EtlZnQDk=; b=eEY4lMsiWiSX97aPyo1/Fyguw3thg7ZvR5XB9pjlOVNMJyxU9NseI69El8ShXImBLs 3RiuBMcnD7hoLqg5cpdWh+QyB6/a7iwTBGJiYdwFkvNMsJrtiqPPteEQF/Sckco3xJKS YGvArOfGT9WDp53FqThdZHG5qwXK3s/NR+NSCOAlzWTJ8mBarZqwMM3e1Hyn3KR9Bf0j Qa0yc371CbBumPwOv8fpJQq0vEdQVPlQQ5lu29vYCpGKmDFwn5oAgNj25jxCsGOML4an Nhp6QCHr7ccdCDzc9ZgfQHFUsvcV08XM94QuZn1LMwxZk/tUxpNC6oVu/zq6gGM0yRlO wMVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=zfyEaWdh/B+Az2cvbQsQ9+iSTU7+HEGokz6EtlZnQDk=; b=obLrb8g1L9ISbCVYqR0ZmV+C/3wP5ezGdhmbQK6nKsi3zVI+VSHZtXtkIkE+03I0EX Vs7hYzkkj0kHs52fCI9CucYMKR4YutrAZhvMD0xx4oCLacSqayHO7S5mdHp5t70SeXMa MpWH4e9K1IwGfyaCC9sV+sL35nvZ2tYDjBmddeLUMieo6+Nm76fwFqEN5nfj6MYXArDz YZlrma9mZVoiKdtvSjkkVhZuQQypBswsuVnPjC77BiQR5Bv4iF83i5QQyeLDvcTJc/AC 0LTeSMmzKDJgXi6G+z3f29OKueiMfdOgzSCFIsAw0iwemCmDiSI8h1Xd9Rh0H664l48J h+Yw== X-Gm-Message-State: APjAAAVrjR8fe2kJvekMsz5pdX3xiBa4ncN4U7wJCLPzWL4ABGUR/RRS K+lQmjft8YsgAKIimNXQmoFgl1USAjnpDrMZT/Y= X-Google-Smtp-Source: APXvYqzBKxVvsru1/bkEEaQNXH0Z/GYKMseVx+AXnF6sGdMa+BL9hXjiyrzXjKVpd6Ne5Qus2msaZda2WhoEb2M+aeA= X-Received: by 2002:a67:edcf:: with SMTP id e15mr52530907vsp.75.1563989556444; Wed, 24 Jul 2019 10:32:36 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> In-Reply-To: From: Brian Dickson Date: Wed, 24 Jul 2019 13:32:24 -0400 Message-ID: To: Eric Rescorla Cc: Ted Lemon , Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000f1c21f058e70b156" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:32:39 -0000 --000000000000f1c21f058e70b156 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 1:15 PM Eric Rescorla wrote: > > > On Wed, Jul 24, 2019 at 8:58 AM Ted Lemon wrote: > >> There are a variety of attack scenarios to account for. DNSSEC is not >> useful for countering a fake NXDOMAIN attack when the attacker also >> controls the path and can prevent connection establishment. >> >> However, if the attacker is the resolver, and the resolver isn=E2=80=99t= under >> the control of the path, then detecting a fake NXDOMAIN is useful. >> > > How? > Assumptions: 1. One resolver is controlled by the attacker 2. The path to the real endpoint is free from control by that same attacker 3. Any other resolver, not controlled by that same attacker, is known If the attacker's resolver supplies a fake NXDOMAIN, which the client detects via DNSSEC, then the client sees the resolver's answer as a SERVFAIL. The client then consults a different resolver, and gets a non-NXDOMAIN answer (validated by DNSSEC), and connects to the correct host. Since the attacker does not control the data path to the correct host, the client's connection succeeds. QED (useful). Brian --000000000000f1c21f058e70b156 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 1:15 PM Eric = Rescorla <ekr@rtfm.com> wrote:
<= div dir=3D"ltr">

On Wed, Jul 24, 2019 at 8:58 AM Ted Lemon <mellon@fugue.com> wro= te:
There are a variety of attack scenarios to account for. DNSSEC is not= useful for countering a fake NXDOMAIN attack when the attacker also contro= ls the path and can prevent connection establishment.

Ho= wever, if the attacker is the resolver, and the resolver isn=E2=80=99t unde= r the control of the path, then detecting a fake NXDOMAIN is useful.=C2=A0<= br>

How?

Assumptions:
  1. One resolver is = controlled by the attacker
  2. The path to the real endpoint is free fr= om control by that same attacker
  3. Any other resolver, not controlled= by that same attacker, is known
If the attacker's resolv= er supplies a fake NXDOMAIN, which the client detects via DNSSEC, then the = client sees the resolver's answer as a SERVFAIL.
The cl= ient then consults a different resolver, and gets a non-NXDOMAIN answer (va= lidated by DNSSEC), and connects to the correct host.
Since the a= ttacker does not control the data path to the correct host, the client'= s connection succeeds.

QED (useful).
Brian
=C2=A0
--000000000000f1c21f058e70b156-- From nobody Wed Jul 24 10:46:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB7A3120059 for ; Wed, 24 Jul 2019 10:46:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pe1a0VQGzThF for ; Wed, 24 Jul 2019 10:46:15 -0700 (PDT) Received: from mail-lj1-x233.google.com (mail-lj1-x233.google.com [IPv6:2a00:1450:4864:20::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 396A7120112 for ; Wed, 24 Jul 2019 10:46:15 -0700 (PDT) Received: by mail-lj1-x233.google.com with SMTP id d24so45317523ljg.8 for ; Wed, 24 Jul 2019 10:46:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=QVCq6FuzucpQKcCHqXjE3JrIq7FRD3XGZAoOiq3Qlfs=; b=0RvWkA+jX5gtQTvPgZyBCjgtexQylnLRUMOGxuTcewYGaKgtUZ9OZkO78YKloODDdB JTTlBfK3C0WMs+QaeGLBmEhUG9u7bofIvTAIm8MFEaF0PFG+ZS/uXzOCiQCOcpv+iMjn uHUexuo2alZPtEdF9hxissWOvFGNrx3D+7IU7sihZR7LhoHHWfP4V6P/l7hUJb6Ob7ZJ rM2CxFIiO57h5mcQk/1EewX7cLA79txGRpVM0O7TNCCY3N6UgEqFIZNnZqJGnsKeGrK0 RK+ZTb9IjPRYoFAUMdVgkOq+hszcvW5+ooM96szvgHlrU8NCGWtnp+k1pe004iQV5Y2f UO8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=QVCq6FuzucpQKcCHqXjE3JrIq7FRD3XGZAoOiq3Qlfs=; b=Zhq5xH7v7HpLHp8UDGcuJwQF4zaqFT5HDlb1sN7M35QZ7C2GJcnFfJY53CzqF51LvR 0BKdWVoIfF2IPmY+PHbWlkj0eaAAPhuMtRW/j2A2b7CmxJbY6ypa2Y9osjr+XhBMYqvF dnXG6xRUbwNdBcfXecty4FApn/2O8xVd/+DVOaC2d+XVPfETITIUpZuDmKF1IGn4B+0u +5XpmdAqQS6ZsBqVxLh3TCMKMWbgLhUU/+WwNpUBerj+uyZwUcUtXOaUW3mPPNy6U2Vi lDNIvT0YX5BQyqBqlxMxZLE2QamJUe66Q0jGGXqTmS8upmFtQ+9Pg6FSJcSTKnhiGcG2 iPng== X-Gm-Message-State: APjAAAWSEH8an9Iyzq8SsxfAs43FPrFFFZS72lOIJIBXIqgAKOYPFFIM oFESxiTDdnQdyrLJwRZ+8WCuz07lEGJqvyW9Yu8= X-Google-Smtp-Source: APXvYqxTISI9OPSMwu7hjLJ65FBDqvOexSnZ7qTWV2OCMjDbEJK8HacVla+X7iIPmRQnylHKhpicJqvSJLMXnKM7RyQ= X-Received: by 2002:a2e:96d0:: with SMTP id d16mr30289778ljj.14.1563990373388; Wed, 24 Jul 2019 10:46:13 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> In-Reply-To: From: Eric Rescorla Date: Wed, 24 Jul 2019 10:45:37 -0700 Message-ID: To: Brian Dickson Cc: Ted Lemon , Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000a35e83058e70e26b" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:46:18 -0000 --000000000000a35e83058e70e26b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 10:32 AM Brian Dickson < brian.peter.dickson@gmail.com> wrote: > > > On Wed, Jul 24, 2019 at 1:15 PM Eric Rescorla wrote: > >> >> >> On Wed, Jul 24, 2019 at 8:58 AM Ted Lemon wrote: >> >>> There are a variety of attack scenarios to account for. DNSSEC is not >>> useful for countering a fake NXDOMAIN attack when the attacker also >>> controls the path and can prevent connection establishment. >>> >>> However, if the attacker is the resolver, and the resolver isn=E2=80=99= t under >>> the control of the path, then detecting a fake NXDOMAIN is useful. >>> >> >> How? >> > > Assumptions: > > 1. One resolver is controlled by the attacker > 2. The path to the real endpoint is free from control by that same > attacker > 3. Any other resolver, not controlled by that same attacker, is known > > This last possibility seems like a pretty narrow case. In the vast majority of cases, clients have one path to the network. It's a little surprising to be hearing resistance to local resolver blocking being cited as a goal here, given that previously I've heard complaints that DoH (which is effectively a separate path to another resolver) is a mechanism for circumventing exactly this kind of blocking. -Ekr If the attacker's resolver supplies a fake NXDOMAIN, which the client > detects via DNSSEC, then the client sees the resolver's answer as a > SERVFAIL. > The client then consults a different resolver, and gets a non-NXDOMAIN > answer (validated by DNSSEC), and connects to the correct host. > Since the attacker does not control the data path to the correct host, th= e > client's connection succeeds. > > QED (useful). > > Brian > > --000000000000a35e83058e70e26b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 10:32 AM Bria= n Dickson <brian.peter.= dickson@gmail.com> wrote:


On Wed, Jul 24, 2019= at 1:15 PM Eric Rescorla <ekr@rtfm.com> wrote:


On Wed, Jul 24, 2019= at 8:58 AM Ted Lemon <mellon@fugue.com> wrote:
There are a variety of attack scenar= ios to account for. DNSSEC is not useful for countering a fake NXDOMAIN att= ack when the attacker also controls the path and can prevent connection est= ablishment.

However, if the attacker is the resolver, an= d the resolver isn=E2=80=99t under the control of the path, then detecting = a fake NXDOMAIN is useful.=C2=A0

How?

Assumptions:
  1. One resolver is controlled by the attacker
  2. The pat= h to the real endpoint is free from control by that same attacker
  3. A= ny other resolver, not controlled by that same attacker, is known
=
This last possibility seems like a pret= ty narrow case. In the vast majority of cases, clients have one path to the= network.

It's a little surprising to be heari= ng resistance to local resolver blocking being cited as a goal here, given = that previously I've heard complaints that DoH (which is effectively a = separate path to another resolver) is a mechanism for circumventing exactly= this kind of blocking.

-Ekr



If the attack= er's resolver supplies a fake NXDOMAIN, which the client detects via DN= SSEC, then the client sees the resolver's answer as a SERVFAIL.
The client then consults a different resolver, and gets a non-NXDO= MAIN answer (validated by DNSSEC), and connects to the correct host.
<= div>Since the attacker does not control the data path to the correct host, = the client's connection succeeds.

QED (useful)= .

Brian
=C2=A0
--000000000000a35e83058e70e26b-- From nobody Wed Jul 24 10:56:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C25512015B for ; Wed, 24 Jul 2019 10:56:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UNN0KycLIkap for ; Wed, 24 Jul 2019 10:56:39 -0700 (PDT) Received: from mail-vk1-xa36.google.com (mail-vk1-xa36.google.com [IPv6:2607:f8b0:4864:20::a36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97713120059 for ; Wed, 24 Jul 2019 10:56:39 -0700 (PDT) Received: by mail-vk1-xa36.google.com with SMTP id o19so9568466vkb.6 for ; Wed, 24 Jul 2019 10:56:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gOjJDEzZfhbZWwnhRF5hPmUZ9UYKWXM1C5lLfJ0D95g=; b=MUVbtPrXBoaCmT/gEqC1HK+TX/xkNYeJlxVXy8pVha6PfGRny3OOluOXkvG7RJHg+T qEa4jct7JNtT111grg4dLsraGJe+7giUIZ8wbJGtGoACnWprZLba3fWj8pWmMgf15QOT eMhQ1rIyqMv0fb/nLAmkWgTUr36/lB3VTvOoLnXjgMsEqQ3tHS0ABG7WMcqZEphue+Ya R4dvbPph+LH2LvH54GvLBjSseqO+4/6vXKfvooNndx0Tb2SBGS2ZphRiGKkqHumsUJbH J6IR8Lzemg423iNvtEOs1eGWRitkoNDUwpS8zOrpCazWJc7AmRWQ/w2kPcA5ISwYnNRV OXOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gOjJDEzZfhbZWwnhRF5hPmUZ9UYKWXM1C5lLfJ0D95g=; b=cepT+OXc9X4f1HpMJi/duQ6qniFm5IQekYI6QBN89FN6NMJ+H+t0nDJyUurmSGmJEa w5BeDPbMqIMGKm2bLbMy8UeKKCjho4zlXTsX/WfVFSuk2vrHvOusw3GTIDvhx3BYsWfb 8VmNZNcx88477p3EwBY7oFvzymInfil/+zoOtSpAqB1r1uzRRYGHaFZ68LfXxQ2UnJfb Sb6fo5yTGgw4CWbhBLFozKmf5hGbRGwu1T4y2tN6FGINtOzCMi4g5Vj8BLuJ1RDuCCG7 vzWrJ8D1+8F+WaamgoxqxIcSENbe46v7URJbj5DN/Qus6vb2j3urJ7qs/3dXIQSNtcAe Y/hw== X-Gm-Message-State: APjAAAVcN3QUN56RlQwHEMR8ke0H5wjamt2eOoRst2WjKxFTQfFY0GaN XkSY03skFe1FcMcOdrGJCyVJFgwkO8xcZDEc28g= X-Google-Smtp-Source: APXvYqx3V9ULoAd6Dr9HPRuaYXq4iQPv95OMcZsLnhbjS9Jus7pO6GyTS+Qo2fjmfqtYNYNTuxTAcFqApm3xJ1e0RPM= X-Received: by 2002:a1f:9f06:: with SMTP id i6mr32539589vke.52.1563990998623; Wed, 24 Jul 2019 10:56:38 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> In-Reply-To: From: Brian Dickson Date: Wed, 24 Jul 2019 13:56:27 -0400 Message-ID: To: Eric Rescorla Cc: Ted Lemon , Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000e7ab4a058e71072c" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:56:43 -0000 --000000000000e7ab4a058e71072c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 1:46 PM Eric Rescorla wrote: > > > On Wed, Jul 24, 2019 at 10:32 AM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > >> >> >> On Wed, Jul 24, 2019 at 1:15 PM Eric Rescorla wrote: >> >>> >>> >>> On Wed, Jul 24, 2019 at 8:58 AM Ted Lemon wrote: >>> >>>> There are a variety of attack scenarios to account for. DNSSEC is not >>>> useful for countering a fake NXDOMAIN attack when the attacker also >>>> controls the path and can prevent connection establishment. >>>> >>>> However, if the attacker is the resolver, and the resolver isn=E2=80= =99t under >>>> the control of the path, then detecting a fake NXDOMAIN is useful. >>>> >>> >>> How? >>> >> >> Assumptions: >> >> 1. One resolver is controlled by the attacker >> 2. The path to the real endpoint is free from control by that same >> attacker >> 3. Any other resolver, not controlled by that same attacker, is known >> >> This last possibility seems like a pretty narrow case. In the vast > majority of cases, clients have one path to the network. > > It's a little surprising to be hearing resistance to local resolver > blocking being cited as a goal here, given that previously I've heard > complaints that DoH (which is effectively a separate path to another > resolver) is a mechanism for circumventing exactly this kind of blocking. > > I think you are misinterpreting the meaning of "controlled by". I.e. "operated by", "subverted by", "poisoned by", "subverted by" (an attacker). It has nothing to do with the path, to either the destination endpoint, or to either resolver. For example, suppose the client knew about 9.9.9.9 and 8.8.8.8, and preferred 8.8.8.8. If 8.8.8.8 was compromised and injecting (responding to queries with) false NXDOMAIN answers in a DNSSEC-signed domain, the client would detect that, and would then query 9.9.9.9. Since (by the assumptions above) 9.9.9.9 is not compromised, it would return a non-NXDOMAIN (legitimate, DNSSEC-signed) answer. Brian > > > If the attacker's resolver supplies a fake NXDOMAIN, which the client >> detects via DNSSEC, then the client sees the resolver's answer as a >> SERVFAIL. >> The client then consults a different resolver, and gets a non-NXDOMAIN >> answer (validated by DNSSEC), and connects to the correct host. >> Since the attacker does not control the data path to the correct host, >> the client's connection succeeds. >> >> QED (useful). >> >> Brian >> >> > --000000000000e7ab4a058e71072c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 1:46 PM Eric = Rescorla <ekr@rtfm.com> wrote:
<= div dir=3D"ltr">

On Wed, Jul 24, 2019 at 10:32 AM Brian Dickson <brian.peter.= dickson@gmail.com> wrote:


On Wed, Jul 24, 2019= at 1:15 PM Eric Rescorla <ekr@rtfm.com> wrote:


On Wed, Jul 24, 2019= at 8:58 AM Ted Lemon <mellon@fugue.com> wrote:
There are a variety of attack scenar= ios to account for. DNSSEC is not useful for countering a fake NXDOMAIN att= ack when the attacker also controls the path and can prevent connection est= ablishment.

However, if the attacker is the resolver, an= d the resolver isn=E2=80=99t under the control of the path, then detecting = a fake NXDOMAIN is useful.=C2=A0

How?

Assumptions:
  1. One resolver is controlled by the attacker
  2. The pat= h to the real endpoint is free from control by that same attacker
  3. A= ny other resolver, not controlled by that same attacker, is known
=
This last possibility seems like a pret= ty narrow case. In the vast majority of cases, clients have one path to the= network.

It's a little surprising to be heari= ng resistance to local resolver blocking being cited as a goal here, given = that previously I've heard complaints that DoH (which is effectively a = separate path to another resolver) is a mechanism for circumventing exactly= this kind of blocking.


I think you are misinterpreting the meaning of "cont= rolled by". I.e. "operated by", "subverted by", &q= uot;poisoned by", "subverted by" (an attacker).
It has nothing to do with the path, to either the destination = endpoint, or to either resolver.

For example, supp= ose the client knew about 9.9.9.9 and 8.8.8.8, and preferred 8.8.8.8.
=
If 8.8.8.8 was compromised and injecting (responding to queries with) = false NXDOMAIN answers in a DNSSEC-signed domain, the client would detect t= hat, and would then query 9.9.9.9.
Since (by the assumptions abov= e) 9.9.9.9 is not compromised, it would return a non-NXDOMAIN (legitimate, = DNSSEC-signed) answer.

Brian
=C2=A0


<= div>If the attacker's resolver supplies a fake NXDOMAIN, which the clie= nt detects via DNSSEC, then the client sees the resolver's answer as a = SERVFAIL.
The client then consults a different resolver, an= d gets a non-NXDOMAIN answer (validated by DNSSEC), and connects to the cor= rect host.
Since the attacker does not control the data path to t= he correct host, the client's connection succeeds.

=
QED (useful).

Brian
=C2=A0
--000000000000e7ab4a058e71072c-- From nobody Wed Jul 24 10:59:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C834212015B for ; Wed, 24 Jul 2019 10:59:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TmXepkaj6VJb for ; Wed, 24 Jul 2019 10:59:53 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 546451202A5 for ; Wed, 24 Jul 2019 10:59:53 -0700 (PDT) Received: from dhcp-8a04.meeting.ietf.org (dhcp-8a04.meeting.ietf.org [31.133.138.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id C3FE2242109D; Wed, 24 Jul 2019 17:59:51 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <20190724165643.GA29051@laperouse.bortzmeyer.org> Date: Wed, 24 Jul 2019 19:05:13 +0100 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <9BD6861C-411D-4D41-8076-8305D5FB6B93@rfc1035.com> References: <20190724165643.GA29051@laperouse.bortzmeyer.org> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] Not a good BoF meeting X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 17:59:55 -0000 > On 24 Jul 2019, at 17:56, Stephane Bortzmeyer = wrote: >=20 > I suggest that this list does not do anything useful at this time. Plenty of others have a different PoV. > I have nothing about specific work on specific points, but I don't = think > general "everything I do not like about DoH" slides will help. [Citation needed.] No such slides were presented yesterday and AFAICT = that opinion isn't being expressed on this list. From nobody Wed Jul 24 11:11:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC49F120648 for ; Wed, 24 Jul 2019 11:10:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bqu7VJL0OHQi for ; Wed, 24 Jul 2019 11:10:56 -0700 (PDT) Received: from mail-lj1-x229.google.com (mail-lj1-x229.google.com [IPv6:2a00:1450:4864:20::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B53312061D for ; Wed, 24 Jul 2019 11:10:56 -0700 (PDT) Received: by mail-lj1-x229.google.com with SMTP id v18so45357991ljh.6 for ; Wed, 24 Jul 2019 11:10:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=RvLUybX2ZvnGax1nxCTe/olgGodRYI2gqmdOnfQ1PVU=; b=krapfGfuxMNwr1QNRodGsBMzH2Qa4+8htrZgcMDDoGANTCTHI1pncVzo5xb1E9Fo6C hLs1IeLGqZd69eWf4zxrKTKnfD0Hvml45C+kS2dzHQS1nEoS2GSIfqq1J3DQv4g7jfBK eCsgWQmbK29BxMVivv0k0ixwHwTtGl8Wpg83lngPCVwaPKfy73v3LvF9RflnmHJmG9b3 9eUNNWTpuVtAd/3GSuugY7xziLLZOGJwIk47vBm/TYHsuCtswYfQm89+aNjLQBH5L7H0 nGAK1t2fLEOYRBPGc9i+rE0eQUNUsZy38hnmDykwj1GZ9ne/z72MeuI7J8sEtJu09upG 3vYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=RvLUybX2ZvnGax1nxCTe/olgGodRYI2gqmdOnfQ1PVU=; b=fiUygeeTaQysmkJufsHADEvKZvEQenAcRDxJk3taODTvZy8Pmvh8SfYvBUrk5Tp/tm gcVT3kGNcB06pd7lftWr+9iDskLinImnMBoUJuKjI1+PEeCuCb6mzqhFlJ1hQYcvAlJV RhKHkmyd/y01YuyoB/hVHNpGFhjp3wpGR6Aafv4pxL1fArlg90ot7ik/4QJYOAdqu0G6 zNZovboUeM5FXWh/rzMwzWJr6yHeu77WPwqxBbvpgdKMDHUggqa/at3hZfgsN9dlAuiy 4o+WXvNo/iNAmeha1dkmTr6RjLQOYGkQwB5SloumJO/8t49RgfItj91fFOyf959TF9dd eTiA== X-Gm-Message-State: APjAAAXEvPDU4ET8usCFf/Bzc2RH3SzeANfkf1Pfwo+bUWpTSv4isx9N 2/oY6zPaIqYSnduVB6WHmsPsWfNJXih9AL9MLiM= X-Google-Smtp-Source: APXvYqzKlZvbecKbrRCQn9bUBPV+Bp72Fazev+gSjHGQLssjGzZnQJFeORrx0/wOkVvq+g0FhF2fCb4oJvsCcJcElrY= X-Received: by 2002:a2e:9b84:: with SMTP id z4mr27093961lji.75.1563991854330; Wed, 24 Jul 2019 11:10:54 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> In-Reply-To: From: Eric Rescorla Date: Wed, 24 Jul 2019 11:10:17 -0700 Message-ID: To: Brian Dickson Cc: Ted Lemon , Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000e8c5d8058e713af9" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 18:11:03 -0000 --000000000000e8c5d8058e713af9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 10:56 AM Brian Dickson < brian.peter.dickson@gmail.com> wrote: > > > On Wed, Jul 24, 2019 at 1:46 PM Eric Rescorla wrote: > >> >> >> On Wed, Jul 24, 2019 at 10:32 AM Brian Dickson < >> brian.peter.dickson@gmail.com> wrote: >> >>> >>> >>> On Wed, Jul 24, 2019 at 1:15 PM Eric Rescorla wrote: >>> >>>> >>>> >>>> On Wed, Jul 24, 2019 at 8:58 AM Ted Lemon wrote: >>>> >>>>> There are a variety of attack scenarios to account for. DNSSEC is not >>>>> useful for countering a fake NXDOMAIN attack when the attacker also >>>>> controls the path and can prevent connection establishment. >>>>> >>>>> However, if the attacker is the resolver, and the resolver isn=E2=80= =99t under >>>>> the control of the path, then detecting a fake NXDOMAIN is useful. >>>>> >>>> >>>> How? >>>> >>> >>> Assumptions: >>> >>> 1. One resolver is controlled by the attacker >>> 2. The path to the real endpoint is free from control by that same >>> attacker >>> 3. Any other resolver, not controlled by that same attacker, is know= n >>> >>> This last possibility seems like a pretty narrow case. In the vast >> majority of cases, clients have one path to the network. >> >> It's a little surprising to be hearing resistance to local resolver >> blocking being cited as a goal here, given that previously I've heard >> complaints that DoH (which is effectively a separate path to another >> resolver) is a mechanism for circumventing exactly this kind of blocking= . >> >> > I think you are misinterpreting the meaning of "controlled by". I.e. > "operated by", "subverted by", "poisoned by", "subverted by" (an attacker= ). > > It has nothing to do with the path, to either the destination endpoint, o= r > to either resolver. > > For example, suppose the client knew about 9.9.9.9 and 8.8.8.8, and > preferred 8.8.8.8. > If 8.8.8.8 was compromised and injecting (responding to queries with) > false NXDOMAIN answers in a DNSSEC-signed domain, the client would detect > that, and would then query 9.9.9.9. > Since (by the assumptions above) 9.9.9.9 is not compromised, it would > return a non-NXDOMAIN (legitimate, DNSSEC-signed) answer. > This also seems like an edge case. The vast majority of clients do not have two independently controlled resolvers. -Ekr > Brian > > >> >> >> If the attacker's resolver supplies a fake NXDOMAIN, which the client >>> detects via DNSSEC, then the client sees the resolver's answer as a >>> SERVFAIL. >>> The client then consults a different resolver, and gets a non-NXDOMAIN >>> answer (validated by DNSSEC), and connects to the correct host. >>> Since the attacker does not control the data path to the correct host, >>> the client's connection succeeds. >>> >>> QED (useful). >>> >>> Brian >>> >>> >> --000000000000e8c5d8058e713af9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 10:56 AM Bria= n Dickson <brian.peter.= dickson@gmail.com> wrote:


On Wed, Jul 24, 2019= at 1:46 PM Eric Rescorla <ekr@rtfm.com> wrote:


On Wed, Jul 24, 2019= at 10:32 AM Brian Dickson <brian.peter.dickson@gmail.com> wrote:


On Wed, Jul 24, 2019 at 1:15 PM Eric Rescorla <ekr@rtfm.com> wrote:
<= /div>


On Wed, Jul 24, 2019 at 8:58 AM Ted Lemon <mellon@fugue.com> wrote:<= br>
There are a variety of attack scenarios to account for. DNSSEC is not use= ful for countering a fake NXDOMAIN attack when the attacker also controls t= he path and can prevent connection establishment.

Howeve= r, if the attacker is the resolver, and the resolver isn=E2=80=99t under th= e control of the path, then detecting a fake NXDOMAIN is useful.=C2=A0
<= /div>

How?

Assumptions:
  1. One resolver is cont= rolled by the attacker
  2. The path to the real endpoint is free from c= ontrol by that same attacker
  3. Any other resolver, not controlled by = that same attacker, is known
T= his last possibility seems like a pretty narrow case. In the vast majority = of cases, clients have one path to the network.

It= 's a little surprising to be hearing resistance to local resolver block= ing being cited as a goal here, given that previously I've heard compla= ints that DoH (which is effectively a separate path to another resolver) is= a mechanism for circumventing exactly this kind of blocking.


I think you are mis= interpreting the meaning of "controlled by". I.e. "operated = by", "subverted by", "poisoned by", "subverte= d by" (an attacker).

It has nothing to do wit= h the path, to either the destination endpoint, or to either resolver.

For example, suppose the client knew about 9.9.9.9 and= 8.8.8.8, and preferred 8.8.8.8.
If 8.8.8.8 was compromised and i= njecting (responding to queries with) false NXDOMAIN answers in a DNSSEC-si= gned domain, the client would detect that, and would then query 9.9.9.9.
Since (by the assumptions above) 9.9.9.9 is not compromised, it wou= ld return a non-NXDOMAIN (legitimate, DNSSEC-signed) answer.

This also seems like an edge case. The = vast majority of clients do not have two independently controlled resolvers= .

-Ekr


Brian
=C2=A0
<= br>

<= div dir=3D"ltr">
If the attacker's = resolver supplies a fake NXDOMAIN, which the client detects via DNSSEC, the= n the client sees the resolver's answer as a SERVFAIL.
= The client then consults a different resolver, and gets a non-NXDOMAIN answ= er (validated by DNSSEC), and connects to the correct host.
Since= the attacker does not control the data path to the correct host, the clien= t's connection succeeds.

QED (useful).

Brian
=C2=A0
--000000000000e8c5d8058e713af9-- From nobody Wed Jul 24 11:16:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD26F12017F for ; Wed, 24 Jul 2019 11:16:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ea8mk_5aP2fX for ; Wed, 24 Jul 2019 11:16:08 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D0CBF120141 for ; Wed, 24 Jul 2019 11:16:07 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id 201so34439980qkm.9 for ; Wed, 24 Jul 2019 11:16:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=8ibQYDqqrqWn/4c9c0oiTYP73C5tTqt4Qp94yuL5cE0=; b=kqxM4r6UNdZmY6yOAVcCW3D8cJMWL4vh4Hax3TjYpOEsTYguDDmGjuDVCNebANWJ2n nCFnClyYPqLiWkfdOCMej+Gt2U33kdxhcdhrxvsqkBdIJagTM+5p7Ti5FaNM53jhPMog sx5yHwj14NRG+HtEEPNoS/8MChvhJrKhfCv3XrKTPzURxjY5uZD/F4FKszTp68yV4mdC 5OzuF6MGLNUoNjFVQCNndGvdv1vG51V+G37S/nNbaxzfLNv4RMto7a57owVC1cwOvIiV 6+DdSth0mTrB1lu4EATfj1hS9Mht72dly6LBMLXIGlWT0yctegQ+SiWMiN4P5928/7w5 Vohw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=8ibQYDqqrqWn/4c9c0oiTYP73C5tTqt4Qp94yuL5cE0=; b=EFa1JPFnFXm8aeov35mMoTIrkvRi6McQTJJMl87Z0rcTty8IZvqo34lb91jqRLQ++h oz3/nkDCZaQ9uo5pOrrZIwElnilIfuH+/7exTpF044lZjLRrZs0MOTJYkkPaKzOZNT/7 merQPhSuI2j7Trw26pX5HMK1361JyHZzAhHk1XS68BYm/dNtuAYvgQiGopv9AK5YfF8h bbbc03LT7P7/pNsAwDZWlOqr45JWGiuVFA/TxbUzqILQ03BrwB9ihAzpWgE9fGtcNPGS 3M+rKWIl+YPPnuiAfXpXopAULfI2+DHPXTR20timMgxZss9lb0OVDef9HHpWu/7ypDwQ d1CA== X-Gm-Message-State: APjAAAWLRJiKCiLyFZWqKmN37ZdIcW929sScm4sHP7iKSxWDFjOzLEF1 8hjfmD2qZVf6yXLwwcgtayTO+Db6CBA= X-Google-Smtp-Source: APXvYqywr2YcXRzOUwpVZjEuroyL6nw0XElULJt0Myk95UmUVhrlNMnT+beEoB3w0/yINk065Yafzg== X-Received: by 2002:a05:620a:1006:: with SMTP id z6mr22685689qkj.312.1563992166767; Wed, 24 Jul 2019 11:16:06 -0700 (PDT) Received: from ROADKILL.local ([199.180.96.142]) by smtp.gmail.com with ESMTPSA id h18sm19756814qkk.93.2019.07.24.11.16.04 (version=TLS1_3 cipher=AEAD-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 11:16:06 -0700 (PDT) To: Stephane Bortzmeyer , add@ietf.org References: <20190724165643.GA29051@laperouse.bortzmeyer.org> From: Thomas Peterson Message-ID: <2457067b-49fe-c2cf-d554-95f524573eea@gmail.com> Date: Wed, 24 Jul 2019 19:16:02 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Thunderbird/68.0 MIME-Version: 1.0 In-Reply-To: <20190724165643.GA29051@laperouse.bortzmeyer.org> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] Not a good BoF meeting X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 18:16:10 -0000 As the author of a draft (draft-peterson-doh-dhcp[0]) that provides discovery of DoH resolvers, I disagree as "trusting the network" is more complicated when there may be many operators and users in a given network, any of whom could be a threat. To me it is a positive if operators can provide secure means of DNS resolution within their network, and clients can choose to use them or not. Regards 0: https://datatracker.ietf.org/doc/draft-peterson-dot-dhcp/ On 24/07/2019 17:56, Stephane Bortzmeyer wrote: > * discovery of local DoH resolvers (in my opinion, a flawed idea from the > start: if you trust the local network, you don't need DoH, if you > don't, you won't trust its DoH announces anyway), From nobody Wed Jul 24 11:18:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66B5F1202A5 for ; Wed, 24 Jul 2019 11:18:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1xA3vqBJTRDa for ; Wed, 24 Jul 2019 11:18:05 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10FEC120112 for ; Wed, 24 Jul 2019 11:18:05 -0700 (PDT) Received: from dhcp-8a04.meeting.ietf.org (dhcp-8a04.meeting.ietf.org [31.133.138.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id B8FA4242109D; Wed, 24 Jul 2019 18:18:02 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 24 Jul 2019 19:23:23 +0100 Cc: "add@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 18:18:07 -0000 > On 24 Jul 2019, at 18:45, Eric Rescorla wrote: >=20 > I've heard complaints that DoH (which is effectively a separate path = to another resolver) is a mechanism for circumventing exactly this kind = of blocking. I think those complaints are about the way one browser vendor has = decided to deploy DoH, not the protocol itself. From nobody Wed Jul 24 11:18:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7833120316 for ; Wed, 24 Jul 2019 11:18:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JkABapIh7L4Y for ; Wed, 24 Jul 2019 11:18:39 -0700 (PDT) Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DA7FB120112 for ; Wed, 24 Jul 2019 11:18:38 -0700 (PDT) Received: from dooku.sandelman.ca (dhcp-8550.meeting.ietf.org [31.133.133.80]) by relay.sandelman.ca (Postfix) with ESMTPS id 0A8561F44B for ; Wed, 24 Jul 2019 18:18:37 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id A8C321624; Wed, 24 Jul 2019 14:18:59 -0400 (EDT) From: Michael Richardson To: "add\@ietf.org" In-reply-to: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> Comments: In-reply-to Eric Rescorla message dated "Wed, 24 Jul 2019 08:10:16 -0700." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Date: Wed, 24 Jul 2019 14:18:59 -0400 Message-ID: <21062.1563992339@dooku.sandelman.ca> Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 18:18:41 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Eric Rescorla wrote: > In the case where A is not DNSSEC signed, the attacker just sends > NXDOMAIN,=20 > which the client accepts and refuses to connect. > In the case where A *is* DNSSEC signed, the attacker can also inject = an > NXDOMAIN. DNSSEC of course won't validate, but the client still doesn= 't > have an IP address to connect to, so it's only recourse is to error > out. Now, it can show the user a different error than it did for > NXDOMAIN, but these errors tend to be fairly generic anyway (Firefox, > for instance, shows "Hmm. We=E2=80=99re having trouble finding that = site."), > so from the user perspective these=20 > aren't really very different. This needs to be an on-path attacker who can not only inject a fake NXDOMAI= N, but also suppress/delete the legitimate answers. This means it is the "coffee" shop that is doing the attack. When the coffee shop is a soveign country, then there are many things that they can also do which DoH/DoT may or not help with. When this is an off-path attacker, DNSSEC enables successful connections (that HTTPS can validate) vs "Having trouble" dialogues. =2D-=20 ] Never tell me the odds! | ipv6 mesh network= s [=20 ] Michael Richardson, Sandelman Software Works | network architect= [=20 ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [=20 =09 --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEERK+9HEcJHTJ9UqTMlUzhVv38QpAFAl04oRMACgkQlUzhVv38 QpCKLQgApHRHJUs/GDkIM/pJ1RKvShh4nuZdE5Sv+sXBuPdg5VTTJn+O7DRM0p/K Mk3W7ltlpzJtwmutTnIrf+WZeXU+oFuBJJ12TAUOwJj47f7e3kytmp9ysdJVj83B oYYZuAeBe6Y2t7RsLe1DsRsgsObiCv+539rcpT6+tSeiZZ7ttNsmdhmJFquq8CKB +HGqHe1+GX8ucpLo9HsgBgeWRPfvmV+eDMiKFdzV8mGEvAqsnnaDXybbD6XnJNmZ CLk+eMJbPz0LV8WrFN7gCHMj1DXrw9XGXYblNHbaF6uqsb1TdWAFfNs7RMrvxaf7 BAsYx2P13JS9z7zEITp5s5H3mLiWQA== =QICt -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jul 24 11:21:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E15312034D for ; Wed, 24 Jul 2019 11:21:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vHVsZBezaxxG for ; Wed, 24 Jul 2019 11:21:00 -0700 (PDT) Received: from mail-qt1-x835.google.com (mail-qt1-x835.google.com [IPv6:2607:f8b0:4864:20::835]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0AC30120112 for ; Wed, 24 Jul 2019 11:21:00 -0700 (PDT) Received: by mail-qt1-x835.google.com with SMTP id l9so46420136qtu.6 for ; Wed, 24 Jul 2019 11:20:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=ehm4+YQB2q0hsh41VrD+G7WEQiaeJ+kaRLFeDufHNfc=; b=oHJYRHTzgNTu6uURd/XFkRKWXq5+MGJXTN5bsqzYpq8o+r8LJEmX50bqR+ccMMqGos EWPV0TKqo+S7uBsTcprwYCYd8z3uVK6s43San3VWEz5ILt7vXqaKQOQE+SUXxkVlXlbu kYU3H8wZGsZW2nTxGQq7kHVb8Fknvm3ZBgsIhx8e+RH8mE6ru50s/cz/4MosSIBGvOUD 7fYeajyxY5YMFIs2TbjO6r4KzDqM58S8VJPDg9mqGOid1oiGCMwjo1Ytf+1/k2wnrLsC 1gIrxEOhFGZUdfjnQjBy6V74xvgKWwutkz0Xrar/etIj/xxofIdMJGFvcmtXUc093f+h v6uw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=ehm4+YQB2q0hsh41VrD+G7WEQiaeJ+kaRLFeDufHNfc=; b=T+3nJqbJWhWABjhl7Ime72GdgXSiekshQqwoeDEykgCmQMtZeEtnLXZBVFE3q4v+gO tXYlGoGV2LjdzmNYO931jqayMLGzcAKAbrZlKe/QQ096rOBpmasbdkA+XU1kPeLqZnG5 E88Nf7iXy38nBR/Nw0PG9tDKOyvTQw2Nz4HSzk4LIdKvisacNiSEDOLWuN6x/vINf7O6 oRYqN8hL/FeDy76hrlDSJ3BA/lrAW8SKi+ypmqUr01FKX2WY4Y9g2pMvV36bChyC9SN6 4S7aLb/qnuuH/vPcB6+X3uJUjTG9Ek1wHc0WeVUjpit7MGylPx0Wx83kajpPryXLGkOy RaWA== X-Gm-Message-State: APjAAAXqrwWWHhG2h9b+a/HvqCvRjh6Z6K0/atLSetpceuurZuDOWTPa Rrw87QkJzjZDDRPo4oxMmmDZXQ== X-Google-Smtp-Source: APXvYqy/y6K+1iiXo/gN5Zckaf0zdQFEoesUe284TMDFYay84HV8WpxurRvaUF3qyK8eyTspZIrKMQ== X-Received: by 2002:ac8:31dc:: with SMTP id i28mr59937249qte.226.1563992457924; Wed, 24 Jul 2019 11:20:57 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:b45e:4ed5:44e0:bf73? ([2001:67c:370:128:b45e:4ed5:44e0:bf73]) by smtp.gmail.com with ESMTPSA id h18sm19761993qkk.93.2019.07.24.11.20.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 11:20:57 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_A54FE317-4FD6-4264-9A45-BC961F1B9B15" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 24 Jul 2019 14:20:55 -0400 In-Reply-To: Cc: Brian Dickson , Jim Reid , "add@ietf.org" , Rob Sayre To: Eric Rescorla References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 18:21:02 -0000 --Apple-Mail=_A54FE317-4FD6-4264-9A45-BC961F1B9B15 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 24, 2019, at 2:10 PM, Eric Rescorla wrote: > This also seems like an edge case. The vast majority of clients do not = have two independently controlled resolvers. That sounds like a problem statement. But it=E2=80=99s really easy to configure two resolvers. Just put two = IP addresses in the dialog box. The stub resolver, if it is following = the standard, will consult both, particularly when one fails.=20 --Apple-Mail=_A54FE317-4FD6-4264-9A45-BC961F1B9B15 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 24, 2019, at 2:10 PM, Eric Rescorla <ekr@rtfm.com> = wrote:
This = also seems like an edge case. The vast majority of clients do not have = two independently controlled resolvers.

That sounds like a problem = statement.

But it=E2=80=99s really = easy to configure two resolvers.   Just put two IP addresses in the = dialog box.   The stub resolver, if it is following the standard, = will consult both, particularly when one fails. 

= --Apple-Mail=_A54FE317-4FD6-4264-9A45-BC961F1B9B15-- From nobody Wed Jul 24 11:36:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D4241202A5 for ; Wed, 24 Jul 2019 11:36:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vP34KvkLj60E for ; Wed, 24 Jul 2019 11:36:56 -0700 (PDT) Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 461E4120141 for ; Wed, 24 Jul 2019 11:36:56 -0700 (PDT) Received: by mail-lj1-x22e.google.com with SMTP id i21so45492019ljj.3 for ; Wed, 24 Jul 2019 11:36:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=sMLCm3EY06b3M7wbufUnIPL8HA2CHhKHVrX6ojp2sR8=; b=tlv1tyikPRcW0A3GCvuCucqb+P6IlnCib/eubWaaLTQOT7xa75O6tgc0ZXUokpSZi0 XjL1JEBYdaOUmAkcmtUYwYmvSbCL5G4lA0HXc/3jHEzXs0pu3ooG7ubKjYunPISuYlLL Zg3lWJRbmmr3SwZ3wFbvVCi0E1+rlC0Hyk0ug+N5R33D7DPfUFTWQUwQOPPRS78n6OmJ unH9kturPySkpUwO0s0JUv7jv3p3TwkaxPMe0IK2SdmWduI1UXqmYhtNQd15bgy/n9hB dx2ZUV0MRQ9NzcSFxtXxptQjZAIdJVNZxtQxUj32zes6G4awsCveZDv1YfE7JlkKJQJi 9+oQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=sMLCm3EY06b3M7wbufUnIPL8HA2CHhKHVrX6ojp2sR8=; b=d4yNauMcUCtGP31GoeQk4zzu6wch+ERjeDGXTB3cgkiBZ6FxXPpSh16uHXegJlu09e vC0uAcEf0CpRLbjCuEfIt7gkzxUcVYxDp52j5Th+PrRodXhFlC9G70riYiFQoh8yoIEj dRSHP4wPI1oIQ/1Ct/14Z/3UIqqB+Lcwrm94y0j0WFJ5g1yeEQaJ94G8YpAptp09J1HV V8JwDFURfV/XmV2pSh1dDqsOxrEtuWN7+3XVX8/uisoj9HCUtnmDEVyZE1bNuP365b4a TUh3w9TjPCYQNm9hgbFUZeODxhx8n7/1dBzhRg7tIKDwZlqWqaW9iDTKoNKneYxCOWRT npKw== X-Gm-Message-State: APjAAAWrZLmVhriHKQncfmaoi37hHGsITEZoWKRpks61u746ELpUmrlz cS9ZB9SzYIsX6WBjv8NiH/cMx6euEcpmfZwk92E= X-Google-Smtp-Source: APXvYqy6oI42OGejpnFKDjq1kFvL8BpN6VaxfpkurnPYRNWqpR9ldePBmbB8Nf1m3p1d4Vqgx+MPt3gdmH1ZBwsWx8I= X-Received: by 2002:a2e:8892:: with SMTP id k18mr44354587lji.239.1563993414544; Wed, 24 Jul 2019 11:36:54 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> In-Reply-To: From: Eric Rescorla Date: Wed, 24 Jul 2019 11:36:17 -0700 Message-ID: To: Ted Lemon Cc: Brian Dickson , Jim Reid , "add@ietf.org" , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000e7c103058e719721" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 18:36:58 -0000 --000000000000e7c103058e719721 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 11:20 AM Ted Lemon wrote: > On Jul 24, 2019, at 2:10 PM, Eric Rescorla wrote: > > This also seems like an edge case. The vast majority of clients do not > have two independently controlled resolvers. > > > That sounds like a problem statement. > > But it=E2=80=99s really easy to configure two resolvers. Just put two I= P > addresses in the dialog box. The stub resolver, if it is following the > standard, will consult both, particularly when one fails. > What dialog box? The case of interest here is when the client gets its resolver via DHCP -Ekr --000000000000e7c103058e719721 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 11:20 AM Ted = Lemon <mellon@fugue.com> wrot= e:
On Jul 24, 2019, at 2:10 PM, Eric Rescorla <= ;ekr@rtfm.com> wro= te:
This also seems= like an edge case. The vast majority of clients do not have two independen= tly controlled resolvers.

That sound= s like a problem statement.

But it=E2=80=99s reall= y easy to configure two resolvers. =C2=A0 Just put two IP addresses in the = dialog box. =C2=A0 The stub resolver, if it is following the standard, will= consult both, particularly when one fails.=C2=A0
<= div>
What dialog box? The case of interest here is when the c= lient gets its resolver via DHCP

-Ekr

--000000000000e7c103058e719721-- From nobody Wed Jul 24 11:38:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 559B3120141 for ; Wed, 24 Jul 2019 11:38:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IqMG6terkJnV for ; Wed, 24 Jul 2019 11:38:04 -0700 (PDT) Received: from mail-lj1-x230.google.com (mail-lj1-x230.google.com [IPv6:2a00:1450:4864:20::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3AB36120316 for ; Wed, 24 Jul 2019 11:38:04 -0700 (PDT) Received: by mail-lj1-x230.google.com with SMTP id z28so45550801ljn.4 for ; Wed, 24 Jul 2019 11:38:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=UqOrDHla6q2FTzHDDmAyk0U/4nJw11SIPaxEH1nFt58=; b=j/MCu3Sb/q/+4LMko2F6fcfxrLYtTr+whx1Ab1t3woul5T+gH4vAxFEwhhpszXn1Fp +VT3L/W1QFiE2+sIQ/qoQrfz4oowqGG13q73Fadn85Lad68Wyi0uMtJCM2zAM+LcSSLd EPC8Rl27JSn+TQDq45F2FxllcotB5LLd0b9bGIsio1QsHEFZKaMaQDdyDGTGf8xtf+tL GPpa5DxRf8ti/3z7MAUBQRPD2TIe8bHaGyTzthPwLc+J+gZsSMs/am/BJgR8mjfZY0dw ZY7frKTiwE2w+Q/gPW19dbaQaMZN37yOWOKdy+RHhLkj/ekDKlcvixpqXfWF6/Yb3ZDF Q5Fg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=UqOrDHla6q2FTzHDDmAyk0U/4nJw11SIPaxEH1nFt58=; b=r0k2iAqFAxoKXq1c+iFlUhR2iGf/IBTPOpYYyVAVu4otUx7i7Wh5E6T2ze2FCAkAzH bbhPKODLxfbvlonrl2nfBcTXGJqI54nOGnPtNqdxj2t2p5o3aX8x/AgNkbK8wR0B/GqT hd9fVrLIRX1ZO2vvS+DJbASmLjQvlHiDZ6mGkyJRSuHoevd7ACc57UVeLbSEmOWF+And xMWtYtsIcxHfKiXjgccAr+wZHCL9UnDyh8+Vf1MaFYv8w/cCZ3lMTnRwdRs0qE8MSeX2 55a4rCVAqtm1BTRgfU6bqVyH4NLWyK0f0a9+BVhcplhoakPpLroH4bi/omHJ0BgwfPEJ 41ow== X-Gm-Message-State: APjAAAUrmYBaH/cP3B05bWllpmRMXFyqDrMFWNB7d4j+woSUt1Sw2MfB yznBqudnKI8xieBItqq00fosOzmP/zOBvve/OEU= X-Google-Smtp-Source: APXvYqw4yq+Fiq5nrfnRsFhzt81Rc/vBMbTslDdXmdd2QruSUTibbiXQPkIrTOaQc+3bT5RoHjpKo0JCQC1ns4A7d8A= X-Received: by 2002:a2e:9cd4:: with SMTP id g20mr21167635ljj.205.1563993482570; Wed, 24 Jul 2019 11:38:02 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <21062.1563992339@dooku.sandelman.ca> In-Reply-To: <21062.1563992339@dooku.sandelman.ca> From: Eric Rescorla Date: Wed, 24 Jul 2019 11:37:25 -0700 Message-ID: To: Michael Richardson Cc: "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000f5c552058e719b6c" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 18:38:06 -0000 --000000000000f5c552058e719b6c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 11:18 AM Michael Richardson wrote: > > Eric Rescorla wrote: > > In the case where A is not DNSSEC signed, the attacker just sends > > NXDOMAIN, > > which the client accepts and refuses to connect. > > > In the case where A *is* DNSSEC signed, the attacker can also injec= t > an > > NXDOMAIN. DNSSEC of course won't validate, but the client still > doesn't > > have an IP address to connect to, so it's only recourse is to error > > out. Now, it can show the user a different error than it did for > > NXDOMAIN, but these errors tend to be fairly generic anyway (Firefo= x, > > for instance, shows "Hmm. We=E2=80=99re having trouble finding tha= t site."), > > so from the user perspective these > > aren't really very different. > > This needs to be an on-path attacker who can not only inject a fake > NXDOMAIN, > but also suppress/delete the legitimate answers. > Yes. > This means it is the "coffee" shop that is doing the attack. > When the coffee shop is a soveign country, then there are many things tha= t > they can also do which DoH/DoT may or not help with. > Sure. When this is an off-path attacker, DNSSEC enables successful connections > (that HTTPS can validate) vs "Having trouble" dialogues. > Yes. However, DoH/TRR also prevents these attacks. -Ekr > > -- > ] Never tell me the odds! | ipv6 mesh > networks [ > ] Michael Richardson, Sandelman Software Works | network > architect [ > ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on > rails [ > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000f5c552058e719b6c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 11:18 AM Mich= ael Richardson <mcr+ietf@sand= elman.ca> wrote:

Eric Rescorla <ekr@rtf= m.com> wrote:
=C2=A0 =C2=A0 > In the case where A is not DNSSEC signed, the attacker j= ust sends
=C2=A0 =C2=A0 > NXDOMAIN,
=C2=A0 =C2=A0 > which the client accepts and refuses to connect.

=C2=A0 =C2=A0 > In the case where A *is* DNSSEC signed, the attacker can= also inject an
=C2=A0 =C2=A0 > NXDOMAIN. DNSSEC of course won't validate, but the c= lient still doesn't
=C2=A0 =C2=A0 > have an IP address to connect to, so it's only recou= rse is to error
=C2=A0 =C2=A0 > out. Now, it can show the user a different error than it= did for
=C2=A0 =C2=A0 > NXDOMAIN, but these errors tend to be fairly generic any= way (Firefox,
=C2=A0 =C2=A0 > for instance, shows "Hmm.=C2=A0 We=E2=80=99re havin= g trouble finding that site."),
=C2=A0 =C2=A0 > so from the user perspective these
=C2=A0 =C2=A0 > aren't really very different.

This needs to be an on-path attacker who can not only inject a fake NXDOMAI= N,
but also suppress/delete the legitimate answers.

<= /div>
Yes.

=C2=A0
This means it is the "coffee" shop that is doing the attack.
When the coffee shop is a soveign country, then there are many things that<= br> they can also do which DoH/DoT may or not help with.
<= br>
Sure.


When this is an off-path attacker, DNSSEC enables successful connections (that HTTPS can validate) vs "Having trouble" dialogues.

Yes. However, DoH/TRR also prevents these attac= ks.

-Ekr


<= div>=C2=A0

--
]=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Never tell me the o= dds!=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| ipv6 me= sh networks [
]=C2=A0 =C2=A0Michael Richardson, Sandelman Software Works=C2=A0 =C2=A0 =C2= =A0 =C2=A0 | network architect=C2=A0 [
]=C2=A0 =C2=A0 =C2=A0= mcr@sandelman.ca=C2=A0 http://www.sandelman.ca/=C2=A0 =C2=A0 =C2=A0 = =C2=A0 |=C2=A0 =C2=A0ruby on rails=C2=A0 =C2=A0 [


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000f5c552058e719b6c-- From nobody Wed Jul 24 11:38:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3DEF12017F for ; Wed, 24 Jul 2019 11:38:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9SZojJkMBZCM for ; Wed, 24 Jul 2019 11:38:52 -0700 (PDT) Received: from mail-qk1-x72d.google.com (mail-qk1-x72d.google.com [IPv6:2607:f8b0:4864:20::72d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB7AA1202A5 for ; Wed, 24 Jul 2019 11:38:52 -0700 (PDT) Received: by mail-qk1-x72d.google.com with SMTP id 201so34492775qkm.9 for ; Wed, 24 Jul 2019 11:38:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=OnOQg1GhcJnvxeTXb33CPDtd/D7O01xI7E6olhc6DO8=; b=DKtdRMa+SsOuzFR7vETCWKrIn47umTpzUIl6IsLvYj58Uilu1zzZVe5VZXjzNeMDb2 jAzSs3jorM1b/oK3WUBdBBPz+D7K4kawJs6pIlgMHZ2qHA+8IQSZEa4Vpn89BhqGHiBP tOpp6lQda0nqVMQ8NbAm1pszVelzkG9ywqJ6TDlK7UVfawsdnmf+ZYq4UQLgUehQjVT5 vIUIuZI2IF6GfyZ/tpKbhpasP2tx2RS/AS2kMS5iGF85S2+hwZ8UmIjhXbGafqz9gvuB QoQ+0kuzo1yejRYK7vx4rIhNcu0ZkRTdKK980FcpmegGFiHjLChibdLUNIvVo9Uq1DQ8 z+YA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=OnOQg1GhcJnvxeTXb33CPDtd/D7O01xI7E6olhc6DO8=; b=LVAW9xwgmPb2231NrqRwuG5k+A8YchV3A7H4T+GaOE1PZAXlJ/i4I9zwIimomVPEUS k7o4esN/X+xibDVJntZj/sfiKyFqXct0YRyDUox18dXDe6aj8RBXnWGJR1b1OZO4vDaD zIqne7A4tOaCqmywse85RFVPq9BsNaabmmZjjsCcIKxUdWDbXYXSCIYdfb25ZI9eRFFb F8nEvPfGpUWlga67fTgxKSeR2D0EsUmWsVn8kPaECjMARnkuQ1k1GXiIq41CJm6pZjZ1 pPANd01DJB5FPXpoEfqFFRf6IUqX5qzOPbL3aaUkBG4CEusqLPAVuXE9H3SAamWoFyQM YOjw== X-Gm-Message-State: APjAAAXJhmCgwO7T0cm+UsG6yMFqLS24vRjKsgSLisd2YT55v4JK0V8r t9dyfWM4+poPEcySx7tJXR1xPOHzEA8PsQ== X-Google-Smtp-Source: APXvYqzOcqiFPJ4Ah+K1+BmbIwhHadbHNZ4M0l6oFApnGqB0Zqy8sSyze9AZSeXRG+078+EXHT374g== X-Received: by 2002:ae9:e202:: with SMTP id c2mr51670002qkc.15.1563993531920; Wed, 24 Jul 2019 11:38:51 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:b45e:4ed5:44e0:bf73? ([2001:67c:370:128:b45e:4ed5:44e0:bf73]) by smtp.gmail.com with ESMTPSA id c14sm18690390qko.84.2019.07.24.11.38.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jul 2019 11:38:51 -0700 (PDT) From: Ted Lemon Message-Id: <13C0A5F6-3137-4EF2-A078-4BFA449D71B1@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_5AF3C164-0CD1-4D64-B9C9-994454283AA6" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 24 Jul 2019 14:38:49 -0400 In-Reply-To: Cc: Brian Dickson , Jim Reid , "add@ietf.org" , Rob Sayre To: Eric Rescorla References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 18:38:55 -0000 --Apple-Mail=_5AF3C164-0CD1-4D64-B9C9-994454283AA6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Jul 24, 2019, at 2:36 PM, Eric Rescorla wrote: > What dialog box? The case of interest here is when the client gets its = resolver via DHCP I must have missed something. When was it stated that we were only = considering this use case? That said, if an ISP offers 8.8.8.8 and 1.1.1.1 as resolvers, and one is = compromised while the other is not, DNSSEC validation will definitely = detect this situation and mitigate it. --Apple-Mail=_5AF3C164-0CD1-4D64-B9C9-994454283AA6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On = Jul 24, 2019, at 2:36 PM, Eric Rescorla <ekr@rtfm.com> = wrote:
What = dialog box? The case of interest here is when the client gets its = resolver via DHCP

I = must have missed something.   When was it stated that we were only = considering this use case?

That = said, if an ISP offers 8.8.8.8 and 1.1.1.1 as resolvers, and one is = compromised while the other is not, DNSSEC validation will definitely = detect this situation and mitigate it.


= --Apple-Mail=_5AF3C164-0CD1-4D64-B9C9-994454283AA6-- From nobody Wed Jul 24 11:41:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E0C6C120338 for ; Wed, 24 Jul 2019 11:41:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.244 X-Spam-Level: X-Spam-Status: No, score=-0.244 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_IMAGE_ONLY_08=1.651, HTML_IMAGE_RATIO_02=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pvoP1or00Om0 for ; Wed, 24 Jul 2019 11:41:47 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83DDC12017F for ; Wed, 24 Jul 2019 11:41:46 -0700 (PDT) Received: from dhcp-8a04.meeting.ietf.org (dhcp-8a04.meeting.ietf.org [31.133.138.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 679282421249; Wed, 24 Jul 2019 18:41:42 +0000 (UTC) From: Jim Reid Message-Id: <22BC5D05-4826-498C-A9B1-178FD7B9929F@rfc1035.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_C3795927-3724-468D-92C1-E4F319F07D0C" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Wed, 24 Jul 2019 19:41:40 +0100 In-Reply-To: Cc: "add@ietf.org" To: Eric Rescorla References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 18:41:49 -0000 --Apple-Mail=_C3795927-3724-468D-92C1-E4F319F07D0C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On 24 Jul 2019, at 19:36, Eric Rescorla wrote: >=20 > What dialog box? This one (MacOSX). I understand similar functionality is available on = other platforms. --Apple-Mail=_C3795927-3724-468D-92C1-E4F319F07D0C Content-Type: multipart/related; type="text/html"; boundary="Apple-Mail=_8E4423B4-93F8-4DC4-AE29-7FA54CA402A8" --Apple-Mail=_8E4423B4-93F8-4DC4-AE29-7FA54CA402A8 Content-Transfer-Encoding: 7bit Content-Type: text/html; charset=us-ascii

On 24 Jul 2019, at 19:36, Eric Rescorla <ekr@rtfm.com> wrote:

What dialog box?

This one (MacOSX). I understand similar functionality is available on other platforms.

--Apple-Mail=_8E4423B4-93F8-4DC4-AE29-7FA54CA402A8 Content-Transfer-Encoding: base64 Content-Disposition: inline; filename=resolver.png Content-Type: image/png; x-unix-mode=0644; name="resolver.png" Content-Id: iVBORw0KGgoAAAANSUhEUgAABRYAAAP0CAYAAADfh2BtAAAMKGlDQ1BJQ0MgUHJvZmlsZQAASImV VwdYU8kWnluSkJDQAqFICb2JUqRLDS2CgFTBRkgCCSWGhKBiRxcVXAsqIliRVREF1wKIqIi9LIq9 PxRRUdZFXWyovEkC6Or33vve+b65979nzpzzn3Nn5psBQD2aIxZnoRoAZItyJTGhgcyJSclMUifA gSqgAR1gwuFKxQHR0REAytD7n/LuJkDk72sOcl8/9/9X0eTxpVwAkGiIU3lSbjbEBwHA3bhiSS4A hB6oN5+RK4aYCFkCbQkkCLGFHKcrsYccpypxhMImLoYFcQoAKlQOR5IOgJqcFzOPmw79qC2H2FHE E4ogbobYlyvg8CD+DPHI7OzpEKvbQGyT+p2f9H/4TB32yeGkD2NlLgpRCRJKxVmcWf9nOf63ZGfJ hmKYw0YVSMJi5DnL65Y5PVyOqRCfE6VGRkGsBfF1IU9hL8dPBbKw+EH7D1wpC9YMMABAqTxOUDjE hhCbibIiIwb1vmnCEDbEsPZonDCXHacci/Ik02MG/aMz+dLg2CHMkShiyW2KZJnxAYM+Nwv47CGf TfmCuEQlT/RKnjAhEmI1iO9LM2PDB21e5AtYkUM2ElmMnDP85xhIk4TEKG0wi2zpUF6Yl0DIjhzE EbmCuDDlWGwql6PgpgdxBl86MWKIJ48fFKzMCyvgi+IH+WMl4tzAmEH7KnFW9KA91szPCpXrzSBu k+bFDo3tzYWTTZkvDsS50XFKbrh2BmdctJIDbgciAAsEASaQwZYKpoMMIGzraeiBX8qeEMABEpAO +MBhUDM0IlHRI4LPWJAP/oSID6TD4wIVvXyQB/VfhrXKpwNIU/TmKUZkgqcQZ4NwkAW/ZYpRouFo CeAJ1Ah/is6FXLNgk/f9pGOqD+mIwcQgYhgxhGiLG+C+uDceAZ/+sDnjHrjnEK9v9oSnhHbCY8IN QgfhzjRhgeQH5kwwHnRAjiGD2aV+nx1uBb264oG4D/QPfeMM3AA44GNgpADcD8Z2hdrvucqGM/5W y0FfZEcyStYl+5NtfmSgZqfmOuxFXqnva6HklTpcLdZwz495sL6rHw++w3+0xJZiB7Cz2AnsPNaM NQAmdhxrxC5hR+V4eG48UcyNoWgxCj6Z0I/wp3icwZjyqkkdaxy7HT8P9oFc/sxc+WJhTRfPkgjT BbnMALhb85lsEXfUSKazo5MnAPK9X7m1vGUo9nSEceGbblEOAD5bBgYGjnzTRagDcBCuHUrnN511 AlzOUH9uJVcmyVPqcPmDAChAHa4UfWAM9y4bmJEzcAPewB8Eg3EgCsSBJDAV1lkA56kEzABzwEJQ CIrBKrAOlIMtYDvYBfaC/aABNIMT4Ay4CK6AG+AenCtd4CXoBe9AP4IgJISG0BF9xASxROwRZ8QD 8UWCkQgkBklCUpB0RITIkDnIIqQYKUHKkW1INfI7chg5gZxH2pE7yCOkG3mDfEIxlIpqo0aoFToa 9UAD0HA0Dp2CpqM5aD66GF2BlqGV6B60Hj2BXkRvoB3oS7QPA5gqxsBMMQfMA2NhUVgyloZJsHlY EVaKVWK1WBP809ewDqwH+4gTcTrOxB3gfA3D43EunoPPw5fj5fguvB4/hV/DH+G9+FcCjWBIsCd4 EdiEiYR0wgxCIaGUsINwiHAarp0uwjsikcggWhPd4dpLImYQZxOXEzcR64gtxHZiJ7GPRCLpk+xJ PqQoEoeUSyokbSDtIR0nXSV1kT6oqKqYqDirhKgkq4hUClRKVXarHFO5qvJMpZ+sQbYke5GjyDzy LPJKchW5iXyZ3EXup2hSrCk+lDhKBmUhpYxSSzlNuU95q6qqaqbqqTpBVai6QLVMdZ/qOdVHqh+p WlQ7Kos6mSqjrqDupLZQ71Df0mg0K5o/LZmWS1tBq6adpD2kfVCjq41SY6vx1OarVajVq11Ve6VO VrdUD1Cfqp6vXqp+QP2yeo8GWcNKg6XB0ZinUaFxWOOWRp8mXdNJM0ozW3O55m7N85rPtUhaVlrB WjytxVrbtU5qddIxujmdRefSF9Gr6KfpXdpEbWtttnaGdrH2Xu027V4dLZ0xOgk6M3UqdI7qdDAw hhWDzchirGTsZ9xkfNI10g3Q5esu063Vvar7Xm+Enr8eX69Ir07vht4nfaZ+sH6m/mr9Bv0HBriB ncEEgxkGmw1OG/SM0B7hPYI7omjE/hF3DVFDO8MYw9mG2w0vGfYZGRuFGomNNhidNOoxZhj7G2cY rzU+ZtxtQjfxNRGarDU5bvKCqcMMYGYxy5inmL2mhqZhpjLTbaZtpv1m1mbxZgVmdWYPzCnmHuZp 5mvNW817LUwsxlvMsaixuGtJtvSwFFiutzxr+d7K2irRaolVg9Vzaz1rtnW+dY31fRuajZ9Njk2l zXVboq2HbabtJtsrdqidq53ArsLusj1q72YvtN9k3z6SMNJzpGhk5chbDlSHAIc8hxqHR6MYoyJG FYxqGPVqtMXo5NGrR58d/dXR1THLscrxnpOW0zinAqcmpzfOds5c5wrn6y40lxCX+S6NLq/H2I/h j9k85rYr3XW86xLXVtcvbu5uErdat253C/cU943utzy0PaI9lnuc8yR4BnrO92z2/Ojl5pXrtd/r L28H70zv3d7Px1qP5Y+tGtvpY+bD8dnm0+HL9E3x3erb4Wfqx/Gr9Hvsb+7P89/h/yzANiAjYE/A q0DHQEngocD3LC/WXFZLEBYUGlQU1BasFRwfXB78MMQsJD2kJqQ31DV0dmhLGCEsPGx12C22EZvL rmb3jnMfN3fcqXBqeGx4efjjCLsISUTTeHT8uPFrxt+PtIwURTZEgSh21JqoB9HW0TnRRyYQJ0RP qJjwNMYpZk7M2Vh67LTY3bHv4gLjVsbdi7eJl8W3JqgnTE6oTnifGJRYktgxcfTEuRMvJhkkCZMa k0nJCck7kvsmBU9aN6lrsuvkwsk3p1hPmTnl/FSDqVlTj05Tn8aZdiCFkJKYsjvlMyeKU8npS2Wn bkzt5bK467kvef68tbxuvg+/hP8szSetJO15uk/6mvRugZ+gVNAjZAnLha8zwjK2ZLzPjMrcmTmQ lZhVl62SnZJ9WKQlyhSdmm48feb0drG9uFDckeOVsy6nVxIu2SFFpFOkjbna8JB9SWYj+0X2KM83 ryLvw4yEGQdmas4Uzbw0y27WslnP8kPyf5uNz+bObp1jOmfhnEdzA+Zum4fMS53XOt98/uL5XQtC F+xaSFmYufCPAseCkoK/FyUualpstHjB4s5fQn+pKVQrlBTeWuK9ZMtSfKlwadsyl2Ubln0t4hVd KHYsLi3+vJy7/MKvTr+W/TqwIm1F20q3lZtXEVeJVt1c7bd6V4lmSX5J55rxa+rXMtcWrf173bR1 50vHlG5ZT1kvW99RFlHWuMFiw6oNn8sF5TcqAivqNhpuXLbx/Sbepqub/TfXbjHaUrzl01bh1tvb QrfVV1pVlm4nbs/b/rQqoersbx6/Ve8w2FG848tO0c6OXTG7TlW7V1fvNty9sgatkdV075m858re oL2NtQ612+oYdcX7wD7Zvhe/p/x+c3/4/tYDHgdqD1oe3HiIfqioHqmfVd/bIGjoaExqbD887nBr k3fToSOjjuxsNm2uOKpzdOUxyrHFxwaO5x/vaxG39JxIP9HZOq313smJJ6+fmnCq7XT46XNnQs6c PBtw9vg5n3PN573OH77gcaHhotvF+kuulw794frHoTa3tvrL7pcbr3heaWof237sqt/VE9eCrp25 zr5+8Ubkjfab8Tdv35p8q+M27/bzO1l3Xt/Nu9t/b8F9wv2iBxoPSh8aPqz8l+2/6jrcOo4+Cnp0 6XHs43ud3M6XT6RPPnctfkp7WvrM5Fn1c+fnzd0h3VdeTHrR9VL8sr+n8E/NPze+snl18C//vy71 Tuztei15PfBm+Vv9tzv/HvN3a19038N32e/63xd90P+w66PHx7OfEj8965/xmfS57Ivtl6av4V/v D2QPDIg5Eo7iKIDBhqalAfBmJwC0JADoV+D5YZLybqYQRHmfVCDwn7Dy/qYQNwBq4Ut+DGe1ALAP Nit/6Bs2+RE8zh+gLi7DbVCkaS7OSl9UeGMhfBgYeGsEAKkJgC+SgYH+TQMDX6og2TsAtOQo74Ry kd9BtzrK0VWTA+BH+TeUCm/GyZOlwgAAAAlwSFlzAAAWJQAAFiUBSVIk8AAAAWJpVFh0WE1MOmNv bS5hZG9iZS54bXAAAAAAADx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1w dGs9IlhNUCBDb3JlIDUuNC4wIj4KICAgPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3Lncz Lm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KICAgICAgPHJkZjpEZXNjcmlwdGlvbiBy ZGY6YWJvdXQ9IiIKICAgICAgICAgICAgeG1sbnM6ZXhpZj0iaHR0cDovL25zLmFkb2JlLmNvbS9l eGlmLzEuMC8iPgogICAgICAgICA8ZXhpZjpVc2VyQ29tbWVudD5TY3JlZW5zaG90PC9leGlmOlVz ZXJDb21tZW50PgogICAgICA8L3JkZjpEZXNjcmlwdGlvbj4KICAgPC9yZGY6UkRGPgo8L3g6eG1w bWV0YT4KbszeLgAAQABJREFUeAHs3Q9AFGX+P/A38m9RQUHFQgsMLDVdDeowDQ201DrFTLMU7zS/ gfkr/9xVRndyHd030uz8U9dX7Tz9nuj3ujwTzdRKOPFPkmknmJJKSiklKggoLLDA75nZndld2EWW f+7Ce2pldv488zyvmZ2d+ewzz+NSWlpaAw4UoAAFKEABClCAAhSgAAUoQAEKUIACFKAABewQ6GDH slyUAhSgAAUoQAEKUIACFKAABShAAQpQgAIUoIAswMAiDwQKUIACFKAABShAAQpQgAIUoAAFKEAB ClDAbgEGFu0m4woUoAAFKEABClCAAhSgAAUoQAEKUIACFKAAA4s8BihAAQpQgAIUoAAFKEABClCA AhSgAAUoQAG7BRhYtJuMK1CAAhSgAAUoQAEKUIACFKAABShAAQpQgAIMLPIYoAAFKEABClCAAhSg AAUoQAEKUIACFKAABewWYGDRbjKuQAEKUIACFKAABShAAQpQgAIUoAAFKEABCjCwyGOAAhSgAAUo QAEKUIACFKAABShAAQpQgAIUsFuAgUW7ybgCBShAAQpQgAIUoAAFKEABClCAAhSgAAUowMAijwEK UIACFKAABShAAQpQgAIUoAAFKEABClDAbgEGFu0m4woUoAAFKEABClCAAhSgAAUoQAEKUIACFKAA A4s8BihAAQpQgAIUoAAFKEABClCAAhSgAAUoQAG7BRhYtJuMK1CAAhSgAAUoQAEKUIACFKAABShA AQpQgAIMLPIYoAAFKEABClCAAhSgAAUoQAEKUIACFKAABewWYGDRbjKuQAEKUIACFKAABShAAQpQ gAIUoAAFKEABCjCwyGOAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUsFuAgUW7ybgCBShAAQpQgAIU oAAFKEABClCAAhSgAAUowMAijwEKUIACFKAABShAAQpQgAIUoAAFKEABClDAbgEGFu0m4woUoAAF KEABClCAAhSgAAUoQAEKUIACFKAAA4s8BihAAQpQgAIUoAAFKEABClCAAhSgAAUoQAG7BRhYtJuM K1CAAhSgAAUoQAEKUIACFKAABShAAQpQgAIMLPIYoAAFKEABClCAAhSgAAUoQAEKUIACFKAABewW YGDRbjKuQAEKUIACFKAABShAAQpQgAIUoAAFKEABCjCwyGOAAhSgAAUoQAEKUIACFKAABShAAQpQ gAIUsFuAgUW7ybgCBShAAQpQgAIUoAAFKEABClCAAhSgAAUowMAijwEKUIACFKAABShAAQpQgAIU oAAFKEABClDAbgEGFu0m4woUoAAFKEABClCAAhSgAAUoQAEKUIACFKAAA4s8BihAAQpQgAIUoAAF KEABClCAAhSgAAUoQAG7BRhYtJuMK1CAAhSgAAUoQAEKUIACFKAABShAAQpQgAIMLPIYoAAFKEAB ClCAAhSgAAUoQAEKUIACFKAABewWYGDRbjKuQAEKUIACFKAABShAAQpQgAIUoAAFKEABCjCwyGOA AhSgAAUoQAEKUIACFKAABShAAQpQgAIUsFuAgUW7ybgCBShAAQpQgAIUoAAFKEABClCAAhSgAAUo wMAijwEKUIACFKAABShAAQpQgAIUoAAFKEABClDAbgEGFu0m4woUoAAFKEABClCAAhSgAAUoQAEK UIACFKAAA4s8BihAAQpQgAIUoAAFKEABClCAAhSgAAUoQAG7BRhYtJuMK1CAAhSgAAUoQAEKUIAC FKAABShAAQpQgAIMLPIYoAAFKEABClCAAhSgAAUoQAEKUIACFKAABewWYGDRbjKuQAEKUIACFKAA BShAAQpQgAIUoAAFKEABCjCwyGOAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUsFuAgUW7ybgCBShA AQpQgAIUoAAFKEABClCAAhSgAAUo4NZeCaqqa3D+SjkuXKvETyXVuFpWhYKyGpTqXVBaWYPKaqBC vKTBQ4Rf3cWro9Dq6A74ebmgm5crbvfugN5d3RHU3ROuHVwMC/NfClCAAhSgAAUoQAEKUIACFKAA BShAAQq0AwGX0tLSmnZQTkiBxLOXdDj+UwVOF1Th4nVRbHc3uHu4wU38dXN3haubeLl2QAdXF7i4 GF6STU1NjfyqrqpBVVU1qvRV0FdKLz0qK/SA+HuHtwv6+rlCe5sHQnpqGGhsDwcVy0gBClCAAhSg AAUoQAEKUIACFKAABdqxQJsOLIp4IE7+VIaMXBFQzK9GhZs7NB09oPHyhLunmxw8tLXvpaBhlV4E DcXg6mYIPtpaVgo8Vuj0KNeVQ1daAQ99JQb7d0B4oAYDbvcS27G1JqdTgAIUoAAFKEABClCAAhSg AAUoQAEKUMA5BdpkYLG0vAp7vyvBgR+rUeLiBq/OXvDq5ClqIpqalJSCgYU/X8G1S5dRUlCIG9eK UFZcjPLSMlRVlMPDrQM8RE1GaagQQcYKfTVcPTzh2VGk5eODTl27wNvPF1179oDvbd0tgpTVolZj 2Y1ylF0vg3eNHhF3umLUPd7wkp6p5kABClCAAhSgAAUoQAEKUIACFKAABShAgTYg0KYCi8WincSd 317HgQt6uIpgYiefTvIjzsp+ul5YhAvZObjy44+4fuUKAv074+47/BB0e1cE3uaNO3t2gb9vZ3Tp 7Ak3syCktL5eBAuLrpcjv/A6cn8uwg+XSnD+p2s4/WMBcvOvo3OPHujeuzd69wtGZ98uyiblR6Zv FN+AXgQZI3q74fF7O8NHtM/IgQIUoAAFKEABClCAAhSgAAUoQAEKUIACzizQJgKL5aKnlU9OFGFv bjXcvTuhc5dOcDF2plIhHk8+f/wk8s6cgbdLBR4ecgceHHQH7rv7NniLx6KbYygRjz8f++5nHD7x I9K++QHXoUFA3xAEDR4AD42nvIka0cbj9aIbqCy5gVGBrvjlQB94Sj3CcKAABShAAQpQgAIUoAAF KEABClCAAhSggBMKOH1g8cuc6/jo23JUajqKgGJH9XHnkoIinPn6GG7k/YDHftEHjw0PwaC7erZ4 e4dSu46ZOZfw6ZdnsSvjHDoF3Im+D4TC21iLUXpM+npRKdx1pZhyryceDO7shIcNs0wBClCAAhSg AAUoQAEKUIACFKAABSjQ3gWcNrBYeL0CfztyHWdKPdDJ2wueXobah0WXr+LMkWNwLbmMX40ZiCdG 3AON6KjlVgy6cj227svGxs++RZVPDxFgvB9duvvKWSkvq8CNkjLc3bECsx7oDN/OzVN78laUk9uk AAUoQAEKUIACFKAABShAAQpQgAIUaH8CThlYzPzxBj44qkNNx07w7tpJ3msV5RX47suv0OHqBTz7 uBaPD+sLd9EBiyMMlaLjl08Onsbfdmahpntv9HvwF6JXakMgseTaDbiU3sBzYRpo7zCUxRHyzDxQ gAIUoAAFKEABClCAAhSgAAUoQAEKUKA+AacKLFaL54z/9U0RPj1bBZ/uXeSenqXC/XDyNH785gh+ /Ug//Hqc1mECirXhpQDjhk+P4+97T+OOIffjzgF3y4tIPUgXXynCYyGuePK+Lujg4lJ7Vb6nAAUo QAEKUIACFKAABShAAQpQgAIUoIBDCThNYLGsogqr0q/hXLlG7pylg+i1WXejDCf3H8C9XauwaMaD COju7VC4tjJz8XIxliZ/iZPFHhgQ8ZB4jNsThrYXbyDIU4d5EV3R0ZM9R9vy43QKUIACFKAABShA AQpQgAIUoAAFKECBWy/gFIHFolI9lv37Gq5AdNDS1dDZydWLP+P7Q/uxcNJAREfcc+slG5GDLWmn 8O6OkwgZPgJ+t/eUU7h+7Tq6VpfityN80N2H7S42gpWrUIACFKAABShAAQpQgAIUoAAFKEABCrSC gMMHFi8X6bB03w2UuHZEpy6GNgh/+PYkqn44haXPj0RIb79mYyq8UYn8Yj1uVFSjVLzKKoFq0cuz u2sNOnm4oqtXB/j7uMG3k3uzbTM79wpeXZMO98ABuPPeAXK6pcU34Fl+A69GdsZtXTXNtq0WT0iv g07vBo3m1nSWI5fPEfLQ4tDcAAUoQAEKUIACFKAABShAAQpQgAIUuPUCDh9YnLv8C5T2GiJq9PlD NLGIs19/jbvdC/DGcyPRUdP4AF+FaO/wxMUyfPtzJb4vqMLF6zXQVXWAq5srXDq4wEW0c+jSoQOk 1g5rxIZrRISxuroaVfoqaFyr0auzC+7yc8W9t7ljYC8veDSho5jroofoP/w1HWf03RAcFia2DRT8 lA+vC//B//xm9K0/ShqQg+unP0bUkOk4IZYdv+wLfDh3WAPWat5FHCEPzVsipkYBClCAAhSgAAUo QAEKUIACFKAABRxXwOEDiz9fLUHsO6nwG/IQ8r8/i4fvqMZvnxkKVxH8s3eoEsHB//xQigPnypGZ X41qVw94aDzg5uEON3c3OaDYkDSlIKO+Ug99RSUqdBXoUFWBwT074KE+nhh8R8dG523Z5i+x76Ib /PsEo/D4Aaz9bRR6+jWx3Uj9d/jD+BnYJRUsIA57/vosfK12DvMTlk+Nxv8VAyeuhuPQ3ncxxMqm a2r02LtkOiZsPScWHISduasR2cMd/3l/Koa9tMPINxvfFLyLexpR2bKmpgT/fHEK3vnKBX5+IpJc z1BQkI7weUfwbsy98lLNlYd6NslZFKAABShAAQpQgAIUoAAFKEABClCAAkaBW/jMasP2wW3dvLH6 N1F4bukejH/wLjz/RGjDVjRbqkw81rzn22J8lqNHKTyg6dgZnfw95VqJZotBd/0GrhcUQFd6HVUV FagUL6mapKubG9w8PaHp1BlePl3QqWtXQzBSBCQ1nTvKNRpPlpbj2Fc6dDpyFY8Eu2HMvT7w8uhg nny941KgdFHMMHhvPYqdh9PwwStjmh5UlLbo5gPN1RM4IVUlxBacXDYbw32lcctB/+Mx/G6HvJCY cQJp2QkY8kAPy4Xkd7n4PFEJIA6Cr7HWaLfbA03LDuwPf08pKGh/8FdK5PrldGN+TUnaGvMrEvvI ODRnHpQ0+ZcCFKAABShAAQpQgAIUoAAFKEABClDAuoDDBxalbEu9Pf/fH8bDp5On9VLYmKqvqsa2 /xRj99lK1Hh0gqcICnqLR52lQXqs+trPP6Pg4o8ouvQzbhRcRteObgi6vSt6+4pOYrw90MnLHR1E 7b7yyjIUXb+GS3nfI+94CX6+JgKIfj3Q5bbb4NfrTnTx7wl3jUZ+SY9K7zhfhp3fXcWYEHdMvM8H bqIH64YOcyeFIWbMQLvLajv92zH6mfF443dSMHAfvjp7DcMf6Fpn8R++3mcxbc8Xp7HQSmCx6kI2 3lWWfGYM+hlrNfaeuBgHd45Dkd4Ft4vapdZrRSor1v/XtJcHYvYrj8FP2llWBp2uALf16aLOac48 qIlyhAIUoAAFKEABClCAAhSgAAUoQAEKUMCqgFMEFqWc2xtU/Ca3FBuOlqEYXvDy7YoOxuBeWcl1 5GWfwJXzObirhwaj7g3A/Y9oMaRvT3h3bFgvzFKbiN+cvoQjp/KQ8e1+ZOwrR/egYAT0GyhqMEq1 GjujusoLO38ow4EfCvHrMC/cF9jR6g6wNtHeslpLw3xa38iR4q2hluGe/VLA8Bfms8W4Dl9/8p7F tPSP9+On+OG43WIq8FPmV+qU2eMfgPK0s4uLN+6LjFTnNcvI+Hl4+/UYdRs3S7NF8nCzjXI+BShA AQpQgAIUoAAFKEABClCAAhRopwJOE1hs6P7RVVbjrweLkHHJFZ5ePujoZaj/Jj3i/EPmMbiWXMIT I+7GL2c+hjt7mmq7NTR9abnOXh6IGHyH/JLe/3CpCJ8cPIutaSmo9u6JO7Vh4nFpX3T07ozrZe74 8+EyhJ8rxLMPivx4GmpMSuu11tA1eBjGi41JocX0z79G4cIHLGsU6s5iz/+JmQPFS30aeiuO/fQS Hr/ddIhI7St+ly631igWBKLC7pD/Gv7R4fIP+SgTb7z8AtCjs2k9s4XsGy0uR5moraix2iaktaRa IA/WNsNpFKAABShAAQpQgAIUoAAFKEABClCAAmj4M7pOgPXj1XK8tqMAR654orNoB9FdtIsoda5y 9quDuPLVZ5j3SC98umwqpMeNGxtUtMYgpSWl+enbT8nbuPzVHnmb0ralPEh5kfIUv+Macq+UW0ui RafVdA7GeCmyKA379uHsDcu2D6/nHIYUV5SCiiN+OUIaE8MJ7Dv2k2HU+K+LSx72v6tEHl9G2B1m wcPrWfhVv37oJ16Pf6AsY7F6o96YbeHm67dQHm6+YS5BAQpQgAIUoAAFKEABClCAAhSgAAXan0Cb CSwe+f46frerBAXoLB5H7oRqUdMtP/d7nPr8X3hyoAYfJ03GxBH3wN2t5Yrs4e4qb+PjN5+Utylt +/IP5+W8SHkqcu2MxbtL8E3ujVY90qRHhH8xfrZxmztwRLSzaD6c3fe58e1ILEpKwovGd+/tPioe kjYb8r4z9C4tJg18OQp3ms0S3WojwPi+j6dl4NJ8sRYdd4Q8tGgBmTgFKEABClCAAhSgAAUoQAEK UIACFHAcgZaLsrViGVNPFuGddB1cO3eBh8YLVZVVOHf0S/gVnsQ/fj8OsdH3tWhAsXZRpQCjtE1p 2z6XM3H+2Feo0lfDw1ODDp18sPTfOqRnF9derUXf3znsITX9fYdy1fGamss4tMPQ/iIGPor77xqC kUoMct1e5JpFFn/69oD6pPSkqHvUNFpsxMcT7g1+DLrFcsGEKUABClCAAhSgAAUoQAEKUIACFKAA BawI2PWkqZX1b/mk4hvleGvDv9Hjvii4unug7EYpzh1OxbThtyFu4ji4drhFteeETG9/H6xd9Bj+ 8q+v8VHap+gzNAqeHTui0qMcb25Iw30JYxvcYUxToT3vuF+uiSj16Lxjn2hn8Xmt3M6iy5UT4r0h 9fEzH4K3COTdN+FlYN3bYuI6fJWThHvu7SwvcPqA0r7iSIRrbzOs1JL/ioBn8sed0K2iAhXWtuNx Bx6b+KCcZ2uzOY0CFKAABShAAQpQgAIUoAAFKEABClCg5QScPrAo9aC84vlhePEvqeiujcCl4/vx p+lD8HBoYMup2ZGym+iNev5Tv8DgkFy8vukz9BR5vJKVjvdeGN5qQUU5u26BGPniQLwrtZG44zPk Xp8NX2/g55MZMMYV8cjI/vKitw95GCPxtjz9k8M5mHHvYDH9JxzaZWw7ceR4DOlaI6a1dNB2B+ZN N9amlHNW+5+R2Je/Cw8Y4p61Z/I9BShAAQpQgAIUoAAFKEABClCAAhSgQAsKtIlHoQf06YFVcx9E 8fHPsfL5oQ4TVDTfb1KgU8pbcebneHfucPQP6mE+u8XHXVzccN/occbt7MDXOdfl8ROpW43TZiPi HkOErqb7EIwfaZi8Y8tBFIr2KnH5BD42xhXHjx9u2au0MQVrf3SnP0RHUUuzvteLyd9aW7UB0wLg 5fSh8QYUk4tQgAIUoAAFKEABClCAAhSgAAUoQAEHFGgzYZl77/LH9iVTGt2WYklZFbIulOH7K1XI K6pCka4aZZWGPeblDnTRdEBAF1fc1d0V2ju80FnjavfuHBzSEzuWToFUi/FWDLcPeQgDRU1EKT74 +dFc/NcQb3z+tjFa+OI4BLsaaiG6uPhi5ORnRA/Soq/ofTtEL9JzcffZo2r7io8MC25w9vWlV2+6 7Jl8G53ZjFyG3E+fh29VlZU09GKaJ9zazBFspYicRAEKUIACFKAABShAAQpQgAIUoAAFHFigTYVl 7O3xubyyGv/OvoF9Z8uRfbkarh6e6CAiVR1cRScrUtuMLsYAYHk1qstqcPSKHtXf6VFVcRX9/Ttg ZIgnRt7TCZ7uDQ8U3qqgonQMSjURnxkI/E7EEnccOoMrj7pDanNRGl4efR/czDpKCX7oYTFVBBbF A9EHTv2Emi//Lcal4RkM7dfwZ49d/fpj8cuLoemqMaxe69/y8nLcE3VXranGt6LzFmktN6vRwzZ1 6FovP6dSgAIUoAAFKEABClCAAhSgAAUoQAEHFmiX0Rl9VTU+PlqMHScrUSpCV+4aH3Tq5lHvbjKE Dj3VZb7XVeC7r8uR/PVVRN/rjuhQn1tWE1HN1E1GXFx6YPjTI4DfpwNZe5GiNl84Eg8Pud1ibc+7 RLuVYooUeDz8yafQZYt1pOGZMQixHiM0zK/1r9edkYj/Y2StqQ1827odZzcwU1yMAhSgAAUoQAEK UIACFKAABShAAQpQQBJod4HFzB9u4P39pbhS6QUPL294djA80lwlgo0l+Rdw4/JFlF+/hsqyElRX SY/bQtRgdIO7tGznrujUoxe8/XuLaR7w7OSByqqO+L9vy/DFmat4/qGO0N7ZSV7HUf+5O2KCyJoI Ep5YhxdfMuZS6oyle63OWERnL48YO3vZ8faLUGKQs8c8INcidNTyMV8UoAAFKEABClCAAhSgAAUo QAEKUIACrSPQbgKLUv8jmw9fw0f/qYB75y4iUOgJKZRWXlKMq98fR9nlXAy+yw/3h96OkN79cYe/ N7w8ReOKYigrr8SP+SU4e6EQX2efwPG96fDqEYhudw2GRycfkVZnXKlwR8LOIkwZUolpQ7vC7Kli OQ1H+adrv2EYLzKjBAqlfI2fPLJOZyxSZy9DHpskqiwa22A0FiDqwTuMY/xDAQpQgAIUoAAFKEAB ClCAAhSgAAUo0J4F2kVgUXr0+Z09hcj4yROeXXxE04kdoK+owJUzR+FekovZjw7A48OehF8XL5vH Qt87uiEqLAix0fehoKgMOw6exqbPP0WldyC69w2Dq7ton7FLd/zrZCkuXruK3zzq65CPRtd0DsZ4 EVncYRZZnBRhvTOW7toIjBQi+1SVlxF2R7s4ZNQSc4QCFKAABShAAQpQgAIUoAAFKEABClDAuoCh 6UDr89rM1JPnL+OTvYdFQFEKinXAjas/46cj2/FMmAY7334KM8Zp6w0q1oaQApC/fmwwPhE9PE8N 9ZTTktKU0pa2seOLwzh17nLt1RzivYuLN34xfrZZXl7E/X1MbUeazUBNVy0mS9UbjcPAlyNwp/Km 9l/Rg/b12tMa+b7cbD3Dw+hmE+obbcY81LcZzqMABShAAQpQgAIUoAAFKEABClCAAhSQImHtYNAG 98SfYgbi8rdpKMr7Hu55h7HhlSi59qG9PUmbc3m4u2LOxFA5LSnNop++l7fx3zMGYVBIT/NFHWr8 zmEPqfkZsXgcgt1FD9hWBikIGfGkKQg5aewQK0sZJ3l5Icg42tmnabUaPZVOp0PE4+j2PFPejHmw XVDOoQAFKEABClCAAhSgAAUoQAEKUIACFJAEXEpLS6WmBtvF8MWR7/Hh3lN458XR8OlkvZZeYyGK b5Rj4arPMe2RezHq/j6NTYbrUYACFKAABShAAQpQgAIUoAAFKEABClDAKQTaVWDRKfYIM0kBClCA AhSgAAUoQAEKUIACFKAABShAAScQaBePQjvBfmAWKUABClCAAhSgAAUoQAEKUIACFKAABSjgVAIM LDrV7mJmKUABClCAAhSgAAUoQAEKUIACFKAABSjgGAJN62XDMcrQ7LmorqnBxYJK5BeLbobF4O/j jt5+HrCnH5FmzxQTpAAFKEABClCAAhSgAAUoQAEKUIACFKCAAwkwsGi2M8orq7HlSBE+ydLjmk5U 5uzgaphbrUNXTTV+OcgNkx/oAk93VvQ0Y+MoBShAAQpQgAIUoAAFKEABClCAAhSgQDsUYOctxp1+ /lIJ/viJDj+XaeDm6SX6y64VPKyphr68DLd56fCHX2oQ1NO7HR4uLDIFKEABClCAAhSgAAUoQAEK UIACFKAABQwCtaJn7Zfl65MX8N2pTHRw16AGHSCehrZ8iWnSPGmZY6cutl8olpwCFKAABShAAQpQ gAIUoAAFKEABClCAAkKAgUXjYTA5sj/+3yP+KDz7Jar1VRAVFC1e0rTCM/vx/x7tiUkP9+PBQwEK UIACFKAABShAAQpQgAIUoAAFKECBdi3AwKLZ7p8+ZhCeH9UVRecyRFBRBBeNtRarq6pw7fvDeH50 d0x/dKDZGhylAAUoQAEKUIACFKAABShAAQpQgAIUoED7FGBgsdZ+nzFWi/8a2RnXzn8lgovV8qvo fAbiIn0gzeNAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKiC5KSktLRb08DrUF/rrjP1h/oFSePDui I5795ZDai/A9BShAAQpQgAIUoAAFKEABClCAAhSgAAXarQADi/Xs+tXbjqGDiwtio++rZynOogAF KEABClCAAhSgAAUoQAEKUIACFKBA+xNgYLH97XOWmAIUoAAFKEABClCAAhSgAAUoQAEKUIACTRZg G4tNJmQCFKAABShAAQpQgAIUoAAFKEABClCAAhRofwIMLLa/fc4SU4ACFKAABShAAQpQgAIUoAAF KEABClCgyQIMLDaZkAlQgAIUoAAFKEABClCAAhSgAAUoQAEKUKD9CTCw2P72OUtMAQpQgAIUoAAF KEABClCAAhSgAAUoQIEmCzCw2GRCJkABClCAAhSgAAUoQAEKUIACFKAABShAgfYnwMBi+9vnLDEF KEABClCAAhSgAAUoQAEKUIACFKAABZoswMBikwmZAAUoQAEKUIACFKAABShAAQpQgAIUoAAF2p8A A4vtb5+zxBSgAAUoQAEKUIACFKAABShAAQpQgAIUaLIAA4tNJmQCFKAABShAAQpQgAIUoAAFKEAB ClCAAhRofwIMLLa/fc4SU4ACFKAABShAAQpQgAIUoAAFKEABClCgyQIMLDaZkAlQgAIUoAAFKEAB ClCAAhSgAAUoQAEKUKD9CTCw2P72OUtMAQpQgAIUoAAFKEABClCAAhSgAAUoQIEmCzCw2GRCJkAB ClCAAhSgAAUoQAEKUIACFKAABShAgfYnwMBi+9vnLDEFKEABClCAAhSgAAUoQAEKUIACFKAABZos wMBikwmZAAUoQAEKUIACFKAABShAAQpQgAIUoAAF2p8AA4vtb5+zxBSgAAUoQAEKUIACFKAABShA AQpQgAIUaLIAA4tNJmQCFKAABShAAQpQgAIUoAAFKEABClCAAhRofwJu7a/ILDEFWl+guroaVVVV kP5yoAAFKEABClCAAhSgAAUoQIGWF+jQoQNcXV0h/eVAAQq0jAADiy3jylQpIAvodDqUlpairKwM 5eXlcnCxpqaGOhSgAAUoQAEKUIACFKAABSjQggIuLi5yUNHT0xNeXl7o2LEjNBpNC26RSVOgfQow sNg+9ztL3cICUvCwuLgYRUVFcHNzQ5cuXeSXh4dHC2+ZyTdVIC8vT04iICCgqUlxfScSUPa7E2W5 XWSVn0Pn3M3K54n7zzn3X1Nzzf3fVMG2uT6Pi7a5X52hVBUVFfI9mXRvdv36dfmezMfHB1LQkQMF KNA8AgwsNo8jU6GAhYD0xXXt2jX4+fnB39/fYh7fUIACFKAABShAAQpQgAIUoEDLC0gVO3r06CG/ 8vPzUVBQIG9UqvjBgQIUaB4BBhabx5GpUEAVkB5/lmoqMqioknCEAhSgAAUoQAEKUIACFKDALRVQ KnwUFhZCejyaj0Xf0t3BjbchAbZg2oZ2JoviGAJSm4pS48DKF5dj5Iq5oAAFKEABClCAAhSgAAUo 0L4FpHs06V5NumfjQAEKNI8AA4vN48hUKCALSL0+Sx21sGo9DwgKUIACFKAABShAAQpQgAKOJyDd q0n3bNK9GwcKUKDpAgwsNt2QKVBAFaiqqpJ//WJgUSXhCAUoQAEKUIACFKAABShAAYcRkO7VpBqL 0r0bBwpQoOkCDCw23ZApUEAVkH71qqyslNvsUCdyhAIUoAAFKEABClCAAhSgAAUcQkBqX1G6Z2ON RYfYHcxEGxBgYLEN7EQWwbEE2twvX3oddDr9rUV2hDzcWgFunQIUoAAFKECBNi4gdQB4i6+42rgw i0cBk0Cbu2czFY1jFGh1AfYK3erk3GBbF6ipqWkzRSzJ3oKH+k9BpihR9Mp0bJsX0eplc4Q8tHqh 7d2grhC55y/gaiXQUVrX3Qd+vXrB37v1TvE5u1fhvT3n4NdvEl6Oi4DG3jJweYcQ0N8ows8/XUaJ +BXfXcqRlx9u790TnVrvUHIIB2fOhL6kEBcvXkKxsg87dkOvwAC04unglvAV5uXi0tVicf4DKsWZ sGevQLvOgfm52bggTqLu8oHfEb37B8PXjuO+JD8PFy9dFdsWg7v9278laNyoAwmUYPtr0YhOShN5 ikH6pfWI8LfjAHSgkjArzSSgz8WahDXIFe0A3j3pZcyMCGimhJmMItCW7tmUMvEvBW6VAL+xbpU8 t0uBpgjos/Hao1OxU0qj11z8e2McfK2ml4elE8dhk7jXyrw6FEcPrEGot7UF9dj9xmSM23JOLKjF XnFBGyUuaM98liwHFaU1UuYnIzs2Av0aFTEqwea4aCw5DHTrZm37pmlXr6Zh6MJMrJk5SJ7YfHkw beOWjenEfntM2m/dxH8NHySTqMWnsHxyP8uV9HnY/v7biJ6/wnK68V1kTCL++PoLiAi2dnTosPu1 pzFuZzEirWbmqkilD4ZOjMGvZkxEv3rvsPOxc9F8rJAi0DEPiMAioMvejPD+S8SEblh0KgXT+ikH XnNu11hQp/ijQ9pbcxHzRQmGWdkdhYWF8PW9E/dGjsGEx0YjNMjqTpFLqjv7MX458i9A/1MI+/Vu LJlh+KzYZNCdxVsz5uCLQrH8c19gydT+dRbVXcrCpv9ZjoQP9tSZJzaE5xJfwfO/fhQ928JVQyud PwHDeW/64TREDt2ElDXToH4KlM+HNhND5x7FmrhQK+5mk5Rzx1WxvNn50WwJ6PKOYe3biZi/IsV8 snFciwUr38DLcycgoC3sQ7MS5u7fjN+/MB3J0vmn1hC9YDXeSJiNQfWcv/R5GUiIGQo5nmOxvhYr d32IeWNrnXctlhHnutwMvP37WCRYyUBM/Cb8KWEaAhv1vSk2pMvBmvm/xfuH5S9xLMw8gJmDlKNI fL9Hie936dtEfEc8vvgs3pwcXCt3lm8zVsVh6LoziEQafGYfFj8Whlsu4DTv2uD3SMlJrFAPwmQk f/E7REyr/9hzmt3Vahm1fc61lYWcLa8h5A3pajoKmQeWQ/142VqhNaeXXcWupCRIZ/TI22cwsNia 9twWBShgt0Abu7y0u/xcgQLOKeDmAy9xg5kp30h9iBPiZiHCSrBCn/s1FqUod1uZ+OLkGwgN97dS 5lzsSVBuRrXo6mU4NXQL6GNaVnsvejb25kikUnIpzZhfU5K2xroVy3U+5NnNmQdb22u16ZVFOJwm 9lsjNtjt+yKLtXS5qXguaBSSLaZavklLToD0il2djr+IWoSWJ/xK5J4U+1xkRqofYX3IRFpaCpLm A0t2ncUrY23ctOafwDpjoeKnD5drK5ZUloikDROvlJo/2NWM27WeaQedWoULp0XQ7hRwyGYOT+HQ oT344L9FKC/mLaxOmIGQTnUXrqq8LpIRCUn/vzoWofefxtT+VhZUVq0qw+lD8hq487r5vjAscOng +wh9SmzU5nAKHyTMEq9J2Jq5HOHdLI8km6s56oxWOn9KxZfOe/JnrFuJxeONlcrnQ3xEMueE4cFh xWYBIytwlaU4aTx39DE7PypL5qUuRa9Ri5S3Vv5mYsX8aPFqSzWh9Ni/dDJGLFK+u+oWO2XFHKSs eB8fnTqAyeqPG6bldDnbER4SbTxTmaYbxjIxf1x/HFl9GBvjwmvPlN/n7V+FXiPECdLGkJwkAp5J u3C4YCPCfW0sZGNy/rHNeDpsusX5ubjS/PMbgCfnRmHRFMMPS5lTnsPoS6niR0HrCZZkbcDQ+Wvl mWnQIiV6sPUFnWJqG/we8eoOaY8o38fBwT2dYk84WiZtnXNt5bP06klxEpauVfqg1NZCt2q6qD2t /Izg04Tr71uVfW6XAhRoXwJOfnfQvnYWS0sBk0AAHp0ejYRM6YYqDV+eLkSElbuW3CPKJaphzd2f fYdXrAQW9bnfQq3zFjMOA4xXMoGTE3F073hcqwACQkfYqBVpylV9Y57qTC1i4x+3WWOvTPxCe3tQ F3Xp5syDmuitGvG6DVPjF2BwmRe8vMwyUXYSSUotI2004h8fYDYTKLt6Ff3uv02dps/bjceCxqk3 INKMmMT1iH08DD3cK3E66wv8bfoi+Vduad7aOSNQ6pmJjcZaoNI0aTDtE7F+fCLuQJlhhpS5C0eR tNZ0w75oXAg0hwswz9pxdvgL4415JEaHBhrSqOff5tpuPZtwyFkeZrma9NyL6CXdKOjES/zVFV7E geStUqxQHk4lv4qRydux/uBGPBpU/x3Fb0a/jfDc1xFk6xvdFbAVdtSLwNd0i6DiGCS+NwPDBvWB e2UBstK244X//sCYq62YNPUuHPtiIZz7lrd1zp8Smvmxbmv3SMvN0iYgonI5gm0tZHaDKS1vPkjn g3EWQcVorNw0B5GhfcU+vIJju/6B6YuUM3wyRjxyNy4eXwxnf6iuMON9i6BidPxqJMwejz7i++vC d//GUrUWYyam9F+B8zWLYXF20mXhOfOgYmQ89r4fh4F+ehz+x+uiJniyzJw8Zyju7nsRi6NqieXv R4xZUFEbswTvvfIkgkXgPefQh3hhyiLjeTEZQ2eNQvG2mWqQwHz/1R0vQeqquRhl3H7d+aYpweI7 en3MCsySs5qGUbEbrG9Hn4ME7Sx1xdiPtmJCo6tRqsnc0hHzz1ZTvr9uaSHMN+4WjKTzRzEm5xo8 3AMwwsp3rfniHLcuYH5c2DqdWq6phO7kVhQsZ/EdBShAAQo0WKBh59wGJ8cFKUCB1hK4e3SU2JQh 8LN732kRMAyvtWkdMlKUm0nDrLQt/0be4og6N5QXjx9W142NDjdrH88boVHSdppxiF6IlW/ONNvG zdJugTzcbJMtNd8tEHFvLq+buj4LP4rAonRvGD33DbwZN6juMuqUQqybax5UjEbK2Y2YEGy6OO43 KBQTpj2P1DUvYdQcQw2V5FkxmBJ5VNxMWjntR6/HB1b2SeKyHKx7aRLmrDXUPJwf+wGePv4KLCvE 6HBkZ5Ihd5ETcZ/lTDXXVkeatF2rKTrHxDF/xtuvT637GfjvPyFjx/9g0gvvGstxCLOG/wH7cpYg pN7Y4gf4r2Uj8cWrkXaX/8xnG9VgJsa8hWN/m2EWNAxCSP9QPDF1Al7UjsdWKfVTy/CvY89ibqgp +G/3Rh1ghdY5f9pT0BWYlDAGx98ca89K8rKndqw21biLXo2L2+LMzvHB6DcoHNNmPo0ZPYcaajhn JiA54wXxnWFnFTq7c9aSK+jF99s6dQOx68Xj5DND1fe+/tOw8Wg47ggLQZJ8+kpAyrEFmGfWFkjW /y411fiOXILzqa+ogccJ8zYis3tHaKcbzp8Jo9ZhtghMmocWsz5+R/1xJzJxLz5bHKXWCg+Y/AqO nu+HsCBjbciU5TiYF4OxN3sOvTALrz2sNebZUJxIrfj50HAKVstnGvHGzFXp+HvyCENeUmYhYUuE aDbDsnb5/qTnTD8eivPuslrzTek54Vgb+h7RBIZirEX02wn3B7NMAQpQgALtUoC9QrfL3c5CtwUB 374PIdpYkLTdGSisXSjdGeySIlXipkQdMrfg6zzzR6mkOXqcSpNba5QXe+QB86taHfJzc5ErXvkl tddTU7VvpLhcqRfXwPVaIA8N3HKrLVZmevQb5WbjVjKgy07BHLUiYSR2nd9iEVQ0reKNqLi/4KNY 5QDIxN/Ux+JNS8ljNvaJm3cw4tZsR7yaxCKk5xhrNSpJiOMsxXDvjeipD9lXq9Wu7UpV+9rIUFKB cmtFceuC8CdeRc7BZIxR5yfjzY+UeozqxDojp96NwfsZV+tMr3/CDWSmKW0q9sf6pGfMgopma3YL xW/fm6ROSPvmB3XcWUda5/xpn05m0jgs3Z9v30qiHceju5QTgni89f3ZFsEvNTH/cLy+KUZ9uzvj nDrunCNloikHJdoWiWefDK1bDFED7IXliWbTzb/D8rDtfekLUhqEW/Jv1KCiYRowaNoyrFa+ZJGA z7LNz0ElOKS6R+KPL5iCisr6boETsHaJEuzPxOmfS5RZNv+WnEszCyrGYNfZMny2dZPN5eUZvhFI 3hWvLrNCPBKdanYYlRxbgxEJacb50Uhf39Cak2qSjj3SqO8RvXxtkyOubQyXNnrkZmVg9/bt2LJl C/ZnmwEaS68vycOx1N3yfGmZLdtTkZVb58pLXFKVIM943ZSbZ2W+nJ7OtEy+6bjQl+TL11u5ufkW TSdY7gA98rIzsF3Kg/zajv1ZuXLld8vlar8rQU7Wfmzfblhv+26R/5y65ay9Ft9Lu1Ts+/2pws5w fNjc9zKW/cdWYW6WOPas7xfT0WHaE1JHUdJ1ua3jS+rIqrHzW7qsUvoZqUZHcfxu370fuYXm51ZT OTlGAQo4lwADi861v5hbCpgEvPtionLTk5aK07WuPkrOHDLWThGNPkebbm7Svr5oSkMeu4h0udcN 6U08HjCv0VZyHE8HBSFIvB75H+UmrtbqjXhrpc6c7VRaKA+2N3gL5rg3dJs6fLJ8lrpw9MplonZD fZpumPjKInX5lG1HRBjC+mA7lUA8M9cUkMgrsrwALDlpPM5EshNHDrCeeD1TG77dWgHNetJ0hlm2 yy2ejA6KxPKtv1OLsefVD3HWPCaizhFtMY4Zpr7770mvI+uG+rYBI3pUqAeELzppbOcqaNzr2Ldv n/x67+m6nb80YGOOtUhrnD8bWGKten4GFo34LY6p+6QhCehRXqws1w2dje3jKlPM/wZPegenTom2 NsUreZbya4H5Es40Lj4Qarlt59vN3fzBSNNyuuzPRFMixveiFn2k1ZqE3hg/xxSw27bvjCkBeGHI uFhERkYiesF/YYiNyp9d/HuZrdPwUe2C9bhYuRFjgzUoK735AREwNkH8iKSkLx6J/u0Gw7ledFSU EDZHmYH4Xe9bbY9ZXcBJR2yfuWp/fxm+R3Q5/0RPcV0TIl4rPt2NN6LcEaQdinHR0ZgyZQpe2G4e eNdh/4bX4O7TC2GjxsnzpWWmRI+CNsgPg2esQrbZLtLnp6GXSFe6bgrq5YfNFgFpA3DWhudMy8Tu UIOCmeufNqwX9DSOmqWp7BZd3n4sFHnt1X8ooqU8yK9ojNAGwWtwHFJzLb+flfVyUjdgoosPQrQj EB1tWC96nMh/SE+4RC1Eao6VjSkrt+e/ooO8zW/MMOz7EaOEneH4MO37pRb7XqKy79jKx5bXJsIv SCuOvVr7ZeJSZF2ClR/7RAc1j/QyHl/zkF3n2iAXib2U4+9JZNTZtfn4QJ3/NnKV/dviZZU+Rwtl y6GjjI7i+I0eNwJBfl7iR+xU9XOgZIl/KUAB5xJgYNG59hdzSwEzAW/RY69yJ5GCjDOWv4yfSdtl XDYSv39nGRYY363YecTyyzvvlKF3aTFfGz/astaGu7iANa7Xp95HMY0LtcQfR8hDS5SrUWmWIU+9 t9VizuSbBwfcgp9CwaVLuCReBSmzG9jGV8Mzd/KLD40LL0BE/c/rNjxRLoku4VORqMYMP8CXZ6xH DJ977T2sf04J9G3F2Fc/tvx812vZBXcPUzZyCE8tXIfz1u9LRbSzG0JCQuRXz062b+Pr3ZxDzWyF 82cDy7vwrWSkLFA+y8kIm7vZjn3oiwEiuGUYREBp1irk2NyH/ujXr5/8CvB29n3oiyFjTeX+x54c K9p52PAH0w8rAV28TMtUmuoMxz411OZ5MSB0tOhB2TCk7Dpq9sOMG8Lj1iA1NRXblpt6+zZtQBrT 48SXyeokn443N/fu+zj27j2Fo8tn2tl7twaTlx1Wn2IQkWMk7c7C/j/PNT0CHfsREsYGqPlpzyOV ZsHahOhxUCt0GlG6aZRf+wqxOc4LI2YZm/uwgpaZPB/9fSYi1fg0iFvABJzapFybAdOnvo088/VE m6gxhkYxxdRoHF4/TW0Ww91TueLygZIDZdUS0ZO8V68RWKFUPlVmKH8z12JUkBc2Z1lGkvL3L0XI qFlqm8vS4lqtcr4Rb9JWYFTIDOzPrxOhUlJ2zr8+Tc12CTbM6oXpCabPcO0UM5MXiX3/hsX+bfix lY9VE3tiSpJS47xW6imLROA6DGtrTZa6cxmm/tibjGO1gsn63COmz7xoIGHfSct7AxR+h93GNLXx I4zX+C1d1hJsWRguPkeWzTOZF23tnFHwittsdo41n8txClDAGQQYWHSGvcQ8UsCGQFDESHVO6gHz X9jzcWCb8WJFOxYPBIciUrnOXfu5RfAgLzNdbZ9r8uh+anotNuLjWeeCucW21dYSLjmHVOWmInIu wq3WsqldaDf4+vvDX7x8GxlMuJxfu5arso08fLbJkCFt/BjbHU8oi9v51/Z27UzIKRfvhmETTA9E 23ou7nplFzz66nJMUsq49QW89dl55d1N//YbqYRNxKJ7EjA8eDTeWrcTWWcv4EYbu8+sjeEo58/i Sj9MSFqPGCWDydMRv91aoExZwPLvwEfN2mVMmY8Qr8F4bdUWHMtWHvO0XL6tvAuf+Uc16LdiSgji lm5HTl4+CgsLxWOtu/FaVC8sUs6XC1LwS1H7TxkufpetjCJ0kBLMUSeZRny6Qo1PiEdu7flIlGQl Y4oaFUjEo1Z6pTZtyDgmmp+IiuqnttVYZ359E7zDsXav6dHvpHFa0bmNAhCDzJWT1QBWfcm0tXkN +x7RYslH6TgvfoC7eP48/hUbKjPkbk+EsZlN+X38psMoEE2X1NRU4mJmCpTLKqm961Fz16lBkX7T 3sJ65YkS0abpog1ZRlYRwBFtJCuVZRP3vt/A3sJzkdR/urprtLGrcepSMSorK1F86RRWqk2eiECm 6MzHFMjMxz/Mguvx69NRUFmD48ePo6zgLNYvUM7/KXhhw1E1/TYx0sDPa2W5ZSBWKXtJ1mZjp0jS lBh8dPQsioW3Yd/vgok8AetSTeLK+qa/1o+tnM2LMd8spmg4tspQVlaGs4c3qec2Uzqmsb4jR6lv 9mVYXp/lHvxcnSeN7P7shMX7wtPfqG3DTh6tlc81LV3WvN1JmKI+GaXFyl2nZMvKymKc2rXS1GLT 2ulYYd6Og0XO+YYCFHB0AQYWHX0PMX8UqEdAExiu1kRMST1iamcx/wS2Ge8nomePlGtj3P+E8kjX Whw+Y7qQyk5X2leMxPD7WqE2Q8o2/K/ULtDmzdhs7bVlv3pxXk/R2+csUYVB7aJF3O3evP5LA5nU O+e6y0sXnKPU6hzRCO9jeuZPn/u1+jjh5NGGG7G6KdQzpZHbrSfFNjXL/65Banku/lSr1oEyRy9q XmkG4U87TAGFD2a9jLRLDQuBdAl9FskvDVNSE39P4d2EWIwdGY67A3vh2RffwoefZeDCVVvV4MxW dbJRhzl/VorHMzWhWHV4pSq4Ivo57K7THq4622LEN3wediUqAQJpViaS5k9BWP8g+Li7YOKM17Bh u2jHKr+N7UP/CHx2MV0NyK5dFI2QXj3h5+cnHmsdhyTjd2BkYgoKlk+wCKqVXj2nGpZX1vNZ0dyG YVp10Yafc0uOYa5ZL8yJe220fWlKulnG/KPikRJvfiwYkl15+B0MMsVVm2VbDpNIk79HpLaKj+KV yREIFD/ABQQGwle2ysPfF5tqWK1Mv4Q3p4WLedI3rxsCBk3AmrJM9RoMKXPwL7W2oC9mrk1Xg0NS 52mp4hSen5qEWUowSQS742v3NG4DNX//36HWmRQ1TzPWxKGfvzfc3Nzg7d8P89b829QeqNw5k7Ht RNHeo2i20zgsQfzMCPgaLxw0vsGY+fYHWLkgFgvEa/pdHZUF28bftPnwc3GBy01eYebRPfOSdwxE /IIFwmYBNmW+j8mhwfAW3oZ9PxZ/MWv7NO3Ez+Zrmo3bPrY2m0Wsl+y9aDy2NNBoNAgOn4bUi3vV 48csQXlUEzJUDWqv3feNWQ33EmTsUn/NkJeVO200S+B0RqrxXSQeVq75W7Ss+UhepB692HQqA/PG 9pMt3dy80W/sPBw4ulrNYcKf/gG2/KlycIQCTiXQbPelrVVq6de5GzduoLy8HNXV1eKXo5rW2jS3 Q4GbClRUVODy5cs3Xa7ZFhC9DEeKR+hWSL8EpuzCuZI4USsNyDtxUP1Fclykod07wyNdSfL0bYfO YKboOVgsiYM7jb+dSz36mmJGzZbFugmJzkemKFfWdeeKFiFxuDgV4WoEzdoynNaQ9sUarHSuSHTO I4IO+jK5Ro50syI1Ip+xYx3GzTFdEGrj5yDM7BjJPaIEpaPxqF3dQRtz1sjtNrhcTr5gJ7/uagmO nhWX2o/2Vt/XHukSOhv/fGk3nlp2SMw6hJgX/heZH81Gt9oL1nmvQeTCj3DwFxuR+NSr2FNr/p6t 70J6ScOYl9Yi6cXH0dPprhxqFUp562DnTylAuDdxmzGQn4ZxMe/jUuq8Wr2wK5k3/6vB2MWpODt8 DX47ao7FI4/SUinJSfJLGo9O/Ajvx0+28zFbaU3HHM5m59z0h6irF87jgnjM09ff/MBt6BeMN/z7 iLIbvyYbpKDPxRsPhak9TmvjdzU4gNSg9OtdyA0T4n4FNaoqL7sSc8P9613LqWc28XskckmS1baK 9bmH1B/OIHqenhVhxVD8qLMgZQFWRBsCkH9PU66thKgIfEud6vQaJ32HZmLUw4OhzVQOpFhkJk1o YKBaj8Nbtxh3UST2vmWt5qkvZr+1XnTsNkteTuqc6RVpn+srUWpcU/pe2JOVj8mDzMohOjiat3yN ugRHTALewWPx5vKxpgm1xtzEk0AxYlqyeNmKbds6tnQ54thS0otejeetBZgDorBydQy0c6Qt1Brc QvC4uPZfK137rz2Ii3+ZbHhiROm0USwem7gAhxNWIFPutDEeE+QnXAqRoTzNFDkVA43Xcy1ZVn1u OhYptxmJ6ZjWr+4vHN7i+mVTzBxMl4oq2ow/VyK+9xp6iq5FY+9b6Z7Nx8cHHh4e9q7K5SnQ7ALS DyGurq7y8dipUye4i+bAnGkwv8py6HxLAcSioiLodDoZWfpFR4LnQAFHEpACi507d27FLLnh/jGP A/IjBik4ImoihoZ6I/ML5SI0FiP7G7+d/e/DRFGRIU38ep3y4QEUxoXCNz8TW4xf+NETG96jr05q 68fssRxrBY5dn4k1MwdZm3WTab3Q0bnOozcpTwvNtnUl25jNZS5CiI+pLTLrSSzAh4vHmt0IiV/G 1e6gJ2KAWcDR+vpWpjZ0uwnm27WSThudVF5WoZbs3kA/ddzWyPAX38aLy4ZDDgMeSsDrG4fh3Rmi /cUqW2uYpgcNn4G/XXwGV8+fQeY3X2OfeOb+g62WYcY9y2KxZ+dLyNi9EL2d5urBVMa6Y7fm/Fk3 H6YpUfEfID4hxFA7SdS4+e2aSGyME+fRStMytsaCo+KwrWY28nNO4ViGCCLs2oUVyZY/4qQkTEHK lkScP7oY9fb7ZGsjDjQ9a0MctLNMtXMiYxMxd+rDuKurBy5k78Pfpi+Sg6yZa+dDuzYVey9tQZRF cLEhhSlDcXFDllOWyceayUGmgJR2CXa92ZrnLx22r1iuZMb4dxs+zZ2LCc6+w2uVSn3bxO8RH7U9 RTVFeaTs6lV1QvS4MNPTAupUw0hg5NOipcQV8rEmWnqxGAyd6ojHQKXDVAQVjZdbWHn4LTtqkJbh p3PKmmnY8c/N+Nl4WWfamAiKXPlSfau20KgRAahYEXuSPyYpmKJNgTZa1E4c9wgeHHYfBvaVame2 iZO5WnbTSCTil0xEV7P6fKZ5hjFxK4lv1y3CWoW39gLSe1HrMzf3PH7OuyyaWbiOgusFKLlSjKKf v1X3p7XVpGm2jq3KIvNja5jNY8vwyLMUbas9mH93rcA3uUkIFk09FJ48YDNkJaUAAEAASURBVPxB IwZxcXHoJgUWxX9ph3IxYXIwUHJabU4neuow1Llsa4Gymn+O0rZsxeb+PwKmSxtDwcThe8RsH7Tm LYB0z8bAYu3ji+9vpUBVVRX0ej2uiu8gT09PdO3aVa55fSvz1NBtO8W3iRRUlHA7dOggB22Uau0N LSSXo0BrCUjHqPRqzSEgdIRonyRJvsDZdeQ84kJ9sCfJ+A294HGEqJ9yX0ROFb+vpomLlLRtohfp ebj7uyPqhdG4h/o2ONuVpVduuuyZfNPv5BYLR66Ua+H4iZNm3UGaphGP99SdwylCQAQX1IfYi1tP JDp+E95PnGZZy6nkJP4pDiVpiKmn8wPDEo371+p2G5eUU66V9+1BNd/Bd/VQx22OuAVhwb738O7I F+RFtr46GlERuXhCRAFv2FzJfIYbugX1R6T0emIGXl9+AxdOfYW/Jsbgg0PG5U4tw5J/jce7U0PM V3Ta8Vtx/qwXS9QgSji1SW1PLXmO6C10dCWmBbqbPvv1JwD/4EGiN2HxmhaH5evFTXHmQax4aZyp 0wfxqOTvk6dg48x+9abk0DPzU0UHGKag4ur0i4iLCFCzHBoajgnTnhM9rj4pOkeQngUVbeAt3oay NYbaXu7epsc+Pd3r+cIpuaDeiNuslqRuVfTWGtdT1BpTJsTi6IFXYMqVMr3l/ualvo1otS0zZTtp iJ7wZ1w83rp5UbZ+q/82+nvE3ZTzqAeCTG9qj4kaJUqcL2VXJkriQtX30vXM5JVHEb02TA48SqtK NVjnhdcJ6dRO1eK9ebxyxRxTW4sWC5m9Sdl2BCXzpHyIGqzLTiHxTH+1g5pM8YOg9FKGyJhE/PFP ovO1QKUUyhwn/xv9KyS8MtOiCQRrJcr2ycLaWcaLmVoLZO9ehanj5qvXybVmN/6txbHV22Y6GtFb tLhqNwYLLReTnkJSrv0PfnMRk4ODcfqLbYaFRI/lA8Qj8iNErcYkcT5YkZKBJBFYrDyToR6HE0cG WSTYGmVF5gpMn2KxWStvUnDgTKGoJGHfZ8RKQg2apNy3tfa9W4Myx4XapYB0LEpPjklBRanCkhQD 69atm1MEF+u5mnKcfXnt2jUZWELmB99x9gtz4iAC/qGYLtqAkp6wSTnwHfLHeqg9wsWPud+shhlg +vVT6ikuD/hSaXwnBsMGNPyi0r3bQCTGJ8Kzq/nlrslDaqqg/2jp+TErg/hJX+qbU/o81x2sTau7 VLud4t0bUaLWaYq029I+xJH8OFEDpzk0RMPke2fBT3yBVZgl59HJF8H3DBbtTtV9dKXwP/vUC9To 4SFma9kzav927UnduZe9gcyvTDUGK6zF4a0UUBPyBL54KxWjX90qz31h+Lt44PRYNCAsWTc1t07o PSgSr3+Ug5HL5yJmmSE/W7d8iT+JwGKXums435RbcP68GZKm3zRkrt6lPgI3PSQJw4snoufNVrQ2 X7RhFRg6FstTyzDmjacxLsEQ9Ur++z6sEoHF1rl1s5axpk3LSf9QvdmXasebBxVNKfti8pvrEb8z CPJvbWuTcXzZZLmZjSC5KRDDktnnCoBBNr7/9DdMrU6IH3Nsfwx12P1atFlHH7E4XLAG4gGC1htK MjB3lPqAJZaIGqvlS409HotafXNXjcY2EWxqe0PLf4/oboh2UM3ChZaGpiiRto+fxTWXtJz+0gWc M1shc+cR5CaObXSN4eiYWPQ0xcXNUjaMlpZeQscH+srXWfIU735YLD7/U/Z/hu27dmJ30lq1qRxp flpygvxafbRA/DDtrGcEQ9kt/hWdt0h7re7Vi8VSMOsg3mJG7vaF6G98xF2ZoY2MRp9e3ujZ/Q50 Kz2MpLXKNbSyhP1/dTfqqY4uOgpSf0yunbT/QEwX14OZIgsrPv8Wyyf7YZ+xMz3px16p3Nrxkw1P NCXvw/mN01B5INWYSiyGhphOTq1VVlFdFrFD6/8mK73UEQO7SXcJHCjQfgWUSnTSI/pS7UXpqV2p 5qKjDw5/Fy+1qSi1pShFbRlUdPTDifm7NQL+GKlcXWR+jo8N940iK5EYHWpZV0ITEiE3NC61BnQo ZQfKTxovimLGoe/Nrr7MCqcJjMLiN6PMptgx2oo17ezIlZMs6oPuvZSspmH9p1mIutnj5rocrEpc hyJxneYZHI3fiMbn65z4xa/bv4yKuukFuLJl6e83/95tfJuIBxr7iF0jtmueh7Y8rju1Fb8xxAZF MUXgv2+nBhe3/4zXkbh9KxLkWobLsDDxZxvr3sDZrO/FzVcl3HzvQf/etrYh2mF8fiHGiMCiHFoU 9yN1jiEbW3D8ya1//myIyaC4d7Dyw2TMl0/RCZj10gUbq5Ug+9gZ0Y5aJdy7DcAgm7WORDuMLycg WgQW5a8IH+feh6VXL6keoWFB6njdET/cLf3GlWmYYwoBmX4UW/HRQSRNCLR6/ss/8aUahImeOMRm IHb/KhG0VXqLEZ/X9EtrGtjbb90cN26KDpvnDlV/7NGKjkFeGTsWul7rkWDsRCZlfhg2P1pmtY2z xm3TQdZqqe8Rs4jT7i9Fm4XW2liUCAouKocX+vTrbQroyTx54tiKVufLk0SN4VlJDyN1cYT89ub/ 6FGuXjfF4I31azDI7hOwBv0iJsivV978CwrzL+L0sTS8t2gWko2fjTkvpWBa6kyb4dOb59PxlrCb SS1CPlJWGNrNlCbFrt6LN34dBcvfWLPx49r+VmsTqsnYGmngsVVyzlTDsG5S4rtrYrSIDIsz+trj yHmtM3Yb92V0eJC8eMB9D4s7AbEIRKeNWa/A44jxBsHiaabWK2v0wrdEE0n96haFUyhAAasCSu1F qcKOFBNz9DYXW/eZTatk9U8sLS2VEaXILQcKUMC6wN0jJxpmZK7FnPnGR1ykzlhq12YTnRWMEY9G SENK0hwYK68gdly41ZsqQ6L813EENBi/0NR7XvKsxdgvepqsb8jeuhTzk5KQkJCERft+tF7jRvyy X89v5laSz8UXxp6iIxMfRqCVJRo0ye7tNihVp1jIds0nkf2iLPxh9KtqOYYlTkV/OwL/EF22zH4v GcOMKRxKThbN9tcddGc/wUgRfBg7djxGz/wHiuouYppSVWqqOVFSYf04Mi3tVGOOef70x7zkXfJN oYSZJhpJM/4MZGGry/4X+oeFISxsKLQT1qPe00Glee27ciffh6baNvmXpXpJtga9RRuJynlOI2ri xiurJP8VR6zC6ZCevEhZClEP3a2Om49IbT2OUHuWjcbei+thKwZlvl5zjuduTzR0fCAnGotk0TGI NGgGzcThJSL4YBym909ErvKmrfxtoe8R794DTZ+/TZ+Jru6sD8e2rDYLHJpC19LSGavmqu1txq7c BKXz9rSEEVhzzOpBZ2UjvhgQKYWHpCEZu74UHXnZGHQlJSgRL9EVmzroRdv0Uvv0pu8cN9GRUSDC x87ExuNnTZ+DtL04Y76imkI7HDFvAiFyNZbF1Q4qArrsw40LKgpO79vuFo8xG4a0RSk2P5MHt6yr F39A5DglFaxbs974HRGPB0R7i/LgOxBTjYfOtr+tU5uviR8z2PTjYEuX1exzlPL3z2z3+KzXycdu ic50pNZbeM6kQDsRkGJgUkBRiok5+uDwgUWpAUspWsvAoqMfSszfrRTwHfCQaDzccogWVxO+lpPE OzeESo9G1BoeGd7o0FCtlPi2pQW8Q5/ASuUeQ9RPGeEXh4w86xdi+cc2YOp0Y6BZZGzJsyOaJYCs yxE1fIwFnfjowJYucttL39sDpvpS5sXT4+zBjZgyYKzZDcsYJDwdar5Qw8Z7Ror29Z6rd1lNby0m KUucSsDf0s4r72r9vYoPEyepwclhwwa2jcegjaV02PNnwFisFz3O1jdogsLkNrjkZTLn473dOTYW z8eGl0aowcnIyPusfD/YWNUBJwc98ICaq4RRi2ErRpOz/W1jrU9p8QHorj5hF4jolcq3ZhpGzNtQ JygrtVcod7ohb2kBHtfW/UbN2f6aWQcysUgv2IYoufdVNXvWR/T52L7qNcTNiMOq7VlmQR/ri9c7 NX8/ZkUrZ2TU6Rgk/JV3TMEjceaetXR/vclxplHA/wH8SjlERC3DRav219lPJVmbMUsNKkdi3hOD VD5d9gYMVeaJTnzemDcNL69cr86fE5aIbOtf3eoyysiQiVOVUSwaYf14PyYC3F6id1upI4r5Wwzn gZKsNXD38oKXeIW9pjwGqyYlRkSdPiXCpb0bt9n1A5Z5Om1sXNzEqw/spmVDdCpvOYgnQd6eO8ty mj3vAsIxVzm2xGdyvpVjK2//KlEL2lgF0Uba3n2HGc//aUhKSpaX0iaONvux1xfDfhUjT09ZkWSs 0RyJEaFm1/xuLVxW88+R6JBs8YZjdUtTeAxx7l7ysevj9TJyanvXXYNTKNBuBKQYmBQLk2Jijj44 fGCRjz87+iHE/DmEgHdfSE9EmA9Pjexr/lYd9zc+GqFOELccjX6U1ZQIx1pNwB+xH3xktrW1GNrL Ha+t2Y7s3Dzk5eXg2P7teGPGYPQMm2WqSRGzCc+H167CapaMHaPn9+8yLh2DhwbXvdm2I6n2ueie LfifdeuwTnlt3Ih1y9/Cs6MDMfKpV9UAHtAff969HIM6NY6p96Ov4j01cmglDU1/zEoco85YFjMc o599CzsPZuH8+fPyK+OzjXi2lxa/MdyzyMvOfGKwuk6bGHHg82fghCRsMtwXWqfWDMILaoAMSBgX gsETX8OW1GPIycmRX/u3r8FEl54w6+sEc6eZAnPWE3bsqd7ax82CZWsR5hclAnQZyCssFD23FiI/ 9xg2vDYRIWYBt5j1zyDY7NnI8Bm/VWukIVm0MTtjDbLyCkWtmXwc2/IGepm1Vxi7Kc5iXUknL3Wp RfrQdkPOP9dg1apVdV5Lly7F5v2mOm852xYjen4S1iavxfxoLb6w8ePQzfdCCTbEmgLG2vi9VjoG CUZ8pimglbZI1JbLstly28032W6W8MaTb6xWS5s8fwTCZixF6rEsZGUdw/Y1C+Gjna5+x2rjf29q 81ifg8T+psDT+g/nQfr21QyKwa54JZK3AlMTdqvp1zfiPegprFav8QzH+xpxvOfm5oqmEFKxamEU wtQPeDTixogegMXg3bOvGjfMTBqFia9twLGcPPEZyUd2xnYsjDK2PyqW1T4+vFU7GpIz6Kj/aPri QdV7BUIeXYjtGVnIzs5GhnQ+9QpRO8NpXBF88cRvl6irpqjH1jFxbGVgy9IZ6DVivjrf5ojIp+jk 22KY/rDlj719I5RajcbFtGMRan4pKMrSsmUVn6ME0+do7awwRC1cg4ws6XOUhdQtqxDlFyYe1jYM 0atn1DnXWhSQbyjQTgWcISZmdonlmHuJNRUdc78wV44m4I2hE8XVhdrT3wKEh9j46dl3CKaKCyap WRZp0MaPMPt10zBN/Vc8N9Zctx/laqL1NYBvtpAy2ox5UJJ0xL/2OGuCJ6P41EeI7j9FrYGUNCda rUVYp3zRK3F+/bQ6bSc1bp8UYt82Y5RJtM05wMZhVicPZhMat12zBJx0tELN9yEsMzSAqE6pMzLm RexIegmhPZvyNa3BE2/tRurWsdhaZwOGCaGz38af/7NHbc/x1J53EStetoYX1x/E40GN2Om2EnSI 6S10/hRla/qxrsG0949iV3KYWS1WS7TweWuxXrSdpXRsmpmShCniZWuITzkrehB18n0oes9OPL8L h4PGGc+BaSJANxQ2b8VjN4nOaky1yWQb3wj86/Bq+A2dY6BKngOteNUetPEpWDmtX63JhdjyJ9Nj 0vLMTFEbsO7q6nqRS0ZimrHnavM2IqUFcq+WAQGmx7vVlW4ykr1FtNdn/C6HaEH5w0TrbR97D5qJ 9CV/x4hFaXKKc7QJGFm2HP00N9mAA89u0mdLeSb+JuXzHhSHzI9yoZ1i+DxlikfjR5k9Hq+uHrMa u9R2p/VITXpO/T6OTEzHTBXaDWMT1iMmyfB5zkwah6XRl/CK+qOf6UrAMou+iFt/FNkPh8HQ6Xca 5ojj3doQv2ulqdMg/ygkb4qF1vjkQkrSLNEMjrW1YrD2ZevHjrWlHXlaU44Lk7lGBJXXi8+WMTic tgLRQ01tLtZbflMi9S7mH/EbpK/MEs0oGK6nDMeW5Spa8Qh8ZprhM2s5R3mnwQOPiFrta5W8RWPk EPOooQhmB4arbatLa0XOHikHuZUUIFoFbemyeoeKz9GmbHEcGvKZtmIOrHJqE7FydiOe0DAVhmMU aLMCzhATc/gai2326GDBKNDMAkERI9UUIxPH1/OLn7eoFWX6iXPyuHq+xL06oo8xVW8fy7aD1I01 cMRTuWfq612rcfObJNCMebjJlm7hbHc16Nezez3dPZrl0LvfZKQWn8X6BerP6mZzjaOiB77VuzJR uW2e1R4o1X3Sy9PU3k7dVCynFJ7Ah8Yb2QVThtfzaLWnul73jpbBsUZtV03NeUc8blrzsD/GxLyE 9TsOIvdvr9YTVPRQEfy8LG3VGcpIp0H4045E5R1gWtU4rRumvivazEx+C2P6mxarPTZs0kvYevA0 Xn00qPasNvG+Rc6fQkY91uuc92x/PuqAeodi1eGVpsmmVY3T/DFzYyUyd62GqPxmc4iMSUT62WK8 OcFQm8nmgk4ywy1wrDgHnsemRNP3WZ2sy+fAU6hcM83qo9++4XHiR5oU0+PktRJYsDodR9+cYOU8 54WAvvVg10pHeturi+nc3n/8HFPzJeKHn/G2eqUW67l3VL48xfFkcabOxd+nKAEFYPXRBPSr53QQ 8ZsPoFaWwwos/8TWY/NWMu+Ak9TPlj3fX8ZyuHe7Xa2terPv3EGT30TBqV1YYPXDFYklHx1F2cY4 U22//HQsNLZBLAV73385wlJPE4ole03n5EXxH6uP4Xfsplxx9UTH2pdcvqFYfvwSUlZaP96jY5eI z3cB3hwbaLG9QdPW4OLRj2zkX4sFK1NwsWxjK3c2ZJHFZn1j73Hh7ql8Lnuii5m5FIy3td9j4jfh fMEp9fPk7WlaseHHlhsi5m3EWXHejqwjoEX8+nRkfPqBHBSUZtu6Bg8cNkatlYqYpzDAdLowpCp+ hBmvNO4ppkx9aIBhutm/LV9WYNC05biUmYLYuoUVOYnGkk3pKDi+2Oq1qllWOUoBCjiwgItoCLLG gfMnd6/t6urKHqEdeScxb6pARUUFzpw5gxEjRqjTOOJcAnl5eXKGAwICnCbjusI8nDmdg8sVHugh glfXbojKL3f2QWCgv8VtaHMUKC9VeURQi10Xj2JsQ9oTa44Nt3Aayn5v4c04ePJ6XL1wHrkXr0LU nxJVi/Vw8/JDUHAf9Oxya6o2OdPn0DF2rl48BnwW5364DHEagOhGEO6deiD47r4I8G29fah8nlpt /+kKkXPmNHKvAT26uuPatUr0EOfAkAafA3XIOXZErC/OoV0rcFH87X9fGAJ964nUOcYOd8hctPr+ byWFEvFdW1DmBh830SmQ3g09A/ytBJ1bITO6EuRdKoCbjw/0ZWXw9vOHt+bmx6pOPOZfICpFiiYX UVbmDr8A31bNv7MeF9J+L6n0EtdTlaIdS8m6ufexTpy3L0E0Miifs338b9FxJYrV8mUV28gXnyO9 aFPRrUxca3jD39+72a9VG7qH0tPT0bdvX3h41PnVtaFJcDkKtLhAdXW13MZily5dWnxbTdnAzb+F mpI616UABShAgRYX0PgGYFB4awRC9fh6xxZDeUTbUqFtJKjY4jvIaTbghm69Q+SX02SZGa0l4Ab/ wH7yq9aMtv1W44vgQeFofF1MDYJDI9T1B7VtLZaukQLe4rvW29ewsvFPI1Nq4moabwQEGqum+TY8 Jxpvf/WJeztWa2JmnX91eb+3aDE04pxtWdO0RTdXT+ItX1ZR+9JffI7kPPharUleT/Y4iwIUcGAB PgrtwDuHWaMABSjgUAL6s9hpaODJSjs9DpVTZoYCFKAABShAAQpQgAIUoAAFWkGANRZbAZmboAAF KNAWBHRnj+GMaM1Hq+2DuY/WbaenLZSRZaAABShAAQpQgAIUoAAFKECBhgswsNhwKy5JgZsKSD02 ubm5ibZrykQbNqIRGw4UaEMCmn7TkFozrQ2ViEWhAAUoQAEKUIACFGhvAtK9mnTP5gy97ba3fcPy OqcAH4V2zv3GXDuogNTRkNQAcEFBgYPmkNmiAAUoQAEKUIACFKAABSjQfgWkezXpnk26d+NAAQo0 XYCBxaYbMgUKqAIdOnSQaypeuXJFncYRClCAAhSgAAUoQAEKUIACFHAMAeleTXq6TLp340ABCjRd gJ+kphsyBQpYCHTu3BnXr1/H+fPnLabzDQUoQAEKUIACFKAABShAAQrcOgHpHk26V5Pu2ThQgAL/ n717gauiTP8A/lNRVMgLGhoqqWtgAalFQRe8hbm2YCv5F41USoqMwpKoJRKVYqlQSwzNDQttTbGi DdnMRE1pU9PMGxVmSqikqHhFPXrQ/zvnMmfOOXM43G/9Zj/IXN955zunPQ/PzPu+tSPAxGLtOLIU CsgC0tOvDh064MiRI0wuyiqcoQAFKEABClCAAhSgAAUo0HACUlJR+htN+luN/eE33H3gmZufAAdv aX73lFfUwAJSXx0uLi7QarU4ePAgpFftu3btCldXV7Rv376Ba8fTU4ACFKAABShAAQpQgAIU+HMI XLx4ESUlJbq/yc6dO4fOnTvr/lZj/4p/jvvPq6wfgRbiP7Tr9XOq6p3l7Nmzuk5V2f9B9fx4VMMI XLt2DRqNBtKXl/QZPn/+vG65vLwc16836v/kGgaMZ6UABShAAQpQgAIUoAAFKFCLAtKoz1IC0dHR ETfccAM6duyoe1tRWmZ+oRahWVSdCUh5BSmHIH12G/PENxYb891h3ZqsgPRFJX1hderUCU5OTrqk 4pUrVyD9HwMTi032trLiFKAABShAAQpQgAIUoEATEZASi9LfZdII0NLfZq1bt9b9MKnYRG4gq9lk BJhYbDK3ihVtagLG5KKDg4Pui0yZVGRysandTdaXAhSgAAUoQAEKUIACFGgqAlJSUZqMyUXpbzM2 f24qd4/1bGoCTCw2tTvG+jY5AekLjF9iTe62scIUoAAFKEABClCAAhSgAAUoQAEK2BHgqNB2gLiZ AhSgAAUoQAEKUIACFKAABShAAQpQgAIUsBZgYtHahGsoQAEKUIACFKAABShAAQpQgAIUoAAFKEAB OwJMLNoB4mYKUIACFKAABShAAQpQgAIUoAAFKEABClDAWoCJRWsTrqEABShAAQpQgAIUoAAFKEAB ClCAAhSgAAXsCDCxaAeImylAAQpQgAIUoAAFKEABClCAAhSgAAUoQAFrASYWrU24hgIUoAAFKEAB ClCAAhSgAAUoQAEKUIACFLAjwMSiHSBupgAFKEABClCAAhSgAAUoQAEKUIACFKAABawFmFi0NuEa ClCAAhSgAAUoQAEKUIACFKAABShAAQpQwI4AE4t2gLiZAhSgAAUoQAEKUIACFKAABShAAQpQgAIU sBZgYtHahGsoQAEKUIACFKAABShAAQpQgAIUoAAFKEABOwJMLNoB4mYKUIACFKAABShAAQpQgAIU oAAFKEABClDAWoCJRWsTrqEABShAAQpQgAIUoAAFKEABClCAAhSgAAXsCDCxaAeImylAAQpQgAIU oAAFKEABClCAAhSgAAUoQAFrASYWrU24hgIUoAAFKEABClCAAhSgAAUoQAEKUIACFLAjwMSiHSBu pgAFKEABClCAAhSgAAUoQAEKUIACFKAABawFmFi0NuEaClCAAhSgAAUoQAEKUIACFKAABShAAQpQ wI4AE4t2gLiZAhSgAAUoQAEKUIACFKAABShAAQpQgAIUsBZgYtHahGsoQAEKUIACFKAABShAAQpQ gAIUoAAFKEABOwJMLNoB4mYKUIACFKAABShAAQpQgAIUoAAFKEABClDAWoCJRWsTrqEABShAAQpQ gAIUoAAFKEABClCAAhSgAAXsCDCxaAeImylAAQpQgAIUoAAFKEABClCAAhSgAAUoQAFrASYWrU24 hgIUoAAFKEABClCAAhSgAAUoQAEKUIACFLAjwMSiHSBupgAFKEABClCAAhSgAAUoQAEKUIACFKAA BawFmFi0NuEaClCAAhSgAAUoQAEKUIACFKAABShAAQpQwI4AE4t2gLiZAhSgAAUoQAEKUIACFKAA BShAAQpQgAIUsBZgYtHahGsoQAEKUIACFKAABShAAQpQgAIUoAAFKEABOwJMLNoB4mYKUIACFKAA BShAAQpQgAIUoAAFKEABClDAWoCJRWsTrqEABShAAQpQgAIUoAAFKEABClCAAhSgAAXsCDCxaAeI mylAAQpQgAIUoAAFKEABClCAAhSgAAUoQAFrASYWrU24hgIUoAAFKEABClCAAhSgAAUoQAEKUIAC FLAjwMSiHSBupgAFKEABClCAAhSgAAUoQAEKUIACFKAABawFmFi0NuEaClCAAhSgAAUoQAEKUIAC FKAABShAAQpQwI4AE4t2gLiZAhSgAAUoQAEKUIACFKAABShAAQpQgAIUsBZgYtHahGsoQAEKUIAC FKAABShAAQpQgAIUoAAFKEABOwJMLNoB4mYKUIACFKAABShAAQpQgAIUoAAFKEABClDAWoCJRWsT rqEABShAAQpQgAIUoAAFKEABClCAAhSgAAXsCDCxaAeImylAAQpQgAIUoAAFKEABClCAAhSgAAUo QAFrASYWrU24hgIUoAAFKEABClCAAhSgAAUoQAEKUIACFLAjwMSiHSBupgAFKEABClCAAhSgAAUo QAEKUIACFKAABawFmFi0NuEaClCAAhSgAAUoQAEKUIACFKAABShAAQpQwI4AE4t2gLiZAhSgAAUo QAEKUIACFKAABShAAQpQgAIUsBZgYtHahGsoQAEKUIACFKAABShAAQpQgAIUoAAFKEABOwJMLNoB 4mYKUIACFKAABShAAQpQgAIUoAAFKEABClDAWoCJRWsTrqEABShAAQpQgAIUoAAFKEABClCAAhSg AAXsCDCxaAeImylAAQpQgAIUoAAFKEABClCAAhSgAAUoQAFrASYWrU24hgIUoAAFKEABClCAAhSg AAUoQAEKUIACFLAjwMSiHSBupgAFKEABClCAAhSgAAUoQAEKUIACFKAABawFmFi0NuEaClCAAhSg AAUoQAEKUIACFKAABShAAQpQwI4AE4t2gLiZAhSgAAUoQAEKUIACFKAABShAAQpQgAIUsBZgYtHa hGsoQAEKUIACFKAABShAAQpQgAIUoAAFKEABOwJMLNoB4mYKUIACFKAABShAAQpQgAIUoAAFKEAB ClDAWoCJRWsTrqEABShAAQpQgAIUoAAFKEABClCAAhSgAAXsCDCxaAeImylAAQpQgAIUoAAFKEAB ClCAAhSgAAUoQAFrASYWrU24hgIUoAAFKEABClCAAhSgAAUoQAEKUIACFLAjwMSiHSBupgAFKEAB ClCAAhSgAAUoQAEKUIACFKAABawFmFi0NuEaClCAAhSgAAUoQAEKUIACFKAABShAAQpQwI4AE4t2 gLiZAhSgAAUoQAEKUIACFKAABShAAQpQgAIUsBZgYtHahGsoQAEKUIACFKAABShAgT+LgFYDjUb7 Z7laXicFKEABClCgVgUcarU0FtYkBa5dPIs/ik/gvFaL1uIKrrftjJt6dYNTq9q4HC3OlRzHidLz uNpaKh3o3LU7unV0qo3CWQYFKEABClCAAs1GgDFDy2tHkTl/GQ5cvoSeQ5/FxHtcm83dbawXojmU g5F3hWOfqGBQyjpkPD6osVaV9aIABShAAQo0SgEmFuv0tmjwvzci8fBX5zHY5brVmUpLS+Hi0hve gX/DmKARGOTeyWof44ryws/xgO98wHsf7nryf0gJ8zRuUv3d6uoB/HN8BNacEvs/uw0pY/9itZ+2 ZC8+WjgXse/mWG0TJ8Izb81AVPgIdGt5TWW7vVUa/Jz7b7z1+stYLUVqFpN38HN4Je55POjR0WIL FylAAQpQgAIU+HMJMGYw3u8WmlJ8mTQXq8WKwd3DajWx2OLY1wjx/ieuD3Yxnk7+3aJFKU6d6oLe 3j4Y9fAYBD4wCF2qFf/JRTaZmcJvPtUlFaUK58SuxIHHfNGvdXmTqT8rSgEKUIACFGhogRYXL160 zng1dK0U5z979ixatWqFli2bYqvtMqx4/GY8J0WHlZi8pyxA+szH0K+9dTBz9cBHuMn/BbmUtC3F CL2ljbxsOdPq0l5M6jVMF5gGpXwnnr56mO1yeutC3BKUYLZOfWECvjzwLu7uVPmPifS0fdGUAYiv xHWHvvU15j9xB5jhVtfnWgpQgAIUoEBzFmDMYH53W2n34pnuw7BCrFaL38z3rtrS1Z9FLBlgiiUr PnoI3lydiin39Kh4t2aw9cSaBNw6caH+Srzn4LfNT6Djteo8VG8GGLwEClCAAhRoVALXxPdReXk5 OnZs3C9kMZ9Txx8bR0X5oVEvomdbkaC7JFa2Ay6XHsGmDzPlp6T7ljwH/yWf4uMfV+HBXhW3Q466 Jxl+JxLRu4V1ElJ3StHq2FlxbuVsi5PfiDcklUnFYLyZ/jju83FHG+1p7F3/OaYkGAIsEdo+9Pdb kL/5eXSrVJClxbaUMLOkYtCzKQj/+33o3aklzv6+F/9JfRILNulrlPnSg+h32694wb+zsoqcpwAF KEABClCg2QswZqjXW6zvkUZ/Su8JiBnppjj9JRTv2IwVm4zNTDbh5eAB+O+ML7Bi2n1QxrOKg5rF 7I2jXsamL0bizFWg2+33MqnYLO4qL4ICFKAABepTgInF+tIO/hfmzQ6xCsxavvlPbF+9ECOnzDXU ZBMeHfQKtv4xx04zjAUIf2sEvnn53ipfwW9fZ8jJTAQvQP7SMEXSsDf6eg7C2EfH4Ol+I3RPzLEv EZ/tfgrP+LS1e65W2p+xMMUYlAJvrt2PKXcqmtz07ocBQ8bgkeVRGDotU1deUsoXeOJzPh22i8sd KEABClCAAs1IgDFDw93Mt9NTMbFfC6sKJBd9jyUzH8JrhlYnm197GNP77ETaaHerfZvPCid43Xdf 87kcXgkFKEABClCgngWYWKwv8HMaXBbNuR0t3vq71rIj7nw4DsfvuAcRg8bqmi4DS/D6J5HIeLRv hbXblzIaC0ccwjN33FDhfuYby7BrnbFPRW98nPKoIqlo2vNqp0F45YNQrHhCn/zL3fG7SCxW3K+j dPTlwl2GaxC9NMZmmycVTcVjwKMvYIpILC6R1m1ajYMXn8SgttbNTq5dPI49P+7GkdNXdEe3ce4G rzsGokcH5WN3U8HnSo7ivHjijHad0cOlPa6dO4o9e38Vx18A2nTDvcO8oS0phbSLg/ONYhAZ9ebk La+cxeET4hgxnE3XHq5WCeGq1UuL0qPHcU6UdmP3HmJQHC3+KNiLgt9P4MKVK3C97X7c3VfZv2YZ igry8cvvJRCb0ca5M9x734r+vRUJWlEWJwpQgAIUoEBTFqjdmEGLEwf34sefjsIQMcD1Fh8M8LzJ 6jvc0kz6Tv85/wCOni4T37vSF29n9PPyQf8eHSx3FctV/U4HWoryd/74sz4WESVI3+t9b/NBP1e1 8q1PaYxlSkQscwVt4Nq7PwZ4u9u9LuuSTGuuXL0sFkTzGYvJ2f1uTPvwKHzniz7CX9PHi5lPpOC5 Pxaiv2q/g1qU/PYzfvrtdxHT6Avr3PMWeN9+Kzqq9tFo7Sfdt/wDR8XxbdC5580YKOJN5QCCpYW/ 4Of9RThtuDfevnejt4t6HKivgajT7z/j14I/9MeIlRXXSSPitJO6BkVtO9+ELu2N3S9Z1hViP1GX fGNdnHGz5wD43Fxxq5uLpYXI/3k/jutiWXGN3W5Gf69bxXms416L28FFClCAAhSgQJMQYGKxHm+T g0VSUXnqVr2GYtHXiVj9oL6Jck70RzgwIRH9VJo6ewcPwb7V+rbECQ++goDDC+HTzkaTaOVJxHzL llpopAyXbuoCp7bSR0BKs1lPPf6aiK1b9X3x3OBWcZJTPvqqIaoUK1zaWgesxv3KW/TDy7u34kmp WbiDC3q3tayDBj98koSRU41Nso1H6n8/Pv+/eD3MzyKoLkPWuAF4cZ/YZ0gSPo+4iDETkxQHDsFX G8bgr8Of16+b8imOvTlUtX/HvR8+jCHxUkFA4sYjirc1q16v8sOr4THoSV1Z8Zmfo+XCMXjN0BRc WumdtAnfROoTi0e+y8SM0VFyclZ3kPGfIc/hi7dfxn3u5m+OXj9XiE2b9+GCcx8EDPdhEx6jF39T gAIUoEDjFqilmEF74nskPf2Q3M2K2UV7T8EXK5Jw303WIW/La8dF9yyJeOJ1/UNUs+PEgveEJKS/ +YxZ39dV+U4HNNj7yTwMm2pslWJ+Bu8pc5AePwX9OqjHcE43XBCxUIJ6LOT9HNZ9MguDbqx8H9jm Z69oyREBL8xF0uYcxOvilRVYsv4VpPz1JrODKnQXgwAmfr4UzwTcbHaM0u/N1WvR6uOReFHqUNJs Csan+zLwQJdfMe8pf/ntSeUuj8//Gslh1n10n9z9OWZPexIr9CGc8hAxL+qUKer0gHmdWl/+CU8O GAHpUr2TvhMxmb5fcrO6rs1D51VT8dQS64KlPtKXJ4ehh0UitdXFQqx6axYiVQdJBJ55JwcvP+YP J7NaanF417fYc6gMbv4PYNBN5jGf2a5coAAFKEABCjQSAeMjuUZSnT93Ndr7hmLOEKPBAmz5TXqa bD1NTfgXPn3O27BhBYa99IUIXSs3XbvWEf0HDzbsvAkPP/c+Cq+q9+d4rU0X9OvXT/fTTX56W/F5 2t/UH8ZL2PzaCCzZctTmAS499GX3E2/imYf7Zfh69kj1QNpQ2ofT/oYeL+egzKL0Dn0MKzbFWyQV 9esd+gci1njMkjU4oHLtLVseRY4hqQhMwfD+xpCvevW6prlgPCOSQs2TitIGlzb6qz+/cyEGWiQV vb2N91nsuGkBHr5jKr4/00Iur2XL40gd7Yux4eEIHzsEjy/ZI2/jDAUoQAEKUKAxC9RGzKAp/Bzd b7WRVJQuft8SPOzTHZ//ahkpleHTaV42k4q6Q1fEw9/9bRxXDCBY2e90iAhFimVsJRX1VXsR/n1f xC8X1eOwzKcftB0L7VuAEbfOwoHr6sdK5ddkunatCx6NT5SL+DBzi1nMpfnVjrvodCdhzJ0If+9H 8Y6naVL6vRysllSU9l2Nsd4hmDRePako7fHhtAeRsvW0NCtPV37NRP8HbCUVpd1EnULvRLLFcdcc HOBmKKW3oiGLWV1HBqgmFXWlij7SB0z7yiwWb9nyFBY+5GueVBQxnSKqw8LngzBR+Cin8zsXYFDg WEx+cjJG+IThx8sVvZmpPJLzFKAABShAgYYTYGKx4eytziwFcYMfCTKtt3yJz7DlQrkLHohfgAnG PVeEI2l9sXHJ7u9bhwea9ln9InxvCkDyB2uw97dilKk/NDftb2eu3KU/xAuV8iR1/D308TeR8798 HC29KK+vaOZ0XioeXWB8IuyNN7N24Pfjx3H8+O/YkfWmKShbEo5/bT1fUVG6tw2+/F40OxZNi3f/ 9CEGtumOv6cYjZdgwy+WqUnRyOm3b5FiKNU7Yazc9Kf26iWemH+0Frv378dPu3fjw7BbxZukp/BZ kv5tVenUMYvW4jfRZPubb77BHwd3YPGzxmTwaryUabQBWl0shnhZUZ425+w1C/zlDZyhAAUoQAEK NDKBmsYM0oPAd3z1LQKkS5PeHNsqmsweO3YMRfu3Ys4UUxrnyScXmyUIrx7IwlPym3ITkLHpR12s cfLkMfzy3acwHZqIj787VYGc9Xe6tLN5zCDeTpO+14tLcPLYUezb9LGi/CW4P2WzWfLN/GQiDlqZ Jx+7e+3b8gNcYAEWrz1ivnstLnW6PQDBcnmmxGyrVoV44x6TO4YkYN3eQhw7eRIlRfn4z1uPy0fl vCr66/7ZRkAr7SXevPxip3TsMfy2XbjLR26CvnHOBOH/i67sP8Q9XWC6MZib8pUi5inDZ/+Iko8O fe3f2CF9FlTqNPcfH5l9FuSD7M6Iz0nuPhw9Jq6zuABrFz1jOmLFo/jysCmIPrs7E/Iz6iGx+FL4 nBQx3Tcnj2LX+jT5Hm5+9XV8f8GUPCwWcaFp2oSdh+RmRqbVnKMABShAAQo0MgEmFhvZDbmx7wC5 RkeKz8jzZjOiX5xyBx+8teFNefXC0OdEsGJ6k03eoDLT1kc0C5phTFRJO+zD3JcmYpjf7bi5W1eE P/sGMtftEInACgJBlXKlVVJydOI7H8sBk7Ru32oxKvTDQzDAwx1dhz6O5IWf4HvR740pRJX20k9S gm3VDFOTofd3rMeUwb1FXzut0KqVE3oPnoJ1eW8bd0dSymc4pXiTQN4gZga/+AVyF0SK/gtFfzld uqGHoS+j/qMelXdblbXTKpj/ae0aefvUUfr7UXv1GiKa92zCM6PuFH1AusC1Rw90bHMNLcrP4/dN xtMmIfr/7pT7JmrdoTfGzZyHt6IeR5T4GadoCl3evi/CTFE/QiffZ9Gkxlgmf1OAAhSgAAUal0BN Y4azO1bJDwIx5WOsfXMC+on+lR3EG2jtXfrhCTE43ALjd6RuILqzMsA1x16IeeYZPCN+3t8yB0Fe vXSxhuifBV09huKtj96X9837uUSeN59R/06XWhMsU8Qy8Z//jETpe72NCLsdHNHd60HMWbPRlLRb kI6ftepvHqZt+RpTAkV/hYZje9w5EctF1znG6bc/Thlna/339Tau8DfmZg8V4cw1/Z8NZ/73uUhp GqbgOSj4/HnRZNdZ1/qkZftuuF/0yfjDElPS7YWFaxUJQOOB0u8JWPfV66KLF+lYB3TsI9x/zFDs IHx/eRcPenTVld1a3NPH3khXJB8Vu4rZnn+LwTMx4p7Gf4R/Rj0k+mEUnwWxXl+nZHxsTEru+xHF Nt4SNS9RuTQEXxx4D0EDu8NRFNpStOq58/8S8c3rxofVov/FC9fkA84fOSbPx8+Kwd3CRz85oueA UKSufBOPR0WJn0B0UDSh7iuaP5umKbivn/E401rOUYACFKAABRqbABOLjeyOOHftKtdo+6/H5Xm1 mXa3T8GXcoJwE8ZGfmgzyWZ+vCPum5aF3avfNgW1ih1yVs5B1IS/ikTgTQifvxbHDYGkYpcKZ1v1 ehD/KdqK1GdNwZZ8wL7VmJswFQ/d54MeXZ9DTv5JeZM0c714i/yEd/CMdRjT2zrQbn2reGJsfF1z 0yYUqQaHwZjxvHr/iS3c/LDA8FblvgVfmDWHlt5++O+rOfo6eSdgqKe+b5vaqtfg12djaPfrZtes W9BqYXqfcys27jf98SNtL2/RG0/MTsFs8fPMqL/oDpH+kZq2j13yG3b8sEP85GN+sx61Ub5szlCA AhSgQDMRqH7MoMUPq78wKIikz4y/WfS7rP+ODEtIk6WkgeiMk2OvoYhLTESi+Blzi6Nxtfy7ZW8f uWVIB6g/uLX1nX69eDte22coKngBngq4US7XOFPezgcpmz5Fxscf4+NPX4SHg+ltN+M+CP4Xgm5R tM01bHBSvEkotVQ4a+MBq1xONWeuXXPGjX0MB+/7BSVXpJhM9DW91ugOvB0fhi4qfYj3GROJ54zn XfEZ9qs06R38eqQYuM/8IXbL7v1kdwwZi7u6msdM5S1ugp8xWWwsX/fbCQFPxCExTtzTF0ap9Dft AJ+7vOQjHK6bkoDyygpmBr/+Ku7rZF5XaXevQFMicOfOIrkE7VWpE3H9tHtDHk5ZxNI9AqcgZfZs 8TMV/dub7n3rWyfi4E9STLcD+UXJcqsZY1n8TQEKUIACFGiMAtKDPE6NSODyRdPgJ943u9it2T3R 8xD7mq/+if2mF5HwUQDSwkTiyTr2sSqrxz0T8eHJCSgtPIB9u7ZjQ+56vLvSkFQz7J3zWhhyPk/A 7g3PW3VKbVWgYkV5+354dFYGxr90Cgfy9+L7bzdg/RcLsdoYaOv2XYHwISsQI57kxxmC7iunT8ul bP48G5/3K4RheEd5vRgQUYz0bFq0FRzaWi8l4wLFGwrYJA0MIzWHno3+PvoEorIZdNBTQfKI2bVV rw6O1n8gSFdS3ro3Rk0RtVkiLa1G+L2r4R08BeMeGApfEQh79umpf1tB2mwxSSOL9765o8VaLlKA AhSgAAWahkD1YgYN/ig0BhWbsPY/n6LEyTJZ1AatTu+QETpIAYTlVF6Go4cP48SJUzgjRoU+XXYa F0ov4MKJX6AINSyP0i3b+k5XxgxBI/xstiTo6jVUvCmpWrRuZdAIb9Vjr7dxwUBvES1Ily8Glq5o cEDbpdvf0rLlZZyTW+L2RmdHyVercJ+Agb2l+MmUGDOWeu1aD4wXXc8siJXiSvFGokoiT9WvhSmA DQryUb1+4zls/b5YehQHfz+Ks2cv4qK4n6fLxP28cB4F/823dYjd9R0cnVT3UfYfWXbF5HDz3dIT 7A91x+S89n/Iec0bj78YiiH+vvC+zRM9RSsaW3+EdXDtLd1WThSgAAUoQIEmI2DrO63JXEBzq+gf +/LkS7rlFusn3PJGw0x5i954ccf7SDH0MZQ5zQ+Bg09hbM/WuGC5s+qyA1x698dg6efvEzFrfhmO /bIdi0Xfggs2GQ4QzYf+mfV3pI11Vy2hopUt23eBx11DdT+PvZAIKdj74cvFGPO8abTnuWPmYMwf c/RPZU3dzIg21Asg+q62M63G94UX4HNrOzv7mW92u2+MeFtTJDrFaqk59FM+9+oCPFMzaG+EPygS tDA8Ka/zejnggZlbMeOA6Kjc4L5v9RLRjFyXadRVfvD4GfhHvGjazRECzW8mlyhAAQpQoFkIVC1m gNkbigufF0/n7Ew5OT+g7HEPOVlVuHkJwkNeFh3C1PKkiBkCBvWqfuFqfcaI0q5d64Re0puEUsXl xF/1T2PryBZXiiEahuinYA/c2EKfOJPf7wy+F33V3rQ0HOLQxpiMW4FdR+fBp58CxtZJzdarJILN tpsvtDp3AOmvv4TYDzabb2iApevdg/BDZjzuDE0ynH0fPpwjfuS6DEH8klfw1MN3yp9HeRNnKEAB ClCAAk1MgInFRnXDyrBri/RkVz9dMT20Na5S/d2q9xhsm58Lv2mZuu1PDpqPu4sehKvq3nZWin4M u4sn6DM/O4rA+ZF4+DV9fTJX/A//HNdbpWmJnfIsNrd36YGAxxJxPHA4xnmPhT5eXYL/HZiF/pbJ Qe9gPH5XV4sSzBcvnXBC/05VDVTFC51tfTBZ/A0i5e10zaFfCcBtjkWmZtDBkVbNb+Qz11G9pDc2 pgn30ds34av165A750ODj/7Mm1e+Bunn7bzDmGhpJVeOMxSgAAUoQIHmIVBxzGB+jUHjn8CN7QwP A8036ZYuXTqBdnf0lZORJ9YnwDfU9JBT2sl7SDB63+SEG7v0RJdL32NOLSSozp29IErurKtDU/vn cuEu3QNYm/UWrzNeFs2wnVSaQpsf4y3edqzb3pdaXS/EP/v6m/rclCogRmEO6i366b7xRvR0c8GO pLlmcZV5HWt/6eYHXsCJ/cHYsP5rrP1vLj7IUSY8NyFpivjJ/Rd+Sxtb4/i69mvPEilAAQpQgAKV F2BisfJWdb7ndbMRCqUOm9Wbl6hV5JaJiZiTlYkXdZm6RDw364iNHoHK8Nveg7jUQguHzp7o36O9 WnFinSMGR8UgWCQWpbf6KtvU5uLRAyg4fVkc0B4e3n1tPoVt1X0oUlKDcHe0KZEqnQZXTU3Bg55L RMojNXjSryvQ1j8O8At7U7Q9flnsICU234CP8/dyQPrMY4Hmda+3ejmiz10PYqr0849knCs9jkN7 v0X6zCis2Ke/lhdeXYOQz0LM62frMrmeAhSgAAUo0EgFahIztGyphUZ+W28C/rFgLvob3qizd7nS gGz/XWhKKj4+/7/4x//dgy5iMDXj1KrVARz9wB8rjCuq8lvxYDhv11G84N8UE4tlWJ30gnzVoX/T Dw5n5r5pq+jn+ll0aWtykw8QTaZPHf7DsNgHN3eV3j7Uv/Fo2qf25i7sXS/HcLqRppdNE4PCdDI7 wR9/OQKfJ/QP4c021OFCCzHgzAP/J/08gzeunMXxIwfxv+x0PP26oR4rnkL2tGBMrPLbnHVYaRZN AQpQgAIUqKJA3T4+rGJlmvvu2go61251fi/+4W8K4AanTKxSh83SyIpPLf5UHo158wcfqD6VvXYo B37DhmHo0BG4P2xVhR1+t9ReMrWwOadBRfXX3zsNNrzqjxFDh4qfu7H0FynBaHu6KP9BYNqn/U39 5WvI+Xi97cFotBqUlZWhTFP9INXZZ4jcsfh/N32HbZtzDRUJxpj73EyVEnP1US+tRgON+DH11+OA DuINzwFDQrEwbwdijTXatBEHbYweadyFvylAAQpQgAKNW6BmMYPUX3L/wYMNl7gCG348Y/NyNVK8 IH6MLYtblCma+A5ZgFlhfmZJRamgqwd+qF5SURzbvpenHMtsfvUzFLZqpVq3X0Tf0wnJyUh++5Mq D5SnWmAtriz4dBae0j1ZlgoNRkSQ1D2MfkAck/tqfLW9RLfe8p9Wl37GojnGN/Scgao3LrEsssLl IkVXQm8uesUqqQgxLvUP6+oxqSgG5ZNiOo0pqBMjSXfETX0HYezzafg5M0a+nq3biuR5zlCAAhSg AAWaogATi/V11zo4oq1qUxEtCrd8hL/3GSbemzNOwZg9foBxodK/r3QdivcyxaAkFUytew4wjba3 70V8sOmI6t7S0/zMmQ/JycnBgwdUopmGI279W6hcXkL8v1B4VT2YvvhTJoYaR18W4bdPL3031Vc7 DUSYcbQ/MRjNG6t+lsszzkhJ2Je798DNN9+Mm3u8jsLr6ucw7m/rd3mLfnjkdf0fJZtffRgPGpqS 47nJ8LEYpbCu63X1wEfo3qMHeoifwDe3W1X5+nURkYuO2nWT9y1wbWNq7nU2/2u8ERuL2Dc+wC/n TOutCuEKClCAAhSgQKMRqHnM4P23MfLVJDz4Ovaet44HCj6NRQ8pXhA/r35leIPOobWpu5hN+3HC Io5odbUQC16Mksuu6sxV5wF4fILxqAWYPm+znNQ0rm1x7Gs8PSUBC+fOxdykHTjfooVxU738btNa P2id5cmui34KP54VgvueNvUGGJQaZzZ6s9dDplhv7pgEfH/CvO4tW57Fmreek5tReydMgk8FfTFa 1qE6y+3amPol/73whFURxev/hfBqvX5qVVQlVpQh68nuupiuR/dH8M3JivuK7PkXF7nMltdOYf0H yYiNisWS3AOKh83yLpyhAAUoQAEKNDoBNoWur1uyejkWfnAGHa4bEj9t2qDFySPI+2KuxUjJ3kjb nAafdtV7E+/GB+KRMWGhzeCpvHV/RIpR+lboRukDksbcji+CY/FiRBC8e+o72T71ax7eHf+CHBBK RE+E3F4pqf5/jRDPtTP1x25KhO9NWYh562UEDbkNNzhcR8vLJfj284WInqNoAj3lOQxwNrYbckLw S2+Lzg/1b29++PR9+G1fKmZMuBPthN3pg//DnEkvywnPoNQJ6F3Jpk9qF+Dzt4nAq8Yn6vo93hzn pzJSX93Wq33Xvrq8odTaeV/KKIRfX4yYCQFw79QKpYd+wLLXHsUCQ1No71H3yKNV6/oUGvKonJT+ UOOJkzPvU7tUrqMABShAAQo0KoGaxgyOHqOxIPgFPKd7s24JhvU5gLdXzsTwW7tAc6YQmz6Zi9h3 jd/xwZg0pKe4/nKUt+4DP/EQc4nuuAXwHQt8PGMC+jq3xMXCLXjbIgaqOpojHpqeBqzQJyc3v/Yw euxKwKfTHkBXhys4vusrhD4/Vy42KGVw8LZOAABAAElEQVQK+tUglpELqsLM+n8vxpVextcI26BN mys4ujdP9CupiM+k8qZkYP5j/aVXFeXS29wiRnsOjjK4r8BDt+5F4kdvYHifTii/XIRPpZhF1zWP dIg3Zk2+W/yu2wefPe/0FefQJ0MXThQx6zuZePSe3mijPYWtK0Tc+a7FdUlVq7PJCb0GGYft3oSx /cOQ9lkshnr3QOvLJ/Dj2mUIfcnYFN8b9/STEot6n6NfvyG26a8DmR/iL7+cwtCudWtXZwwsmAIU oAAF/jQCTCzW8a02NruBSIUlvSRHWepnFQm+dW/9A4NurEkA4YiH39qICSuG2WzCc/uUufjXzhw8 ZXhyu291CsLFj60pJnMPgnpZvwWgtv9V50FYuOFtrB5ubNa9D3NfmghT+GxxlHcstr7+gOjR0ZRI bX3rRGxd8iv8p+iDrs3vRmPEuxbHSYveCUgaL4JdmIJdkzegbSG9kGsqVzrEcmpx82Akidgvfp9x Syz+6iUSrIoA2ril2vUy5kyNBan8vtrpPiz54HH4PaEPJnPmRCJnjsqO4n3Tt6PuFRsMhZafh1kj pMLjorEP2P+iGh3XUYACFKBAoxKoacwgNYd+LHUj9h8aZnj4tgkvjB+ueo0xn7+leGjriKBXROJv tT7xh00L8Kj4qdRUie90qZyWfUKxJ7MYtxtHBV6diLHix2oKXoC5UxSJO1H+BaudrFeYxTtSVzsq cYv1UaY1Oe++CnuptpglGxH7sA8crMp2wmNp36Lo0P1I0cVP+5AwMQgJpuLlubfXZmFoR0Vca8+v EtevvHbjiVr2CRIP1qPkB+sLnxfdyBg3qvw2ixFtndNeXVXKNa7yj3gPUxLvNzz4XY2oR3RZbONm +Xfo/MVmicNLpSfkbdLM4TOi7/GuxgSw2SYuUIACFKAABRqNgJR54VSHAo7O9goXI9Y9MQMf5/6I Yx++bDOpeP26qRmFS7uKb1t5Ox+8tUEMTGKcHI0z+t9Sf4whC45ha9bbCBZJNVvT4PEz8OXOI4h7 wLy/QVv7G9e3u32iGAXvW6Q+G2RcpfJ7COKXrMVvm+PQr7V18q/fw4n47buPMWWIyqHinchE3bHP o0dLU1IR4j1D94HGc7qiXSvlNrVypDi8C4JfNjUfD0oZgx5WAbTp2OrUq2XnbnJfSzd2UW96JJ3h L6NT8MumDDynelO88cxbmcgvTsMg+e1OkTZ1uBVTXzdeM/Dms0OZVDTdLs5RgAIUoEAjF6hpzFB+ gw9mby7AqrceV73SoCdeF7FMIeICTE1lpR3b3BKK37d/qvqdG/riB9h9cCtiDTGSUxvTw9XKfqdL 53ATowIf2fkFYlW/14eIWGYjfv9wAroo44627dBbOlhMyvPq15j+leNLtxtUEn+m/ZRzylhSuV45 7z1kAuLF2347Dp5AnJRUVG5UzJe374+4zb8h5x1TDKXYjMHCfeNPxzDxTlMzX2m7XT8H0/XLQ3gr CxY16uJquDGimyHT5ITRaTbq4z0B72/+RSR6Ywy7O8PBQREjKs1vqNq9bunYWe6pRhnjST4pxfn4 6K1n5O2muopn4+Jlgo83/YK0ME/lavzlwXAR5Rqm4Dl40EN5jcYN/E0BClCAAhRoXAItLl68qHiM 2LgqJ9Xm7NmzaCU6vW5ZwcAnja/WTalGWpQeLcTvR0txUerf58oVtG7fFTf37YNuHU3JzOpe0bWL p1B4sAinzl4UUbxUfBt06eGOPr27qceLKicqO3UcZ8rbwbnVJVyGM7p0cbIZ6KocXmer6rJeV4Tb 6fNAW5GHvHzZAZ26day0V51dMAumAAUoQAEK1KFAjWMGTRlKTp5BK2dnaC+LiKFTVzg5mhJFtqpe dvY4LmjbithCi7bOXcQxtvas/nrpHGc0rUUscxWXxbm6iO91W0m76p+lgY4sF+7H9O7lFy6gVecb 0aV9zWPIal+NqM/xkxdEDCXuqLadiBvbV7uoWjlQDDh46pQYXEgf1AE3dG5Yn1q5KBZCAQpQgAL1 IXBNPHwsLy9Hx44d6+N01T4HE4vVpuOBFKAABShAAQpQgAIUoAAFKEABClCAAhSofYGmklisuE1t 7buwRApQgAIUoAAFKEABClCAAhSgAAUoQAEKUKAZCDCx2AxuIi+BAhSgAAUoQAEKUIACFKAABShA AQpQgAL1LcDEYn2L83wUoAAFKEABClCAAhSgAAUoQAEKUIACFGgGAkwsNoObyEugAAUoQAEKUIAC FKAABShAAQpQgAIUoEB9CzCxWN/iPB8FKEABClCAAhSgAAUoQAEKUIACFKAABZqBABOLzeAm8hIo QAEKUIACFKAABShAAQpQgAIUoAAFKFDfAkws1rc4z0cBClCAAhSgAAUoQAEKUIACFKAABShAgWYg wMRiM7iJvAQKUIACFKAABShAAQpQgAIUoAAFKEABCtS3ABOL9S3O81GAAhSgAAUoQAEKUIACFKAA BShAAQpQoBkIMLHYDG4iL4ECFKAABShAAQpQgAIUoAAFKEABClCAAvUtwMRifYvzfBSgAAUoQAEK UIACFKAABShAAQpQgAIUaAYCTCw2g5vIS6AABShAAQpQgAIUoAAFKEABClCAAhSgQH0LMLFY3+I8 HwUoQAEKUIACFKAABShAAQpQgAIUoAAFmoEAE4vN4CbyEihAAQpQgAIUoAAFKEABClCAAhSgAAUo UN8CDvV9wj/L+QoKCv4sl8rrpAAFKEABClCgkQl4eno2shqZV4dxkrkHlyhAAQpQgAIUqHuBxh4f 1b1A3ZyBbyzWjStLpQAFKEABClCAAhSgAAUoQAEKUIACFKBAsxbgG4t1fHvvvffeOj4Di6cABShA AQpQgAJ6ge+++65JUTBOalK3i5WlAAUoQAEKNEmBphYfNTVkvrHY1O4Y60sBClCAAhSgAAUoQAEK UIACFKAABShAgUYgwMRiI7gJrAIFKEABClCAAhSgAAUoQAEKUIACFKAABZqaABOLTe2Osb4UoAAF KEABClCAAhSgAAUoQAEKUIACFGgEAkwsNoKbwCpQgAIUoAAFKEABClCAAhSgAAUoQAEKUKCpCTCx 2NTuGOtLAQpQgAIUoAAFKEABClCAAhSgAAUoQIFGIMDEYiO4CawCBShAAQpQgAIUoAAFKEABClCA AhSgAAWamgATi03tjrG+FKAABShAAQpQgAIUoAAFKEABClCAAhRoBAJMLDaCm8AqUIACFKAABShA AQpQgAIUoAAFKEABClCgqQkwsdjU7hjrSwEKUIACFKAABSjQfAW0Gmg02iZ1fRqNBk2rxk2Kl5Wl AAUoQAEKNGoBh0Zduz9h5cpKi3H85AVopTsj/nHu2g1uLk7NS0JbhuLi47hwWbosLRzaOqObmxuc qvBplJyOCicHcYxWOHXq3gOuHRxrz0nUsUTU8Yyoo4NUR+eucHNzEfOVnzTnSnD02BmpAFFCW3Tt 5gaXqlykOKq0pBgnRSWk82odnNG9hxtq8zKhOYei349BdyvEOdpW4zorL8I9KUABClCAAhSoSKDs 4FpMGBWNArFTYPxypE3yrWj3RrCtDBvmTcXUxdtEXUZj+ZZk+LpUJVqqhUvQlCDv80+QnfcTLraX yrsNMa9HoW8thoW1UEsWQQEKUIACFGi2AvX8zd9sHWt8YaX787B4fgoycqVQ0nzyDIxGQnwEfN0q GyFpsGPlPCR+vAWdpNB06CK8P304Knu0+dnVlqpZvrYUeZ8uRsTMDJVCPRE9NwERQb4V1/PcQSyb MwtJmVIAaz4FRs7FzOgguNboU63B7px0zIhJ1QX1ZmfwDERyQjxCfN3MVlsuaEp2Iz1lBlKzre9l YGQyXo4Kgbudm1G8IwtvJ8ZBpQhEJi9FZIg/apZuFvcwKw1hcYstqy+W/RC/6FU8OtyjSolUlYK4 igIUoAAFKECBKggUfpstxx+5Sdk4GOrbuBNkZQeQoUsqSheZjezvpsI3qG8VrriGu5btR8Idwcg0 K+Y8npoVhYoDSrMDuEABClCAAhSgQA0EapSCqcF5eahC4ODaZIyKzlCsMZ8tyE1FmPiZnbUd4706 mG+0XDq3H2lxwUjNVWzoVAKNWLSTy1IcUMFsdcvXHETy7aOQYbPoAqTGhCF1UzK2p4RA7So1xXl4 clgErFOK+kJzF8cgd/FeZG2Pgz0m9WqUYGVUAGYq7ZQ7FuQiLiwX6yt4g6B0xzLcE5akPMpsPndx nKjjevFEf76NJ/oa5KU9iYhUW1cJLI6bjMXrY7FxfgTcqvVfcCmyYu9BXLZZ1RQL25A0NRhJ4anY GTeyhglMRbGcpQAFKEABCvypBbTYuiwRH207hfZ/GY1Z062/Yzt362kS8uyHrrUSvJmKrPU5x864 VRRqjFrce3WtpVPYt5JOdHDt+4qkoici48eia5ueuKmxu9WSEouhAAUoQAEKNAYB9rHYwHdBU7TW LKnoFx6P5avXIS8vD1lLkxGoqN/MkDQclDKENqbirSsx+i6LpKJh31Y2jqnK6uqXr8HaJGVSUbwR l7oc68Q15q3LQnKk4iqz4zAn56B1tc7txnSzpOJopC5fI5w2Iit9tnjHzjhlIOSuNBRXo6Of3ctm K5KK0huUS3V13LhmFeJDPY0nQG5SGFbml8nL8oyo4wxlUnF0NJbq7uVGrFoUD0UJCJuRDZUSULQ2 ySyp6Bkaq/88bFyH5amxpjJyUzBs2kqck09e2RkNNiSbJxUjk9OxZmMe1onrTI4cbSooIxqpa4tM y5yjAAUoQAEKUKAGAhoU5mYiNzcX2btOo1ylJLeR0SL+W4ql6UuxJuNR1QetKoc13CoHd0zfmIV0 qc4iLgsfoPZouDrVs28FEUntWm98SuqJ9LwsTJ80CZPGD69h65Xq1JfHUIACFKAABf68AkwsNui9 1+L75WlyDULnrsayuEnw9XCHq6srvPxDkLZnNcLlPTKw4Re1VJJ4qpsehWGTZ8rNZzxNWSz56OrP 1Kx8bfH/EJ1pPHs4Vu9chkkjfeEurtHV3Qsh09OwZm64cQdkrvrWKmG2NX0G5BcJPSOxbk8KRvr2 FU5u8AoYj2VblouefYxTKt7+SiU5adys9luzH/9KMp7BD4s2foKoIH9dHd36DsCkxCwsjTalL2dm bxM9IJpP+7/8t1xHv8h05KdEwV93L90wYPgkZOWlmxKguXH4ttgiSyzqkG6CQmhyFrITRRN4qQw3 d/iOjED29lUINZ42dyZW7Vb7PBh3sP5dtv+/mJphXO+J1DU7MT0kAH3dXOEurjNkegry0qONOyAj bTVK5CXOUIACFKAABShQfQEHtLnBcLT4rf7Q10nEf/7wD/BH3/ruq7CaF+bo5oUAqc4iLqtWQwrV 81bGSnGg50h41qwvHEVhnKUABShAAQpQoCoCtff9X5Wzcl+DwEUc2lJgmA/H00Ee1jKOHghLDUeG oal0G9U7Jp7qbjYmxYDoRWsQNRhI8BqlaB5iXXTl19SsfM1pU5IvdNFkeKh0Dtj3r2EIj8nQN5W+ oY15sF2Wj48WG538sDRjunUfhS6+mLU6GdnBcbrLyo5Zg9igKLhW8iLLft8nJwU9o6Mx3Ko/Swf4 T4yGX2qYvrnPzyW4KMo2PZcvw74841NzPzwTEWAVXDu4BiAmNhDjUvT36vhpkVhUnKfswE7T/Qqc jZdDvKxr32EAXs6ajcyQmbptKf/ejAkDgirZXFmLnTkZcpnRS9Mxsq/1zXANmID4wFQkHZay0xpc ENV0dZQP4wwFKEABClCgngTEIGbFJbggztZFPEh0ctCi5GA+CgqP4eLV1ujYvSd8vDzMBn8rLdqP /QeO4OzVq0Drjrh14CC4u1T0JaYvc9+vxyCOEFNrdOnTHz4ebpXoQqayx2pxrqREDJR2GoWHdScB DotB6MQ6Z614TCkGZ3NzNUYUGnHNp3SDqrXt6KoY9M3SAmI/ca2/GK+1PXr284KXu4vhBDZ+ac9h /67dOHRKRDGthWGXnvDo7wGJSFtWipKz0nBubcUDzcoPWFeZ47RlJcjfuw/HzhqU23dB/wE+cLMa ka4yVu11nwutg8JT1PqM8NRKnlWufwkK9hbgyFkpshOT+Nz06X8bPNyM90S/2vSv5b3Qonh/Pn47 ckp8Lq+iyy13wbev4j7UgbmpLpyjAAUoQAEKNLyAapqq4av1Z6lBewTOWYXbzokgq514e8/GZbdt X1FArD/oihh8GOJdtuUb4/WDvIhk3Ckb5VVndU3Kd+r9EFYtH4irItZzvc3GVYrhnR09Rc2k/OF5 mDUPKhIdmetTcYBn5JPwV8Rqymtx8hiJ2YFxhubMqfj+YASCKjkkoFNXd4T6+aFQFPjQ/TY6HXfs gG7KE5rNO+EvAaHwOy9K6P13eNiIRW9w0Q1XaHakcaFcK/3ppJ8iHxlsM1no5Hm37q1F3Uug2Wtw YFYQBljnB41FmX5ri7BOTtBGYoy/jXsBF0xKK8Ak05GcowAFKEABCtS7gKboK9wzIkZ33vily4HP wiDGM7GYApG+cT4CuhQhbfoo8z6mDXuGzl6OhPG+Vg/8NCU7MO/FMGQYOwhUluwZiqXvxcNf8QBQ ublKx2oK8GxAiNwPoa6cgsUIDlisL9IzHtuzJ+kfVpb9gueHjdPt6xkrWi5E6B8ymlksz4Kz6Dom LlMKmswnz9DZeC9hvGofzCW7s/DiuDjzehgOj160GvefeR/jdB0w+2GVaF1SqdhCHF/w2fMISZIQ 1Y6TBoubJwaLyzCcyfxX6OyliB/vb0riVsbqkzuFkaVnqvBMNRSuVg/z8+qXKhrITsSco+PxzqxJ sHwGq7wX0YvSgYwIKLvG9oxdhWxDYrGuzNWuhusoQAEKUIACDSXAxGJDyevO6wA3jwGoeIzhUmS/ bwg8xTEuN6glGR3h/8py5Pn6mvqUEXfWdgqrqhddw/KdRFNgOyMpl+74EnLOq1tnU4Apqnr5dKlc 4bEjB8jz1jNOuHd0OJCbodv0/a/HRWLR3Xo3tTXijcfEZcvUtpjWnTokxjs0TJZvVYrVA8YnYtl4 4w5qv7UoLDD9EdCmtXkjqJOHTf0Zdu3mrFaAfp1DV/STWmXr/hA6j3NlImPrZP8/5bKDu+Q3Ij2j B+s+d9pzxdi1ey8OHD2tL9vZFT63+4o3HmxkRm3XilsoQAEKUIACtSqgvWx64JY0OcxG2bmIGPYE Av22IVctQSiOypwZhk698zBd8UCt7GAO7hilT1qqFlyQicnDMjF39U4EWTS1qPqxrWFsAa16LuVK 8aDV+BCzVxvTBjOLsBDTBou5gsyZGHapM/akjDSLpUq2piNgcorF3qbFVDFomzEtB1Fb+1GF6djW bYw1tjyuDGuTJyA6wxT7mI7Sz2XOnIzMn+ZiZ6Kx9UXlrCr2tKyH5Vml5XPISbgLMZlq2/TrCrKT MEp0fbM0bz78Fc2slfcidWqEVQGdDM2L6tLc6qRcQQEKUIACFGhAAfax2ID49k59rjgf6WL03hRj oByaihHuaolFB3j4K5KK9gqu8vY6LF80D8lfmy5GUjYFu3OnDlUEwxoc+smYzgvEnb0rTnh16dNH vrpTx8Wrj7U2lSHnPVN/mOGP+Nt8o9DWKcv2f4V35OA6EoMt/lDp4XGbfGjuN/vleasZMTK36Y+n bTh0wtB0x2pHyxVX5BVj/VyxOysZXncNQ1hENGbOnKn/iZmKkBF3YXTCSlh2ASkfzBkKUIACFKBA Qwh4hmPpuu3IL8jHljXppj6HxZM2/ffiaCxanSe2F2DPljWYrRh4bfHCDYpB04qxWJFUlN7yW7Nl J/Lz87FTHKccsC3mxQyLvoarcazo1mbezp3Ys2cjYqUHg9LkF4uNe/Zgp1i/c0V1BmkRg9it2og9 +QXI37MFy5PDdcXq/smOxroijWlZ9OGcokwqBsaKfp93okBy2r4Oc5WD6JmOqvFcSd5iRVLRE/Hp a7BTGOfn78SadMWgdpkxyNhqeIhcGStHL9kzPtBQTaXnznnwcqq4+sUb0sySipFzV2H7HtHMXny2 8lYvUny2cjF59qeKz45auZ6IFYMSbtyyBXkbN+LdUC/Rk0zDmKvVjusoQAEKUIACdS3AxGJdC1el fBGEJIhRVzwNP3eJZh4phpxaYOwibE80f/pclaIb074HcxLka/T0ugsh0cakoviDYM12i+bLWpyu Qptux7ad6+RS92fNEgGo4Ym7ZzQmD6/4PVOrSoim6bOCY+TBdSLTRTMly53amt5S3JaaCmOMbbnb 1o9SVZsxWe5nuSy6QZdXJYWNEM2dMuRlcUNM82JO98bD7ckVjkJudgAXKEABClCAAnUqMBqrVsTB X7xR7yD+59I3AAnrTO/YSc1w0/OSMdzDVfe2naNLX4xPeEeRIDJVrnTH51hsXBQPbT9JHC8GSnGC g3hb0EkcNynx36JrFcMOBanI3m1qOVHdYx2dnODo2FG0PDGUe4MzOjo6wkmsd6pEqwNjdfW/RX/T W8QgdgNEP5AOootGRxf4hsRhlejH2TiVnhetGQxT8f8+M7W4EH04b0mLgJerPvPm2MEdQWIQvVVy hs54VE1/ixY3KbIy5q75BJMC+ooGFuLuOTihb8AkrBB9Rhun1IU5MCpXxsq4jxw5mXmqPYQ3nkn6 XYLP38mQV8Qv34LpQQPQQcIUnx5Xj+FIVA6eKAbLW7u/TN7ffEZ87sSo2BFiUEI3FxfRN6WbKAdo GHPzmnGJAhSgAAUoUF8CTCzWl3RlzqO9hEIb+7XXXMQZWzGNjWMa6+pLpbauErhYquss0qzqpnSY 2WrVBQe3PorRoVV3qfJKqSlLsK7PIelQMZLyexHWScEKSy1B+tQQU1AfvgjRAVZpRTi6j8Dc0caC tmHyPVFYm19iXCE6VS9GzrwoTFZ25CNvtT9z/JAhMarY1S88WbylsQcF2dkoEG8QZC2KVWzNwPPp WxXLnKUABShAAQo0jIBf7GNWff45dFN85/s9hDsUzVV1tXTohoGmXJuh4lrsWrfWMC8SdC+qPbTt gLExyfKFbt5tHHGlJsfKxelnatCowi82WrW/6f6DA+ST7N171DBfhp1rMuT1ydPGiJ6UracBodNq NX7SFm9HiiHs8ItebvHQWH9+J6+xprhn2zYcthXnVsaqMvsYLltb/CNSjSFRYDIe8VUREW9OTl4U LkP9Z2uhPK+c8YuNQYCblJBUTg1jrqwB5ylAAQpQgAL1KWD5TVif5+a5LAWc+iE6NRlFV9vo3i0r /f17JKXqO3/JTo1Bduoaq35eLItoCsu9h0Yj2bkIbdqIlOGVUnz/nyRk6pp7ZyMmLBtrYpdjfoSp k3VTA177V6ctOSS/FWh/b/t7nNu90qxPosj09zDSRkfu6qWVYmVsgKk5u3jbcWPccN3bFNb7O+Kv sUuxKnuy4Y3EXESH5FrvVs01zh1vNDvSTzgvE87yJN4g8BoegZ2rXXCHYXTtgtSPkB/ub7dJkVwG ZyhAAQpQgAJ1IHCDod8686L1IwxL6wIDb61kFyUalBwxZpW2YeOXOTgpv/ZmLL21GHJ5l3FB0eNg TY6Vi6vxzA1t2qmWYXpHUTyovWKyuSD3mBIK75ttvM3neDMCQ4FsfdipWn5VVmpOG/puFgdtW7sO Of2OwTDstqkYwSwGY5an+vqjRFm3wABvm58bN5GsDkSGbgBB0bW26qT+uQQawly1glxJAQpQgAIU qAeB+voOr4dLaQ6ncILvyBCYUj1BmBTxNFa++jRmZkuRl+jnJeUr0SF3kKIPwqZ33U7uvggRP8Yp KGQSnt6xEsPCZupW5aaEIXv4ToTohuFzQOcuxj3t/9ZcOF1riUWpc/a7xunrJJ15dHIWpqu8aWi7 VlKn5eHi3hn3CEXWv6MqfNvRwdUfH+StQsqL49RHqRRFhSYvxyPi/cdxcVWL/h1dlH85heLViaZ7 YKyh9NvJYzTSIzMQoRtNJxc/FJ6Dl1cH5S6cpwAFKEABCjQygcqHtMocUcbMGLvXkZu7F2WTvHQJ qJoca/dEdbSDXOfAgehhI68IEVneMlA0m8iUg5aa1UYkDeWpIAMx0fKSjZl6jDcUdfPz6WGjPmK1 aLZtHAgxN68AZeP1nwHbB5i2NIi56fScowAFKEABCtSrQOWjsHqtFk8mCzi6YXzyOziUPUo8MxVT 9hr8MivIqjmQvH8TnXHzHY81cw9hVEyG7gr+822hSCyKzq9FoNvnNql9sBTo5mJvYZlIcun7BdLt aPHPqUOH5DVdXNSf6Ms7VDCjLc7DVEXH7qNni2RfiFSfyk5a5KVNVXRaLvqG2pKIyuTnHFwHIG7Z HoTt/h7fbd+DUxrpnI7ocrMn7r73btEPlCPy5iUaKhKIAXYGtJFrbHp5QbzaUdEfF2JESjdPcZji NQK5EM5QgAIUoAAFmo9A4OhQdKkgXLh06RTa+fRWfaBbk2MbRDC3EGfFidWjKC1K/jheN9XyDETo wIqfEl861Q4enW1mPeumXqLUK5ekIEtdBDBlID17drLR2sRO1RrK3E61uJkCFKAABShQmwJMLNam ZpXLKkPxweO4LI5r26mH6PTZRkDl0AMiJpPyarqpqd00TWkxjp7RXSV69BUdjesvw+rfHrdJySz9 ZOzbXFpq29kU8X/8zV6M9/I37GX5qww7sjPklQNvq+AptLyXykzpDsQNi5AHSAmMX46U8QNUdrS9 aveyOETIfSEGYvmWZAxQ6cLHdgmOcB8QoPux2kcM8pOte5tQ2tIF7Sr5gXC8UXyOxBG6dOH5ihuY O8iP2q3OzhUUoAAFKECBJixQjityf3yjMS05ER6V/B4FanKsBZky0LHYVNuLpm/8b/BbyXS4uaqd oRQ/rN2mtqF6666azhoYHoPEkL7VK0c6qratFHXbvOswItT6WJTOe/a4/Ii1V59uNuNXaVfLyXT1 9WhuWQkuU4ACFKAABepJgIO31BO02mm0RRsxbNQojBI/wzL2qu1iWKfBBTkIBpR96FRwUCPZpME3 ycN01zhq1NP48ZztamnPX5A3Ki4X7vc/Ivq40U9Sn387bJShObgRcYbkKxAJ/762UpjyaaxnysTI 3PeIptiGLX6iz8P5k9SbDFsfrF+zX4x6PS7JWEKgrl9MX5dK/NWiOYh5UZMQJf0k58BWH+bKkQY9 ox+CRyUv08HVC2P9DLXe9jG2Fdv6JJ3D9+uN9YcYwbKSJ7AFwvUUoAAFKECBRiPQAf38jF+G2di8 q9RmzTRlZSgTP7qGA7q9anKsxWlEzGMq12JbrS46wSdAavkhTQV4P3u3ftbi33M7sk0Dmlhsq86i 000eYpxu/ZT7n2/lEZ+tytJqdMZlGlsxiTiilq2UdduW/a0YI1p9yv9qpZxYVL69qL63cm3DmCtr wHkKUIACFKBAfQowsVif2hbnkkYzNCbMsDgRaw+qp5KK1qYjSX6IfBtustViw6L8yi6W5m/AvIQE JMxbhv3nKgjsKlug2X6iKfOdxqsswD/T1qoH0iKptnhGknzkwD6KgUacvDA+UnrXTppyEfbsMusg sCwfSYqmy4HJQVZ9Gdq9Tm0R5k0IRqb+RBgt3lRcFuFfpaYvRRvmIThGLkG8qZgGf8tRKg3lW/1q BZzJ3YZc6ScjBiu2Woe6moNr8fTUDPnQ8FE+8rxuRluKDcvmISE2Acs27LdIQrsgMCzcsH8Bpv4j A2q5xfysOZgpJ2jDcXuVBqsxrw6XKEABClCAAo1N4NYRD8lVSgl7B/kqDyzzsxJw+x134A7xk7S2 SN6/JsdKhchvsm37EYfrJ7MoBmYbpWuxIJ1/W8o4JOfkm8UHJbuz8FhYirTZ5mQ3hrI80sUHfzeG f9uS8E5WvuUewLl8JHjdrjO+4/YUFFmEoDW2shUTKetWkIqUZTvMPKSKlu3PQVySMRjyw8QHPazr X8Ga2jCvoHhuogAFKEABCjQqgUq8RtWo6tu8KuPoiYnRfsjVNZktQPSoOxA+exFChw9ENydHlJ0q xIZPF2LmYmNgIwbuSA2GaguW6sqIZNo7IVPlZFqmpg8K4gKqW5rqcR4PToSnyFRJTXALMqJx+8/h WBQTioG6ZiVlKNy9AQsjZhpbeou9wvH3u5VX6YCA8AT4LQ7TN08WAWrApKNYOmsyPDq1xYXD27Fg XLT8lqF0fMxoiwDQ7nWWYtm0EZBbGItauOAAVi77yfRHgHx1V3DlSnc8FC6Sl4r/gkp3L8OIqYvl veDpgqJvVuKnC3JobNp25QpcRCfpQb6K63Toi8eSRyMzTv+2YMrkABTFpuKxB30gLhN//PglxkUr Av/QVPxNN8CNqdii9e9gapIhsSmGduyTl48ARWLT7YEw8S5nBnS13JaCYV4FSF01FYNuEgO7XD6B DcvfxMwMOYuN8EWT4a64RtOZOEcBClCAAhRomgJOHg9hduBMw0O0TITcVYjZi2IwuP+NuHy6CN9m L0SS/F0o+ge8312+0JocK0YDgWsX6UGpFBHlYsb0NMQ+7ocOHdwxwEMRD8hnq6UZ1+F4RcSbkw1d tGTEhCBj1WiE9m6HS6d2ITtXqk8Fk90YSu1YJ4x8ZrZoSaIfBC8zLgSFBbMR88gdaCd2Lz20FQuj k0zdzswebRFv1NzKdkwk6jbNVLfspDAU7I3FK+GD4dL6Ko7szMbUmRnyRXlGPgN/F3mxcjM1Na/c WbgXBShAAQpQoFEIMGXQoLfBAf6RbyB62zAYu+PLmDkVGaaBiM1q5xeZjviRpuDWbKPlgnjqe1Gx rlwxbzZbfh6nlCuOnNA1wbX7UmRly5fKdvHHe+nRGBaRqj/TtgxMHZehn7f61w+L1k2HVStmF18s WpOKCaOi9c1SRBmTR6mVMVq8JRiLvpafbHvXWXYY20z5W12tMpJs3AjdVj/cNcE8sfjHblNCTrdL QQbi4nRzqv/4xd5lnlgUe3mEzMDsLdnySNKZKdHIVOQS5YIC45GXONKqv5/Lp83upujbUgMoEotw cMf0Latw5p5xhmRyNqLH6ROZctmGGb/odEwf7ma5mssUoAAFKECB+hFQDjqmdkaLWERtF5VHe2K3 DmJgvCwcOiwSbLqc2jbMnDpO7XBEpsfDfMy4mhzriIGjRbNkwxd7QW4qIqTYwzMe27MniVqJydY1 2bNQrb1ppX/UIqTjJdH/s3RCMW3LRqYibPGMnItYt+8RMTNTv135r70YShFxiurLk5PXeKwWA/MF x2To1m0TAa5q+OcZjfixXvJx+plKWIkdlffXMtatKCZy8hB1Sy1GcPRi3ekKslMwWfxYTaNnI326 Rd/elbwXNTK3qghXUIACFKAABRqvAJtCN/S9cXBD1LKdWJ4cLTdTsaqS52gkL1+HZdMDrBJJVvsa Vzi2Q0/jfG9n28dJb03GBhr3RPzj99scG0/eSZqpbPmGg9wCorBz3XJEjzY2aTYrTbcwOjIZ63Yu w3B39T79nPqORFbeKkSaqmtWiF/obHF8ClT7M7R3nQ4OaG9Wmr2FblZNpFs7V7EEZ+mZveUk/mBJ kT4PkTY/D6Gx6dieNkn1zdW+w8ebmteL5ONwD5UUscsAJO7ZiGRbkKKE2UvF5y2qCp83y8vgMgUo QAEKUKCGAg6dXeV++rq4qHxnOihiHdVBxxzQWfeGoKjIDRY7dPBCXPYWLIoPVa1lYGgslq/bjukB Kg/YanCsi284Vi+Kla9Ld/JObSB6Q9FPiviqvbNpVGK7FuJoh7ad5djB2ssJAVFp2LJ6KWIjQzFa JDhHixGxwyPjkZ61EdnTg9DN/FGzsUYi5qs4Vmzb2RhxWg8o5xEUJ84pWuMYO1w0lSrmAhE7d7lI qkaZtQAx7mLXSkRiyvsrGxoKsBcTeYycju1r0hEeqBab+iE2NQt7UsZbxVuVuRf6KtTA3IjA3xSg AAUoQIEmINDi4sWL1xtzPc+ePYtWrVqhZcumlQMtKNA9Ase9995beV6tGCW6qBDFpefFA2sH8b/W cHHrBXc3F6skVuULbXx7lolRogsPF+P8JREEizcLW7dzQa/e7nBxsnzN0HbdS4sP4nDxedzg2g7n Sy6hs3s/uLuqJNFsF9H4t4jPQ9HBQpy+1FqM/HwOpZfawd3DE24dKu9k7yI154pxYH+xeKvUBdrS Uji4uKNfX1fbiWh7BXI7BShAAQo0qMB3332nO7+np1qypEGrZnbyasVJZiXU4oKmDCWnzsLB2Rna y5fh1NEFTo6V/K6twbFaacAS8Sy1XPolBUR1OGk1GjGmNdDK0dFGTFmGlVF3GJqHB2LVzjQMqOWw qqy0BGe1beHscBlCWYQeTjbqYg1R11Zl50TdLjuIumlxQeuALq4uNY6FGoO5tSTXUIACFPhzCjSV +Mjy7ly7dg3l5eXo2LGj5aZGtVy3UUyjutQmUBkHJ7j19RI/TaCuNaiik4sbvMRPTSYXgSQXUcnW 4TU5X4McKz4P7h5eqMvLc+wg7oWv4V70beYfvAa5iTwpBShAAQo0egFHJ7i6GbJoHXQNkitf5Roc 62BIXtZxThGaohzcPiJGf02jk7EzJcSqdcq5/LWmgds8B6FXLScVpZM7ubgazttB3+y78sqoayun DqJuhltfxU+A6lU0FnPVynElBShAAQpQoJYFmFisZVAWRwEKUIACFKAABShAgcYi4NjtNowWldH1 qJwdhwntShH7yGB49uoK7YU/sPPrTMSkmPpWHP3UcDGAHaeaCNC8Jno8lgIUoAAFmpoAm0LX0R1r VE186ugaWSwFKEABClCAAo1LoKk09WGcVL+fm9Ldy3DPuCT7Jw1NxvbEkCq/UWi/4D/fHjT/891z XjEFKNB4BZpKfGQp2FSaQjetjgstlblMAQpQgAIUoAAFKEABClQo4DJgEnZuXIXY8ED1/fzEQIFL 1yCfSUV1n2qspXk10HgIBShAAQo0SQE2hW6St42VpgAFKEABClCAAhSgQOUFnNwGICIuDeHTy1Bq HKzmwgXAuSNcO9RBp4qVr1qz3ZPmzfbW8sIoQAEKUEAhwMSiAoOzFKAABShAAQpQgAIUaM4CDjUY cKY5u9TltdG8LnVZNgUoQAEKNLQAm0I39B3g+SlAAQpQgAIUoAAFKEABClCAAhSgAAUo0AQFmFhs gjeNVaYABShAAQpQgAIUoAAFKEABClCAAhSgQEMLMLHY0HeA56cABShAAQpQgAIUoAAFKEABClCA AhSgQBMUYGKxCd40VpkCFKAABShAAQpQgAIUoAAFKEABClCAAg0twMRiQ98Bnp8CFKAABShAAQpQ gAIUoAAFKEABClCAAk1QgInFJnjTWGUKUIACFKAABShAAQpQgAIUoAAFKEABCjS0ABOLDX0HeH4K UIACFKAABShAAQpQgAIUoAAFKEABCjRBASYWm+BNY5UpQAEKUIACFKAABShAAQpQgAIUoAAFKNDQ AkwsNvQd4PkpQAEKUIACFKAABShAAQpQgAIUoAAFKNAEBZhYbII3jVWmAAUoQAEKUIACFKAABShA AQpQgAIUoEBDCzCx2NB3gOenAAUoQAEKUIACFKAABShAAQpQgAIUoEATFHBognVu1lUuKy3G8ZMX oJXujPjHuWs3uLk4Na9r1pahuPg4LlyWLksLh7bO6ObmBqcqfBolp6PCyUEcoxVOnbr3gGsHx9pz EnUsEXU8I+roINXRuSvc3FzEfOUnzbkSHD12RipAlNAWXbu5waUqFymOKi0pxklRCem8WgdndO/h htq8zMpfDfekAAUoQAEKUIACFKAABShAAQpQgALmAlXJk5gfyaVaFSjdn4fF81OQkVtgVa5nYDQS 4iPg61bZxJkGO1bOQ+LHW9AJoryhi/D+9OGo7NFWFbBaUc3ytaXI+3QxImZmWJUIeCJ6bgIignwr rue5g1g2ZxaSMrdZlREYORczo4PgWqNPtQa7c9IxIyZVkjOfPAORnBCPEF838/UWS5qS3UhPmYHU bKsSEBiZjJejQuBu52YU78jC24lxUCkCkclLERnij6qnmzXImzcdEd+ch18ni0qrLZ45gzMDn8KK xKBqnEutQK6jAAUoQAEKUIACFKAABShAAQpQoDkJ1CgF05wgGvJaDq5NxqjoDJtVKMhNRZj4mZ21 HeO9OtjcT7fh3H6kxQUjNVexW6cSaMSinVyW4oAKZqtbvuYgkm8fhQybRRcgNSYMqZuSsT0lBGpX qSnOw5PDImCdUtQXmrs4BrmL9yJrexzsMalXowQrowIwU2mn3LEgF3FhuVgfvxxpk3yVW+T50h3L cE9YkrxsOZO7OE7UcT2Wb5kPXxe1//xE8i/tSUSk2rpKYHHcZCxeH4uN8yPgplaE5UnlZQ0O7RIX J/KdtkuXd9bPdLqAcotVXKQABShAAQpQgAIUoAAFKEABClCAApJAldISJKt9AU3RWrOkol94PKIf GQr3Tm1x4uC3WDhZJKIMp50Zkoa798Shr40MYfHWlXh68kzrN+3E8a1qoerVL1+DtUnKpKIf4lOj MXSQO9pePoFvP12IuMWGq8yOw5whA5EY1Ne8xud2Y7pZUnE0UpdPxSB34VSwGW9GzDQkyzIQclcH bMyPqmLSDdi9bLYiqSi9QfkKgu/uC4cLfyA3Y4Z4S1L/BmJuUhhW3rlTJHkt3hkUdZyhTCqOjsbS J4PRt5MD/tiXixlTkwz3JhdhM7KxMy3E6k3AorVJZklFz9BYJDz2INydgaK9XyMxOkVfRm4Khk1z xva08apJWHM841J7/D979wNdVXnn+/8zJRowgBrb0MY2VzIusn7mKtRGg96mV5hQioUsm/aSOLSQ mRUnTenNzILJ6s2PCsK9aW5XCqOnC2mmWV0hNdXQNuOKTilDCi7jiBEuFW30JuMv0ljjGGvAQJDY g/N7zr999vmXk3DOhuTwPl3h7LPP3t/9PK9nx0U/PHvvxffVqGLJ+AQhszm53napqTOwz4eBBd4R QAABBBBAAAEEEEAAAQQQQACBEAGCxRCOS/3BrRfbdlsHLdv5lAnUFlmfs7JKtfvl/2xm+q3xz/Rr 0aH/u1G5i8Pn87n1QvPfakNjIII0FxbnmYlpkVfiWrWntpBYfffQv6qmPXDECj11vE6LrEwuS6Wb dmvJIjNrc3OLd6P2fc/p702waO/lC80PWgGr8qp08OebrMuJs7LK1XrkZtXetU6+PMylf/j1KjWG h5OBJkR7H+/XP9YH/Aq15/CPtTxw6XlWltbv6NCiBX+tDf6ZhNs6e/S1/OUhyXz/rx6z2lhY1ayf bCqyvs9avl4d3Qv110X+GZdddXpu6MtaGTiGp02mDc1BKJU1dGhHab7V2qzsSnUevUNb71grL2fX Nu07ca8qI84Ha5ewhTQtLt2oxWFrwz8OHRo1wWKLd3XxvZ8LGYfwbfmMAAIIIIAAAggggAACCCCA AAJXrgBPhb6sY39ObxwJpH8V+qYtVLSalb5I61wV1sero0bB4zr5bCAUk2r27Fdnx36VWXslupBY /fFTA1YDyvZssIWK1mrlfmmdKgIf510dOsNyrFc/bQo4FWpvSzBUDOyizAI99FSD9bFz834NW5/i L4z9/ndWKJhXUxMMFa1d07T0GzUqDHx+bVjnAsve9zH9rjswza9Q36oMhoqBzdKyirS5tjjwUe+c GreWPQtjrx/3BYaeD8Xb9R1bqOhZ5X3NX6zvdGwPfFLjY89qzPqUhAUTbv5DdYu/UIm+9ZVgsJmE 6pRAAAEEEEAAAQQQQAABBBBAAIEUEogaU6VQ/6Z5V65R8Q/26ZbRP0lzspQVo7Wzr4lx7bNt+w/N w4dlosS2w1t8D3kxYdx7tu8TXUykfsZN92pf2xL9yS1l3RKjl+bxzulmlqX3Ot8zCrmv3+BzncHQ r+oBLc2M3puMRSu1vbjOfzmzSy8OVGp1rOvGw0pkfDxHZYWFOmnW3/v5sMuwA9umz9eCwHLEe4b+ vKhMhWdOSjfdp0X26Za2bedlXmP7FLp4wX3WWlH11S9EXCYd+DIj705vaOydtdi5X68/tFqLrRmg ga0u7r3/n3/sn/UplWx/QPnxT72LOxB7IYAAAggggAACCCCAAAIIIIDAjBcgWLysQ5im7EWLNfEz hkfU+eMmq5WZ86IlPela+v+2qbugIPhEZDOysSMsq9wkFxKsn5GtxXGepDxy7FeyJiUuuD7kHoDn T41Y7fzayoku5M3Q3SUVMjdE9G7/4r+9Y4LFHGvfCRfMjMcdra0TbqL33rBCN4XPqjR7Li7fodby iUq4dbIvMPNSuvqq0Dtf/vHNQWvnjy8wN1WM9Ur7uG72TJ30PoHljEbHTGKbkYRf5fFe/bguMOuy RA98JXhZfqymsB4BBBBAAAEEEEAAAQQQQAABBK5cAS6FnsZjPzrUq+bau9ToDZBMQ8tcWpETLVhM 06KltlAx6X1ysL57VL0Hms2TlButVu+svscWLJonGb8aCLuK9bmbYkwF9O99w8KFVp333jFTH5P2 GtPTPwreD7Piq0tjziiMdcix/l/r4ZZAsFilLwRvNOnd5cZFt1i7dj3Tby1HLJgnc3cFzgmTLr7x buhF2RHbT3JF/z+1WMFpScMDWhTtVJtkLTZDAAEEEEAAAQQQQAABBBBAAIHUF0jCNKfUR7pkPTT3 t9tqHtTivcQ17KDFtXvUULncFriFbTCDPg48vdU8qCVaL0u0Z/+DWh5y+bJbp6ZwTXf67Osdkejv eEib/U+FVl6NNiyfeJ5pRCPMpekPrdnsfyq0VNVcHjlTdXZwlmKPy6UX7m+Netn3Cz91+Z+AHXGU i19h2vfItkCAa2YrfpnZihePyZ4IIIAAAggggAACCCCAAAIIXBkCzFicTuPs/kAnY7TnmvFzOp3U p3TEONAlWP3BSKxeSudGvDeLDGnF1SGfJv6Qlr1QJRNvMuVvh19o1hrrEuE8uX5UGRkKTlh1WM3V pdZsQFXsUU1RZDCZnrNCO63G92jDXRt1oHfYquweG9LTuzZaT6a2vkjCQu8vH7XuY8lsxSSAUgIB BBBAAAEEEEAAAQQQQACBK0CAGYvTaZAzblaNq0GDf7panjBt5Pcvqt7lm9nX6dqsTtd+7e1+REuz Zvaw3XRPjRrmDurqq00vPxzRi0/Wq73HMxCd2ryuU/tr2/RIZYECvfxwCmPkHn7DmhU4hd1ibjp6 4gkVbQhepl3V/COtzJ7KNcIjeqK2KHg5u5nteLhuudW30AOn60u1e7Wvc4N/RmKXakqDT/sO3TaJ n8ZO6NH6wHGYrZhEWUohgAACCCCAAAIIIIAAAgggkNICzFicVsOboYKVpSpdvVqrzc/6jTvU9/Jh bS/J87eySxsaf63xadXmqTcmI6dApaWl3j6uLl1vHprSp8Nt261CXY3r1DkQmJ6ZputvsL6KuzB+ 9lTSgsWxgad1x9pt1jFLGjq0KcpMQ2uDiIUxHWiokHWFsXmWc8djGyec7ZiWtVQ/6d6nCs/DWWK8 yhratK+hLMa3U1994vF/tM1WrObeilMnZA8EEEAAAQQQQAABBBBAAAEErkiBwKSwK7LzM6LT6dkq b3hYb3SuUounwZ379X8fWq3FGTOi9ZNuZHZBufbvfMPce7HFu8+Tz51UaW6+WU7Xwls81wd77v/X pVdOjik/P3bn33vjDe/+nj9uyJxjLU91wT3UrepVm63dSrbvU2Oppz2TfbnVvbtaNdbDWkq078gO 5U/87Blv8bSsxaprfVnrTryo54++rPe8SXK6bvhPebrz7juVm5mu7l07/A0p1uI4D7SZsMWjx7Sz MTBbsczcWzF3ws35EgEEEEAAAQQQQAABBBBAAAEEEAgIECwGJC7L+5iGBt7ReXPs2dfdqGwTGEV9 pd2ovGLzjT//mWmDNj4ypLdOe3upG3OzYz6A5sZbAjMzpXk2iNnXBwPCnz3zisrzl9q+tS+O6Vhn i7ViyS03WstTWhg5prplldYDUoq3tKmxfPGUSpxorVOly3t9t9mvWG1HGrQ4cyol0pWzuMj7E7GX echPZ1Pg6dI3aE4CJ8SxfcEHwZQ0VDBbMQKbFQgggAACCCCAAAIIIIAAAgggEEuAS6FjyVyC9e7B w1q2apVWmZ9lLa9McMRxnT0T/NodXJwBS+N6pmGZt4+rVn1Tvx2N3WT3mbPWl7buKufzXzXRnO/V 5/qpjsWoMT5wWHWByXeq0tKQp0tbpSdeGDNP5r7LXIrt36rQ3PPwkfUFE+8T9m2/eer12vpAhWLv fTELMieR/o0PaNfG9dro+Wl4WoGLwcPKa+hff2m1L6/m3osPA0dekKsxEH6WqZrZiuHUfEYAAQQQ QAABBBBAAAEEEEAAgQkECBYnwHH6q7QFC63ATE07dMC6r2DokQcPNKs+kP/oFn0q9pXAoTtO8tNI 7yHt2rpVW3e1qn802bGluZT5c1YsqO/tPhD9HpEmVGt6sN5q8ZKFn7CWlZGv8qrAbMYurft2q4LP SvZvNtaretuly8UNqyPuZRi3n+5B7bp/jdr9JUvMTMXWyqUxHrQSbJ59afDQLq3ZbFUwMxV3T/5h O7Ok01096vL8tGzW4y9E9FLjAwf0zeoW65AVq261lr0L7hEdat2lrbVb1XqoXxON5rHHH7VmZZbs rNDF5LChB+cTAggggAACCCCAAAIIIIAAAghcSQKTmEZ1JXFc4r6m5+kbNYXq8l4y26eaVberYvse lS1fogUZ6Rp776QO/eJRbWuypuGpzLVGWclspgnTHi6ttsK09vGF6qsrSuYRtOiL31Deti7vQ1X6 Wmp022sV2rO5TEsWLjCXRY/p5IlDerRyW+BKb3PsCt13p72XaSqq2KrCpnW+IKynXkXr39LehzZo 0XWzdfbNo/rh2hprFp9n/80li0L7ELefI2r92xWyrjA2e2fqdT3R+qoin0r9oT788JO6t8KEl7bf oJETrVpR3RQ8bl6mBp95Qq+ejaxgCihzSYlWF9j6mZarrzeUqL3ON9uxcUORBmtd+voXb5Xppt7+ 7a+0tqYxWL/MpS/nhqbMg795WNX1/mCzs10Lu3tVFO0p4ma24g7rUm0zW/FL3FsxCMsSAggggAAC CCCAAAIIIIAAAghMRsAWi0xmc7ZJrkCallb9b9X0LFMg42nZVq2W4IOIQw5XWNWsLStzQtbF/GCm qp2zfXnBthyyeOGM3rOv+MO73ktwQ+Mq+wb+5cnW92yeuVQ/aq7RskqXb+eeFlWvbfEtR/xZqD0H N0XOnsss0J79Lt2/qsb31GdTY8OqaDVKzCzBWuWGn9nx+jn2pnqC+a23VS31MQbC+22h7rg/NFh8 +4Q1rdTXq74W1dX5FqP9WVh7R2iwaDZaVPqgth/ptJ4k3d5Yo3ZblmjVKd6i7h0rI+5Xef5UyGia e1uaJ79EBIvmwTIt37Oenl3mma0Y7mUdiAUEEEAAAQQQQAABBBBAAAEEEEAgugCXQkd3uXRr07K1 sfW42hpqFLjYN+LgeSVqaDuo1k1FEUFSxLaBFelz9OnA8k1zY+/nmTVZWxzYUlv+6vOKGyp6tp5s fX/l7KKNOn6wTTUlMXupkqoGHTzequU56VZ77AsZuSvV0b1PVcHm2r9WYdl2s3+jot7PMF4/09J0 TUi1eB8WRFwifdXcKVaYOyfKQearvNFzPlTFPB/Kapt1dPf6qDNXc5eXBy+vN+Hj8kVRRtM9pOes qZkVqmC2YpRxYBUCCCCAAAIIIIAAAggggAACCMQT+LNz5879R7yNLuf377//vmbNmqWPfWxmZaB9 fb6n9t59992T53Obp0QPntTQyBlzb7w087+rlJn9GeVkZ0aEWJMvOv22HDNPiT755pDOfCCZPE9X zcnUZ27KUWbG5KfNjQwN6M2hM5qXNUdnhj/Q9Tk3KycrSog2/bo/+RaZ82Fw4KROfXCVefLzqEY+ mKOczaipzAAAQABJREFURXnKnj95p8kfjC0RQAABBFJB4Pnnn/d2Iy8v9j/kTYd+XtTfk6ZDw2kD AggggAACCMw4gZny96Nw2I8++kgXLlzQtddeG/7VtPpMQjGdhiMtQ9m5+eZnOjUq+W3JyMxWvvlJ 5JVpkKwSk7w6PJHjXZZ9zfmQsyhfqdq9y2LKQRFAAAEEEEAAAQQQQAABBBBAIGkCM2saYNK6TSEE EEAAAQQQQAABBBBAAAEEEEAAAQQQSESAYDERPfZFAAEEEEAAAQQQQAABBBBAAAEEEEDgChUgWLxC B55uI4AAAggggAACCCCAAAIIIIAAAgggkIgAwWIieuyLAAIIIIAAAggggAACCCCAAAIIIIDAFSpA sHiFDjzdRgABBBBAAAEEEEAAAQQQQAABBBBAIBEBgsVE9NgXAQQQQAABBBBAAAEEEEAAAQQQQACB K1SAYPEKHXi6jQACCCCAAAIIIIAAAggggAACCCCAQCICBIuJ6LEvAggggAACCCCAAAIIIIAAAggg gAACV6gAweIVOvB0GwEEEEAAAQQQQAABBBBAAAEEEEAAgUQECBYT0WNfBBBAAAEEEEAAAQQQQAAB BBBAAAEErlABgsUrdODpNgIIIIAAAggggAACCCCAAAIIIIAAAokIECwmose+CCCAAAIIIIAAAggg gAACCCCAAAIIXKECBItX6MDTbQQQQAABBBBAAAEEEEAAAQQQQAABBBIRIFhMRI99EUAAAQQQQAAB BBBAAAEEEEAAAQQQuEIFCBav0IGn2wgggAACCCCAAAIIIIAAAggggAACCCQiQLCYiB77IoAAAggg gAACCCCAAAIIIIAAAgggcIUKpF2h/Z623R4fHdZb/35aMiPj1mx9fEG2MjOmMEzuMQ0NvqWz7jRT wi3Nvk435mQpfQo9HhsZ0lt/PKs0TxtMnes+eaOy5k+lwhQOdrGbjo9q8Pf/rvP+/WfP/biyszM9 bDP/5RnDoXd01ts5t9Jmz9WC7GxN5TRIBoLT50HC57rpZKI13GMjGnrnjzpvznPPb9zc6z6p7Kz5 yeCbdI3R4UH9+7tmsOd4drmI3/lJH4kNEUAAAQQQQAABBBBAAAEEEEiuQErkMMkluTzVxodPqLnx Qbk6+yIaUFzVoO9sLFVOnGxvoLtVD1XWqyeygnbu26bVi7MivglZMTqg1h88pPr2KBWqdmpbzWpl TeGMGR86pl31Lh05Y45iSm48+GOtjNeJkAZF+zCuYx27ta6uKcqXhdqy57v6y+WLogSM4+retUmV z5xR4XVRdg1fdfq0Ti/5Gz2+Y7Uywr9z6rN7RN2/aFLltpYoR8hTzc6tqlxdECUkTnLfknwehHcm Ged6wjXGBtXR9EPVNXWGN08qrtLe71RpaY6zI+/5/dhdv05NXZFNKCzbou/83V8qP3MKv3CRZViD AAIIIIAAAggggAACCCCAgKMCf3bu3Ln/cPQICRZ///33NWvWLH3sYzPrqu2+Pl9AePfdd8cVGDnW qrvW1cfZrlhtRx5RQdSgwQRLux9QpSsyELQXLdv5lHasXmRfZS2PD3XrgWWVUUJJaxOzUKGOo3XK n8SErv4Du7WmxmXfWVs6jmr9ZHYO2cv+YUQdtXepLkoWZN9KFS4dr1sZFgiOqnX9HaqfmCikjAq3 62hruSbR3dD9LubT+IAablullnj7ljToaGNpWJuS17dknwfh3Un8XJcSrTE+eEgPrKiOc65Ltc2H VVmUHd6FpHweOfGE7lq7LU6tPLn2P66Vuc4GnHEawdcIIDDDBJ5//nlvi/Py8qZ1y6fy96Rp3REa hwACCCCAAALTXmCm/P0oHPKjjz7ShQsXdO2114Z/Na0+Mx3mcg/H6Ak9aA8VS2q094E1yr0uTW// rksPVtfLF1F2ad2DnTq+uzQsMJN6nzAz8WyhYkmtS9X3flaz3e/q2bbva1uLL01r37xG1117WJvC wxLThk0hoWKJXG3V+mzObL3b96y+X7nNH8K0qPSO+Trcu1HZsc6c8UE9Uf9tbWuPnHmZGPW4DjWE hopVDc26b2me0s6/rWNPPhacfdZSI9ftB1W3Msd2yGu0+L4aVSwZjzLjL7CZmRL6tkvBSWwfBr5w +H1cB+rtoaKZeemq0T2fzdHs8+/quV88avrmn9bWWacf/NclJiDOtbUpSX1L5nlga521mIRzXYnW cA+ofoU9VMxTrWurvnirOVfODuhfHvueGv3nbmPlMs01YXh5QmG41XtrYXzwQGioWFil5u/cp7zr ze/8/3dMj1XWyZed96lmlUsHe+uUE+v3zarKAgIIIIAAAggggAACCCCAAAKXXoAZiw6ZT/Zf4vuf qNWabb4YobCqWT/ZVBRyGa97uFt/XRScSeg6/LJWZtuuiR7pVsldlf7wUarac1CbltsDNelEa63W 1gem+ZVp/8s7lGsr8cKuEm1o8geBeVU6+PNNoZddjxxT7V3r/GGHVLJzvxpDgi0fonv4Bf1t0QYF r+z0zJYIBowTzlg0lwEf+tnjeub1Ud2yokxfK8oNcRjr79Dta+r8oxV9Jtdw924VVbp82+TVqLtz o+Jc/O2vF3wbOtSgZdUt3hXF2zu0uzw/+KVDS+6hQ8pfVu2vXqGnjtdpUdgktYGnG7Rqc4tvm8It Zibl+rBZi/EbF69vCZ8HccYw4XPddDHRGgMdW7Wqrt2PFX0Gbq/ZpjSwzUVaxx6NMXVsvF11/l+S PDO79vGI2bVD2l2yTC7/r07N3m5tXDrVMzl2C/gGAQRSW2Cm/Iv8ZP+elNqjRe8QQAABBBBA4FII zJS/H4VbzJQZizPr+uJw5Rn/eUy/6w4EfoX6VmVoqOjpXlpWkTbXFls9fefUuLXsWej/lyes6K6w Zm9EqOjZZvH6h9RQ4lnyvNr15IvDvkXPn2O9+mkgVFSh9raEhYqebTIL9NBTDZ4l76tz837ZKgRW a/zd/mCoWFxjAsxOHdxZZn0/0cLgbx5WtbkfY3t7i7ZVrtKRYbdtc7eOP91ifa7Z2xz18tCsovu1 xUPlvfxrXGdDqaz9Yy6M9+sf/KGiiU/1ra9MECqODevEC906cOCA9+dQ9wsaGB6NWXqiL8ZPDVhf l+3ZEBEqer7M/dI6cyG6/zXvas0KLE/2PV7fknAeTDyGiZ/r5mRN8PdlTC8+GQgVpe0dNVEv688v /XttD/zK9dSra2BsssrxtxvuUUsgec+rVXNEqOgpka37t9Z6a3mi+dH3z3qX+QMBBBBAAAEEEEAA AQQQQACB6SbABXaXdUQy9OdFZSo8c1K66T4tinEzv3mZ10RvpXtQv9xmpRR64L8tjb6duXh6ZcV2 c29C3z3dmjpf1Mai1d5Lggef67TCwLyqB7Q0M3qJjEUrTdhSJ9/hXHpxoFKr7dMebbuVbW/TlnLf Q0b6z35g+yb24plT74V8+dZpkwoGnhRj+nnQCj+r9JWYs7cytX53n9aHVJr8h/5//nFwVub2B5Rv m9UZrDKuE+bhMWujPjzGZJrmoRsP//165YaNpXt0UEeOvKZz13xadxXlh8w2zLjpXu1rW6I/mSw1 65YYM9PMI7rTAxNAzcNwLgQbNKmleH1Lxnkw4RiaczChc93by0RrjCt4cXuVvpAfNi3Ukpyvu0tM IN7lCyGffO6kSnPtIbNbgyeO6LU3z+mTt39ei7ND60w01gMvPmP9Q0DF390bc0ZtZoGZhdxXabWI BQQQQAABBBBAAAEEEEAAAQSmowDB4mUelcXlO2SeDzLBy62Tff5rIs1WV19lm6t24YxGAnsW/6Um euhzRt6d3hlvLZ7tO1/RWw2rlWtG//wpq4K+tnJxoFqU9wwTtlSYsKXF+92L//aOCRZDL7lO/9RS 7e04oqX5MdLJKFUDq/K+UG7mS3b57uVYvEXLbdcCjw28ZOZZ+l55NV8w87kk9+iQXjrxil5/65Tv i7lZuvW2AuXnhCV6/v3ivo336sfWU2FK9MBXoj3kZkwHGu5XTUtwPMLr9rXXa1X76+Zy5h22mYfD avr6CuvS1sIt+8yDZGzWGdlaXODpVezXyLFfycpWF1w/wX0io9SYRN+ScR5MNIaeViV0rvu7lVCN 8dN6vcdfqDBbE93+9rpP3+zfUDr9xzPyzJ8N/Mdy5FiTVqxzBQpp3/FWLbayxYnGekwv7Q+cyYVa 4R1zt4b6X9IrvxvUqQ89sefVyropTwUFJnwOHNBqCQsIIIAAAggggAACCCCAAAIITC8B/q/r9BqP iNaM9f9aD1tBlpllZQvcxt95w5phV1x0a8gsuIhCaQuUV2zWeic4/kFnzIRApY3rjVc7/ZsW63M3 TRzK3bBwoVX2vXfMtLmwV1rmopgzHsM2jfiYll2k1t6XNWbalZERPlUwOM/sa4VZZsZgg5kx2BJR w7Mir2y7frSlXPbbUEbdMGxl/z+1WJYlDQ9oUXgTzPbD3U0hoWJFQ5s2fnmJ5s+6oKG+f9WP6qrl e+5Hu9a4Vqi3zn9p+9jb6rFlkT1dr2nMBItWFhXWlpCP7lH1/mafSmsardU7q++ZUrAYv2/JOQ8m HkOr+TEXJjrXY+4U9sWENdIXaIn5HWj3/A70/EqvjZarIMYp33/E+4vird73Ur/Oaan1+/X2q6/a jtqjEydHtTjwgJc4Y22dycXFyjp7Qg1fXyvr19tWVSZm3972v1UeJ3AO2YUPCCCAAAIIIIAAAggg gAACCFxiAe6xeInBp3Q4c9+7h9Zsti6drGo2gZmtgPu87d5rVmJh2yBkMU3XfdpzLa3v5UuU3Qq7 AjnwddT39NnXR12ftJVp6VFCRc9MsautQ9SvWxEaKnrvp2h9rb72bVp2W4MGPMHpZF/G+RH/A3Q8 91Z84MvRZisO6+eNTVbFmubDqist0Px0I2nanZ2/XDse75Anu/W+Wsy9LwNtyFio+6wvzBHW3jlh qDjw9FZzm8g830/+HbZQsUR79h+NeQl64NAh75PqWxLPgxhjGNKmaB/inOvRdolYF7dGmjJuCOzV I9dPXwh8CH03DyFyNQamNpqvwu5pedPnimzbl2npzbZ0Ms5YW2dyV71WLAsNFUNP5R5tW7dMDQeC 99+0HZRFBBBAAAEEEEAAAQQQQAABBKaFgC9fmhZNoRGhAsNqri61ZtGpYo9qiuyxYujW8T+l6yZv cmGbOmd2soKO+AWUlr3QxG7mSupJbJvMTd55I7TNntqFFQ16qOrLys00UwvdY+p99nGVVgdm9bXo 75qXqXNjrHtOhrau95ePWveZjDVb0T30W+tSZhVvV0W0scjI17aOZpW88yddddUC3WzNepyv0keO qmDotDnwbGXnxLiPor9ZH4ycDG2g7dO5EVMj/AaOtu/DFyfTN88+l/c8SMa5Ppka6brHnDdqr/My 9bg2aKNc2lbxF8rK8Pyn0FyWfOLXql+72XdJvncr80fY5NyM/HId7b5bp8+b0bwhW1nWOHt2mGCs 3e+oLzgR0l+9UA1tD+nLBbneWahjw716vLFUjf5fspaah7TsyE/MTGD+U+0H4w0BBBBAAAEEEEAA AQQQQGAaCfD/VqfRYASbMqInaotkTZrKq9HhuuXWPd6C201laTzkXo2BPeNOdAxsaN7dw29Ysydt qx1fnHvtJ0KOUVjbptbKguC6tAzlL6/U8acydfsaX2jU5/qpeiuWKubzOQJ7j53Qo/WBtCfWbEVp /JT/Xo5mv+Ki22POOMzKL9LK/EBx23vafOVM8v6PN91To4a5g7r6ahP3fThinmRcr3bvBLpObV7X qf2m/4+Y/sf95Z1k3zytvHznQTLO9cnXSM8t0d6aJ7XB5ZuR2OWqUVfgdom24Yq3OD8rx7o0OmLb WGOdNlefyDNbWzl5sfYe2R1y+4CMrHxVNh6XOZPNw5Y8lXv006f7tHR9tJMq4sisQAABBBBAAAEE EEAAAQQQQOCSCnAp9CXlnszBPA8IqZB1Za7K1PHYxpBLoANV0mbPDSxOYsqZW6f/YCUa3odReC4y vt66NDRYKtbS+NlTwUwk1kYOrE/PtPXTeHz3G7ZQ0Xa8jEUlaq7yJDeeV5f+j7n3XbzXicf/0TZb sTrqvRW9Na4KViq89cbgBweWMnIKVFpaqtWrV2t16XrtaO3T4bbt1pG6Gtepc2DM+hxrYdJ9u2zn weTP9Vh9lKZaI01LN/5E+8zvWOxXhdr2t5kzzf+aF1hI9D1DmZ8J1ihr2BwSKga/yVBpbbOsM7nn FdNLXggggAACCCCAAAIIIIAAAghMP4G4k56mX5NTuUVude+utj0gpET7juxQ4LkQ4T1PXxC8NLmr 24QP5fkxZ9LJ/Z7tMswbNM878ulaeEvg4uYuvXJyTPkTTPF77403rCbckDnHWnZ84U+2IxQv0Y0h l57avjMB2YLskClh9i8jl0ePaWdjYLZimbm3Ym7kNlHWnDnjiXkyonzj3KrsgnLt3/mGVm1u8R7k yedOqjR3gllsU+rb5TgPpnauR5e92BppWlxap97idTry7PN6+ffvecunz7tBeYvv1J2LzWXJI93a 4T9oceGtSRtt+8zQW/7zgujd8qy91jxsybx5/ykg7FLs2DvxDQIIIIAAAggggAACCCCAAAKXVoAZ i5fWe8KjnWitU6X/Ek1zwa3ajjRoceYEu8yaYy6Z9L+6fqVXRgIfIt/HBp5XS2B1yZ1WODf7+mBA +LNnXglsEeV9TMc6rQpackuSZ+2N9mrX+hLvA0s27jog+1zD9E/caM3e0hl7NBPZzLQp3Czw2D6X dS+9EjODbVHMwNIcxxZu9vzu7cgDJ7BmfGRIAwMD5mdI4xPUufEWT9Tke8WbRDelvpmSSTkPJhjD QLsD71M+1wM72t4TrZE2P0dFq8u1ceNG70/l+nIVeUJFc4yBZzqt2bnXzA3+jtgOfxGL6brxz4Nj +KHtnIpX7EK8DfgeAQQQQAABBBBAAAEEEEAAgcsgQLB4GdCjHbLfPAl4bX2n/ytz77XuR1QQ74EN abkq2VLs36dHj3aciFbarBvX4ce2Wd9VrLrdG554VuR8/qvWk4w99yU8Zk/0rD1MhQHzFOTA5D5V aWmuJ35J3qu/q0VNPb5LtbuaavTsYDBiSzP3nftaof9YPT9Tz5A7xoFH9eJvAoZS5rwJ2jhif/Jv marjzFbM+MzNsprQ+CsNxmhB79PNati1S7t2d2g4VjND9h3XMw3LtGrVKvPzTf02hr9nF/eZ4FPA J5zENsW+eWon4zyYaAw9xwi8LupcD+zsf7/YGgMHdmn9+o3en6f7Y11gPKgnfTc4NEcr1FfvyQ07 +sV+NDMl/8IzQ9j3+kVnj/+WBIE1wfex148HH5J00/XW72twC5YQQAABBBBAAAEEEEAAAQQQuPwC BIuXfww0eGiX1mxu97ekxMxUNA90yJrcVer5Xyq3ZvP1NK5V8wvDET3q76iXVd481/mr/yU7uI15 knG57b6E677dqogKY72qX7XZ2qe4YXXUez5aG1zEQnhvbbc0NNUyVbyuwl+1T9X/o0XRssXejh9o mxV+Vui27NjB4rHHHw3OVtxZobg56fxbtdbKhFr03d3dEbML3UOHVLe5US1NTWpyvaRgDCiN9B7S rq1btXVXq/pH7YmjuQz5c4FwuE/f230goq634+MDanqw3m8gLVn4CWs5fGHKffMUSMJ5MPEY+lqZ yLke6GciNdJ0Wj09Xd6fzf/r8chz3XvPxm+rKXCwkrX6bGbgg//dPaJDrbu0tXarWg/1R4SDscfa PDM6/4uq8Jfpa6lWywtDYcXNRzPz8/ulwX8IKPsv/w/BYqQSaxBAAAEEEEAAAQQQQAABBKaBQHgW MA2adGU1YeREq1ZUWzGGlJepwWee0Ktno1zy++GHylxSotUFWUGkrCITcBRqnf8R0o0bivRuw15t +PwizTbR1tGf/1A1ruAsvgrXfw+75DdNRRVbVdi0zhe09dSraP1b2vvQBi26zlR486h+uLYmOHvK xCKbSxYFj5+kpdyV1ap96Zx+a253d0PhN3RPTmgomP0X68w8STOr0XO8nkYty++Ta1+1Pvsp82CX 8+/qUNv3ta2lx2pNxZ4Nyol1dpsZfTusS87NbMUvTWZGWroZpwaps857jB5XpW57tUbNf3OPMtPc eueV36h6W3Aci7eUKTdwfPegHi6tViA6bh9fqL66Iquti774DeWZRLTPrOlrqdFtr1Voz+YyEx4u MIHSmE6eOKRHK7dZD5mRGYP77rSdA1Yls3BRffMUSPw8iDeGCZ/rnu4l+PuSc0+ZidbbfeezOY+K Sgbl2vp13ZpzndLOv63OH65VY/DXRTurV0SEeoO/eVjV9f7R7GzXwu5eFQX+ISDOWCstRxv2mDPZ /zvfuGGZ+mpdqr73s5przpd3+w7p+2asg2dylb65MsczQLwQQAABBBBAAAEEEEAAAQQQmHYCgehj 2jXsSmnQ2yeCEYK3z30tqvNlV1EJCmvvCA0WzVYFlXvkevd+66EvLXUbgvdTtFUp2dKmumghRWaB 9ux36f5VNb77yvW0aMOqFtuegUXPbMraYGAWWD3h+7kJv7W+zMhV5Y7d1seIBRPIbDqyT6fvWusP 6DpVs9aWANl2KKxp1qbltlmZtu/MBcXqbvmedf+8Ms9sxUn+FqTnlurgnrdNwOjyVexyqdL8RLyK t+t/rrc9WOXCGfkeD+Lf8g/vep/yaz3+JXOpftRco2WV/lrGv3ptS0RZ34pC7Tm4KcYMy4vvm7d2 oudBnDFMxrmecI30fD3YsV2dgRmBfe2qWReIfEPJa9u6tTrKVNbzp0JGU2+dHpcCwWK8sTaHyF6+ Sfu2n9babb7jdjaa4L4x9Ni+T56xjv5E+Ghbsw4BBBBAAAEEEEAAAQQQQACBSy3ApdCXWjzseFfN vSZszcQfF0R9kESGVtZ1aN/Oqhg7F2rL3oNqXF8Q43tzJWzuSnV071NVcfRNCsu26+Dxxvj3fQzb ffb1n7bWzJ0zy1q+qIXMxdrx8mE1xGqkuVvkdtPP1o1FEbPMrOO5h/Rck2duoOdVoYpJzVb0be35 M2f5Rh0/uNc45QVXWkuFqt25T8d3l5uLt22v9Dx9ozYIu+WvPh/xlOHsIk/dNtWURKvrq1VS1WDG oFXLw2ZzWkdKsG+eOk6dB57ayTjXk1Fjfn65jh9uizGGpqF5ZSZoP6pK+8xgTwf8r9zl5dZ9SVW8 RcsXWRGxNImx9pRZXL5Dh9sagnUCxf3vxRWe37cJxjpsez4igAACCCCAAAIIIIAAAgggcDkE/uzc uXP/cTkOPNljvv/++5o1a5Y+9rGZlYH29fnCq7vvvnuyXU3OduMjGnj9TZ25ap7m/emMeb9eN+fm KGOSs/I8jRgZGtCbQ2c0L2uOzgx/oOtzblZOli08SU5LE6oyPjqk1/vN/ekyM+UeGVFaZo7pZ1bs QDGho0XfeWx0WO+fTzOXsLp13j1bmVnzzQXFib/GzFOiT745pDMfmAuUTcGr5mTqMzflKHMqg5h4 M2bEeZBoN8eGB3Xy7VO6at4cjQ6PaE6W5zzKvoTn0biGBl6X+XVT5hy3Rj5IU/bCm5U9Pz3RrrE/ AghcoQLPP/+8t+d5ebH/oWo60Fy2vydNh87TBgQQQAABBBC4pAIz5e9H4SgfffSRLly4oGuvvTb8 q2n1ORk5yLTq0BXfmPRM5eaHzJebMklmdq4yA1cST9Pbu6XPz1Z+gb+RuZO5R+KUGeLukDE/Sxnz fZv53+LuM5kNMgx+vjUAk9nDmW1mwnmQaM8zTJCYb368r8tyGqUrOzffehjSZWlCoojsjwACCCCA AAIIIIAAAgggcMUKzKxpgFfsMNFxBBBAAAEEEEAAAQQQQAABBBBAAAEEppcAweL0Gg9agwACCCCA AAIIIIAAAggggAACCCCAwIwQIFicEcNEIxFAAAEEEEAAAQQQQAABBBBAAAEEEJheAgSL02s8aA0C CCCAAAIIIIAAAggggAACCCCAAAIzQoBgcUYME41EAAEEEEAAAQQQQAABBBBAAAEEEEBgegkQLE6v 8aA1CCCAAAIIIIAAAggggAACCCCAAAIIzAgBgsUZMUw0EgEEEEAAAQQQQAABBBBAAAEEEEAAgekl QLA4vcaD1iCAAAIIIIAAAggggAACCCCAAAIIIDAjBAgWZ8Qw0UgEEEAAAQQQQAABBBBAAAEEEEAA AQSmlwDB4vQaD1qDAAIIIIAAAggggAACCCCAAAIIIIDAjBAgWJwRw0QjEUAAAQQQQAABBBBAAAEE EEAAAQQQmF4CBIvTazxoDQIIIIAAAggggAACCCCAAAIIIIAAAjNCgGBxRgwTjUQAAQQQQAABBBBA AAEEEEAAAQQQQGB6CRAsTq/xoDUIIIAAAggggAACCCCAAAIIIIAAAgjMCAGCxRkxTDQSAQQQQAAB BBBAAAEEEEAAAQQQQACB6SVAsDi9xoPWIIAAAggggAACCCCAAAIIIIAAAgggMCME0mZEK6+gRo6P Duutfz8tmZFxa7Y+viBbmRlTGCb3mIYG39JZd5op4ZZmX6cbc7KUPgXDsZEhvfXHs0rztMHUue6T Nypr/lQqTOFgF7vp+KgGf//vOu/ff/bcjys7O9PDNvNfnjEcekdnvZ1zK232XC3IztZUToNkIDh9 HiR8rptOJlrDPTaioXf+qPPmPPf8xs297pPKzpqfDD5qIIAAAggggAACCCCAAAIIIJDyAimRw6TC KI0Pn1Bz44NydfZFdKe4qkHf2ViqnDjZ3kB3qx6qrFdPZAXt3LdNqxdnRXwTsmJ0QK0/eEj17VEq VO3UtprVyprCGTM+dEy76l06csYcxZTcePDHWhmvEyENivZhXMc6dmtdXVOULwu1Zc939ZfLF0UJ GMfVvWuTKp85o8Lrouwavur0aZ1e8jd6fMdqZYR/59Rn94i6f9Gkym0tUY6Qp5qdW1W5uiBKSJzk viX5PAjvTDLO9YRrjA2qo+mHqmvqDG+eVFylvd+p0tKc5I+8e+iQ/nbZwzozqZNQOm1+b/5m/x6t zk1+WyI7zhoEEEAAAQQQQAABBBBAAAEEpibwZ+fOnfuPqe1yabd+//33NWvWLH3sYzPrqu2+Pl9A ePfdd8cFGznWqrvW1cfZrlhtRx5RQWa0ZM8ES7sfUKUrMhC0Fy3b+ZR2rF5kX2Utjw9164FllVFC SWsTs1ChjqN1yp/EhK7+A7u1psZl31lbOo5q/WR2DtnL/mFEHbV3qS5KFmTfShUuHa9bGRYIjqp1 /R2qn5gopIwKt+toa7km0d3Q/S7m0/iAGm5bpZZ4+5Y06GhjaVibkte3ZJ8H4d1J/FyXEq0xPnhI D6yojnOuS7XNh1VZlB3ehYQ+j/W26vbSeL/roYdI/PcmtB6fEEAgtQWef/55bwfz8vKmdUen8vek ad0RGocAAggggAAC015gpvz9KBzyo48+0oULF3TttdeGfzWtPkdLqaZVA1O+MaMn9KA9VCyp0d4H 1ij3ujS9/bsuPVhdL19E2aV1D3bq+O7SsMBM6n3CzMSzhYoltS5V3/tZzXa/q2fbvq9tLb40rX3z Gl137WFtCg9LTBs2hYSKJXK1VeuzObP1bt+z+n7lNn8I06LSO+brcO9GZcc6c8YH9UT9t7WtPXLm ZWJjOa5DDaGhYlVDs+5bmqe082/r2JOPBWeftdTIdftB1a3MsR3yGi2+r0YVS8ajzPgLbGamhL7t UnAS24eBLxx+H9eBenuoaGZeump0z2dzNPv8u3ruF4+avnX52tBZpx/81yUmIM61tSlJfUvmeWBr nbWYhHNdidZwD6h+hT1UzFOta6u+eKs5V84O6F8e+54a/eduY+UyzTVheHlCYbjVe+9C+qcWq6ai QuPpsacfe7464Gry/96b3cwdDXghgAACCCCAAAIIIIAAAgggMB0FmLHo0KhM9l/i+5+o1Zptvil4 hVXN+smmopDLeN3D3frrouBMQtfhl7Uy2xZKjHSr5K5KK4So2nNQm5bbAzXpRGut1tYHpvmVaf/L O5RrK/HCrhJtaPIHgXlVOvjzTaGXXY8cU+1d6xSoULJzvxpDgi0fonv4Bf1t0Qb5IzCzMs/8BAPG CWdemcuAD/3scT3z+qhuWVGmrxXlhjiM9Xfo9jV1/tHKk2v/41oZdnnocPduFVW6fNvk1ai7c6Pi XPztrxd8GzrUoGXVLd4Vxds7tLs8P/ilQ0uey2Pzl1X7q1foqeN1WhR25evA0w1atbnFt03hFjOT cn3YrMX4jYvXt4TPgzhjmPC5brqYaI2Bjq1aVdfux4o+A7fXbFMa2OYireOPxkRbDGlX3jI1eTcp UcfxRuWHnQ8T7c13CCBwZQvMlH+Rn+zfk67s0aT3CCCAAAIIIJAMgZny96Pwvs6UGYsz6/ricOUZ /3lMv+sOxHWF+lZlaKjo6V5aVpE21xZbPX3n1Li17Fno/5cnrOiusGZvRKjo2Wbx+ofUUOJZ8rza 9eSLw75Fz59jvfppIFRUofa2hIWKnm0yC/TQUw2eJe+rc/N+2SoEVmv83f5gqFhcYwLMTh3cWWZ9 P9HC4G8eVrW5H2N7e4u2Va7SkWH7NC23jj/dYu1es7c5IlT0fJlVdL+2eKi8l3+N62wolbV/zIXx fv2DP1SUSvStr0wQKo4N68QL3Tpw4ID351D3CxoYHo1ZeqIvxk8NWF+X7dkQESp6vsz90jpzIbr/ Ne9qzQosT/Y9Xt+ScB5MPIaJn+vmZE3w92VMLz4ZCBWl7R01US/rzy/9e20P/Mr11KtrYGyyyknZ bqDjH/yhojkLtz9AqJgUVYoggAACCCCAAAIIIIAAAgg4IRDrglYnjkXNCIEM/XlRmQrPnJRuuk+L YtzMb17mNRF7ele4B/XLbYH5gXl64L8tjb6duXh6ZcV2c2/Cbd7vmzpf1Mai1d5Lggef67TCwLyq B7Q0M3qJjEUrTdhSJ9/hXHpxoNI8UMI27dG2W9n2Nm0p9z1kpP/sB7ZvYi+eOfVeyJdvnTapYOBJ MaafB63ws0pfWRprHmKm1u/u0/qQSpP/0P/PPw7OyvQEOlG7N64T5uExa6M+PMZkmmVb9PDfr1du 2Fi6Rwd15MhrOnfNp3VXUX7IbMOMm+7VvrYl+pPJUrNuidE384ju9MAEUPMwnAuT75Z3y3h9S8Z5 MOEYmnMwoXPd24tEa4wreHF7lb4QcxrgfN1dYgLxLl8I+eRzJ1Waaw+Z3Ro8cUSvvXlOn7z981qc HTqdcKKxjjtsJgDeY91EtEQVX4l+T9S4ddgAAQQQQAABBBBAAAEEEEAAgUsgQLB4CZAnOsTi8h0y zweZ4OXWyb4+6/urr7LNVbtwRiOBb4r/UhM99Dkj707vjLcWz/adr+ithtXKNaN//pRVQV9buThQ Lcp7hglbKkzY0uL97sV/e8cEi6GXXKd/aqn2dhzR0vwY6WSUqoFVeV8oN/Mlu3z3cizeouW2a4HH Bl4y8yx9r7yaL8jzOA336JBeOvGKXn/rlO+LuVm69bYC5eeEJXr+/eK+jffqx7ZA54Gogc6YDjTc r5qW4HiE1+1rr9eq9tfN5cw7bDMPh9X09RVy+Xcr3LLPPEjGZp2RrcUFnl7Ffo0c+5WsbHXB9RPc JzJKjUn0LRnnwURj6GlVQue6v1sJ1Rg/rdd7/IUKszXR7W+v+/TN/g3Nk5n/eMZ7m8PAfyxHjjVp xTpXoJD2HW/VYitbjDPWVtXoC/3/ZAu3G2KF29H3ZS0CCCCAAAIIIIAAAggggAACl1og8P+VL/Vx Od4kBcb6f62HrSDLzLKyBW7j77xhzbArLro1ZBZcRPm0BcorNmu9Exz/oDPjZjltXG+82unftFif u2niUO6GhQutsu+9Y6bNhb3SMhfFnPEYtmnEx7TsIrX2vqwx066MjPCpgsF5Zl8rzDIzBhvMjMGW iBqeFXll2/WjLeWy34Yy6oZhK/v/qcWyLDGBzqLwJpjth7ubQkLFioY2bfzyEs2fdUFDff+qH9VV y/fcj3atca1Qb53/0vaxt9VjyyJ7ul7TmAkWrSwqrC0hH92j6v3NPpXWNFqrd1bfM6VgMX7fknMe TDyGVvNjLkx0rsfcKeyLCWukL9AS8zvQ7vkd6PmVXhstV0GMU77/iPcXxVu976V+ndNS6/fr7Vdf tR21RydOjmpx4AEviYy1uRz9x/77rXouxX/gy8xWtEGziAACCCCAAAIIIIAAAgggMA0FuMfiNBwU q0kmaHhozWbrHopVzSYws740s/bOnw1+CmZvwXUhS2m67tOea2l9L1+i7FbYFciBr6O+p8++Pur6 pK1MS48SKpr8U1dbh6hftyI0VPTeT9H6Wn3t27TstgYNeILTyb6M8yNxA51h/byxyapY03xYdaUF mp9uJE27s/OXa8fjHfJkt95Xi7n3ZaANGQt1n/WFiYzW3jlhqDjw9FZzm8g830/+HbZQsUR79h+N eQl64NAh75PqWxLPgxhjGNKmaB/inOvRdolYF7dGmjJuCOzVI9dPXwh8CH03DyFyNQamNpqvwu5p edPnimzbl2npzbZ0copjbSuk3qcejRtu27dnGQEEEEAAAQQQQAABBBBAAIHLLeDLly53Kzh+FIFh NVeXWkGDKvaopsgeK0bZZcJV6brJG8LZps6Z7YOR3YQ7e79My15o5lGZK6njb5rULd55I7TNnuKF FQ16qOrLys00UwvdY+p99nGVVgdm9bXo75qXqXNjrHtOhjav95ePWveZjDVb0T30W+tSZhVvV0W0 scjI17aOZpW88yddddUC3WzNepyv0keOqmDotDnwbGXnxLiPor9ZH4ycDG2g7dO5EVMj/AaOtu/D FyfTN88+l/c8SMa5Ppka6brHnDdqr/My9bg2aKNc2lbxF8rK8Pyn0K2hE79W/drNvkvyvVuZP8Im 52bkl+to9906fd6M5g3ZyrLG2bPD1MY6cAiNndCj1v1Sma1oubCAAAIIIIAAAggggAACCCAwrQUI Fqfl8IzoidoiWZOm8mp0uG65mbmXyGs85F6NgUpxJzoGNjTv7uE3rNmTttWOL8699hMhxyisbVNr ZUFwXVqG8pdX6vhTmbp9jS806nP9VL0VS+M/UdcT6NQHLnuNHeiMn/Lfy9Ectbjo9pgzDrPyi7Qy P9g0ayltvnImef/Hm+6pUcPcQV19tYn7PhwxTzKuV7t3Al2nNq/r1H7T/0dM/+OeD5Psm6eNl+88 SMa5Pvka6bkl2lvzpDa4fDMSu1w16grcLtEarPgL87NyrEujI7aewlgH9u395T/GDbcD2/KOAAII IIAAAggggAACCCCAwHQR4FLo6TISVjs8DwipkHVlrsrU8djGkEugA5umzZ4bWJzElDO3Tv8hOPPP 7d0zTddbl4YGS8VaGj976rIEi+mZtn4aj+9+wxYq2hqbsahEzVV5/jVd+j/m3nfxXicetwc61VHv reitcVWwUuGtNwY/OLCUkVOg0tJSrV69WqtL12tHa58Ot223jtTVuE6dA2PW51gLk+6biSgvz3kw +XM9Vh+lqdZI09KNP9E+8zsW+1Whtv1t5kzzv+YFFhx6Hz2m71vhdhn3VnSImbIIIIAAAggggAAC CCCAAALJF4g76Sn5h6RibAG3undX2x4QUqJ9R3Yo8FyI8P3SFwQvTe7qfkVj5fkxZ9LJ/Z76AhPz dIPmeUc+XQtvCVzc3KVXTo4pPz8j/DDW5/feeMNaviFzjrXs+MKfbEcoXqIbQy49tX1nArIF2Z5g MRig2r+NWDaBzs7GAIon0MmN2CTaijNnPKFebKdo+yS6LrugXPt3vqFVm1u8pZ587qRKc6NNjfQf aUp9uxznwdTO9eh+F1sjTYtL69RbvE5Hnn1eL//+PW/59Hk3KG/xnbpzca7SR7q1w3/Q4sJbHR3t E/tc1qXXJSbwXBTz/I6uwFoEEEAAAQQQQAABBBBAAAEELpcAMxYvl3yU455orVOl/xJNc8Gt2o40 aHFmlA0Dq2bNkfV116/0ykjgi8j3sYHn1RJYXXKnFc7Nvj4YEP7smVcCW0R5H9OxTquCltyS5Fl7 o73atb7E+8CSjbsOyD7XMP0TNyowD1FnJr5oN20KNws8NpVAxxZu9vzu7Sg+F79qfGRIAwMD5mdI 4xOUufEWS0HxJtFNqW/mmEk5DyYYw/BuTflcDy9gPidaI21+jopWl2vjxo3en8r15SryhIqm9sAz nVY8fc3c4O9IlGYktsobAPsuy5aZIznZcDuxg7I3AggggAACCCCAAAIIIIAAAskRIFhMjmPCVfrN k4DX1nf66xRrb/cjKsiMM6E0LVclW4r9+/To0Y4TMdoxrsOPbbO+q1h1uzc88azI+fxXrScZe+5L eMye6Fl7SOMD5inIgcl9qtLSXE/8krxXf1eLmnp8Mw27mmr07GAwYkvLytfXCv3H6vmZeoZ8F3JH Hn1UL/4mYChlzpugjSP2J/+WqTrObMWMz9wsqwmNv9Jg5MG9a3qfblbDrl3atbtDw7GaGbLvuJ5p WKZVq1aZn2/qtzH8Pbu4zwSfAh72PJGQippi3zw7J+M8mGgM7Q28qHPdXsAsX2yNgQO7tH79Ru/P 0/2xLicf1JN1gfOoUF+9Jzfs6Mn7eOynttmKO5mtmDxZKiGAAAIIIIAAAggggAACCFwKAYLFS6Ec 5xiDh3ZpzeZ2/1YlZqbibi3NihMq+rfO/1K5NZuvp3Gtml8Yjjhaf0e9rPLmuc5f/S+2p0ubJxmX 2+5LuO7brYqoMNar+lWbrbrFDauj3vPR2uAiFsJ7a7uloamWqeJ1Ff6qfar+Hy2Kli32dvxA1oN1 VaHbsmMHi8cefzR4+akJdOLmpPNv1VrPVePeV4u+u7s7Ynahe+iQ6jY3qqWpSU2ulxSMAaWR3kPa tXWrtu5qVf+oPXE0lyF/LhAO9+l7uw9E1PUecnxATQ/W+48vLVkY+kAb6wuzMOW+eXZOwnkw8Rj6 WpjIue6rICVSI02n1dPT5f3Z/L8ejzzXvfds/LaaAgcrWavPZgY++N/dIzrUuktba7eq9VC/eZZ0 6Cv2WIdu5w2ArRnKJtxe4VyAGXZkPiKAAAIIIIAAAggggAACCCCQFIHwLCApRSkyeYGRE61aUW3F GFJepgafeUKvno1yye+HHypzSYlWF2QFD5BVZAKOQq3zP0K6cUOR3m3Yqw2fX6TZJto6+vMfqsYV mH0lVbj+e9g93NJUVLFVhU3rfEFbT72K1r+lvQ9t0KLrTIU3j+qHa2tkq6DNJYuCx0/SUu7KatW+ dE6/Nbe7u6HwG7onJzQUzP6LdWaepJnV6DleT6OW5ffJta9an/2UebDL+Xd1qO372tYSuKTU9HPP BuXEOrvNjL4d9kDnS5MJdNLNODVInXXeHve4KnXbqzVq/pt7lJnm1juv/EbV24LjWLylTLmB47sH 9XBptQLRcfv4QvXVFVlyi774DeWZRLTPrOlrqdFtr1Voz+YyEx4uMDNLx3TyxCE9WrnNemqw6Z3u u9N2DliVzMJF9c1TIPHzIN4YJnyue7qX4O9Lzj1lJlpv953P5jwqKhmUa+vXdWvOdUo7/7Y6f7hW jcGTXTurV1izez1Kntfgbx5Wdb1/NDvbtbC7V0WBfwiIM9a+Cr4/X7CF22WTCbftO7OMAAIIIIAA AggggAACCCCAwDQQCEQf06ApV2YT3j4RDMO8An0tqvNlV1FBCmvvCA0WzVYFlXvkevd+66EvLXUb gvdTtFUp2dKmupU5tjX+xcwC7dnv0v2ranz3letp0YZVLZHbmUim7UhtMDCLskXkqnORq6KtychV 5Y7d0b7xrUvL0aYj+3T6rrX+gK5TNWttCZBtz8KaZm1abpuVafvOXFCs7pbvWffP8wY6k/wtSM8t 1cE9b5uA0eWr2OVSpfmJeBVv1/9cb3uwyoUz8j0exL/lH941caHt8S+ZS/Wj5hotq/TXMv7Va1si yvpWFGrPwU0xZlhefN+8tRM9D+KMYTLO9YRrpOfrwY7t6iz13xqgr1016wKRbyh5bVu3VkeZynr+ VMho6q3T41IgWIw31v5DuIe79T1buF0xqXA7tH18QgABBBBAAAEEEEAAAQQQQOByC3Ap9GUegavm XjOlFiyI+iCJDK2s69C+nVUxahVqy96DalxfEON7E3LlrlRH9z5VFUffpLBsuw4eb4x/38ew3Wdf /2lrzdw5s6zli1rIXKwdLx9WQ6xGmrtFbjf9bN1YFDHLzDqee0jPNXnmBnpeFZpqoJOzfKOOH9xr nPJ8JUL+LFTtzn06vrvcXLxte6Xn6Ru1Qdgtf/X5iKcMZxd56rappiRaXV+tkqoGMwatWh42m9M6 UoJ989Rx6jzw1E7GuZ6MGvPzy3X8cFuMMTQNzSszQftRVdpnBns64H/lLi+37kuq4i1avsj2hPBJ jLWnzPDvnruocDvQBt4RQAABBBBAAAEEEEAAAQQQmA4Cf3bu3Ln/mA4NidWG999/X7NmzdLHPjaz MtC+Pl94dffdd8fqmjPrx0c08PqbOnPVPM370xnzfr1uzs1RxiRn5XkaNTI0oDeHzmhe1hydGf5A 1+fcrJwsW3jiTMunVHV8dEiv9w+Z2y9myj0yorTMHNPPrNiB4pSqT27jsdFhvX8+TXPNpdDn3bOV mTXfXFCc+GvMPCX65JtDOvOBuUDZFLxqTqY+c1OOMqcyiIk3Y0acB4l2c2x4UCffPqWr5s3R6PCI 5mR5zqPsS3oeJdoH9kcAAQTsAs8//7z3Y15e7H+osm9/uZYv29+TLleHOS4CCCCAAAIIXDaBmfL3 o3Cgjz76SBcuXNC1114b/tW0+pyMHGRadeiKb0x6pnLzQ+bLTZkkMztXmYEriaNcOT3lgg7skD4/ W/kF/kbmTuYeiclvRMb8LGXM99X1vyXlIBkGP98agKSUvKgiM+E8uKiO2XbKMEFivvnxvi7PaWRr DYsIIIAAAggggAACCCCAAAIIzCyBmTUNcGbZ0loEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWH lo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgW U3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAABBFJW gGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAABBBBA IGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAABBBBA AAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAABBBBA AAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAABBBBA AAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBA AAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBA AAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBA AAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBA AAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRG AAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpn S2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADB onO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALO CRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAII IOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAII IIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAII IIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAII IIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAII IIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAII IIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAII IIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAII IIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aO IYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2 aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBg MWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBl BQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAAB BFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAAB BBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAAB BBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAAB BBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAAB BBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAAB BBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAAB BBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgAB BBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tl BBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJz tlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQ LDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCLEb0iIAAEAASURBVCCAAAII IIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAII IIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAII IIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAII IIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aO IYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2 aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBg MWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBl BQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAAB BFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAAB BBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAAB BBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAAB BBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAAB BBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAAB BBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAAB BBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgAB BBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tl BBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJz tlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQ LDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDg nADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCA AALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCA AAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCA AAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCA AAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCA AAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCA AAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCA AAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGA AAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjp GAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFl h5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUI FlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRS VoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQ QCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQ QAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQ QAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQ QAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQ QAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQ QAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQ QAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQ QAABBBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZU RgABBBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6 Z0tlBBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwA waJztlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAAC zgkQLDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAAC CCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAAC CCCAAALOCRAsOmdL5f+fvTuB86Ku/wf+ZrnkVhFQ0bzQNPEqrzKlvEoDzbTIjDzII4jK1C6vUqkU j9KwslDL/hpaWeKRP4/EK7zyQvPCK1FBEJFLYNn9z+zu97vfZXdhl2Vgd/Y5j8fyne/MfD7z+Tw/ A8LLz8wQIECAAAECBAgQIECAAAECBAgQyK2AYDG3Q6tjBAgQIECAAAECBAgQIECAAAECBLITECxm Z6tmAgQIECBAgAABAgQIECBAgAABArkVECzmdmh1jAABAgQIECBAgAABAgQIECBAgEB2AoLF7GzV TIAAAQIECBAgQIAAAQIECBAgQCC3AoLF3A6tjhEgQIAAAQIECBAgQIAAAQIECBDITkCwmJ2tmgkQ IECAAAECBAgQIECAAAECBAjkVkCwmNuh1TECBAgQIECAAAECBAgQIECAAAEC2QkIFrOzVTMBAgQI ECBAgAABAgQIECBAgACB3AoIFnM7tDpGgAABAgQIECBAgAABAgQIECBAIDsBwWJ2tmomQIAAAQIE CBAgQIAAAQIECBAgkFsBwWJuh1bHCBAgQIAAAQIECBAgQIAAAQIECGQnIFjMzlbNBAgQIECAAAEC BAgQIECAAAECBHIrIFjM7dDqGAECBAgQIECAAAECBAgQIECAAIHsBASL2dmqmQABAgQIECBAgAAB AgQIECBAgEBuBQSLuR1aHSNAgAABAgQIECBAgAABAgQIECCQnYBgMTtbNRMgQIAAAQIECBAgQIAA AQIECBDIrYBgMbdDq2MECBAgQIAAAQIECBAgQIAAAQIEshMQLGZnq2YCBAgQIECAAAECBAgQIECA AAECuRUQLOZ2aHWMAAECBAgQIECAAAECBAgQIECAQHYCgsXsbNVMgAABAgQIECBAgAABAgQIECBA ILcCgsXcDq2OESBAgAABAgQIECBAgAABAgQIEMhOQLCYna2aCRAgQIAAAQIECBAgQIAAAQIECORW QLCY26HVMQIECBAgQIAAAQIECBAgQIAAAQLZCQgWs7NVMwECBAgQIECAAAECBAgQIECAAIHcCggW czu0OkaAAAECBAgQIECAAAECBAgQIEAgOwHBYna2aiZAgAABAgQIECBAgAABAgQIECCQWwHBYm6H VscIECBAgAABAgQIECBAgAABAgQIZCcgWMzOVs0ECBAgQIAAAQIECBAgQIAAAQIEcisgWMzt0OoY AQIECBAgQIAAAQIECBAgQIAAgewEBIvZ2aqZAAECBAgQIECAAAECBAgQIECAQG4FBIu5HVodI0CA AAECBAgQIECAAAECBAgQIJCdgGAxO1s1EyBAgAABAgQIECBAgAABAgQIEMitgGAxt0OrYwQIECBA gAABAgQIECBAgAABAgSyExAsZmerZgIECBAgQIAAAQIECBAgQIAAAQK5FRAs5nZodYwAAQIECBAg QIAAAQIECBAgQIBAdgKCxexs1UyAAAECBAgQIECAAAECBAgQIEAgtwKCxdwOrY4RIECAAAECBAgQ IECAAAECBAgQyE5AsJidrZoJECBAgAABAgQIECBAgAABAgQI5FZAsJjbodUxAgQIECBAgAABAgQI ECBAgAABAtkJCBazs1UzAQIECBAgQIAAAQIECBAgQIAAgdwKCBZzO7Q6RoAAAQIECBAgQIAAAQIE CBAgQCA7AcFidrZqJkCAAAECBAgQIECAAAECBAgQIJBbAcFibodWxwgQIECAAAECBAgQIECAAAEC BAhkJyBYzM5WzQQIECBAgAABAgQIECBAgAABAgRyKyBYzO3Q6hgBAgQIECBAgAABAgQIECBAgACB 7AQEi9nZqpkAAQIECBAgQIAAAQIECBAgQIBAbgUEi7kdWh0jQIAAAQIECBAgQIAAAQIECBAgkJ2A YDE7WzUTIECAAAECBAgQIECAAAECBAgQyK2AYDG3Q6tjBAgQIECAAAECBAgQIECAAAECBLITECxm Z6tmAgQIECBAgAABAgQIECBAgAABArkVECzmdmh1jAABAgQIECBAgAABAgQIECBAgEB2AoLF7GzV TIAAAQIECBAgQIAAAQIECBAgQCC3AoLF3A6tjhEgQIAAAQIECBAgQIAAAQIECBDITkCwmJ2tmgkQ IECAAAECBAgQIECAAAECBAjkVkCwmNuh1TECBAgQIECAAAECBAgQIECAAAEC2QkIFrOzVTMBAgQI ECBAgAABAgQIECBAgACB3AoIFnM7tDpGgAABAgQIECBAgAABAgQIECBAIDsBwWJ2tmomQIAAAQIE CBAgQIAAAQIECBAgkFsBwWJuh1bHCBAgQIAAAQIECBAgQIAAAQIECGQnIFjMzlbNBAgQIECAAAEC BAgQIECAAAECBHIrIFjM7dDqGAECBAgQIECAAAECBAgQIECAAIHsBASL2dmqmQABAgQIECBAgAAB AgQIECBAgEBuBQSLuR1aHSNAgAABAgQIECBAgAABAgQIECCQnYBgMTtbNRMgQIAAAQIECBAgQIAA AQIECBDIrYBgMbdDq2MECBAgQIAAAQIECBAgQIAAAQIEshMQLGZnq2YCBAgQIECAAAECBAgQIECA AAECuRUQLOZ2aHWMAAECBAgQIECAAAECBAgQIECAQHYCgsXsbNVMgAABAgQIECBAgAABAgQIECBA ILcCgsXcDq2OESBAgAABAgQIECBAgAABAgQIEMhOQLCYna2aCRAgQIAAAQIECBAgQIAAAQIECORW QLCY26HVMQIECBAgQIAAAQIECBAgQIAAAQLZCQgWs7NVMwECBAgQIECAAAECBAgQIECAAIHcCggW czu0OkaAAAECBAgQIECAAAECBAgQIEAgOwHBYna2aiZAgAABAgQIECBAgAABAgQIECCQWwHBYm6H VscIECBAgAABAgQIECBAgAABAgQIZCcgWMzOVs0ECBAgQIAAAQIECBAgQIAAAQIEcisgWMzt0OoY AQIECBAgQIAAAQIECBAgQIAAgewEBIvZ2aqZAAECBAgQIECAAAECBAgQIECAQG4FBIu5HVodI0CA AAECBAgQIECAAAECBAgQIJCdgGAxO1s1EyBAgAABAgQIECBAgAABAgQIEMitgGAxt0OrYwQIECBA gAABAgQIECBAgAABAgSyExAsZmerZgIECBAgQIAAAQIECBAgQIAAAQK5FRAs5nZodYwAAQIECBAg QIAAAQIECBAgQIBAdgKCxexs1UyAAAECBAgQIECAAAECBAgQIEAgtwKCxdwOrY4RIECAAAECBAgQ IECAAAECBAgQyE5AsJidrZoJECBAgAABAgQIECBAgAABAgQI5FZAsJjbodUxAgQIECBAgAABAgQI ECBAgAABAtkJCBazs1UzAQIECBAgQIAAAQIECBAgQIAAgdwKCBZzO7Q6RoAAAQIECBAgQIAAAQIE CBAgQCA7AcFidrZqJkCAAAECBAgQIECAAAECBAgQIJBbAcFibodWxwgQIECAAAECBAgQIECAAAEC BAhkJyBYzM5WzQQIECBAgAABAgQIECBAgAABAgRyKyBYzO3Q6hgBAgQIECBAgAABAgQIECBAgACB 7AQEi9nZqpkAAQIECBAgQIAAAQIECBAgQIBAbgUEi7kdWh0jQIAAAQIECBAgQIAAAQIECBAgkJ2A YDE7WzUTIECAAAECBAgQIECAAAECBAgQyK2AYDG3Q6tjBAgQIECAAAECBAgQIECAAAECBLITECxm Z6tmAgQIECBAgAABAgQIECBAgAABArkVECzmdmh1jAABAgQIECBAgAABAgQIECBAgEB2AoLF7GzV TIAAAQIECBAgQIAAAQIECBAgQCC3AoLF3A6tjhEgQIAAAQIECBAgQIAAAQIECBDITkCwmJ2tmgkQ IECAAAECBAgQIECAAAECBAjkVkCwmNuh1TECBAgQIECAAAECBAgQIECAAAEC2QkIFrOzVTMBAgQI ECBAgAABAgQIECBAgACB3AoIFnM7tDpGgAABAgQIECBAgAABAgQIECBAIDsBwWJ2tmomQIAAAQIE CBAgQIAAAQIECBAgkFsBwWJuh1bHCBAgQIAAAQIECBAgQIAAAQIECGQnIFjMzlbNBAgQIECAAAEC BAgQIECAAAECBHIrIFjM7dDqGAECBAgQIECAAAECBAgQIECAAIHsBASL2dmqmQABAgQIECBAgAAB AgQIECBAgEBuBQSLuR1aHSNAgAABAgQIECBAgAABAgQIECCQnYBgMTtbNRMgQIAAAQIECBAgQIAA AQIECBDIrYBgMbdDq2MECBAgQIAAAQIECBAgQIAAAQIEshMQLGZnq2YCBAgQIECAAAECBAgQIECA AAECuRUQLOZ2aHWMAAECBAgQIECAAAECBAgQIECAQHYCgsXsbNVMgAABAgQIECBAgAABAgQIECBA ILcCgsXcDq2OESBAgAABAgQIECBAgAABAgQIEMhOQLCYna2aCRAgQIAAAQIECBAgQIAAAQIECORW QLCY26HVMQIECBAgQIAAAQIECBAgQIAAAQLZCQgWs7NVMwECBAgQIECAAAECBAgQIECAAIHcCggW czu0OkaAAAECBAgQIECAAAECBAgQIEAgOwHBYna2aiZAgAABAgQIECBAgAABAgQIECCQWwHBYm6H VscIECBAgAABAgQIECBAgAABAgQIZCcgWMzOVs0ECBAgQIAAAQIECBAgQIAAAQIEcisgWMzt0OoY AQIECBAgQIAAAQIECBAgQIAAgewEBIvZ2aqZAAECBAgQIECAAAECBAgQIECAQG4FBIu5HVodI0CA AAECBAgQIECAAAECBAgQIJCdgGAxO1s1EyBAgAABAgQIECBAgAABAgQIEMitgGAxt0OrYwQIECBA gAABAgQIECBAgAABAgSyExAsZmerZgIECBAgQIAAAQIECBAgQIAAAQK5FRAs5nZodYwAAQIECBAg QIAAAQIECBAgQIBAdgKCxexs1UyAAAECBAgQIECAAAECBAgQIEAgtwKCxdwOrY4RIECAAAECBAgQ IECAAAECBAgQyE5AsJidrZoJECBAgAABAgQIECBAgAABAgQI5FZAsJjbodUxAgQIECBAgAABAgQI ECBAgAABAtkJCBazs1UzAQIECBAgQIAAAQIECBAgQIAAgdwKCBZzO7Q6RoAAAQIECBAgQIAAAQIE CBAgQCA7AcFidrZqJkCAAAECBAgQIECAAAECBAgQIJBbAcFibodWxwgQIECAAAECBAgQIECAAAEC BAhkJyBYzM5WzQQIECBAgAABAgQIECBAgAABAgRyKyBYzO3Q6hgBAgQIECBAgAABAgQIECBAgACB 7AQEi9nZqpkAAQIECBAgQIAAAQIECBAgQIBAbgUEi7kdWh0jQIAAAQIECBAgQIAAAQIECBAgkJ2A YDE7WzUTIECAAAECBAgQIECAAAECBAgQyK2AYDG3Q6tjBAgQIECAAAECBAgQIECAAAECBLITECxm Z6tmAgQIECBAgAABAgQIECBAgAABArkVECzmdmh1jAABAgQIECBAgAABAgQIECBAgEB2AoLF7GzV TIAAAQIECBAgQIAAAQIECBAgQCC3AoLF3A6tjhEgQIAAAQIECBAgQIAAAQIECBDITkCwmJ2tmgkQ IECAAAECBAgQIECAAAECBAjkVkCwmNuh1TECBAgQIECAAAECBAgQIECAAAEC2QkIFrOzVTMBAgQI ECBAgAABAgQIECBAgACB3AoIFnM7tDpGgAABAgQIECBAgAABAgQIECBAIDsBwWJ2tmomQIAAAQIE CBAgQIAAAQIECBAgkFsBwWJuh1bHCBAgQIAAAQIECBAgQIAAAQIECGQnIFjMzlbNBAgQIECAAAEC BAgQIECAAAECBHIrIFjM7dDqGAECBAgQIECAAAECBAgQIECAAIHsBASL2dmqmQABAgQIECBAgAAB AgQIECBAgEBuBQSLuR1aHSNAgAABAgQIECBAgAABAgQIECCQnYBgMTtbNRMgQIAAAQIECBAgQIAA AQIECBDIrYBgMbdDq2MECBAgQIAAAQIECBAgQIAAAQIEshMQLGZnq2YCBAgQIECAAAECBAgQIECA AAECuRUQLOZ2aHWMAAECBAgQIECAAAECBAgQIECAQHYCgsXsbNVMgAABAgQIECBAgAABAgQIECBA ILcCgsXcDq2OESBAgAABAgQIECBAgAABAgQIEMhOQLCYna2aCRAgQIAAAQIECBAgQIAAAQIECORW QLCY26HVMQIECBAgQIAAAQIECBAgQIAAAQLZCQgWs7NVMwECBAgQIECAAAECBAgQIECAAIHcCggW czu0OkaAAAECBAgQIECAAAECBAgQIEAgOwHBYna2aiZAgAABAgQIECBAgAABAgQIECCQWwHBYm6H VscIECBAgAABAgQIECBAgAABAgQIZCcgWMzOVs0ECBAgQIAAAQIECBAgQIAAAQIEcisgWMzt0OoY AQIECBAgQIAAAQIECBAgQIAAgewEBIvZ2aqZAAECBAgQIECAAAECBAgQIECAQG4FBIu5HVodI0CA AAECBAgQIECAAAECBAgQIJCdgGAxO1s1EyBAgAABAgQIECBAgAABAgQIEMitgGAxt0OrYwQIECBA gAABAgQIECBAgAABAgSyExAsZmerZgIECBAgQIAAAQIECBAgQIAAAQK5FRAs5nZodYwAAQIECBAg QIAAAQIECBAgQIBAdgKCxexs1UyAAAECBAgQIECAAAECBAgQIEAgtwKCxdwOrY4RIECAAAECBAgQ IECAAAECBAgQyE5AsJidrZoJECBAgAABAgQIECBAgAABAgQI5FZAsJjbodUxAgQIECBAgAABAgQI ECBAgAABAtkJCBazs1UzAQIECBAgQIAAAQIECBAgQIAAgdwKCBZzO7Q6RoAAAQIECBAgQIAAAQIE CBAgQCA7AcFidrZqJkCAAAECBAgQIECAAAECBAgQIJBbAcFibodWxwgQIECAAAECBAgQIECAAAEC BAhkJyBYzM5WzQQIECBAgAABAgQIECBAgAABAgRyKyBYzO3Q6hgBAgQIECBAgAABAgQIECBAgACB 7AQEi9nZqpkAAQIECBAgQIAAAQIECBAgQIBAbgUEi7kdWh0jQIAAAQIECBAgQIAAAQIECBAgkJ2A YDE7WzUTIECAAAECBAgQIECAAAECBAgQyK2AYDG3Q6tjBAgQIECAAAECBAgQIECAAAECBLITECxm Z6tmAgQIECBAgAABAgQIECBAgAABArkVECzmdmh1jAABAgQIECBAgAABAgQIECBAgEB2AoLF7GzV TIAAAQIECBAgQIAAAQIECBAgQCC3AoLF3A6tjhEgQIAAAQIECBAgQIAAAQIECBDITkCwmJ2tmgkQ IECAAAECBAgQIECAAAECBAjkVkCwmNuh1TECBAgQIECAAAECBAgQIECAAAEC2QkIFrOzVTMBAgQI ECBAgAABAgQIECBAgACB3AoIFnM7tDpGgAABAgQIECBAgAABAgQIECBAIDsBwWJ2tmomQIAAAQIE CBAgQIAAAQIECBAgkFsBwWJuh1bHCBAgQIAAAQIECBAgQIAAAQIECGQnIFjMzlbNBAgQIECAAAEC BAgQIECAAAECBHIrIFjM7dDqGAECBAgQIECAAAECBAgQIECAAIHsBASL2dmqmQABAgQIECBAgAAB AgQIECBAgEBuBQSLuR1aHSNAgAABAgQIECBAgAABAgQIECCQnYBgMTtbNRMgQIAAAQIECBAgQIAA AQIECBDIrYBgMbdDq2MECBAgQIAAAQIECBAgQIAAAQIEshMQLGZnq2YCBAgQIECAAAECBAgQIECA AAECuRUQLOZ2aHWMAAECBAgQIECAAAECBAgQIECAQHYCgsXsbNVMgAABAgQIECBAgAABAgQIECBA ILcCgsXcDq2OESBAgAABAgQIECBAgAABAgQIEMhOQLCYna2aCRAgQIAAAQIECBAgQIAAAQIECORW QLCY26HVMQIECBAgQIAAAQIECBAgQIAAAQLZCQgWs7NVMwECBAgQIECAAAECBAgQIECAAIHcCggW czu0OkaAAAECBAgQIECAAAECBAgQIEAgOwHBYna2aiZAgAABAgQIECBAgAABAgQIECCQWwHBYm6H VscIECBAgAABAgQIECBAgAABAgQIZCcgWMzOVs0ECBAgQIAAAQIECBAgQIAAAQIEcisgWMzt0OoY AQIECBAgQIAAAQIECBAgQIAAgewEBIvZ2aqZAAECBAgQIECAAAECBAgQIECAQG4FBIu5HVodI0CA AAECBAgQIECAAAECBAgQIJCdgGAxO1s1EyBAgAABAgQIECBAgAABAgQIEMitgGAxt0OrYwQIECBA gAABAgQIECBAgAABAgSyExAsZmerZgIECBAgQIAAAQIECBAgQIAAAQK5FRAs5nZodYwAAQIECBAg QIAAAQIECBAgQIBAdgKCxexs1UyAAAECBAgQIECAAAECBAgQIEAgtwKCxdwOrY4RIECAAAECBAgQ IECAAAECBAgQyE5AsJidrZoJECBAgAABAgQIECBAgAABAgQI5FZAsJjbodUxAgQIECBAgAABAgQI ECBAgAABAtkJCBazs1UzAQIECBAgQIAAAQIECBAgQIAAgdwKCBZzO7Q6RoAAAQIECBAgQIAAAQIE CBAgQCA7AcFidrZqJkCAAAECBAgQIECAAAECBAgQIJBbAcFibodWxwgQIECAAAECBAgQIECAAAEC BAhkJyBYzM5WzQQIECBAgAABAgQIECBAgAABAgRyKyBYzO3Q6hgBAgQIECBAgAABAgQIECBAgACB 7AQEi9nZqpkAAQIECBAgQIAAAQIECBAgQIBAbgUEi7kdWh0jQIAAAQIECBAgQIAAAQIECBAgkJ2A YDE7WzUTIECAAAECBAgQIECAAAECBAgQyK2AYDG3Q6tjBAgQIECAAAECBAgQIECAAAECBLITECxm Z6tmAgQIECBAgAABAgQIECBAgAABArkVECzmdmh1jAABAgQIECBAgAABAgQIECBAgEB2AoLF7GzV TIAAAQIECBAgQIAAAQIECBAgQCC3AoLF3A6tjhEgQIAAAQIECBAgQIAAAQIECBDITkCwmJ2tmgkQ IECAAAECBAgQIECAAAECBAjkVkCwmNuh1TECBAgQIECAAAECBAgQIECAAAEC2QkIFrOzVTMBAgQI ECBAgAABAgQIECBAgACB3AoIFnM7tDpGgAABAgQIECBAgAABAgQIECBAIDsBwWJ2tmomQIAAAQIE CBAgQIAAAQIECBAgkFsBwWJuh1bHCBAgQIAAAQIECBAgQIAAAQIECGQnIFjMzlbNBAgQIECAAAEC BAgQIECAAAECBHIrIFjM7dDqGAECBAgQIECAAAECBAgQIECAAIHsBDplV7WaU4EHH3wQBAECBAgQ IECAQAMC/p7UAIpNBAgQIECAAIE2JGDGYhsaLE0lQIAAAQIECBAgQIAAAQIECBAg0FoEOixcuLCy tTSmoXbMnTs3OnbsGGVlMtCGfGwjQIAAAQIECBAgQIAAAQIECBDIl0BFRUUsW7Ys+vTp06o7Jq1r 1cOjcQQIECBAgAABAgQIECBAgAABAgRap4BgsXWOi1YRIECAAAECBAgQIECAAAECBAgQaNUCgsVW PTwaR4AAAQIECBAgQIAAAQIECBAgQKB1CggWW+e4aBUBAgQIECBAgAABAgQIECBAgACBVi0gWGzV w6NxBAgQIECAAAECBAgQIECAAAECBFqngGCxdY6LVhEgQIAAAQIECBAgQIAAAQIECBBo1QKCxVY9 PBpHgAABAgQIECBAgAABAgQIECBAoHUKCBZb57hoFQECBAgQIECAAAECBAgQIECAAIFWLSBYbNXD o3EECBAgQIAAAQIECBAgQIAAAQIEWqeAYLF1jotWESBAgAABAgQIECBAgAABAgQIEGjVAoLFVj08 GkeAAAECBAgQIECAAAECBAgQIECgdQoIFlvnuGgVAQIECBAgQIAAAQIECBAgQIAAgVYtIFhs1cOj cQQIECBAgAABAgQIECBAgAABAgRap4BgsXWOi1YRIECAAAECBAgQIECAAAECBAgQaNUCgsVWPTwa R4AAAQIECBAgQIAAAQIECBAgQKB1CnRqnc1q+62aMmVKm+pEZWVlVXs32WSTNtXuTTfdtE21V2MJ ECBAgACBCH9PWjNXgb8nrRlnZyFAgAABAu1ZwIzF9jz6+k6AAAECBAgQIECAAAECBAgQIEBgFQXM WFxFuKYWO/DAA5t66Fo97vbbb686/1ZbbbVW29HUk0+bNq2phzqOAAECBAgQaKUC/p6UzcD4e1I2 rmolQIAAAQIE6guYsVjfxBYCBAgQIECAAAECBAgQIECAAAECBFYiIFhcCZDdBAgQIECAAAECBAgQ IECAAAECBAjUFxAs1jexhQABAgQIECBAgAABAgQIECBAgACBlQgIFlcCZDcBAgQIECBAgAABAgQI ECBAgAABAvUFvLylvslq3VJZWbla68u6srbW3qw91E+AAAECBAhkJ9DW/t7R1tqb3cipmQABAgQI ECBQLSBYdCUQIEBgFQUqFs6IV16fE0uryneOXuv3i4H9e69ibdkWm/nva+JX97wR3dYZFMd9e3gM KKto8gnLKqbHH8//Y/xv0aLY8pBvx/Bd+za5rAMJECBAgAABAgQIECBAIL8CgsX8jq2erTaBBTHp eyPi2IfvjX12vyquuWBY9Kipu8Pb/xdfGPzTqNxn/QbP9u67HWLz3XeLQ780PIbtukWsid9wHWbd E8ds++OYm7Spw7vvxuw9To1bzh9abHODDW11G1u3eVnF7Lj10rPiq+dNrC83ZGT87qyT47CdNqy/ by1umfPcXXH5RTcnLRgSn/3GV2LAOk0PFjssfjfuuuiimJSU3mfjowSLa3EcnZoAAQIECBAgQIAA AQKtSWBN5Bytqb9tvi2DBw+u6sPUqVPbfF/aUgfmv3NvREJ+b9/5UV6WPJq0ojqUWTJnRkyu2tF4 b6ZOnRw3X3lhxLCx8egVo2LzzssaP7iFe8rK5saVJx5RFQBF0uSqpe+8Om1u4SnWWPHWat5x4XPx 04M/GeMa+y04eUIcv9+EuPOXD8T4oz68xrxWdqJOXQpxeO/oVNn0ULGq3s4RPWtO0Ltrh5Wdyn4C BAisNQF/T1pr9E5MgAABAgQItFMBwWI7HXjdbp5A15LDO9WEilWbksCluAweGacfum588EH1lnXW iXjqH8ksr0IANen02PXLvWPajUdFn9I6ihW0fOXVv58Xp06uX0+dNtff3Sq3tEbzsrIZcXGdUHFI nP/ns+OzO/aNJe+8GLf/4dI448rqRHfit/eKPfd4K0YMKr1IWiW1RhEgQIAAAQIECBAgQIAAgVUS ECyuEptCBOoLXHL1z2PE5svN5jr5tJj+7+viqGEnp/MaIyaPiSsfHRonf7RX/QpauKXL3Hvia8dd 1cJa2lbxNW0+45bxcW4hKI6RccerF8cuPaufsBj9B8ZJF3wqPrnt6PjU96pvkT75d/+KI88/cI3c At+2Rk5rCRAgQIAAAQIECBAgQCAPAoLFPIyiPrQKgSWL0qmK3ZZrS6cY+PERccPEN2K74RdV7Rs7 8bEY89FPVYVNC2bPiPc+KE+2d44NBvaP0ll6pRW9P3N6zEvyq049+8WAPl1Kd9WsL4g/f+eI6vAy 2XL+3Y/Gpv9v1/jKhAYObeam9AUl/338v/HKnPnVJbusF4O23yG2HdjYS0rK493pM+L95Oh+Gw6M Hh3L463nn47nX3sn5i9ZEv0/8snYfct1m9mKhg9fk+ZlZbPjlt9fXtOQwXH14xfUhoolzdvpyJPi yCRYfLrqqQVLYnGyr3l/0JbHzNf+Gy8+/1bMSbzSZb1Nto7BO24XfVbywpWyirnx3GOPxwszkrHq 0iXWW2+z2Han7aJvl6bd+vz+9OfiP8+8lIxTUrznevGhzbeLbTevfn5ozehXtaf0l8K1Gd3Wi4Hr d4+K96fHU0+/GG+k10uXAfHx/feIvnXaXR7vvPx0PP7s9KjuXZfov/UOsdOHN2r0+q8+34J4/fln 4rnXZkbKsnz7SttUur7w3Vfjmf++EDPmpGdLTAYkJtsnJt1XbJJe9089/mTSj5pW9hwQ23905xjY e8UzUFf1fKVttk6AAAECBAgQIECAAIG2ItC8f++2lV5pJ4FWJrDhkKFxZFwU16XteumtWJA8p7FP xby46YTtY0zNrcvXPjc7Dtygsl7LO89/OA75yMHVoeHgC2PavcfVu5X6nfsujRPSN2uky8hrY+SO G8XfLqn+uuq/Lo7Hbrg4PvON6kB0+XoGH3lh/P78kTGoe91nRi7736TYZpfjqw4/feKNUXb5YXFu ye3Zg8dOjntOXD3B4vJtKv2+us3Xfe3ftbeZH3lqHLBp/bFKz7+s2w5x2axZpU1p8vqsJ2+Mn3z7 +LhuakNFBsc5E/8Qo/bbrKGdMffZG+O4fY5PnvlZfzn9xsfi4F7d6++o2ZKGprf99JQ46sKb6x+T PBv0/rGfiP719yRbFsTfvrRTnJq2d8jYuPHrC+OwEWNLjhwSd7xxU/SteVFM+TsPx9iTDo7LGmpk 8iiBf1w3NvbaqP5/lt54cGKcecjo6meHltRetTpkTPzjku/HXh9Knj1QsnRc+Gpcf8GP48RfNdCn 5LhRv7g5vv/VPRt4qVF63Y9NrvtCiFxSabJ67C9vifOO2qNeCLrq56tbv28ECBAgQIAAAQIECBBo SwLJWygsWQpUVlbG6vwptHV11pnWZVmDAslEv+pnHvaI/UedUjzxP+55rbheuvLmQ3cVZyIO/+be 9ULFjoueju8dVgj/hsUdZ34uKV5eNVOutJ7mrKcvgbn5+wMbDRXTuqZed2rs+aGvxQPv1K25YvH8 4oaxw+uGiumO9bvUD46KBbJaWQ3mi957vdi6UZ/fqypYWjjzpXjwlhvjmmuuiWsmTIiJt0yOl96t uTW6eHTTVpa8ODG23a+xUDGtY2qcNfxj8bMpc+pVOO+xCbFVI6FievDYwz4WezVym3waKl559Icb DhXTwsmzQT+546ejscmvvbdID0qWyacvFypWby78uvjVG2PD7RoJFdODpk6IQ3fYMG58MZ3jWbvM +8/lsfNyoWLh5QxVR02+LA796Dfi4fc6FAulfbr84F3rhorJi6+qJpHWHHX5d4bGiN88XixTvbIg /u8nn2k0VEyPuerbn4uB3785iVRrl1U/X20d1gi0V4Gs/j6TVb3tdZz0mwABAgQIECDQmIBgsTEZ 2wmsRoGy+e/Hm4X6knuEq94snXzfeK/PxrCa7ROvuzvmpm+crrMsjof+XggNh8RX9t+2zt40QLzv 0jHFmVyjJtbentvYbdXLVdDg1xl3XBTHlCRJp0z4V0x7c2bMmvV2PPdgMiOyWGpSHPq96+qELMVd xZVkpt01t8eTL7wQzz75ZFx11HbFPVmurG7z1x59uNjc7Td6L/71y2PiQx/ZMw45+vg4+eST4+Tv fz9GH3147LnNRjH61/c3MJbF4g2sLIi//mB0cfvwc/8Uj77werydzHyc+foz8fcLji3uu+gH18SM kuukY+VLcd5nvl/cH0NOizuefjWmv/12vPXyo3HVqfvU7mtgbfrffx6nFma7Jvurx/rNmD59ejx+ 1+9iSANlVrRp8JFj49aHk1vfk9uWn3z2qthlnaVRVjY9frFr9SzWtOzgkZfFlLR/SRtff2FKXDiy NvI7/vjfFvuXBnZ/HXtW8XSn/Pr2mDbz3bjnnnuq+vbbbxb6Nim+NzGdNlm9zH1yYpxe+Jp43Jp4 zErK3DNrejxx1/hin+4947x4eH7trc1zkpm/X7msUHBwnP+3R+O1GTNixozX4tG/nV8bTE44Jq6Y Mq9wuljV8xUrsEKAAAECBAgQIECAAIE2KrAWpg61USnNJrBSgcZ+Oy2IG392aPEW1X0O2KE463Dp OjvE0WMGx6Q0zJh8dTw089jkdujaE3WenwRxVfdPJ9uGHRU7r1t3NtzS/14Xh4yrCUKGXRanHDAg ooVvnE7ffHztubW3gZ5/+ysx8mO9ahpVFhtsc2Bc+Nb90X2jT8Zl6dZJY+LmFw+P4Vs39OzHIfGX qX+LT21YOiu2oqau1fGx5sw7delRbPCvR+0WUwv5U7I1nUE3tWTDxDM/HxMfviym/aHpbwDf5HOn xKhdF0Ws8/E4ZfTBxWskug+ITx73s7j2+UeSZ2YmJ536eLy5sGMMqLm9eNb9N9TOJkxuR37mxm/E gMI10HvzGPaD6+PWbl+Pg8+9udj+wko61teXzGQ85+YXY9Se6xV2x6Y7HRY3/bd/HLJd7fVb3NnA yj6n/iOu/8Fe9Z4pOffR62Nc4fjkVv3bkxfaFILvTusPiuPG/SO6ztwqxqQB59Rz4q9PHhujdugV HZbNi9cmFwqOjW998WPJrcvV10/npG9fOvvimFs5Pl5LDhlQciv0vDfeLhSK0398SuxevL26a2yy 0/C49M/z4xf3pTNQN4zeNc9/TEPM688shPgRv3v0rjhs84419fSIzfdJXtZzX5fYaO+Tq7aNHffX +NqNx0XfxHpVzldsoBUCBAgQIECAAAECBAi0YYHlp0e14a5oOoG1K7B47nuxeMGCmDt3bvKzMBYm n/975p44//DNSmb/DY5vHbFDSUM7xR5fGlHzfWosfzv0zMfvKgaSpxz36TrPg0tngV1eE3Ik0VZc +7Ov1IZRJWdo7mrlm4/Uvvl42BXx5WKoWFvTss7bxqiJo4obJt7/SnG9dGWf836yXKhYurfl62va vNDiQoZ47AV/j2den1k1g27mm8/HLb+snVmYBq4X3fJGochKPnvE3sf9MM754TlxzskHNTCOnWKH 3bYv1tGpshDOLo5Hbq4Nw84/77jaULH26Pj46FOSZ3zWX5a+lox1YXMSTB9dEioWNi/tt1dc8Mvh ha8r+BwWZ36n+qVEdQ8qj8cm/aNm05D4R3KrfiFULBxXUdEnjjprfOFr3PloGhUmS3l5LKxeS36d Ev96YW7xW7qyrMPmcdxPxsVPkp9RB21V3Fe+NAloa5Yn774vZlfU/U/dwP1Hxrif/CT5+UZsW/OM 0Mo3/12c5bjPmXeUhIqFmpJXLG13ZFxdgJw8OV5PAt50WZXz1dZqjQABAgQIECBAgAABAm1XoLHp Pm23R1pOYC0JnDV0uzhrJecedc0f4lPLvaCl5+D9YkxSLp39l94O/dMvFV7OsjgeuL4QGh0ZQz++ QXLEsuIZXrz+p8VQaOi4X8WBdWYFFg9r9sqSObXP8Bt6wM51wszSyjbe67DkNu7Lq27D7t21Q+mu 4nrvrg3NYizubvHKmjYvbfApE5+KH+63cXFTWZe+scdR4+KpDdePHWveAH75iGvixHd/GAMLMwiL Rze+svDd6fHya9Orw+kFc2LOgvkxf/68eP6WZxooVB6zZxY2Hxm7b52+wKT2GinsWdZpm/h0Eohd V5j9WrOjYn7pWO/R6Fhv8Yl9khITC9U1+lkbeJYesjjeerUwvXNy3P73v8TMHoVgtHBcl+g459HC l+idvL05XZZ13jwOGhmRPL4yWSbFMZ+YFIOHjYwv7fep2DUJWj+8xSbRp0vd0DA9crPd0xu4r0pX 4+Zzv5j8DI5jTx0eQ/bcNQZ/5MOxSf/e9WZVll739954U9w46NWoeW11VT1VvyTNeurp2q+F/q7K +WprsUaAAAECBAgQIECAAIG2KyBYbCVjt+OOO1a95KWpzdlhh9JZb42Xevrpkn8FN35Ys/fcd999 zS7TlAJ77713Uw5rg8cMi9/dNS4O2ykNB+suy5ZtHoePGxqXnZbcqjq59nbo0tugB592ZOzQqTYw 6vzeA/G9k2qCnsGnxdiROy53C3TJb+3eXeuFKHVbsNy32kfOxd67bLrcztqvFZ06Rc+arzffMTUW fGWbRoOp2lJrcm31mtdp+eCxccIBmyxnXn3EJgccF2cOvqhm1udzMTOZ1Taw5rblOnUs96Xj+y/F 78/7Xpx25b3L7Vnx1+Lsv2GfiC1LrpG6pbrGTnsmsw6vWy4crDPWG9UtUvKt86YfqZrxuFwuWXLE ileLbUwOu/w7SVK4kuXmmx+LBcem11On2O/sKXHmS3sW3yw+ddKESH8Kyz5fPjN+cPqJye3OtW+F rtxwaDw28fT42PCxNYdNjasuTH4KhZKnLJ4+4UdxwqHprdU1S4lFTL0sjj+6sKOxz0nx8KvzY4ft usUqna+xam0nQKBBAX9PqmbJ79+TGhx2GwkQIECAAIE2IFCSPrSB1rbBJq7tNy439/xNPb6pxzV3 yLKqt7ntWJXj0xduHLNjr1iwtPQ5iJ2jz0Zbxkc+vFG92z9Lz7HDQUdEpMFi8ubf9HboA4/4UJTe Bj3ykN1KDl8cd/yy5Jl3e2wf8559Mh5fVF48pkuXufHQpJqvkx6KyU9sGesuWRLrD9olBq1fmqAU izS4snjRB8n2Ro6vrN0+ePP1mxdeNni25m9cc+aJQq/uxQYOPfrTVc/WK24oWamoGBD7HJbM8Jta HRAWZrWVHFJvtWPlq/HTLfesfQ5hekTy3Mahm28ePfr1i002Xj8eHXtR8bb4ehWkG95/Pz5IXurS o5HZkYuWlL7HuH4Ni0uun+X3ln1QHvOX37iK34d++bjo162y0dKLFr0T3T66ZfH3y7Lug+Lbf50e hzwyOf551x1x54VX1XG498/nRvpzyX3/ixFJyFdYNtvv5HjnhWFx913/F7ffcmdceXNpYDs5CeOT nzuviGnjj6h/6/ngYXHsbhsUqmrwc9E7PWLbdWt/D7TofA2ewUYC7UNgbf93v7nnb+rxTT2uuaOc Vb3NbYfjCRAgQIAAAQIFAcFiQWItfz6ZvC23KUv6f+zT5amnnmrK4Zkd4/+Y16fd84DPxG6DGr4l uP7Rdbd02HjvuHBIxKmTq2+HvuCIESW3QZ8W+26fzPkqBkbl8darJeUnHBOfrJ3AVbKjsDoheZt0 9QGDx06Oe06sfVZf4Yg6n0uXFL/e+fBrMeqjtW/sLe5IVjrOfTsK82E333rjYhBUekzW62vOPGKj j1T/3kv79OrMus/6q9vP8pj73rt1N63k2/yn76oNFQePiX/88dux14fWrVPqra3eiB2OqzvjsKys PBYnbxmvWiZPSZ75983o28DsyLKyufH0zWlwvdzSxLFe+L//FN88vlwNK/1ap43JvMcfXHZRbNth 2UrL1T2ga2yx24HxjfTnBz+L99+dEa88fX/8/uzRcd3U6iNPPuO2+MJfv1A7AzHZ3CF5Mcx+X0x/ RsXPl8yNGW+8HA/c9Ps46bwax+tOiJu+PSxGDEoCwhKLoWPOiXGHb1q3CU341qzzNaE+hxAgUCvg 70m1FtYIECBAgAABAq1JoP7DqVpT67SFQBsSWLI0nd23akv68orPHH9sdeHJk+KRF6bE7TX3nQ4d d1j9Z/QVwqRmnm79Liv/fwndN9o2uVG0ern3z3fHjGQWXEPL05OuTuZXFpaV11s4cnV+rknzdQbu XHwBytRxf4nnlnZssCsdl74Ut6Vv+a5Zyjs07FfYn36+PrX20QLn//pH9ULFiAXx2B11Q8W0XEVF j9hqt/T5h+kyKf75SPGBi9Wban7tNPPx+G0SWi+/9Oi3VfLan+rl3jNuiemNjPUjN12zfNEmf0+v 7W33KbTxurj78fcaLZu+/GhB8rO45IjyxYtjcfJTOx+3U/Ref2DsNGR4XH7fo3Fa4djJ/4qXy2vG JHnpS1pmcW2hKOvSJzbacpc44jvj478TTymUiikPvV61Xnrd33ztXTG7EYsoX1zVxgWLS8LRVThf sQFWCBAgQIAAAQIECBAg0IYFVv4v3jbcOU0n0JYEPvTJL9YEepPjiE8cGtW54uD4ykEfXq4bPWL4 NdPi+eefb/Tn5ZeT59IVEqPBZ8WUl1+uOvaary1f13JVJ1+XrrtzHDWsZvvU5C3Fv3+0JNSp3r74 xRvjxKpbt9PvQ+L4g1deb02Nreqj6ebJi0S67RDHnVkIyCbESRffVScAq+7Ygrjzoh9F9fzQZMuR w2KbdUpvjW+4+9269CvueO3Vd4rrhZU377oijqm+IAqbaj47xS6Hfq647aLDzoqH36k7a7asbEZc cdoRJSFw8fAo779LnFgY62TO5OkTHqs31u8+NiEOGVcblNaWbvra4M8dVjz4rAPPi6fn1Q9ln//L aTFws81is+TnjH++VXX80peuiQ0HDoyByc/+5z9SrKOwUpnejl+8zreO/l3SW6wXxN+O37CqzMAN D497Zq34BUKbbLV+9blKr/vJp8bPr/9v4TTFz47zno7vbziwqo2bDTwvXq1M+7Fq5ytWaoUAAQIE CBAgQIAAAQJtWECw2IYHT9PzJbCR7DnFAAAxb0lEQVS0505x4sjl+jTkxNhj47pBUXpEWfc+0bdv 30Z/evfeKDbdoqauLfrFRr17Vx3bo36es9wJ0689YtjplxS3T/zegbH/mN/GA888H88993Tc9aez YuDHjy8GVYNP+0Hste7Kw7Niha1opTnmabN3P/oHxdmcU8cdEQOPvTQeeP6tmDFjRrz+/ANx/rGb xRcvvLfYw/HfHVrn1tzijuVWNvnYrsUtl4/YMc76013x3LRp8fLzD8e1Pz4mecv02OL+5Ve6bv/5 GFsI15I4+uDthsTlt01Jxuq5ePLBG2P0PtvHqYXnbS5XOJ1NmN72W1huPu2AmrF+JgmiH49//np0 bPOZ7xd2r/Jn120OicuKAeaE+PQWn49r7nwqpk9P3oD9zANx1Y+/EHuddFVN/cPia0OSF+MkS/cN tizmhlPHHRTH/Pyv8fRrM5M3Zs+OV574vzj7sJ2ikHkOPujjMaDqcQE9YtNdCiBJSL/tUTFx8rMx Y/bceHf6S3HXlWfFdjVv7U5TyY8Pqg4Wq67779Ve91edtFd84cfXxuNJgJ9a/vvWCfH5LT5dDI2H XnpkbF51S/eqnq+muz4IECBAgAABAgQIECDQhgXWzv2LbRhM09unQJ1bM9NbJIvPO1ydHl1jn+FJ yDPhrGKlo0btX//FEsW9K14ptjm5bbq8mW3uPGhEPHTNG7HHiIuqTjL1utPj0IZmzB15WUz84R51 PVZTxlhsf9KC5rZ/xTKle5tnvnTd3ePaR66Oz+x2THWwOumcODT5aWgZNWFKDN9ixbPlCuXKthga Vx85ujgr8fLvJLf5FnY28Fl9e3X1rbgVFX3jpL/fGlMGHVzzHMSpcdaIoVF7FaUVDI4hg6fG5JqJ h6Xle330hPi/C56JA79Xfat1Q2M9eMiQmDq5gXupk5rrjFPVbd8ltwjXtD0NML966b/ihVc+HdV3 iU+Ok7+8b83euh+n3HhB7NCtuo6l6+4VE648NvY4rjp0vPnCE+PmC+seX/3tyLhk9CeS1eqLb8+v /yZGnvPJmhBwUow+vOFkdfgvfxuf2iCd5Vi9dN5uREyZ8GLsObJa/95ffSsO+FVhb8lnMgt47Je3 TTZUVG1c1fOV1GiVAAECBAgQIECAAAECbVIgSUgsBAisTKBrz5ojBvWKdUpCxcrK2uCoS+eW5/Q9 djkwxhQbc2QcttfGxW/NW+kUffvXzNrq3TU6lbS5qfVsddAP47VH/hJjhhVmf5WWHBLnXHN/TL/s yJpZYrX7ytYbUJzV16/vOrU7mrnWWs27JiHgPS/+K846siGXpJNDRsa1D06Lcw4d1Iwe94hDxk+L m38xqn6ZwUfG7+59Lp4qPhewZ3TqVB1oFQ6uTALPP74+JS795j6FTcXPwcNOi1v/e2dc9v1C3f2j W8fS8p3io8eNjyf/dklx3IqFk0DylF/fHnf8+aLiddmjV+m0107xoZ2H1hy+fL21taRry3rtED+5 9/m4/oJj6+6o+Tb0uPPi1v+8Gj/cu/a28HTXVoeMi+cmX93IdTg4Rl0wMZ55c3zs0rM20V7WfdsY 9+Yzcc0Fo4ozHktPmppcO/m5GH9U/Vv4Bx16Tkx78NoYOaS0RGF9WJwz4faYdu93YmBZrWFLzleo 2ScBAgQIECBAgAABAgTaokCHhQsX1k7XaIU9mDt3bnTs2DHKGnuQfitsc9qkKVOmVLVs330bnpWz qs3eaaedqoo29e2ITT3PXXfdVXVoW3nb8yuvvFLV3k033bSpXXRcCwQWzJ0R7y3uHD07Lo35yzrH Bv3XXytvgW5BFzIp+v7Ml2Laq+9Gt769Y9HsRdFr4Gax+cD1o0UR87IFMWPW/FhnnU5RXt4tuYW9 e7PaviS5TfidxR2iZ9fKKO/cK/p2rw2/V17R4uR24VlR2bNnMk20PHomt9t3XXmh5h+xeEHMnPVe dEzOU/7BB9Fz3Q2iR9fSwLLhKpcsnB1z5kViE/HBB51i3QF9Vt6+5GUrs2cnL4ypLhTRa70mmyyY nVz3y7ol1/2iSFqZjEWPlY9tC87XcK9tJZBPAX9PynZc/T0pW1+1EyBAgACBNSFQkUwQWrZsWfTp 02dNnG6Vz9Gif/+u8lkVJECgTQn06DOg+KzA1v1H2ppl7d1/UOzSv+acW62mc3fsEQMG9Fjlyrr0 6RsDV7l011g/eVFK5kvXHtF/YE0fm/EfyS7d+8aAmpy1ycU6dY2+AwZUd6nJhaoP79G3cN33jiZf 9y04X+buTkCAAAECBAgQIECAAIHVLOBW6NUMqjoCBAgQIECAAAECBAgQIECAAAEC7UFAsNgeRlkf CRAgQIAAAQIECBAgQIAAAQIECKxmAbdCr2bQrKtb3c9WzLq96idAgAABAgQIrCkBf09aU9LOQ4AA AQIECBCoFjBj0ZVAgAABAgQIECBAgAABAgQIECBAgECzBQSLzSZTgAABAgQIECBAgAABAgQIECBA gAABwaJrgAABAgQIECBAgAABAgQIECBAgACBZgt4xmKzyZpXoLKysnkF1vLRba29a5nL6QkQIECA AIEWCLS1v3e0tfa2YGgUJUCAAAECBAg0ScCMxSYxOYgAAQIECBAgQIAAAQIECBAgQIAAgVIBwWKp hnUCBAgQIECAAAECBAgQIECAAAECBJokIFhsEpODCBAgQIAAAQIECBAgQIAAAQIECBAoFfCMxVKN DNb/9a9/ZVBrdlW++uqr2VWuZgIECBAgQIBAiYC/J5VgWCVAgAABAgQItEEBMxbb4KBpMgECBAgQ IECAAAECBAgQIECAAIG1LdBh4cKFrfq1xXPnzo2OHTtGWZkMdG1fLM5PgAABAgQIECBAgAABAgQI ECCQvUBFRUUsW7Ys+vTpk/3JWnAGaV0L8BQlQIAAAQIECBAgQIAAAQIECBAg0F4FBIvtdeT1mwAB AgQIECBAgAABAgQIECBAgEALBASLLcBTlAABAgQIECBAgAABAgQIECBAgEB7FRAstteR128CBAgQ IECAAAECBAgQIECAAAECLRAQLLYAT1ECBAgQIECAAAECBAgQIECAAAEC7VVAsNheR16/CRAgQIAA AQIECBAgQIAAAQIECLRAQLDYAjxFCRAgQIAAAQIECBAgQIAAAQIECLRXAcFiex15/SZAgAABAgQI ECBAgAABAgQIECDQAgHBYgvwFCVAgAABAgQIECBAgAABAgQIECDQXgUEi+115PWbAAECBAgQIECA AAECBAgQIECAQAsEBIstwFOUAAECBAgQIECAAAECBAgQIECAQHsVECy215HXbwIECBAgQIAAAQIE CBAgQIAAAQItEBAstgBPUQIECBAgQIAAAQIECBAgQIAAAQLtVUCw2F5HXr8JECBAgAABAgQIECBA gAABAgQItEBAsNgCPEUJECBAgAABAgQIECBAgAABAgQItFcBwWJ7HXn9JkCAAAECBAgQIECAAAEC BAgQINACAcFiC/AUJUCAAAECBAgQIECAAAECBAgQINBeBQSL7XXk9ZsAAQIECBAgQIAAAQIECBAg QIBACwQEiy3AU5QAAQIECBAgQIAAAQIECBAgQIBAexUQLLbXkddvAgQIECBAgAABAgQIECBAgAAB Ai0QECy2AE9RAgQIECBAgAABAgQIECBAgAABAu1VQLDYXkdevwkQIECAAAECBAgQIECAAAECBAi0 QECw2AI8RQkQIECAAAECBAgQIECAAAECBAi0VwHBYnsdef0mQIAAAQIECBAgQIAAAQIECBAg0AIB wWIL8BQlQIAAAQIECBAgQIAAAQIECBAg0F4FBIvtdeT1mwABAgQIECBAgAABAgQIECBAgEALBASL LcBTlAABAgQIECBAgAABAgQIECBAgEB7FRAstteR128CBAgQIECAAAECBAgQIECAAAECLRAQLLYA T1ECBAgQIECAAAECBAgQIECAAAEC7VVAsNheR16/CRAgQIAAAQIECBAgQIAAAQIECLRAQLDYAjxF CRAgQIAAAQIECBAgQIAAAQIECLRXAcFiex15/SZAgAABAgQIECBAgAABAgQIECDQAgHBYgvwFCVA gAABAgQIECBAgAABAgQIECDQXgUEi+115PWbAAECBAgQIECAAAECBAgQIECAQAsEBIstwFOUAAEC BAgQIECAAAECBAgQIECAQHsVECy215HXbwIECBAgQIAAAQIECBAgQIAAAQItEBAstgBPUQIECBAg QIAAAQIECBAgQIAAAQLtVUCw2F5HXr8JECBAgAABAgQIECBAgAABAgQItECg1QeLZWWtvokt4FeU AAECBAgQIECAAAECBAgQIECAQF2BysrK6NChQ92NrfBbq0/t0mCxoqIiUlALAQIECBAgQIAAAQIE CBAgQIAAgTwLpBlY+tOxY8dW381WHyx27dq1ClOw2OqvJQ0kQIAAAQIECBAgQIAAAQIECBBooUAh WEwzsda+tPpgsVOnTpH+pLMW0x8LAQIECBAgQIAAAQIECBAgQIAAgTwKFPKvQh7W2vvY6oPFFLB7 9+5RuCXabdGt/ZLSPgIECBAgQIAAAQIECBAgQIAAgeYIpLMUC6Fi+mzFNAtrC0uHhQsXtomHF6bA ixYtiqVLl1aFjG3hAZZt4QLQRgIECBAgQIAAAQIECBAgQIAAgbUnULj1Of1MZyqmoWJbyb3aTLBY GN5ly5bF4sWLo7y83AtdCig+CRAgQIAAAQIECBAgQIAAAQIE2qRAepdu+qKW9JmKbeGFLaXIbS5Y LG28dQIECBAgQIAAAQIECBAgQIAAAQIE1o5Am3jG4tqhcVYCBAgQIECAAAECBAgQIECAAAECBBoT ECw2JmM7AQIECBAgQIAAAQIECBAgQIAAAQKNCggWG6WxgwABAgQIECBAgAABAgQIECBAgACBxgQE i43J2E6AAAECBAgQIECAAAECBAgQIECAQKMCgsVGaewgQIAAAQIECBAgQIAAAQIECBAgQKAxAcFi YzK2EyBAgAABAgQIECBAgAABAgQIECDQqIBgsVEaOwgQIECAAAECBAgQIECAAAECBAgQaExAsNiY jO0ECBAgQIAAAQIECBAgQIAAAQIECDQqIFhslMYOAgQIECBAgAABAgQIECBAgAABAgQaExAsNiZj OwECBAgQIECAAAECBAgQIECAAAECjQoIFhulsYMAAQIECBAgQIAAAQIECBAgQIAAgcYEBIuNydhO gAABAgQIECBAgAABAgQIECBAgECjAoLFRmnsIECAAAECBAgQIECAAAECBAgQIECgMQHBYmMythMg QIAAAQIECBAgQIAAAQIECBAg0KiAYLFRGjsIECBAgAABAgQIECBAgAABAgQIEGhMQLDYmIztBAgQ IECAAAECBAgQIECAAAECBAg0KiBYbJTGDgIECBAgQIAAAQIECBAgQIAAAQIEGhPo1NgO2wkQIECA AAECBAgQIECAQJ4FKioqYtmyZZF+WtqPQFlZWXTs2DHSz9a0uB5b02isuba01uuxqQKCxaZKOY4A AQIECBAgQIAAAQIEciHwwQcfxMKFC2PRokWxePHiqnCxsrIyF33TiRULdOjQoSpU7Nq1a3Tr1i26 d+8e66yzzooLZbzX9ZgxcCuuvjVej83l6pD8YepPz+aqOZ4AAQIECBAgQIAAAQIE2pxAGh6+//77 MXfu3OjUqVP07t07+vTpE126dGlzfdHgVRdYsmRJ1TWQXgvl5eVV10B6LaQhz5pcXI9rUrv1nqu1 XI+rKiRYXFU55QgQIECAAAECBAgQIECgTQmkgeJ7770X66+/fvTv379NtV1jsxGYOXNmvPvuu7Hu uutWBYzZnKXhWl2PDbu0561r83pcVXe3Qq+qnHIECBAgQIAAAQIECBAg0GYE0ttN0yBHqNhmhmyN NLQQMM+ZMyfS26PX1G3Rrsc1Mrxt7iRr63psCVTrelJpS3qiLAECBAgQIECAAAECBAgQaEQgfaZi +pKEwj/cGznM5nYokF4T6bWRXiNranE9rinptneetXE9tkRJsNgSPWUJECBAgAABAgQIECBAoNUL pG/bTV/Ukj5P0UKgIYH02kivkTXxhnDXY0MjYFupwJq8HkvPuyrruQ4Wly1bFkuXLo30QZjpT7qe brMQIECAAAECBAgQIECAQPsRSP8dmM4QEyy2nzFvbk/TayO9RtZEZuB6bO7otL/j1+T12FLdXD1j Mf3NuXjx4uJPGiamb3gq/B+HdGpz+uav9I1f6bMTCj8dO3ZsqaPyBAgQIECAAAECBAgQINBKBdJ/ E6YTTdJ/A1oINCSQXhvpNVLIDxo6ZnVtcz2uLsn81rMmr8eWKuYiWEwDxQULFsS8efMifQBq586d o1u3brHBBhtUPXg1XU+XdFpzur9wbPrmp/TBrL169YoePXqEgLGll5PyBAgQIECAAAECBAgQaJ0C a2ImWuvsuVY1VWBNXiNr8lxN7b/jWpdAW7lG2nywmIaE6Zu90tmJ3bt3j4022qgqJGzockjDw/Sn b9++VbvTsrNmzap6tfz8+fOrpsWn+y0ECBAgQIAAAQIECBAgkC+BysrKVtGhd998LabPfr+mLZ2i 2/p9Y/OB/aPN/+N8NehWLHkt/nDB72PaB4viQ58aFSfsv+VqqLXpVazJa2RNnqvpAqv3yMrKRTHz 9fR6Xxq9+3aLhcl136X3gNhss42jW+cOq/dkOaytrVwjbfbPrjS5ff/99+O9996rmnW45ZZbNnta eyFoTG+fnj59esycOTPWXXfd6N27t9mLOfxNqUsECBAgQIAAAQIECBBYWwJvPzopxp15Skya1lAL toqjz/5BjPrKPrFeh/YbuFQumh23/XFiPJEQDer3xTUeLDY0MrY1XyANFP/91/Fx7o+uiAYv99gg jv7hz2LUMQ1f75WV8+L/jR4e5zzxUgza+ayYOP6o6NXA74v0uBtOHRm/nDI/ele+FNO2OTMeu+qr DR7b/F4o0VSBNvnylvS5iXPmzKmaqdivX79YlVCxFCi9dz2tI60rnf2Y1p2ew0KAAAECBAgQIECA AAECBFoikIYsd1x6bOzzlcZCxbT2afGHnxwfe3x4dNz3xuKWnK5tl02mPnWv6UHPtt2Tdtv6ZbOf jjMO3imOaTRUTGlmxR9+llzve50aD81o+HqfN+ul9LB46ZV50XA6Ux63njc8zpj0RLzzThIqztog LvrRMKHiWrjy2tyMxXSmYjpLMb2NeeDAgVWzC1eXWxospiHjm2++WVXleuutZ+bi6sJVDwECBAgQ IECAAAECBNqdQHnccd7h8c1rkpCksGywf/zozC/HxzbvF4uT8OTuv18Tv0/Ckerlzhi578nx10cu ix36eMlogcxn2xBYNvuhGPnxEfFgSXMH7T8ivnHkQbFxl2URlQvi/ht+E+ML1/usSTFi7//Fb+7+ Y+y7yTolpSK6lHxrKLh6+DfHx8klv69+dMMtMWybdUtKWV1TAg2Nz5o69yqdJ739OX0e4sYbb7xa Q8VCY9LboNP72NNwMX2ZSxouWggQIECAAAECBAgQIECAQHMF5jxyZZ1QcecRl8SEMw4umVW1Xey6 97A44aS740efOynurDrBnXH4OTfFsxcd5rmLzQV3/FoTSGfmXntKaai4QZz6+z/FCfvUfU7mx/bc N7505HVx3FfOrrlN+ok46btXxWMTTyr5fbHibjx3w5nx1YsfKB405up74pidZDdFkDW80qaCxXSW YjpbMX35Sp8+fVZK9crsivjns8ti2juV8cHSyujXq0N8fMuy2G+bTtFxBTeBp3Wnb4+ePXt2dOnS pdGXway0AQ4gQIAAAQIECBAgQIAAgXYpkAYtN4+/sNj3QV+8JK4983MNhoXrbr1vXHzzz2LHoT+s Pn7SdfHYWYfEHvVmLZbH9Jeeiuf+Oz3eS15gmi7rDdw6dvnYDrFegy/DKI+Zr02P9FUxAzb+UPRK jpnx6tMx9elXq8t37hFbfGSX+OigAVV1Nf5Lebzx38di6rNvxIKqgzon5x2UnHe7Rs5bqKm63H+S cktryvXfesfYdYfNolsDz8wrlPLZ9gQWv3hrnFsyVfEnyQzCIxsJ+zba9ci48faese9nTknvdo54 4pL467NfjWO277XSjr85+bI45PSJxeOO/sVtMeYTGxe/W1nzAm0mWExvgU6ff5jeqjxgwIr/0FtW EXHeP5fEpIeWRWWyXrrc9O9lMaBfeVw8vEtsO6DxdDE9RzozMj3nOuus45boUkTrBAgQIECAAAEC BAgQILBCgbpBy85x3vc+22CoWKhknW0OjXM/8cM4syqceSIefuH92GO32llY//v3dXHmKWfHg1VJ TKFU4XODOGHcFXHqoYMLG6o+571wQ3xy6NlV62N+9/+ix8TvxM/vfKfOMemXfvufHNf+4sTYrEv9 fyMvfuOhOOf4EXFDg2/h2CDGjPtdjDl0+3p1Lnjjvjjr+JENv6wmuR38N//vgth3i571ytnQFgXK 47bfXlxs+KARv200VCwctM4Ww+KS0dfEiPHVjwH46fhbY/j4LzUYOBeesTjnyeviU8dfVqgiDjn7 b3H6wVsVv1tZOwL1/9RYO+1Y6VnT2YrpLML0uYorWy64c0mkAWIaKg76UFmMPLBTjP5cp9h7p7Io Sx5TMSOZwXj8lUti5rzKFVaVnis9Z3puCwECBAgQIECAAAECBAgQaKrAvFlvFg/t98Wj46P1Zh8W d9esdIovXPZQ3H///cnPQ/GNklBxzpNXx35HNxYqpsVnxRWnfSHOvOO1OpWWL5xX/H7Z8Uc1GCqm B7xz5yVxwAk3xKLksWCly3vP/jU+vW9joWJ65Ky47LTD4tgr/1NaLOY8c13ssm8joWJVsTvjpM98 NK57ck6dcr60TYH07cxvP1sbWI/86seb1JGPDT8ueT90zfLEa1F7tRY2Vn+mM+I+eOWf8ZUvVofk 6da9vvunuPCoukF69dF+XdMCbSJYTGcrzps3r+qW5HT24IqWt96vjL89mDwUNFmGD+kYE4/vGqP2 7hzH7dk5fnFE17jsmC7RIen1woWV8avJ1ZOxG6svPVePHj2qzp22wUKAAAECBAgQIECAAAECBJoi 8PJT9xUP+/Lndy+ur2ilc6/1on///snPesXZjWlo8+cf/LRYbK/jz4tb7380nn3hhZj66D3xi28e UNw38ew/xJsVy922V9ybrnwifvaH2+PJZ56PZ568P6744SG1ex88M/7+4vzi94qK12Lc539Yfatq unWrL8aEW+6tOu8TU+6IC0rO+8DPvxmT/vdBVdm03IWH1QZA6WzIm+5L2vvss/HofTfF6P37Fc9x 9jcuW0l7i4daacUCFQtfiX8VZrRuNTr23bxrk1rbccBeMWLnmkNnPRqvvN/AtTugZ1S8PzUJor9V 80zGiJ2//qv43UlN+z3VpIY4qEUCbSJYXLx4cSxatCg22KCYZTfa6btfKI+KJAPs1q1DnPzpLvWO 23PzjvGRLaq7/eTrDVy0y5VIz5meO22DhQABAgQIECBAgAABAgQINEWgc/RoymFNOmazg4bHIV86 JA752ti4+NQvxqD+vauCxy69N46Dv/XLOK8Q1s2aGv9r9M68reI39/4+Dv/4FtEtedZi527941PH XhhXfb2Q7CTzD+cWbjqNePvuP8UNhdZt9dW445ZzY++tN6w6b/f1N4vPf2t8XPPdQtlZ8etbnq06 +u37Ssrtf27cOf6k5DFkSXs7dYreA7aNb42/OU4uFvtTXDvl7cJZfLZhge6FtvfqUgzFC5tW9Fma 2nRu6MAHfx1fPujwOm+aHnPifs06R0PV2rb6BNrEMxbTUK+srCx69lz58xcG9SuL4w7oFBv2Tv6g TG57bmjZsE+HeCbZ8UH1s24bOqS4LT1neu60Dd27F3+rFPdbIUCAAAECBAgQIECAAAECWQl06NAr CQ/PjYMbPUGn2HHXbSJqnp3YYDiTlB309e/FvhvWjwB2PHD/iN8/UVX7fx57JaLqFuzyeOi2W4tn HHPON2Kz5N/Fyy+7fW1cXNrvyUj/ab3JHh9Ofk3K3VQolwSZ5xxe75l5HTqsF8ec/aO45LDqWZh3 P/JynOrlG8vTtt3vjd3P3GCPFsX06kuvwb3VG2fFtFl1d4/89rXx2FVfbfJbpOuW9m11C9T/U2V1 n2E11Jc+57Bbt25NqmmPzTpG+tPYkj4y4qmamYqb9evQ2GF1tqfnTttgIUCAAAECBAgQIECAAAEC a0vg/ZmvxYsvvx5z31sQ8xfMiXeTR4bNm/d+/Pe2F1bapJ5dG54oUztHMWLB4urHhaVvtH77f4Vn 5n0i9vrI+g3WX9Z9s/js4ZsV91U9a69Yblrc+teJMaP38oFkl6h455FimZ7RWBRaPMRKWxJY+Yud S3rTLQams1dXGi6WFElXHzw3vvXb7eOqkz663A5f14ZAqw8W02cbpqFev361z2FYVag0VBx7+5J4 Z1aykixf3q1p3e/Vq1e88847kbalY8fGQ8tVbZdyBAgQIECAAAECBAgQIJAvgaWLS18C2rR/ezYm UPHuc3HZGd+N8Xe+1Nghq3178RbVnfeIrbsvHw42frpiueSQmy76SdzU+KFVe574539i3rd2N/ts JU6teneSTi8sNHDekmTe6qotjb4FY+fR8dDEb8X7t50VB3xnYlXlD1z85bjiYw/ECbu1PCtatdYq VRBo2Z9uhVoy/KxIHjy7dOnSFt+GnL4B+rS/LYmpL1U/V/Gg3TvGvts0LSRMb4FO25C2RbCY4WCr mgABAgQIECBAgAABAjkR2GK33ZOeVE/Fuu2fT8SY3T69Sj2rWPJSnLnnIbXPO0xrSd4FsPMmm0SP ZALOJhutH4/+cWLxxRardJIVFXojmRWZzNLp1aFpd/yVVrXzXgdEv4YnSlYdtnDhO9F9l0H1bpcu rcN66xco671F7LVVcrWnL3CZNjEeeuPE+OymK37xbtqrZbMfib8UZituMDg27dXQNTYsbrp6TKyX XH/rHXx2XPLA3XHyDdWzaS88anTs9O/rYo++Tct2Wr9k22xhqw8WK5M/wMrLy5t8K3RDwzD1rYr4 xtVLqt4E3Sl5SO3oz3aMr+3e9OnW6a3QaRvStlgIECBAgAABAgQIECBAgMDKBLr1GVg85KVr/hBP f3ef2KHHigOQ52+7Iv704Myk3Dox9JtjYo8BXWP2o7fVhoobDIvf/OG02Dd5iUrp8tzmb8Qh5zxQ uqnF68VXEsz6V0ybc0ps3LcpVZbHkuIz9j4RZ/7m0tih64r73JRaHdPaBdaJDbdI2lj1ZuhZceXf nozPfnuPlTb6qZuuqQ3Et9miKjysV2jnQTEweTlv9dIpDjr32njwhgNqfk88ESO++qu4/9ZvRf9V CL7rncuGVRJo+nzmVap+9RRqSaC3NHlD9Heuqw4V11uvQ/zpG12aFSoWetCSNhTq8EmAAAECBAgQ IECAAAEC7UOg50eG1r79OHmn7bm/n7LCji9b/HT88tsXxsSJf0x+roiX51ZHey8/dV+x3JhfnlEv VEyfa/jInas3VExfGLPDroNqzjst/nz3i8U2lK4sm/1QjDv1jDjjjFPj6nv/F+mLWbb9RKHcg3H7 lBmlh9dZX1T1fMh5scgEnjoubfFLhw7d4uDRPyo2/YnxP45/vrLi91SUv313nP7z2ut2zOihDc9c LQbV1dWXlW0WZ95+UWxQONu08XHMuHsK33yuBYFWHyx2SFLn9GfBgtLnUzRd6rH/LYs5c6pnGv7s iM6xdfLW6OYu6bkL7WhuWccTIECAAAECBAgQIECAQPsTSMO5w79zQrHjT4w/Nkb/5oEGnz9XseTN uO5HJ8WdhaM3GB37bd2z6lv3rrXPkHvt1fpB3Qs3XRrnPlgouPo+d/rcl4qV3XH6yTHphfnF79Ur 5fHPi78bv7vp+rj++pti8uvvVW3eedjni8ddcfx58Z/Z/7+9O42xqywDAPxOO9N2uu+0iBRStNpo bKhARAMGARWFmBBaFIISjTai/qDID5YfShDDFiABBBdCUGOCRm3dIkhIkGDdQmJsLbbIljZpobSU MnSh9byX3ttLO+3MnencM4c+Jzmdu5xzvvc839c7ue98S9HbZ7/tr/cVQ1gXLoyFxX7Fz1fv966n VRQYP//8pkT62vjGxy+J5Sv3W855741t/u8f4nOnLdnXW3HuZXHxByf3+7bHHH9uPHDb4sbxa37w lbj+4Wcbzz1or0DrWbb2xhcjiiXtOzs7o6enZ0Alr9vyZlJxZDHo+6RjB9YFO8vOGDIWGwECBAgQ IECAAAECBAgQ6I/AjA9dFtedue/Ih269NOYvujqW/2VlrFu3Ltas+mf8+p7r4yPv+2h8e3l9FeaI q+6+pDG087iTT2pcYNnV58UV9/wq/rVqVawqejJ+b+miOPeb9zfeP5wPxs9fHNeeWr/i2lj66RPj +vsejv+sWRN/f2x5XL3o9MZcdxELYskn59cOnvyBC5oSTA/HhR/6dNy77Il49tlnY+U/Honbl54T F9/w0N4LL4gvnv2ueiF+VlggE+mX3nJHzG3cw5Ox9DOnxqXX/ShWrHomNmzYEM+s+Wf85KbL4uRP faNpIejpccvtX+x9GHTjWgc+mJvzLV6wL+l+/1eXxB+eP3QvyQOv4pXDIVCk24b3louljB49OjZv 3hwzZ85sOdh3TO6Ik+ePiO7mpalavEqWnTFYuKVFOIcTIECAAAECBAgQIEDgCBbIIaKL7lwRHddc FNc8uHdF5ycfjKWXPHhQlS/f9fv4wgemNN7PnmDXnvqdRq/EZbdcWay23Hj7gAdvWVn3LU8OOPSQ L2TsF921LP53/nnx49rceRH33/DVYj/wtK9//7bGAho5HPrLd/8s1px7YSyvdVhbGzdf8fm4+cDT YvFtN8SJk5o6ADWvLtzL8V4a3gJj3vmJ+OUj34slZywpBv+/uT3+wHcj9963BXHHb++NT+ztndt8 TGOOz+LF3leZ3n++xaKX5OIb46FHr4k5o3QKa7Yc6seV0M6k3muvNRYvb8nklDkj4+7Pjo5bzx/d 0nnNB2fZGYONAAECBAgQIECAAAECBAi0IpCJtkXX/y5+c/dVRb++g28LFl0ev3jsX3HFmfv6fOXR 2RPs4vtWxJ1Lzzvw5Omnxrd++qdYdlN9WOjY6GrqPtQ1fXajB9mM6b0vz9w1dlpjvrr9jxkx9j1x 7e/+UZS9uHFMcxAnnPmleOCPf4uvn35088sxctqJcfPjf44bv3bWW16vP1lw1pfih799Iq47Z797 7R4b79x70LjRXfXD/ayQwJhjzoj7/n3wuq/fyoeLYfKPPvmzIqnY+xDoUfXmevz4Yimj3rf6fIuN VvTij+PGB//d+8FeHTKBjiJpNuyXOt6yZUut2/T8+fNjwoQJQ4bR24W3FhPKrly5MubMmROTJk3q 7RCvESBAgAABAgQIECBAgMAwFti+fXusXr06Tjml75Vqh/I29uzpiXVr18TTz22MUdOnx57iu27H pFlx/PHHxcwJfSfS9uzcGus3bo3u7s7YubO7GNXXvu/HtbLXbYrOiRNjVzFdWPeEGTGlPzH3FDFv 2HfehCkzYkJ33/c6lPVwsGuvWLEi5s2bN+Qdi4ZLezyYw+F6fU/Py/GflU8VbXZbxLjiqsWPrhmz Y967T+hXez9ccVT1Ou1qj4P1afpbxmAvNXTnd3d31/5jr1+/vuXE4jObdsfND+2MUcWdXnnWqJg1 sb5Mef/izTKzt2LGYCNAgAABAgQIECBAgAABAgMVyOHF7zjh/cU+sCt0dE2Io49uXzKxOcpa2XP2 lj1l31Dt5mN6e9zRXcQ8gPN6u5bXqiXQ0T0l3rvwlHhvtcIWbYsClUgsdnV1xZTigysnt81hyWPH 1vvE9n23V/1yZ6x+ZnftwF1v7Ig7FvV/SHOW9dJLLxUf3EdHxmAjQIAAAQIECBAgQIAAAQIECBAg QOBNgUrMsdjR0VHrqZg9B59++umW6m5L00jvrS0uEJRlZZk5/DpjsBEgQIAAAQIECBAgQIAAAQIE CBAg8KZAJRKLGWom+KYXc1DkfIsvvPBCv+vv8rM7Y3KxMvS0qR3xldP630Ezy8iyssws20aAAAEC BAgQIECAAAEC1RQYMWJEdHZ2xuuvt9jbpJq3K+oBCGTbyDaSbWWoN+1xqIWrf/12tsfBavU/0zbY kgZ5fv7Hy8VTXn311Xj++edryb4ZM2b0edWPzeuM3FvZNm7cWCsjh19nme34YGklPscSIECAAAEC BAgQIECAQP8FRo4cWfsO+fLLL8fs2bP7f6IjjxiBbBvZqSjbylBv2uNQC1f/+u1sj4PVGvpU/GAj bDo/5znMZGLOsbh27drIBODh3vKaee0sI8syt+LhFnY9AgQIECBAgAABAgQItFcgO4vkd7ycQ99G oDeBbBvZRtrRsUh77K0GvNYs0M722FzuQB5XKrGY8xzm6sxHHXVUjBkzJp566qmWhkX3BZTDn/Oa ee0sI8syt2Jfat4nQIAAAQIECBAgQIDA8BcYN25cbSj0c889N/yDFWFbBbJN5NDTbCPt2rTHdklX r5wy2uNglFobIzyYkg7TudllOP8Dzpo1KzZs2FDrXbhp06aYO3fugD8Etm3bVrtOdjXN4c8zZ86s XasdXaAPE4vLECBAgAABAgQIECBAgMAhBPJ75OTJk2P9+vW1o4499thDHO2tI0UgkzjZJqZNmzbg nMJArLTHgai9/c8pqz0ORrbjtdealk0ezJXafO6uXbtqf1HIZOCLL74Y+TyHLh9zzDG1VZz7E87W rVtrPR5z+HNO0poLtWRiMXss5nMbAQIECBAgQIAAAQIECLx9BHp6emodVPI75Pjx42Pq1Km175E5 Ws125AhkO8g8QHZSynUcMheQHYza3Q60xyOnzR3qTodLezxUjId6r7KJxbypN954I3bs2BFFcjQ2 b95c27dv3177K0P+JSr3nCMh/xKQW/ZMbD42n+fkrM3Hjho1qi2TtdYC8g8BAgQIECBAgAABAgQI tE1g9+7dtQ4qr7zySmQnlUwq5RDY/G65Z8+etsWhoPIEcrqzHJ2YHYoyuZydiyZOnFh73o75FZvv XHts1jgyHw+n9jjQGqh0YjFvOj/8d+7cWUswZlIxk4W55y+HfJ7v1X9BZIXlYiyZTMwPkUw45p7P M6GY75lTcaBNyXkECBAgQIAAAQIECBAY/gKZzMkOKs17vlb/3jj870CEgxHI7/yZQMwcQPPe7qRi /R60x7rEkflzuLXHgdRC5ROL9ZvO/4w5HLq+1/9z5vP6L4issBzinB8e+aGRj+t7WR8i9fj9JECA AAECBAgQIECAAIH2CWQvxdybk4r1747ti0JJ7RSodySqJ3Oy5+JwWVtBe2xnSxgeZQ3n9tiK0Nsm sVi/6fxFkL8Y6ns+r/9yyEqrf4BkIjH3ekXWz/eTAAECBAgQIECAAAECBAgQIECAAIG+Bd52K5Rk onA4/dWh7ypwBAECBAgQIECAAAECBAgQIECAAIHqCYyoXsgiJkCAAAECBAgQIECAAAECBAgQIECg bAGJxbJrQPkECBAgQIAAAQIECBAgQIAAAQIEKiggsVjBShMyAQIECBAgQIAAAQIECBAgQIAAgbIF JBbLrgHlEyBAgAABAgQIECBAgAABAgQIEKiggMRiBStNyAQIECBAgAABAgQIECBAgAABAgTKFpBY LLsGlE+AAAECBAgQIECAAAECBAgQIECgggISixWsNCETIECAAAECBAgQIECAAAECBAgQKFtAYrHs GlA+AQIECBAgQIAAAQIECBAgQIAAgQoKSCxWsNKETIAAAQIECBAgQIAAAQIECBAgQKBsAYnFsmtA +QQIECBAgAABAgQIECBAgAABAgQqKCCxWMFKEzIBAgQIECBAgAABAgQIECBAgACBsgUkFsuuAeUT IECAAAECBAgQIECAAAECBAgQqKCAxGIFK03IBAgQIECAAAECBAgQIECAAAECBMoWkFgsuwaUT4AA AQIECBAgQIAAAQIECBAgQKCCAhKLFaw0IRMgQIAAAQIECBAgQIAAAQIECBAoW0BisewaUD4BAgQI ECBAgAABAgQIECBAgACBCgpILFaw0oRMgAABAgQIECBAgAABAgQIECBAoGwBicWya0D5BAgQIECA AAECBAgQIECAAAECBCooILFYwUoTMgECBAgQIECAAAECBAgQIECAAIGyBSQWy64B5RMgQIAAAQIE CBAgQIAAAQIECBCooIDEYgUrTcgECBAgQIAAAQIECBAgQIAAAQIEyhaQWCy7BpRPgAABAgQIECBA gAABAgQIECBAoIICEosVrDQhEyBAgAABAgQIECBAgAABAgQIEChbQGKx7BpQPgECBAgQIECAAAEC BAgQIECAAIEKCkgsVrDShEyAAAECBAgQIECAAAECBAgQIECgbAGJxbJrQPkECBAgQIAAAQIECBAg QIAAAQIEKiggsVjBShMyAQIECBAgQIAAAQIECBAgQIAAgbIFJBbLrgHlEyBAgAABAgQIECBAgAAB AgQIEKiggMRiBStNyAQIECBAgAABAgQIECBAgAABAgTKFpBYLLsGlE+AAAECBAgQIECAAAECBAgQ IECgggISixWsNCETIECAAAECBAgQIECAAAECBAgQKFtAYrHsGlA+AQIECBAgQIAAAQIECBAgQIAA gQoKSCxWsNKETIAAAQIECBAgQIAAAQIECBAgQKBsAYnFsmtA+QQIECBAgAABAgQIECBAgAABAgQq KCCxWMFKEzIBAgQIECBAgAABAgQIECBAgACBsgUkFsuuAeUTIECAAAECBAgQIECAAAECBAgQqKCA xGIFK03IBAgQIECAAAECBAgQIECAAAECBMoW+D8mLppjhREaTQAAAABJRU5ErkJggg== --Apple-Mail=_8E4423B4-93F8-4DC4-AE29-7FA54CA402A8-- --Apple-Mail=_C3795927-3724-468D-92C1-E4F319F07D0C-- From nobody Wed Jul 24 11:51:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB7101202A5 for ; Wed, 24 Jul 2019 11:51:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id humrWyD-_s3j for ; Wed, 24 Jul 2019 11:51:03 -0700 (PDT) Received: from relay.sandelman.ca (relay.cooperix.net [IPv6:2a01:7e00::f03c:91ff:feae:de77]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A277120141 for ; Wed, 24 Jul 2019 11:51:03 -0700 (PDT) Received: from dooku.sandelman.ca (unknown [IPv6:2001:67c:370:128:6e88:14ff:fe34:93bc]) by relay.sandelman.ca (Postfix) with ESMTPS id 638201F44B; Wed, 24 Jul 2019 18:51:01 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id DF1E31624; Wed, 24 Jul 2019 14:51:23 -0400 (EDT) From: Michael Richardson To: Eric Rescorla , "add\@ietf.org" In-reply-to: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <21062.1563992339@dooku.sandelman.ca> Comments: In-reply-to Eric Rescorla message dated "Wed, 24 Jul 2019 11:37:25 -0700." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Date: Wed, 24 Jul 2019 14:51:23 -0400 Message-ID: <22934.1563994283@dooku.sandelman.ca> Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 18:51:07 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Eric Rescorla wrote: mcr> This needs to be an on-path attacker who can not only inject a fake mcr> NXDOMAIN, mcr> but also suppress/delete the legitimate answers. =20=20=20=20 ekr> Yes. That seriously limits the threat model that is being defended against, doesn't it? I think that people are feeling hostile because I think that the threat model that Mozilla really wishes to defend against *is* soveign countries, not off-path attackers in a coffee shop. I don't mind: I'm all for that actually, but it means that maybe the coffee shop operator (or Enterprise infrastructure) might sometimes be allies. mcr> This means it is the "coffee" shop that is doing the attack. mcr> When the coffee shop is a soveign country, then there are many thi= ngs mcr> that mcr> they can also do which DoH/DoT may or not help with. =20=20=20=20 eki> Sure. mcr> When this is an off-path attacker, DNSSEC enables successful mcr> connections=20 mcr> (that HTTPS can validate) vs "Having trouble" dialogues. =20=20=20=20 > Yes. However, DoH/TRR also prevents these attacks. DoH prevents the attack from occuring between the browser and the DoH server. It does not prevent it from the DoH server and the authoritative resolver, unless the DoH server also does DNSSEC, and the authoritative resolver runs DNSSEC. Or the DoH server speaks DoH to the authoritative resolver, (and the root name servers, and the com nameservers...) =2D-=20 ] Never tell me the odds! | ipv6 mesh network= s [=20 ] Michael Richardson, Sandelman Software Works | network architect= [=20 ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [=20 =09 --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEERK+9HEcJHTJ9UqTMlUzhVv38QpAFAl04qKsACgkQlUzhVv38 QpCIawgAnY21rLX0c941bhALji+HBpufV/Ik83A62siwtoGuNr7yNXc535evvYEq gbqupmJf9F1JEwltHx/8YfAoiPPwcDtsPLNg6xy0J9TVlGPd1YHePW4fl+DHsli4 Gr02SJKw7juk+ppmQIm+ltTYqx5M+rlYSsaY0VtkXh1E/doWal7PUdJVkocpwMlw jH7S1XEicJioftPUQ7cIwkmQef3uTECWXtccyxwC059srNgkEZr8Ih1rfvQqF0ur Keofn5+0sSBqavj1ht9pqibixZnkgi3z0MSQwYS8QHvtm+VQHFob8PhCPONIeGe3 3nLyV5Yi8amqANi1DhFiIdRdciWnLQ== =QADt -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jul 24 11:51:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DBDB1202A5 for ; Wed, 24 Jul 2019 11:51:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yNOVHURb8Poj for ; Wed, 24 Jul 2019 11:51:21 -0700 (PDT) Received: from gro.dd.org (host2.dlawren-3-gw.cust.sover.net [207.136.201.30]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0591A120141 for ; Wed, 24 Jul 2019 11:51:21 -0700 (PDT) Received: by gro.dd.org (Postfix, from userid 102) id 94CD08D843; Wed, 24 Jul 2019 14:51:19 -0400 (EDT) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <23864.43175.591553.553075@gro.dd.org> Date: Wed, 24 Jul 2019 14:51:19 -0400 From: Dave Lawrence To: "add\@ietf.org" In-Reply-To: References: <06B41162-5936-4BF7-A9D6-3D864BB93ED2@gmail.com> Archived-At: Subject: Re: [Add] Followup from ADD session today X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 18:51:23 -0000 On Jul 23, 2019, at 10:14 PM, Bret Jordan wrote: >> Imaging an app being installed on a device that allows a user to >> browse the web. It has a hard coded DoH server that it wants to use, >> that points to the DoH server of its choice. The app can add as >> many other headers it wants to ensure that it can fully track that >> user and application, no matter where they are. So no matter where >> that client is, you will always be able to have a perfect telemetry >> of everything they have done and when they do it. Ted Lemon writes: > Do you know of a way to detect such a client and prevent it from > behaving in this way? Additionally, how is this particular to DoH? From nobody Wed Jul 24 12:10:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73318120409 for ; Wed, 24 Jul 2019 12:10:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.164 X-Spam-Level: X-Spam-Status: No, score=0.164 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_IMAGE_ONLY_12=2.059, HTML_IMAGE_RATIO_02=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eqQ27f2I9XHV for ; Wed, 24 Jul 2019 12:10:30 -0700 (PDT) Received: from mail-lf1-x12f.google.com (mail-lf1-x12f.google.com [IPv6:2a00:1450:4864:20::12f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 45907120429 for ; Wed, 24 Jul 2019 12:10:29 -0700 (PDT) Received: by mail-lf1-x12f.google.com with SMTP id h28so32687583lfj.5 for ; Wed, 24 Jul 2019 12:10:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=/fcygXFfZQ6pD44JaDc52eQrf0PnvLzO3DmfGkKw/MI=; b=r2LIs+2VtHdLDVDw0fd0UJTGJo8ForXifdM/LxsYfmL6CFBj09X0hB89q9YcyF0evP T3749RCl8MBNNXgpTx7bJPnIB1ZmJutHhnEfUOfVNoQQWGJFd4j5NsXmMy7Yz3pi3tep ZU2Z8DfUG05mJXv+O+M7GQP/evVBVKBO81FIdgcFq0Bx8F5i5eKndaz5P/kMGoWmiuOC 3ADS2qK4iihOx7EzdMJI0vf5z0ICk3MB5WIlmoz1EyeP+7r3eFuVyxsJgwOdnZoObT6G E9YO6uotMe928m65VlnJwzyp2j+DxCTSd8ZR6cEOqdHQIosyFoP6XyyTcU7a5RqRouxX tK4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/fcygXFfZQ6pD44JaDc52eQrf0PnvLzO3DmfGkKw/MI=; b=QS1czRcjSSHEMooebqUTndtsWFaNinUDa4huNFfo3PIF0D9+WidmwABenDv57Z3EMQ 6k2T2gtGFGxsuiGAxKdFV2qPcuI/ebcBbfNBxbwEsB0MrkjXq0QOLFXmtMimTui9k9pd g9mRJpw9WaGV8EZQUJ/R+dYDUxwqu/QE9Na4aIsYqWLDbjE1Wd8PGidzFJ/r8B74eYAx jg7mz9PUiuZp5Iv4ZKoNK8uBbMxFXeull0db3L1GgxXzxPisObZ3dJ0oQKSHt9LKfirS e4IuUdJhZP128RFMSBMrrGQ4JWlPCGKqqW+rtWC/GG7byDwoQ/ix804+fx/7AHUcJBzu mF7A== X-Gm-Message-State: APjAAAWGMV6BK4K/rLdcq7brYi8uZMe9FCKWAaJld0LTGlBl1H5OjU/i 0X31l8XanHD+p/xtPkoJnSm6w0TQRDpUMpHtTQ8= X-Google-Smtp-Source: APXvYqw9pma0r2LqoRc9y77PUUSV0h04c+826NbAcGmlSwJb0p+8Z5P5mN96HZJDproerK4s3chYoPOqgZcj567KwR8= X-Received: by 2002:ac2:528e:: with SMTP id q14mr36660295lfm.17.1563995427006; Wed, 24 Jul 2019 12:10:27 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> <22BC5D05-4826-498C-A9B1-178FD7B9929F@rfc1035.com> In-Reply-To: <22BC5D05-4826-498C-A9B1-178FD7B9929F@rfc1035.com> From: Eric Rescorla Date: Wed, 24 Jul 2019 12:09:48 -0700 Message-ID: To: Jim Reid Cc: "add@ietf.org" Content-Type: multipart/related; boundary="000000000000dbc7af058e720f2d" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 19:10:32 -0000 --000000000000dbc7af058e720f2d Content-Type: multipart/alternative; boundary="000000000000dbc7ad058e720f2c" --000000000000dbc7ad058e720f2c Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 11:41 AM Jim Reid wrote: > > > On 24 Jul 2019, at 19:36, Eric Rescorla wrote: > > What dialog box? > > > This one (MacOSX). I understand similar functionality is available on > other platforms. > > Yes. We're focusing on the common case in which people do not use this dialog box. -Ekr --000000000000dbc7ad058e720f2c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 11:41 AM Jim = Reid <jim@rfc1035.com> wrote:<= br>


On 24 Jul 2019,= at 19:36, Eric Rescorla <ekr@rtfm.com> wrote:

What dialog box?
This one (MacOSX). I understand similar functionality is available on= other platforms.


Yes. We're focusing on the common case in which people do not use thi= s dialog box.

-Ekr

<= /div> --000000000000dbc7ad058e720f2c-- --000000000000dbc7af058e720f2d Content-Type: image/png; name="resolver.png" Content-Disposition: inline; filename="resolver.png" Content-Transfer-Encoding: base64 Content-ID: <16c25636db219d4e4411> X-Attachment-Id: 16c25636db219d4e4411 iVBORw0KGgoAAAANSUhEUgAABRYAAAP0CAYAAADfh2BtAAAMKGlDQ1BJQ0MgUHJvZmlsZQAASImV VwdYU8kWnluSkJDQAqFICb2JUqRLDS2CgFTBRkgCCSWGhKBiRxcVXAsqIliRVREF1wKIqIi9LIq9 PxRRUdZFXWyovEkC6Or33vve+b65979nzpzzn3Nn5psBQD2aIxZnoRoAZItyJTGhgcyJSclMUifA gSqgAR1gwuFKxQHR0REAytD7n/LuJkDk72sOcl8/9/9X0eTxpVwAkGiIU3lSbjbEBwHA3bhiSS4A hB6oN5+RK4aYCFkCbQkkCLGFHKcrsYccpypxhMImLoYFcQoAKlQOR5IOgJqcFzOPmw79qC2H2FHE E4ogbobYlyvg8CD+DPHI7OzpEKvbQGyT+p2f9H/4TB32yeGkD2NlLgpRCRJKxVmcWf9nOf63ZGfJ hmKYw0YVSMJi5DnL65Y5PVyOqRCfE6VGRkGsBfF1IU9hL8dPBbKw+EH7D1wpC9YMMABAqTxOUDjE hhCbibIiIwb1vmnCEDbEsPZonDCXHacci/Ik02MG/aMz+dLg2CHMkShiyW2KZJnxAYM+Nwv47CGf TfmCuEQlT/RKnjAhEmI1iO9LM2PDB21e5AtYkUM2ElmMnDP85xhIk4TEKG0wi2zpUF6Yl0DIjhzE EbmCuDDlWGwql6PgpgdxBl86MWKIJ48fFKzMCyvgi+IH+WMl4tzAmEH7KnFW9KA91szPCpXrzSBu k+bFDo3tzYWTTZkvDsS50XFKbrh2BmdctJIDbgciAAsEASaQwZYKpoMMIGzraeiBX8qeEMABEpAO +MBhUDM0IlHRI4LPWJAP/oSID6TD4wIVvXyQB/VfhrXKpwNIU/TmKUZkgqcQZ4NwkAW/ZYpRouFo CeAJ1Ah/is6FXLNgk/f9pGOqD+mIwcQgYhgxhGiLG+C+uDceAZ/+sDnjHrjnEK9v9oSnhHbCY8IN QgfhzjRhgeQH5kwwHnRAjiGD2aV+nx1uBb264oG4D/QPfeMM3AA44GNgpADcD8Z2hdrvucqGM/5W y0FfZEcyStYl+5NtfmSgZqfmOuxFXqnva6HklTpcLdZwz495sL6rHw++w3+0xJZiB7Cz2AnsPNaM NQAmdhxrxC5hR+V4eG48UcyNoWgxCj6Z0I/wp3icwZjyqkkdaxy7HT8P9oFc/sxc+WJhTRfPkgjT BbnMALhb85lsEXfUSKazo5MnAPK9X7m1vGUo9nSEceGbblEOAD5bBgYGjnzTRagDcBCuHUrnN511 AlzOUH9uJVcmyVPqcPmDAChAHa4UfWAM9y4bmJEzcAPewB8Eg3EgCsSBJDAV1lkA56kEzABzwEJQ CIrBKrAOlIMtYDvYBfaC/aABNIMT4Ay4CK6AG+AenCtd4CXoBe9AP4IgJISG0BF9xASxROwRZ8QD 8UWCkQgkBklCUpB0RITIkDnIIqQYKUHKkW1INfI7chg5gZxH2pE7yCOkG3mDfEIxlIpqo0aoFToa 9UAD0HA0Dp2CpqM5aD66GF2BlqGV6B60Hj2BXkRvoB3oS7QPA5gqxsBMMQfMA2NhUVgyloZJsHlY EVaKVWK1WBP809ewDqwH+4gTcTrOxB3gfA3D43EunoPPw5fj5fguvB4/hV/DH+G9+FcCjWBIsCd4 EdiEiYR0wgxCIaGUsINwiHAarp0uwjsikcggWhPd4dpLImYQZxOXEzcR64gtxHZiJ7GPRCLpk+xJ PqQoEoeUSyokbSDtIR0nXSV1kT6oqKqYqDirhKgkq4hUClRKVXarHFO5qvJMpZ+sQbYke5GjyDzy LPJKchW5iXyZ3EXup2hSrCk+lDhKBmUhpYxSSzlNuU95q6qqaqbqqTpBVai6QLVMdZ/qOdVHqh+p WlQ7Kos6mSqjrqDupLZQ71Df0mg0K5o/LZmWS1tBq6adpD2kfVCjq41SY6vx1OarVajVq11Ve6VO VrdUD1Cfqp6vXqp+QP2yeo8GWcNKg6XB0ZinUaFxWOOWRp8mXdNJM0ozW3O55m7N85rPtUhaVlrB WjytxVrbtU5qddIxujmdRefSF9Gr6KfpXdpEbWtttnaGdrH2Xu027V4dLZ0xOgk6M3UqdI7qdDAw hhWDzchirGTsZ9xkfNI10g3Q5esu063Vvar7Xm+Enr8eX69Ir07vht4nfaZ+sH6m/mr9Bv0HBriB ncEEgxkGmw1OG/SM0B7hPYI7omjE/hF3DVFDO8MYw9mG2w0vGfYZGRuFGomNNhidNOoxZhj7G2cY rzU+ZtxtQjfxNRGarDU5bvKCqcMMYGYxy5inmL2mhqZhpjLTbaZtpv1m1mbxZgVmdWYPzCnmHuZp 5mvNW817LUwsxlvMsaixuGtJtvSwFFiutzxr+d7K2irRaolVg9Vzaz1rtnW+dY31fRuajZ9Njk2l zXVboq2HbabtJtsrdqidq53ArsLusj1q72YvtN9k3z6SMNJzpGhk5chbDlSHAIc8hxqHR6MYoyJG FYxqGPVqtMXo5NGrR58d/dXR1THLscrxnpOW0zinAqcmpzfOds5c5wrn6y40lxCX+S6NLq/H2I/h j9k85rYr3XW86xLXVtcvbu5uErdat253C/cU943utzy0PaI9lnuc8yR4BnrO92z2/Ojl5pXrtd/r L28H70zv3d7Px1qP5Y+tGtvpY+bD8dnm0+HL9E3x3erb4Wfqx/Gr9Hvsb+7P89/h/yzANiAjYE/A q0DHQEngocD3LC/WXFZLEBYUGlQU1BasFRwfXB78MMQsJD2kJqQ31DV0dmhLGCEsPGx12C22EZvL rmb3jnMfN3fcqXBqeGx4efjjCLsISUTTeHT8uPFrxt+PtIwURTZEgSh21JqoB9HW0TnRRyYQJ0RP qJjwNMYpZk7M2Vh67LTY3bHv4gLjVsbdi7eJl8W3JqgnTE6oTnifGJRYktgxcfTEuRMvJhkkCZMa k0nJCck7kvsmBU9aN6lrsuvkwsk3p1hPmTnl/FSDqVlTj05Tn8aZdiCFkJKYsjvlMyeKU8npS2Wn bkzt5bK467kvef68tbxuvg+/hP8szSetJO15uk/6mvRugZ+gVNAjZAnLha8zwjK2ZLzPjMrcmTmQ lZhVl62SnZJ9WKQlyhSdmm48feb0drG9uFDckeOVsy6nVxIu2SFFpFOkjbna8JB9SWYj+0X2KM83 ryLvw4yEGQdmas4Uzbw0y27WslnP8kPyf5uNz+bObp1jOmfhnEdzA+Zum4fMS53XOt98/uL5XQtC F+xaSFmYufCPAseCkoK/FyUualpstHjB4s5fQn+pKVQrlBTeWuK9ZMtSfKlwadsyl2Ubln0t4hVd KHYsLi3+vJy7/MKvTr+W/TqwIm1F20q3lZtXEVeJVt1c7bd6V4lmSX5J55rxa+rXMtcWrf173bR1 50vHlG5ZT1kvW99RFlHWuMFiw6oNn8sF5TcqAivqNhpuXLbx/Sbepqub/TfXbjHaUrzl01bh1tvb QrfVV1pVlm4nbs/b/rQqoersbx6/Ve8w2FG848tO0c6OXTG7TlW7V1fvNty9sgatkdV075m858re oL2NtQ612+oYdcX7wD7Zvhe/p/x+c3/4/tYDHgdqD1oe3HiIfqioHqmfVd/bIGjoaExqbD887nBr k3fToSOjjuxsNm2uOKpzdOUxyrHFxwaO5x/vaxG39JxIP9HZOq313smJJ6+fmnCq7XT46XNnQs6c PBtw9vg5n3PN573OH77gcaHhotvF+kuulw794frHoTa3tvrL7pcbr3heaWof237sqt/VE9eCrp25 zr5+8Ubkjfab8Tdv35p8q+M27/bzO1l3Xt/Nu9t/b8F9wv2iBxoPSh8aPqz8l+2/6jrcOo4+Cnp0 6XHs43ud3M6XT6RPPnctfkp7WvrM5Fn1c+fnzd0h3VdeTHrR9VL8sr+n8E/NPze+snl18C//vy71 Tuztei15PfBm+Vv9tzv/HvN3a19038N32e/63xd90P+w66PHx7OfEj8965/xmfS57Ivtl6av4V/v D2QPDIg5Eo7iKIDBhqalAfBmJwC0JADoV+D5YZLybqYQRHmfVCDwn7Dy/qYQNwBq4Ut+DGe1ALAP Nit/6Bs2+RE8zh+gLi7DbVCkaS7OSl9UeGMhfBgYeGsEAKkJgC+SgYH+TQMDX6og2TsAtOQo74Ry kd9BtzrK0VWTA+BH+TeUCm/GyZOlwgAAAAlwSFlzAAAWJQAAFiUBSVIk8AAAAWJpVFh0WE1MOmNv bS5hZG9iZS54bXAAAAAAADx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1w dGs9IlhNUCBDb3JlIDUuNC4wIj4KICAgPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3Lncz Lm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KICAgICAgPHJkZjpEZXNjcmlwdGlvbiBy ZGY6YWJvdXQ9IiIKICAgICAgICAgICAgeG1sbnM6ZXhpZj0iaHR0cDovL25zLmFkb2JlLmNvbS9l eGlmLzEuMC8iPgogICAgICAgICA8ZXhpZjpVc2VyQ29tbWVudD5TY3JlZW5zaG90PC9leGlmOlVz ZXJDb21tZW50PgogICAgICA8L3JkZjpEZXNjcmlwdGlvbj4KICAgPC9yZGY6UkRGPgo8L3g6eG1w bWV0YT4KbszeLgAAQABJREFUeAHs3Q9AFGX+P/A38m9RQUHFQgsMLDVdDeowDQ201DrFTLMU7zS/ gfkr/9xVRndyHd030uz8U9dX7Tz9nuj3ujwTzdRKOPFPkmknmJJKSiklKggoLLDA75nZndld2EWW f+7Ce2pldv488zyvmZ2d+ewzz+NSWlpaAw4UoAAFKEABClCAAhSgAAUoQAEKUIACFKAABewQ6GDH slyUAhSgAAUoQAEKUIACFKAABShAAQpQgAIUoIAswMAiDwQKUIACFKAABShAAQpQgAIUoAAFKEAB ClDAbgEGFu0m4woUoAAFKEABClCAAhSgAAUoQAEKUIACFKAAA4s8BihAAQpQgAIUoAAFKEABClCA AhSgAAUoQAG7BRhYtJuMK1CAAhSgAAUoQAEKUIACFKAABShAAQpQgAIMLPIYoAAFKEABClCAAhSg AAUoQAEKUIACFKAABewWYGDRbjKuQAEKUIACFKAABShAAQpQgAIUoAAFKEABCjCwyGOAAhSgAAUo QAEKUIACFKAABShAAQpQgAIUsFuAgUW7ybgCBShAAQpQgAIUoAAFKEABClCAAhSgAAUowMAijwEK UIACFKAABShAAQpQgAIUoAAFKEABClDAbgEGFu0m4woUoAAFKEABClCAAhSgAAUoQAEKUIACFKAA A4s8BihAAQpQgAIUoAAFKEABClCAAhSgAAUoQAG7BRhYtJuMK1CAAhSgAAUoQAEKUIACFKAABShA AQpQgAIMLPIYoAAFKEABClCAAhSgAAUoQAEKUIACFKAABewWYGDRbjKuQAEKUIACFKAABShAAQpQ gAIUoAAFKEABCjCwyGOAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUsFuAgUW7ybgCBShAAQpQgAIU oAAFKEABClCAAhSgAAUowMAijwEKUIACFKAABShAAQpQgAIUoAAFKEABClDAbgEGFu0m4woUoAAF KEABClCAAhSgAAUoQAEKUIACFKAAA4s8BihAAQpQgAIUoAAFKEABClCAAhSgAAUoQAG7BRhYtJuM K1CAAhSgAAUoQAEKUIACFKAABShAAQpQgAIMLPIYoAAFKEABClCAAhSgAAUoQAEKUIACFKAABewW YGDRbjKuQAEKUIACFKAABShAAQpQgAIUoAAFKEABCjCwyGOAAhSgAAUoQAEKUIACFKAABShAAQpQ gAIUsFuAgUW7ybgCBShAAQpQgAIUoAAFKEABClCAAhSgAAUowMAijwEKUIACFKAABShAAQpQgAIU oAAFKEABClDAbgEGFu0m4woUoAAFKEABClCAAhSgAAUoQAEKUIACFKAAA4s8BihAAQpQgAIUoAAF KEABClCAAhSgAAUoQAG7BRhYtJuMK1CAAhSgAAUoQAEKUIACFKAABShAAQpQgAIMLPIYoAAFKEAB ClCAAhSgAAUoQAEKUIACFKAABewWYGDRbjKuQAEKUIACFKAABShAAQpQgAIUoAAFKEABCjCwyGOA AhSgAAUoQAEKUIACFKAABShAAQpQgAIUsFuAgUW7ybgCBShAAQpQgAIUoAAFKEABClCAAhSgAAUo wMAijwEKUIACFKAABShAAQpQgAIUoAAFKEABClDAbgEGFu0m4woUoAAFKEABClCAAhSgAAUoQAEK UIACFKAAA4s8BihAAQpQgAIUoAAFKEABClCAAhSgAAUoQAG7BRhYtJuMK1CAAhSgAAUoQAEKUIAC FKAABShAAQpQgAIMLPIYoAAFKEABClCAAhSgAAUoQAEKUIACFKAABewWYGDRbjKuQAEKUIACFKAA BShAAQpQgAIUoAAFKEABCjCwyGOAAhSgAAUoQAEKUIACFKAABShAAQpQgAIUsFuAgUW7ybgCBShA AQpQgAIUoAAFKEABClCAAhSgAAUo4NZeCaqqa3D+SjkuXKvETyXVuFpWhYKyGpTqXVBaWYPKaqBC vKTBQ4Rf3cWro9Dq6A74ebmgm5crbvfugN5d3RHU3ROuHVwMC/NfClCAAhSgAAUoQAEKUIACFKAA BShAAQq0AwGX0tLSmnZQTkiBxLOXdDj+UwVOF1Th4nVRbHc3uHu4wU38dXN3haubeLl2QAdXF7i4 GF6STU1NjfyqrqpBVVU1qvRV0FdKLz0qK/SA+HuHtwv6+rlCe5sHQnpqGGhsDwcVy0gBClCAAhSg AAUoQAEKUIACFKAABdqxQJsOLIp4IE7+VIaMXBFQzK9GhZs7NB09oPHyhLunmxw8tLXvpaBhlV4E DcXg6mYIPtpaVgo8Vuj0KNeVQ1daAQ99JQb7d0B4oAYDbvcS27G1JqdTgAIUoAAFKEABClCAAhSg AAUoQAEKUMA5BdpkYLG0vAp7vyvBgR+rUeLiBq/OXvDq5ClqIpqalJSCgYU/X8G1S5dRUlCIG9eK UFZcjPLSMlRVlMPDrQM8RE1GaagQQcYKfTVcPTzh2VGk5eODTl27wNvPF1179oDvbd0tgpTVolZj 2Y1ylF0vg3eNHhF3umLUPd7wkp6p5kABClCAAhSgAAUoQAEKUIACFKAABShAgTYg0KYCi8WincSd 317HgQt6uIpgYiefTvIjzsp+ul5YhAvZObjy44+4fuUKAv074+47/BB0e1cE3uaNO3t2gb9vZ3Tp 7Ak3syCktL5eBAuLrpcjv/A6cn8uwg+XSnD+p2s4/WMBcvOvo3OPHujeuzd69wtGZ98uyiblR6Zv FN+AXgQZI3q74fF7O8NHtM/IgQIUoAAFKEABClCAAhSgAAUoQAEKUIACzizQJgKL5aKnlU9OFGFv bjXcvTuhc5dOcDF2plIhHk8+f/wk8s6cgbdLBR4ecgceHHQH7rv7NniLx6KbYygRjz8f++5nHD7x I9K++QHXoUFA3xAEDR4AD42nvIka0cbj9aIbqCy5gVGBrvjlQB94Sj3CcKAABShAAQpQgAIUoAAF KEABClCAAhSggBMKOH1g8cuc6/jo23JUajqKgGJH9XHnkoIinPn6GG7k/YDHftEHjw0PwaC7erZ4 e4dSu46ZOZfw6ZdnsSvjHDoF3Im+D4TC21iLUXpM+npRKdx1pZhyryceDO7shIcNs0wBClCAAhSg AAUoQAEKUIACFKAABSjQ3gWcNrBYeL0CfztyHWdKPdDJ2wueXobah0WXr+LMkWNwLbmMX40ZiCdG 3AON6KjlVgy6cj227svGxs++RZVPDxFgvB9duvvKWSkvq8CNkjLc3bECsx7oDN/OzVN78laUk9uk AAUoQAEKUIACFKAABShAAQpQgAIUaH8CThlYzPzxBj44qkNNx07w7tpJ3msV5RX47suv0OHqBTz7 uBaPD+sLd9EBiyMMlaLjl08Onsbfdmahpntv9HvwF6JXakMgseTaDbiU3sBzYRpo7zCUxRHyzDxQ gAIUoAAFKEABClCAAhSgAAUoQAEKUKA+AacKLFaL54z/9U0RPj1bBZ/uXeSenqXC/XDyNH785gh+ /Ug//Hqc1mECirXhpQDjhk+P4+97T+OOIffjzgF3y4tIPUgXXynCYyGuePK+Lujg4lJ7Vb6nAAUo QAEKUIACFKAABShAAQpQgAIUoIBDCThNYLGsogqr0q/hXLlG7pylg+i1WXejDCf3H8C9XauwaMaD COju7VC4tjJz8XIxliZ/iZPFHhgQ8ZB4jNsThrYXbyDIU4d5EV3R0ZM9R9vy43QKUIACFKAABShA AQpQgAIUoAAFKECBWy/gFIHFolI9lv37Gq5AdNDS1dDZydWLP+P7Q/uxcNJAREfcc+slG5GDLWmn 8O6OkwgZPgJ+t/eUU7h+7Tq6VpfityN80N2H7S42gpWrUIACFKAABShAAQpQgAIUoAAFKEABCrSC gMMHFi8X6bB03w2UuHZEpy6GNgh/+PYkqn44haXPj0RIb79mYyq8UYn8Yj1uVFSjVLzKKoFq0cuz u2sNOnm4oqtXB/j7uMG3k3uzbTM79wpeXZMO98ABuPPeAXK6pcU34Fl+A69GdsZtXTXNtq0WT0iv g07vBo3m1nSWI5fPEfLQ4tDcAAUoQAEKUIACFKAABShAAQpQgAIUuPUCDh9YnLv8C5T2GiJq9PlD NLGIs19/jbvdC/DGcyPRUdP4AF+FaO/wxMUyfPtzJb4vqMLF6zXQVXWAq5srXDq4wEW0c+jSoQOk 1g5rxIZrRISxuroaVfoqaFyr0auzC+7yc8W9t7ljYC8veDSho5jroofoP/w1HWf03RAcFia2DRT8 lA+vC//B//xm9K0/ShqQg+unP0bUkOk4IZYdv+wLfDh3WAPWat5FHCEPzVsipkYBClCAAhSgAAUo QAEKUIACFKAABRxXwOEDiz9fLUHsO6nwG/IQ8r8/i4fvqMZvnxkKVxH8s3eoEsHB//xQigPnypGZ X41qVw94aDzg5uEON3c3OaDYkDSlIKO+Ug99RSUqdBXoUFWBwT074KE+nhh8R8dG523Z5i+x76Ib /PsEo/D4Aaz9bRR6+jWx3Uj9d/jD+BnYJRUsIA57/vosfK12DvMTlk+Nxv8VAyeuhuPQ3ncxxMqm a2r02LtkOiZsPScWHISduasR2cMd/3l/Koa9tMPINxvfFLyLexpR2bKmpgT/fHEK3vnKBX5+IpJc z1BQkI7weUfwbsy98lLNlYd6NslZFKAABShAAQpQgAIUoAAFKEABClCAAkaBW/jMasP2wW3dvLH6 N1F4bukejH/wLjz/RGjDVjRbqkw81rzn22J8lqNHKTyg6dgZnfw95VqJZotBd/0GrhcUQFd6HVUV FagUL6mapKubG9w8PaHp1BlePl3QqWtXQzBSBCQ1nTvKNRpPlpbj2Fc6dDpyFY8Eu2HMvT7w8uhg nny941KgdFHMMHhvPYqdh9PwwStjmh5UlLbo5gPN1RM4IVUlxBacXDYbw32lcctB/+Mx/G6HvJCY cQJp2QkY8kAPy4Xkd7n4PFEJIA6Cr7HWaLfbA03LDuwPf08pKGh/8FdK5PrldGN+TUnaGvMrEvvI ODRnHpQ0+ZcCFKAABShAAQpQgAIUoAAFKEABClDAuoDDBxalbEu9Pf/fH8bDp5On9VLYmKqvqsa2 /xRj99lK1Hh0gqcICnqLR52lQXqs+trPP6Pg4o8ouvQzbhRcRteObgi6vSt6+4pOYrw90MnLHR1E 7b7yyjIUXb+GS3nfI+94CX6+JgKIfj3Q5bbb4NfrTnTx7wl3jUZ+SY9K7zhfhp3fXcWYEHdMvM8H bqIH64YOcyeFIWbMQLvLajv92zH6mfF443dSMHAfvjp7DcMf6Fpn8R++3mcxbc8Xp7HQSmCx6kI2 3lWWfGYM+hlrNfaeuBgHd45Dkd4Ft4vapdZrRSor1v/XtJcHYvYrj8FP2llWBp2uALf16aLOac48 qIlyhAIUoAAFKEABClCAAhSgAAUoQAEKUMCqgFMEFqWc2xtU/Ca3FBuOlqEYXvDy7YoOxuBeWcl1 5GWfwJXzObirhwaj7g3A/Y9oMaRvT3h3bFgvzFKbiN+cvoQjp/KQ8e1+ZOwrR/egYAT0GyhqMEq1 GjujusoLO38ow4EfCvHrMC/cF9jR6g6wNtHeslpLw3xa38iR4q2hluGe/VLA8Bfms8W4Dl9/8p7F tPSP9+On+OG43WIq8FPmV+qU2eMfgPK0s4uLN+6LjFTnNcvI+Hl4+/UYdRs3S7NF8nCzjXI+BShA AQpQgAIUoAAFKEABClCAAhRopwJOE1hs6P7RVVbjrweLkHHJFZ5ePujoZaj/Jj3i/EPmMbiWXMIT I+7GL2c+hjt7mmq7NTR9abnOXh6IGHyH/JLe/3CpCJ8cPIutaSmo9u6JO7Vh4nFpX3T07ozrZe74 8+EyhJ8rxLMPivx4GmpMSuu11tA1eBjGi41JocX0z79G4cIHLGsU6s5iz/+JmQPFS30aeiuO/fQS Hr/ddIhI7St+ly631igWBKLC7pD/Gv7R4fIP+SgTb7z8AtCjs2k9s4XsGy0uR5moraix2iaktaRa IA/WNsNpFKAABShAAQpQgAIUoAAFKEABClCAAmj4M7pOgPXj1XK8tqMAR654orNoB9FdtIsoda5y 9quDuPLVZ5j3SC98umwqpMeNGxtUtMYgpSWl+enbT8nbuPzVHnmb0ralPEh5kfIUv+Macq+UW0ui RafVdA7GeCmyKA379uHsDcu2D6/nHIYUV5SCiiN+OUIaE8MJ7Dv2k2HU+K+LSx72v6tEHl9G2B1m wcPrWfhVv37oJ16Pf6AsY7F6o96YbeHm67dQHm6+YS5BAQpQgAIUoAAFKEABClCAAhSgAAXan0Cb CSwe+f46frerBAXoLB5H7oRqUdMtP/d7nPr8X3hyoAYfJ03GxBH3wN2t5Yrs4e4qb+PjN5+Utylt +/IP5+W8SHkqcu2MxbtL8E3ujVY90qRHhH8xfrZxmztwRLSzaD6c3fe58e1ILEpKwovGd+/tPioe kjYb8r4z9C4tJg18OQp3ms0S3WojwPi+j6dl4NJ8sRYdd4Q8tGgBmTgFKEABClCAAhSgAAUoQAEK UIACFHAcgZaLsrViGVNPFuGddB1cO3eBh8YLVZVVOHf0S/gVnsQ/fj8OsdH3tWhAsXZRpQCjtE1p 2z6XM3H+2Feo0lfDw1ODDp18sPTfOqRnF9derUXf3znsITX9fYdy1fGamss4tMPQ/iIGPor77xqC kUoMct1e5JpFFn/69oD6pPSkqHvUNFpsxMcT7g1+DLrFcsGEKUABClCAAhSgAAUoQAEKUIACFKAA BawI2PWkqZX1b/mk4hvleGvDv9Hjvii4unug7EYpzh1OxbThtyFu4ji4drhFteeETG9/H6xd9Bj+ 8q+v8VHap+gzNAqeHTui0qMcb25Iw30JYxvcYUxToT3vuF+uiSj16Lxjn2hn8Xmt3M6iy5UT4r0h 9fEzH4K3COTdN+FlYN3bYuI6fJWThHvu7SwvcPqA0r7iSIRrbzOs1JL/ioBn8sed0K2iAhXWtuNx Bx6b+KCcZ2uzOY0CFKAABShAAQpQgAIUoAAFKEABClCg5QScPrAo9aC84vlhePEvqeiujcCl4/vx p+lD8HBoYMup2ZGym+iNev5Tv8DgkFy8vukz9BR5vJKVjvdeGN5qQUU5u26BGPniQLwrtZG44zPk Xp8NX2/g55MZMMYV8cjI/vKitw95GCPxtjz9k8M5mHHvYDH9JxzaZWw7ceR4DOlaI6a1dNB2B+ZN N9amlHNW+5+R2Je/Cw8Y4p61Z/I9BShAAQpQgAIUoAAFKEABClCAAhSgQAsKtIlHoQf06YFVcx9E 8fHPsfL5oQ4TVDTfb1KgU8pbcebneHfucPQP6mE+u8XHXVzccN/occbt7MDXOdfl8ROpW43TZiPi HkOErqb7EIwfaZi8Y8tBFIr2KnH5BD42xhXHjx9u2au0MQVrf3SnP0RHUUuzvteLyd9aW7UB0wLg 5fSh8QYUk4tQgAIUoAAFKEABClCAAhSgAAUoQAEHFGgzYZl77/LH9iVTGt2WYklZFbIulOH7K1XI K6pCka4aZZWGPeblDnTRdEBAF1fc1d0V2ju80FnjavfuHBzSEzuWToFUi/FWDLcPeQgDRU1EKT74 +dFc/NcQb3z+tjFa+OI4BLsaaiG6uPhi5ORnRA/Soq/ofTtEL9JzcffZo2r7io8MC25w9vWlV2+6 7Jl8G53ZjFyG3E+fh29VlZU09GKaJ9zazBFspYicRAEKUIACFKAABShAAQpQgAIUoAAFHFigTYVl 7O3xubyyGv/OvoF9Z8uRfbkarh6e6CAiVR1cRScrUtuMLsYAYHk1qstqcPSKHtXf6VFVcRX9/Ttg ZIgnRt7TCZ7uDQ8U3qqgonQMSjURnxkI/E7EEnccOoMrj7pDanNRGl4efR/czDpKCX7oYTFVBBbF A9EHTv2Emi//Lcal4RkM7dfwZ49d/fpj8cuLoemqMaxe69/y8nLcE3VXranGt6LzFmktN6vRwzZ1 6FovP6dSgAIUoAAFKEABClCAAhSgAAUoQAEHFmiX0Rl9VTU+PlqMHScrUSpCV+4aH3Tq5lHvbjKE Dj3VZb7XVeC7r8uR/PVVRN/rjuhQn1tWE1HN1E1GXFx6YPjTI4DfpwNZe5GiNl84Eg8Pud1ibc+7 RLuVYooUeDz8yafQZYt1pOGZMQixHiM0zK/1r9edkYj/Y2StqQ1827odZzcwU1yMAhSgAAUoQAEK UIACFKAABShAAQpQQBJod4HFzB9u4P39pbhS6QUPL294djA80lwlgo0l+Rdw4/JFlF+/hsqyElRX SY/bQtRgdIO7tGznrujUoxe8/XuLaR7w7OSByqqO+L9vy/DFmat4/qGO0N7ZSV7HUf+5O2KCyJoI Ep5YhxdfMuZS6oyle63OWERnL48YO3vZ8faLUGKQs8c8INcidNTyMV8UoAAFKEABClCAAhSgAAUo QAEKUIACrSPQbgKLUv8jmw9fw0f/qYB75y4iUOgJKZRWXlKMq98fR9nlXAy+yw/3h96OkN79cYe/ N7w8ReOKYigrr8SP+SU4e6EQX2efwPG96fDqEYhudw2GRycfkVZnXKlwR8LOIkwZUolpQ7vC7Kli OQ1H+adrv2EYLzKjBAqlfI2fPLJOZyxSZy9DHpskqiwa22A0FiDqwTuMY/xDAQpQgAIUoAAFKEAB ClCAAhSgAAUo0J4F2kVgUXr0+Z09hcj4yROeXXxE04kdoK+owJUzR+FekovZjw7A48OehF8XL5vH Qt87uiEqLAix0fehoKgMOw6exqbPP0WldyC69w2Dq7ton7FLd/zrZCkuXruK3zzq65CPRtd0DsZ4 EVncYRZZnBRhvTOW7toIjBQi+1SVlxF2R7s4ZNQSc4QCFKAABShAAQpQgAIUoAAFKEABClDAuoCh 6UDr89rM1JPnL+OTvYdFQFEKinXAjas/46cj2/FMmAY7334KM8Zp6w0q1oaQApC/fmwwPhE9PE8N 9ZTTktKU0pa2seOLwzh17nLt1RzivYuLN34xfrZZXl7E/X1MbUeazUBNVy0mS9UbjcPAlyNwp/Km 9l/Rg/b12tMa+b7cbD3Dw+hmE+obbcY81LcZzqMABShAAQpQgAIUoAAFKEABClCAAhSQImHtYNAG 98SfYgbi8rdpKMr7Hu55h7HhlSi59qG9PUmbc3m4u2LOxFA5LSnNop++l7fx3zMGYVBIT/NFHWr8 zmEPqfkZsXgcgt1FD9hWBikIGfGkKQg5aewQK0sZJ3l5Icg42tmnabUaPZVOp0PE4+j2PFPejHmw XVDOoQAFKEABClCAAhSgAAUoQAEKUIACFJAEXEpLS6WmBtvF8MWR7/Hh3lN458XR8OlkvZZeYyGK b5Rj4arPMe2RezHq/j6NTYbrUYACFKAABShAAQpQgAIUoAAFKEABClDAKQTaVWDRKfYIM0kBClCA AhSgAAUoQAEKUIACFKAABShAAScQaBePQjvBfmAWKUABClCAAhSgAAUoQAEKUIACFKAABSjgVAIM LDrV7mJmKUABClCAAhSgAAUoQAEKUIACFKAABSjgGAJN62XDMcrQ7LmorqnBxYJK5BeLbobF4O/j jt5+HrCnH5FmzxQTpAAFKEABClCAAhSgAAUoQAEKUIACFKCAAwkwsGi2M8orq7HlSBE+ydLjmk5U 5uzgaphbrUNXTTV+OcgNkx/oAk93VvQ0Y+MoBShAAQpQgAIUoAAFKEABClCAAhSgQDsUYOctxp1+ /lIJ/viJDj+XaeDm6SX6y64VPKyphr68DLd56fCHX2oQ1NO7HR4uLDIFKEABClCAAhSgAAUoQAEK UIACFKAABQwCtaJn7Zfl65MX8N2pTHRw16AGHSCehrZ8iWnSPGmZY6cutl8olpwCFKAABShAAQpQ gAIUoAAFKEABClCAAkKAgUXjYTA5sj/+3yP+KDz7Jar1VRAVFC1e0rTCM/vx/x7tiUkP9+PBQwEK UIACFKAABShAAQpQgAIUoAAFKECBdi3AwKLZ7p8+ZhCeH9UVRecyRFBRBBeNtRarq6pw7fvDeH50 d0x/dKDZGhylAAUoQAEKUIACFKAABShAAQpQgAIUoED7FGBgsdZ+nzFWi/8a2RnXzn8lgovV8qvo fAbiIn0gzeNAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKiC5KSktLRb08DrUF/rrjP1h/oFSePDui I5795ZDai/A9BShAAQpQgAIUoAAFKEABClCAAhSgAAXarQADi/Xs+tXbjqGDiwtio++rZynOogAF KEABClCAAhSgAAUoQAEKUIACFKBA+xNgYLH97XOWmAIUoAAFKEABClCAAhSgAAUoQAEKUIACTRZg G4tNJmQCFKAABShAAQpQgAIUoAAFKEABClCAAhRofwIMLLa/fc4SU4ACFKAABShAAQpQgAIUoAAF KEABClCgyQIMLDaZkAlQgAIUoAAFKEABClCAAhSgAAUoQAEKUKD9CTCw2P72OUtMAQpQgAIUoAAF KEABClCAAhSgAAUoQIEmCzCw2GRCJkABClCAAhSgAAUoQAEKUIACFKAABShAgfYnwMBi+9vnLDEF KEABClCAAhSgAAUoQAEKUIACFKAABZoswMBikwmZAAUoQAEKUIACFKAABShAAQpQgAIUoAAF2p8A A4vtb5+zxBSgAAUoQAEKUIACFKAABShAAQpQgAIUaLIAA4tNJmQCFKAABShAAQpQgAIUoAAFKEAB ClCAAhRofwIMLLa/fc4SU4ACFKAABShAAQpQgAIUoAAFKEABClCgyQIMLDaZkAlQgAIUoAAFKEAB ClCAAhSgAAUoQAEKUKD9CTCw2P72OUtMAQpQgAIUoAAFKEABClCAAhSgAAUoQIEmCzCw2GRCJkAB ClCAAhSgAAUoQAEKUIACFKAABShAgfYnwMBi+9vnLDEFKEABClCAAhSgAAUoQAEKUIACFKAABZos wMBikwmZAAUoQAEKUIACFKAABShAAQpQgAIUoAAF2p8AA4vtb5+zxBSgAAUoQAEKUIACFKAABShA AQpQgAIUaLIAA4tNJmQCFKAABShAAQpQgAIUoAAFKEABClCAAhRofwJu7a/ILDEFWl+guroaVVVV kP5yoAAFKEABClCAAhSgAAUoQIGWF+jQoQNcXV0h/eVAAQq0jAADiy3jylQpIAvodDqUlpairKwM 5eXlcnCxpqaGOhSgAAUoQAEKUIACFKAABSjQggIuLi5yUNHT0xNeXl7o2LEjNBpNC26RSVOgfQow sNg+9ztL3cICUvCwuLgYRUVFcHNzQ5cuXeSXh4dHC2+ZyTdVIC8vT04iICCgqUlxfScSUPa7E2W5 XWSVn0Pn3M3K54n7zzn3X1Nzzf3fVMG2uT6Pi7a5X52hVBUVFfI9mXRvdv36dfmezMfHB1LQkQMF KNA8AgwsNo8jU6GAhYD0xXXt2jX4+fnB39/fYh7fUIACFKAABShAAQpQgAIUoEDLC0gVO3r06CG/ 8vPzUVBQIG9UqvjBgQIUaB4BBhabx5GpUEAVkB5/lmoqMqioknCEAhSgAAUoQAEKUIACFKDALRVQ KnwUFhZCejyaj0Xf0t3BjbchAbZg2oZ2JoviGAJSm4pS48DKF5dj5Iq5oAAFKEABClCAAhSgAAUo 0L4FpHs06V5NumfjQAEKNI8AA4vN48hUKCALSL0+Sx21sGo9DwgKUIACFKAABShAAQpQgAKOJyDd q0n3bNK9GwcKUKDpAgwsNt2QKVBAFaiqqpJ//WJgUSXhCAUoQAEKUIACFKAABShAAYcRkO7VpBqL 0r0bBwpQoOkCDCw23ZApUEAVkH71qqyslNvsUCdyhAIUoAAFKEABClCAAhSgAAUcQkBqX1G6Z2ON RYfYHcxEGxBgYLEN7EQWwbEE2twvX3oddDr9rUV2hDzcWgFunQIUoAAFKECBNi4gdQB4i6+42rgw i0cBk0Cbu2czFY1jFGh1AfYK3erk3GBbF6ipqWkzRSzJ3oKH+k9BpihR9Mp0bJsX0eplc4Q8tHqh 7d2grhC55y/gaiXQUVrX3Qd+vXrB37v1TvE5u1fhvT3n4NdvEl6Oi4DG3jJweYcQ0N8ows8/XUaJ +BXfXcqRlx9u790TnVrvUHIIB2fOhL6kEBcvXkKxsg87dkOvwAC04unglvAV5uXi0tVicf4DKsWZ sGevQLvOgfm52bggTqLu8oHfEb37B8PXjuO+JD8PFy9dFdsWg7v9278laNyoAwmUYPtr0YhOShN5 ikH6pfWI8LfjAHSgkjArzSSgz8WahDXIFe0A3j3pZcyMCGimhJmMItCW7tmUMvEvBW6VAL+xbpU8 t0uBpgjos/Hao1OxU0qj11z8e2McfK2ml4elE8dhk7jXyrw6FEcPrEGot7UF9dj9xmSM23JOLKjF XnFBGyUuaM98liwHFaU1UuYnIzs2Av0aFTEqwea4aCw5DHTrZm37pmlXr6Zh6MJMrJk5SJ7YfHkw beOWjenEfntM2m/dxH8NHySTqMWnsHxyP8uV9HnY/v7biJ6/wnK68V1kTCL++PoLiAi2dnTosPu1 pzFuZzEirWbmqkilD4ZOjMGvZkxEv3rvsPOxc9F8rJAi0DEPiMAioMvejPD+S8SEblh0KgXT+ikH XnNu11hQp/ijQ9pbcxHzRQmGWdkdhYWF8PW9E/dGjsGEx0YjNMjqTpFLqjv7MX458i9A/1MI+/Vu LJlh+KzYZNCdxVsz5uCLQrH8c19gydT+dRbVXcrCpv9ZjoQP9tSZJzaE5xJfwfO/fhQ928JVQyud PwHDeW/64TREDt2ElDXToH4KlM+HNhND5x7FmrhQK+5mk5Rzx1WxvNn50WwJ6PKOYe3biZi/IsV8 snFciwUr38DLcycgoC3sQ7MS5u7fjN+/MB3J0vmn1hC9YDXeSJiNQfWcv/R5GUiIGQo5nmOxvhYr d32IeWNrnXctlhHnutwMvP37WCRYyUBM/Cb8KWEaAhv1vSk2pMvBmvm/xfuH5S9xLMw8gJmDlKNI fL9Hie936dtEfEc8vvgs3pwcXCt3lm8zVsVh6LoziEQafGYfFj8Whlsu4DTv2uD3SMlJrFAPwmQk f/E7REyr/9hzmt3Vahm1fc61lYWcLa8h5A3pajoKmQeWQ/142VqhNaeXXcWupCRIZ/TI22cwsNia 9twWBShgt0Abu7y0u/xcgQLOKeDmAy9xg5kp30h9iBPiZiHCSrBCn/s1FqUod1uZ+OLkGwgN97dS 5lzsSVBuRrXo6mU4NXQL6GNaVnsvejb25kikUnIpzZhfU5K2xroVy3U+5NnNmQdb22u16ZVFOJwm 9lsjNtjt+yKLtXS5qXguaBSSLaZavklLToD0il2djr+IWoSWJ/xK5J4U+1xkRqofYX3IRFpaCpLm A0t2ncUrY23ctOafwDpjoeKnD5drK5ZUloikDROvlJo/2NWM27WeaQedWoULp0XQ7hRwyGYOT+HQ oT344L9FKC/mLaxOmIGQTnUXrqq8LpIRCUn/vzoWofefxtT+VhZUVq0qw+lD8hq487r5vjAscOng +wh9SmzU5nAKHyTMEq9J2Jq5HOHdLI8km6s56oxWOn9KxZfOe/JnrFuJxeONlcrnQ3xEMueE4cFh xWYBIytwlaU4aTx39DE7PypL5qUuRa9Ri5S3Vv5mYsX8aPFqSzWh9Ni/dDJGLFK+u+oWO2XFHKSs eB8fnTqAyeqPG6bldDnbER4SbTxTmaYbxjIxf1x/HFl9GBvjwmvPlN/n7V+FXiPECdLGkJwkAp5J u3C4YCPCfW0sZGNy/rHNeDpsusX5ubjS/PMbgCfnRmHRFMMPS5lTnsPoS6niR0HrCZZkbcDQ+Wvl mWnQIiV6sPUFnWJqG/we8eoOaY8o38fBwT2dYk84WiZtnXNt5bP06klxEpauVfqg1NZCt2q6qD2t /Izg04Tr71uVfW6XAhRoXwJOfnfQvnYWS0sBk0AAHp0ejYRM6YYqDV+eLkSElbuW3CPKJaphzd2f fYdXrAQW9bnfQq3zFjMOA4xXMoGTE3F073hcqwACQkfYqBVpylV9Y57qTC1i4x+3WWOvTPxCe3tQ F3Xp5syDmuitGvG6DVPjF2BwmRe8vMwyUXYSSUotI2004h8fYDYTKLt6Ff3uv02dps/bjceCxqk3 INKMmMT1iH08DD3cK3E66wv8bfoi+Vduad7aOSNQ6pmJjcZaoNI0aTDtE7F+fCLuQJlhhpS5C0eR tNZ0w75oXAg0hwswz9pxdvgL4415JEaHBhrSqOff5tpuPZtwyFkeZrma9NyL6CXdKOjES/zVFV7E geStUqxQHk4lv4qRydux/uBGPBpU/x3Fb0a/jfDc1xFk6xvdFbAVdtSLwNd0i6DiGCS+NwPDBvWB e2UBstK244X//sCYq62YNPUuHPtiIZz7lrd1zp8Smvmxbmv3SMvN0iYgonI5gm0tZHaDKS1vPkjn g3EWQcVorNw0B5GhfcU+vIJju/6B6YuUM3wyRjxyNy4eXwxnf6iuMON9i6BidPxqJMwejz7i++vC d//GUrUWYyam9F+B8zWLYXF20mXhOfOgYmQ89r4fh4F+ehz+x+uiJniyzJw8Zyju7nsRi6NqieXv R4xZUFEbswTvvfIkgkXgPefQh3hhyiLjeTEZQ2eNQvG2mWqQwHz/1R0vQeqquRhl3H7d+aYpweI7 en3MCsySs5qGUbEbrG9Hn4ME7Sx1xdiPtmJCo6tRqsnc0hHzz1ZTvr9uaSHMN+4WjKTzRzEm5xo8 3AMwwsp3rfniHLcuYH5c2DqdWq6phO7kVhQsZ/EdBShAAQo0WKBh59wGJ8cFKUCB1hK4e3SU2JQh 8LN732kRMAyvtWkdMlKUm0nDrLQt/0be4og6N5QXjx9W142NDjdrH88boVHSdppxiF6IlW/ONNvG zdJugTzcbJMtNd8tEHFvLq+buj4LP4rAonRvGD33DbwZN6juMuqUQqybax5UjEbK2Y2YEGy6OO43 KBQTpj2P1DUvYdQcQw2V5FkxmBJ5VNxMWjntR6/HB1b2SeKyHKx7aRLmrDXUPJwf+wGePv4KLCvE 6HBkZ5Ihd5ETcZ/lTDXXVkeatF2rKTrHxDF/xtuvT637GfjvPyFjx/9g0gvvGstxCLOG/wH7cpYg pN7Y4gf4r2Uj8cWrkXaX/8xnG9VgJsa8hWN/m2EWNAxCSP9QPDF1Al7UjsdWKfVTy/CvY89ibqgp +G/3Rh1ghdY5f9pT0BWYlDAGx98ca89K8rKndqw21biLXo2L2+LMzvHB6DcoHNNmPo0ZPYcaajhn JiA54wXxnWFnFTq7c9aSK+jF99s6dQOx68Xj5DND1fe+/tOw8Wg47ggLQZJ8+kpAyrEFmGfWFkjW /y411fiOXILzqa+ogccJ8zYis3tHaKcbzp8Jo9ZhtghMmocWsz5+R/1xJzJxLz5bHKXWCg+Y/AqO nu+HsCBjbciU5TiYF4OxN3sOvTALrz2sNebZUJxIrfj50HAKVstnGvHGzFXp+HvyCENeUmYhYUuE aDbDsnb5/qTnTD8eivPuslrzTek54Vgb+h7RBIZirEX02wn3B7NMAQpQgALtUoC9QrfL3c5CtwUB 374PIdpYkLTdGSisXSjdGeySIlXipkQdMrfg6zzzR6mkOXqcSpNba5QXe+QB86taHfJzc5ErXvkl tddTU7VvpLhcqRfXwPVaIA8N3HKrLVZmevQb5WbjVjKgy07BHLUiYSR2nd9iEVQ0reKNqLi/4KNY 5QDIxN/Ux+JNS8ljNvaJm3cw4tZsR7yaxCKk5xhrNSpJiOMsxXDvjeipD9lXq9Wu7UpV+9rIUFKB cmtFceuC8CdeRc7BZIxR5yfjzY+UeozqxDojp96NwfsZV+tMr3/CDWSmKW0q9sf6pGfMgopma3YL xW/fm6ROSPvmB3XcWUda5/xpn05m0jgs3Z9v30qiHceju5QTgni89f3ZFsEvNTH/cLy+KUZ9uzvj nDrunCNloikHJdoWiWefDK1bDFED7IXliWbTzb/D8rDtfekLUhqEW/Jv1KCiYRowaNoyrFa+ZJGA z7LNz0ElOKS6R+KPL5iCisr6boETsHaJEuzPxOmfS5RZNv+WnEszCyrGYNfZMny2dZPN5eUZvhFI 3hWvLrNCPBKdanYYlRxbgxEJacb50Uhf39Cak2qSjj3SqO8RvXxtkyOubQyXNnrkZmVg9/bt2LJl C/ZnmwEaS68vycOx1N3yfGmZLdtTkZVb58pLXFKVIM943ZSbZ2W+nJ7OtEy+6bjQl+TL11u5ufkW TSdY7gA98rIzsF3Kg/zajv1ZuXLld8vlar8rQU7Wfmzfblhv+26R/5y65ay9Ft9Lu1Ts+/2pws5w fNjc9zKW/cdWYW6WOPas7xfT0WHaE1JHUdJ1ua3jS+rIqrHzW7qsUvoZqUZHcfxu370fuYXm51ZT OTlGAQo4lwADi861v5hbCpgEvPtionLTk5aK07WuPkrOHDLWThGNPkebbm7Svr5oSkMeu4h0udcN 6U08HjCv0VZyHE8HBSFIvB75H+UmrtbqjXhrpc6c7VRaKA+2N3gL5rg3dJs6fLJ8lrpw9MplonZD fZpumPjKInX5lG1HRBjC+mA7lUA8M9cUkMgrsrwALDlpPM5EshNHDrCeeD1TG77dWgHNetJ0hlm2 yy2ejA6KxPKtv1OLsefVD3HWPCaizhFtMY4Zpr7770mvI+uG+rYBI3pUqAeELzppbOcqaNzr2Ldv n/x67+m6nb80YGOOtUhrnD8bWGKten4GFo34LY6p+6QhCehRXqws1w2dje3jKlPM/wZPegenTom2 NsUreZbya4H5Es40Lj4Qarlt59vN3fzBSNNyuuzPRFMixveiFn2k1ZqE3hg/xxSw27bvjCkBeGHI uFhERkYiesF/YYiNyp9d/HuZrdPwUe2C9bhYuRFjgzUoK735AREwNkH8iKSkLx6J/u0Gw7ledFSU EDZHmYH4Xe9bbY9ZXcBJR2yfuWp/fxm+R3Q5/0RPcV0TIl4rPt2NN6LcEaQdinHR0ZgyZQpe2G4e eNdh/4bX4O7TC2GjxsnzpWWmRI+CNsgPg2esQrbZLtLnp6GXSFe6bgrq5YfNFgFpA3DWhudMy8Tu UIOCmeufNqwX9DSOmqWp7BZd3n4sFHnt1X8ooqU8yK9ojNAGwWtwHFJzLb+flfVyUjdgoosPQrQj EB1tWC96nMh/SE+4RC1Eao6VjSkrt+e/ooO8zW/MMOz7EaOEneH4MO37pRb7XqKy79jKx5bXJsIv SCuOvVr7ZeJSZF2ClR/7RAc1j/QyHl/zkF3n2iAXib2U4+9JZNTZtfn4QJ3/NnKV/dviZZU+Rwtl y6GjjI7i+I0eNwJBfl7iR+xU9XOgZIl/KUAB5xJgYNG59hdzSwEzAW/RY69yJ5GCjDOWv4yfSdtl XDYSv39nGRYY363YecTyyzvvlKF3aTFfGz/astaGu7iANa7Xp95HMY0LtcQfR8hDS5SrUWmWIU+9 t9VizuSbBwfcgp9CwaVLuCReBSmzG9jGV8Mzd/KLD40LL0BE/c/rNjxRLoku4VORqMYMP8CXZ6xH DJ977T2sf04J9G3F2Fc/tvx812vZBXcPUzZyCE8tXIfz1u9LRbSzG0JCQuRXz062b+Pr3ZxDzWyF 82cDy7vwrWSkLFA+y8kIm7vZjn3oiwEiuGUYREBp1irk2NyH/ujXr5/8CvB29n3oiyFjTeX+x54c K9p52PAH0w8rAV28TMtUmuoMxz411OZ5MSB0tOhB2TCk7Dpq9sOMG8Lj1iA1NRXblpt6+zZtQBrT 48SXyeokn443N/fu+zj27j2Fo8tn2tl7twaTlx1Wn2IQkWMk7c7C/j/PNT0CHfsREsYGqPlpzyOV ZsHahOhxUCt0GlG6aZRf+wqxOc4LI2YZm/uwgpaZPB/9fSYi1fg0iFvABJzapFybAdOnvo088/VE m6gxhkYxxdRoHF4/TW0Ww91TueLygZIDZdUS0ZO8V68RWKFUPlVmKH8z12JUkBc2Z1lGkvL3L0XI qFlqm8vS4lqtcr4Rb9JWYFTIDOzPrxOhUlJ2zr8+Tc12CTbM6oXpCabPcO0UM5MXiX3/hsX+bfix lY9VE3tiSpJS47xW6imLROA6DGtrTZa6cxmm/tibjGO1gsn63COmz7xoIGHfSct7AxR+h93GNLXx I4zX+C1d1hJsWRguPkeWzTOZF23tnFHwittsdo41n8txClDAGQQYWHSGvcQ8UsCGQFDESHVO6gHz X9jzcWCb8WJFOxYPBIciUrnOXfu5RfAgLzNdbZ9r8uh+anotNuLjWeeCucW21dYSLjmHVOWmInIu wq3WsqldaDf4+vvDX7x8GxlMuJxfu5arso08fLbJkCFt/BjbHU8oi9v51/Z27UzIKRfvhmETTA9E 23ou7nplFzz66nJMUsq49QW89dl55d1N//YbqYRNxKJ7EjA8eDTeWrcTWWcv4EYbu8+sjeEo58/i Sj9MSFqPGCWDydMRv91aoExZwPLvwEfN2mVMmY8Qr8F4bdUWHMtWHvO0XL6tvAuf+Uc16LdiSgji lm5HTl4+CgsLxWOtu/FaVC8sUs6XC1LwS1H7TxkufpetjCJ0kBLMUSeZRny6Qo1PiEdu7flIlGQl Y4oaFUjEo1Z6pTZtyDgmmp+IiuqnttVYZ359E7zDsXav6dHvpHFa0bmNAhCDzJWT1QBWfcm0tXkN +x7RYslH6TgvfoC7eP48/hUbKjPkbk+EsZlN+X38psMoEE2X1NRU4mJmCpTLKqm961Fz16lBkX7T 3sJ65YkS0abpog1ZRlYRwBFtJCuVZRP3vt/A3sJzkdR/urprtLGrcepSMSorK1F86RRWqk2eiECm 6MzHFMjMxz/Mguvx69NRUFmD48ePo6zgLNYvUM7/KXhhw1E1/TYx0sDPa2W5ZSBWKXtJ1mZjp0jS lBh8dPQsioW3Yd/vgok8AetSTeLK+qa/1o+tnM2LMd8spmg4tspQVlaGs4c3qec2Uzqmsb4jR6lv 9mVYXp/lHvxcnSeN7P7shMX7wtPfqG3DTh6tlc81LV3WvN1JmKI+GaXFyl2nZMvKymKc2rXS1GLT 2ulYYd6Og0XO+YYCFHB0AQYWHX0PMX8UqEdAExiu1kRMST1iamcx/wS2Ge8nomePlGtj3P+E8kjX Whw+Y7qQyk5X2leMxPD7WqE2Q8o2/K/ULtDmzdhs7bVlv3pxXk/R2+csUYVB7aJF3O3evP5LA5nU O+e6y0sXnKPU6hzRCO9jeuZPn/u1+jjh5NGGG7G6KdQzpZHbrSfFNjXL/65Banku/lSr1oEyRy9q XmkG4U87TAGFD2a9jLRLDQuBdAl9FskvDVNSE39P4d2EWIwdGY67A3vh2RffwoefZeDCVVvV4MxW dbJRhzl/VorHMzWhWHV4pSq4Ivo57K7THq4622LEN3wediUqAQJpViaS5k9BWP8g+Li7YOKM17Bh u2jHKr+N7UP/CHx2MV0NyK5dFI2QXj3h5+cnHmsdhyTjd2BkYgoKlk+wCKqVXj2nGpZX1vNZ0dyG YVp10Yafc0uOYa5ZL8yJe220fWlKulnG/KPikRJvfiwYkl15+B0MMsVVm2VbDpNIk79HpLaKj+KV yREIFD/ABQQGwle2ysPfF5tqWK1Mv4Q3p4WLedI3rxsCBk3AmrJM9RoMKXPwL7W2oC9mrk1Xg0NS 52mp4hSen5qEWUowSQS742v3NG4DNX//36HWmRQ1TzPWxKGfvzfc3Nzg7d8P89b829QeqNw5k7Ht RNHeo2i20zgsQfzMCPgaLxw0vsGY+fYHWLkgFgvEa/pdHZUF28bftPnwc3GBy01eYebRPfOSdwxE /IIFwmYBNmW+j8mhwfAW3oZ9PxZ/MWv7NO3Ez+Zrmo3bPrY2m0Wsl+y9aDy2NNBoNAgOn4bUi3vV 48csQXlUEzJUDWqv3feNWQ33EmTsUn/NkJeVO200S+B0RqrxXSQeVq75W7Ss+UhepB692HQqA/PG 9pMt3dy80W/sPBw4ulrNYcKf/gG2/KlycIQCTiXQbPelrVVq6de5GzduoLy8HNXV1eKXo5rW2jS3 Q4GbClRUVODy5cs3Xa7ZFhC9DEeKR+hWSL8EpuzCuZI4USsNyDtxUP1Fclykod07wyNdSfL0bYfO YKboOVgsiYM7jb+dSz36mmJGzZbFugmJzkemKFfWdeeKFiFxuDgV4WoEzdoynNaQ9sUarHSuSHTO I4IO+jK5Ro50syI1Ip+xYx3GzTFdEGrj5yDM7BjJPaIEpaPxqF3dQRtz1sjtNrhcTr5gJ7/uagmO nhWX2o/2Vt/XHukSOhv/fGk3nlp2SMw6hJgX/heZH81Gt9oL1nmvQeTCj3DwFxuR+NSr2FNr/p6t 70J6ScOYl9Yi6cXH0dPprhxqFUp562DnTylAuDdxmzGQn4ZxMe/jUuq8Wr2wK5k3/6vB2MWpODt8 DX47ao7FI4/SUinJSfJLGo9O/Ajvx0+28zFbaU3HHM5m59z0h6irF87jgnjM09ff/MBt6BeMN/z7 iLIbvyYbpKDPxRsPhak9TmvjdzU4gNSg9OtdyA0T4n4FNaoqL7sSc8P9613LqWc28XskckmS1baK 9bmH1B/OIHqenhVhxVD8qLMgZQFWRBsCkH9PU66thKgIfEud6vQaJ32HZmLUw4OhzVQOpFhkJk1o YKBaj8Nbtxh3UST2vmWt5qkvZr+1XnTsNkteTuqc6RVpn+srUWpcU/pe2JOVj8mDzMohOjiat3yN ugRHTALewWPx5vKxpgm1xtzEk0AxYlqyeNmKbds6tnQ54thS0otejeetBZgDorBydQy0c6Qt1Brc QvC4uPZfK137rz2Ii3+ZbHhiROm0USwem7gAhxNWIFPutDEeE+QnXAqRoTzNFDkVA43Xcy1ZVn1u OhYptxmJ6ZjWr+4vHN7i+mVTzBxMl4oq2ow/VyK+9xp6iq5FY+9b6Z7Nx8cHHh4e9q7K5SnQ7ALS DyGurq7y8dipUye4i+bAnGkwv8py6HxLAcSioiLodDoZWfpFR4LnQAFHEpACi507d27FLLnh/jGP A/IjBik4ImoihoZ6I/ML5SI0FiP7G7+d/e/DRFGRIU38ep3y4QEUxoXCNz8TW4xf+NETG96jr05q 68fssRxrBY5dn4k1MwdZm3WTab3Q0bnOozcpTwvNtnUl25jNZS5CiI+pLTLrSSzAh4vHmt0IiV/G 1e6gJ2KAWcDR+vpWpjZ0uwnm27WSThudVF5WoZbs3kA/ddzWyPAX38aLy4ZDDgMeSsDrG4fh3Rmi /cUqW2uYpgcNn4G/XXwGV8+fQeY3X2OfeOb+g62WYcY9y2KxZ+dLyNi9EL2d5urBVMa6Y7fm/Fk3 H6YpUfEfID4hxFA7SdS4+e2aSGyME+fRStMytsaCo+KwrWY28nNO4ViGCCLs2oUVyZY/4qQkTEHK lkScP7oY9fb7ZGsjDjQ9a0MctLNMtXMiYxMxd+rDuKurBy5k78Pfpi+Sg6yZa+dDuzYVey9tQZRF cLEhhSlDcXFDllOWyceayUGmgJR2CXa92ZrnLx22r1iuZMb4dxs+zZ2LCc6+w2uVSn3bxO8RH7U9 RTVFeaTs6lV1QvS4MNPTAupUw0hg5NOipcQV8rEmWnqxGAyd6ojHQKXDVAQVjZdbWHn4LTtqkJbh p3PKmmnY8c/N+Nl4WWfamAiKXPlSfau20KgRAahYEXuSPyYpmKJNgTZa1E4c9wgeHHYfBvaVame2 iZO5WnbTSCTil0xEV7P6fKZ5hjFxK4lv1y3CWoW39gLSe1HrMzf3PH7OuyyaWbiOgusFKLlSjKKf v1X3p7XVpGm2jq3KIvNja5jNY8vwyLMUbas9mH93rcA3uUkIFk09FJ48YDNkJaUAAEAASURBVPxB IwZxcXHoJgUWxX9ph3IxYXIwUHJabU4neuow1Llsa4Gymn+O0rZsxeb+PwKmSxtDwcThe8RsH7Tm LYB0z8bAYu3ji+9vpUBVVRX0ej2uiu8gT09PdO3aVa55fSvz1NBtO8W3iRRUlHA7dOggB22Uau0N LSSXo0BrCUjHqPRqzSEgdIRonyRJvsDZdeQ84kJ9sCfJ+A294HGEqJ9yX0ROFb+vpomLlLRtohfp ebj7uyPqhdG4h/o2ONuVpVduuuyZfNPv5BYLR66Ua+H4iZNm3UGaphGP99SdwylCQAQX1IfYi1tP JDp+E95PnGZZy6nkJP4pDiVpiKmn8wPDEo371+p2G5eUU66V9+1BNd/Bd/VQx22OuAVhwb738O7I F+RFtr46GlERuXhCRAFv2FzJfIYbugX1R6T0emIGXl9+AxdOfYW/Jsbgg0PG5U4tw5J/jce7U0PM V3Ta8Vtx/qwXS9QgSji1SW1PLXmO6C10dCWmBbqbPvv1JwD/4EGiN2HxmhaH5evFTXHmQax4aZyp 0wfxqOTvk6dg48x+9abk0DPzU0UHGKag4ur0i4iLCFCzHBoajgnTnhM9rj4pOkeQngUVbeAt3oay NYbaXu7epsc+Pd3r+cIpuaDeiNuslqRuVfTWGtdT1BpTJsTi6IFXYMqVMr3l/ualvo1otS0zZTtp iJ7wZ1w83rp5UbZ+q/82+nvE3ZTzqAeCTG9qj4kaJUqcL2VXJkriQtX30vXM5JVHEb02TA48SqtK NVjnhdcJ6dRO1eK9ebxyxRxTW4sWC5m9Sdl2BCXzpHyIGqzLTiHxTH+1g5pM8YOg9FKGyJhE/PFP ovO1QKUUyhwn/xv9KyS8MtOiCQRrJcr2ycLaWcaLmVoLZO9ehanj5qvXybVmN/6txbHV22Y6GtFb tLhqNwYLLReTnkJSrv0PfnMRk4ODcfqLbYaFRI/lA8Qj8iNErcYkcT5YkZKBJBFYrDyToR6HE0cG WSTYGmVF5gpMn2KxWStvUnDgTKGoJGHfZ8RKQg2apNy3tfa9W4Myx4XapYB0LEpPjklBRanCkhQD 69atm1MEF+u5mnKcfXnt2jUZWELmB99x9gtz4iAC/qGYLtqAkp6wSTnwHfLHeqg9wsWPud+shhlg +vVT6ikuD/hSaXwnBsMGNPyi0r3bQCTGJ8Kzq/nlrslDaqqg/2jp+TErg/hJX+qbU/o81x2sTau7 VLud4t0bUaLWaYq029I+xJH8OFEDpzk0RMPke2fBT3yBVZgl59HJF8H3DBbtTtV9dKXwP/vUC9To 4SFma9kzav927UnduZe9gcyvTDUGK6zF4a0UUBPyBL54KxWjX90qz31h+Lt44PRYNCAsWTc1t07o PSgSr3+Ug5HL5yJmmSE/W7d8iT+JwGKXums435RbcP68GZKm3zRkrt6lPgI3PSQJw4snoufNVrQ2 X7RhFRg6FstTyzDmjacxLsEQ9Ur++z6sEoHF1rl1s5axpk3LSf9QvdmXasebBxVNKfti8pvrEb8z CPJvbWuTcXzZZLmZjSC5KRDDktnnCoBBNr7/9DdMrU6IH3Nsfwx12P1atFlHH7E4XLAG4gGC1htK MjB3lPqAJZaIGqvlS409HotafXNXjcY2EWxqe0PLf4/oboh2UM3ChZaGpiiRto+fxTWXtJz+0gWc M1shc+cR5CaObXSN4eiYWPQ0xcXNUjaMlpZeQscH+srXWfIU735YLD7/U/Z/hu27dmJ30lq1qRxp flpygvxafbRA/DDtrGcEQ9kt/hWdt0h7re7Vi8VSMOsg3mJG7vaF6G98xF2ZoY2MRp9e3ujZ/Q50 Kz2MpLXKNbSyhP1/dTfqqY4uOgpSf0yunbT/QEwX14OZIgsrPv8Wyyf7YZ+xMz3px16p3Nrxkw1P NCXvw/mN01B5INWYSiyGhphOTq1VVlFdFrFD6/8mK73UEQO7SXcJHCjQfgWUSnTSI/pS7UXpqV2p 5qKjDw5/Fy+1qSi1pShFbRlUdPTDifm7NQL+GKlcXWR+jo8N940iK5EYHWpZV0ITEiE3NC61BnQo ZQfKTxovimLGoe/Nrr7MCqcJjMLiN6PMptgx2oo17ezIlZMs6oPuvZSspmH9p1mIutnj5rocrEpc hyJxneYZHI3fiMbn65z4xa/bv4yKuukFuLJl6e83/95tfJuIBxr7iF0jtmueh7Y8rju1Fb8xxAZF MUXgv2+nBhe3/4zXkbh9KxLkWobLsDDxZxvr3sDZrO/FzVcl3HzvQf/etrYh2mF8fiHGiMCiHFoU 9yN1jiEbW3D8ya1//myIyaC4d7Dyw2TMl0/RCZj10gUbq5Ug+9gZ0Y5aJdy7DcAgm7WORDuMLycg WgQW5a8IH+feh6VXL6keoWFB6njdET/cLf3GlWmYYwoBmX4UW/HRQSRNCLR6/ss/8aUahImeOMRm IHb/KhG0VXqLEZ/X9EtrGtjbb90cN26KDpvnDlV/7NGKjkFeGTsWul7rkWDsRCZlfhg2P1pmtY2z xm3TQdZqqe8Rs4jT7i9Fm4XW2liUCAouKocX+vTrbQroyTx54tiKVufLk0SN4VlJDyN1cYT89ub/ 6FGuXjfF4I31azDI7hOwBv0iJsivV978CwrzL+L0sTS8t2gWko2fjTkvpWBa6kyb4dOb59PxlrCb SS1CPlJWGNrNlCbFrt6LN34dBcvfWLPx49r+VmsTqsnYGmngsVVyzlTDsG5S4rtrYrSIDIsz+trj yHmtM3Yb92V0eJC8eMB9D4s7AbEIRKeNWa/A44jxBsHiaabWK2v0wrdEE0n96haFUyhAAasCSu1F qcKOFBNz9DYXW/eZTatk9U8sLS2VEaXILQcKUMC6wN0jJxpmZK7FnPnGR1ykzlhq12YTnRWMEY9G SENK0hwYK68gdly41ZsqQ6L813EENBi/0NR7XvKsxdgvepqsb8jeuhTzk5KQkJCERft+tF7jRvyy X89v5laSz8UXxp6iIxMfRqCVJRo0ye7tNihVp1jIds0nkf2iLPxh9KtqOYYlTkV/OwL/EF22zH4v GcOMKRxKThbN9tcddGc/wUgRfBg7djxGz/wHiuouYppSVWqqOVFSYf04Mi3tVGOOef70x7zkXfJN oYSZJhpJM/4MZGGry/4X+oeFISxsKLQT1qPe00Glee27ciffh6baNvmXpXpJtga9RRuJynlOI2ri xiurJP8VR6zC6ZCevEhZClEP3a2Om49IbT2OUHuWjcbei+thKwZlvl5zjuduTzR0fCAnGotk0TGI NGgGzcThJSL4YBym909ErvKmrfxtoe8R794DTZ+/TZ+Jru6sD8e2rDYLHJpC19LSGavmqu1txq7c BKXz9rSEEVhzzOpBZ2UjvhgQKYWHpCEZu74UHXnZGHQlJSgRL9EVmzroRdv0Uvv0pu8cN9GRUSDC x87ExuNnTZ+DtL04Y76imkI7HDFvAiFyNZbF1Q4qArrsw40LKgpO79vuFo8xG4a0RSk2P5MHt6yr F39A5DglFaxbs974HRGPB0R7i/LgOxBTjYfOtr+tU5uviR8z2PTjYEuX1exzlPL3z2z3+KzXycdu ic50pNZbeM6kQDsRkGJgUkBRiok5+uDwgUWpAUspWsvAoqMfSszfrRTwHfCQaDzccogWVxO+lpPE OzeESo9G1BoeGd7o0FCtlPi2pQW8Q5/ASuUeQ9RPGeEXh4w86xdi+cc2YOp0Y6BZZGzJsyOaJYCs yxE1fIwFnfjowJYucttL39sDpvpS5sXT4+zBjZgyYKzZDcsYJDwdar5Qw8Z7Ror29Z6rd1lNby0m KUucSsDf0s4r72r9vYoPEyepwclhwwa2jcegjaV02PNnwFisFz3O1jdogsLkNrjkZTLn473dOTYW z8eGl0aowcnIyPusfD/YWNUBJwc98ICaq4RRi2ErRpOz/W1jrU9p8QHorj5hF4jolcq3ZhpGzNtQ JygrtVcod7ohb2kBHtfW/UbN2f6aWQcysUgv2IYoufdVNXvWR/T52L7qNcTNiMOq7VlmQR/ri9c7 NX8/ZkUrZ2TU6Rgk/JV3TMEjceaetXR/vclxplHA/wH8SjlERC3DRav219lPJVmbMUsNKkdi3hOD VD5d9gYMVeaJTnzemDcNL69cr86fE5aIbOtf3eoyysiQiVOVUSwaYf14PyYC3F6id1upI4r5Wwzn gZKsNXD38oKXeIW9pjwGqyYlRkSdPiXCpb0bt9n1A5Z5Om1sXNzEqw/spmVDdCpvOYgnQd6eO8ty mj3vAsIxVzm2xGdyvpVjK2//KlEL2lgF0Uba3n2HGc//aUhKSpaX0iaONvux1xfDfhUjT09ZkWSs 0RyJEaFm1/xuLVxW88+R6JBs8YZjdUtTeAxx7l7ysevj9TJyanvXXYNTKNBuBKQYmBQLk2Jijj44 fGCRjz87+iHE/DmEgHdfSE9EmA9Pjexr/lYd9zc+GqFOELccjX6U1ZQIx1pNwB+xH3xktrW1GNrL Ha+t2Y7s3Dzk5eXg2P7teGPGYPQMm2WqSRGzCc+H167CapaMHaPn9+8yLh2DhwbXvdm2I6n2ueie LfifdeuwTnlt3Ih1y9/Cs6MDMfKpV9UAHtAff969HIM6NY6p96Ov4j01cmglDU1/zEoco85YFjMc o599CzsPZuH8+fPyK+OzjXi2lxa/MdyzyMvOfGKwuk6bGHHg82fghCRsMtwXWqfWDMILaoAMSBgX gsETX8OW1GPIycmRX/u3r8FEl54w6+sEc6eZAnPWE3bsqd7ax82CZWsR5hclAnQZyCssFD23FiI/ 9xg2vDYRIWYBt5j1zyDY7NnI8Bm/VWukIVm0MTtjDbLyCkWtmXwc2/IGepm1Vxi7Kc5iXUknL3Wp RfrQdkPOP9dg1apVdV5Lly7F5v2mOm852xYjen4S1iavxfxoLb6w8ePQzfdCCTbEmgLG2vi9VjoG CUZ8pimglbZI1JbLstly28032W6W8MaTb6xWS5s8fwTCZixF6rEsZGUdw/Y1C+Gjna5+x2rjf29q 81ifg8T+psDT+g/nQfr21QyKwa54JZK3AlMTdqvp1zfiPegprFav8QzH+xpxvOfm5oqmEFKxamEU wtQPeDTixogegMXg3bOvGjfMTBqFia9twLGcPPEZyUd2xnYsjDK2PyqW1T4+vFU7GpIz6Kj/aPri QdV7BUIeXYjtGVnIzs5GhnQ+9QpRO8NpXBF88cRvl6irpqjH1jFxbGVgy9IZ6DVivjrf5ojIp+jk 22KY/rDlj719I5RajcbFtGMRan4pKMrSsmUVn6ME0+do7awwRC1cg4ws6XOUhdQtqxDlFyYe1jYM 0atn1DnXWhSQbyjQTgWcISZmdonlmHuJNRUdc78wV44m4I2hE8XVhdrT3wKEh9j46dl3CKaKCyap WRZp0MaPMPt10zBN/Vc8N9Zctx/laqL1NYBvtpAy2ox5UJJ0xL/2OGuCJ6P41EeI7j9FrYGUNCda rUVYp3zRK3F+/bQ6bSc1bp8UYt82Y5RJtM05wMZhVicPZhMat12zBJx0tELN9yEsMzSAqE6pMzLm RexIegmhPZvyNa3BE2/tRurWsdhaZwOGCaGz38af/7NHbc/x1J53EStetoYX1x/E40GN2Om2EnSI 6S10/hRla/qxrsG0949iV3KYWS1WS7TweWuxXrSdpXRsmpmShCniZWuITzkrehB18n0oes9OPL8L h4PGGc+BaSJANxQ2b8VjN4nOaky1yWQb3wj86/Bq+A2dY6BKngOteNUetPEpWDmtX63JhdjyJ9Nj 0vLMTFEbsO7q6nqRS0ZimrHnavM2IqUFcq+WAQGmx7vVlW4ykr1FtNdn/C6HaEH5w0TrbR97D5qJ 9CV/x4hFaXKKc7QJGFm2HP00N9mAA89u0mdLeSb+JuXzHhSHzI9yoZ1i+DxlikfjR5k9Hq+uHrMa u9R2p/VITXpO/T6OTEzHTBXaDWMT1iMmyfB5zkwah6XRl/CK+qOf6UrAMou+iFt/FNkPh8HQ6Xca 5ojj3doQv2ulqdMg/ygkb4qF1vjkQkrSLNEMjrW1YrD2ZevHjrWlHXlaU44Lk7lGBJXXi8+WMTic tgLRQ01tLtZbflMi9S7mH/EbpK/MEs0oGK6nDMeW5Spa8Qh8ZprhM2s5R3mnwQOPiFrta5W8RWPk EPOooQhmB4arbatLa0XOHikHuZUUIFoFbemyeoeKz9GmbHEcGvKZtmIOrHJqE7FydiOe0DAVhmMU aLMCzhATc/gai2326GDBKNDMAkERI9UUIxPH1/OLn7eoFWX6iXPyuHq+xL06oo8xVW8fy7aD1I01 cMRTuWfq612rcfObJNCMebjJlm7hbHc16Nezez3dPZrl0LvfZKQWn8X6BerP6mZzjaOiB77VuzJR uW2e1R4o1X3Sy9PU3k7dVCynFJ7Ah8Yb2QVThtfzaLWnul73jpbBsUZtV03NeUc8blrzsD/GxLyE 9TsOIvdvr9YTVPRQEfy8LG3VGcpIp0H4045E5R1gWtU4rRumvivazEx+C2P6mxarPTZs0kvYevA0 Xn00qPasNvG+Rc6fQkY91uuc92x/PuqAeodi1eGVpsmmVY3T/DFzYyUyd62GqPxmc4iMSUT62WK8 OcFQm8nmgk4ywy1wrDgHnsemRNP3WZ2sy+fAU6hcM83qo9++4XHiR5oU0+PktRJYsDodR9+cYOU8 54WAvvVg10pHeturi+nc3n/8HFPzJeKHn/G2eqUW67l3VL48xfFkcabOxd+nKAEFYPXRBPSr53QQ 8ZsPoFaWwwos/8TWY/NWMu+Ak9TPlj3fX8ZyuHe7Xa2terPv3EGT30TBqV1YYPXDFYklHx1F2cY4 U22//HQsNLZBLAV73385wlJPE4ole03n5EXxH6uP4Xfsplxx9UTH2pdcvqFYfvwSUlZaP96jY5eI z3cB3hwbaLG9QdPW4OLRj2zkX4sFK1NwsWxjK3c2ZJHFZn1j73Hh7ql8Lnuii5m5FIy3td9j4jfh fMEp9fPk7WlaseHHlhsi5m3EWXHejqwjoEX8+nRkfPqBHBSUZtu6Bg8cNkatlYqYpzDAdLowpCp+ hBmvNO4ppkx9aIBhutm/LV9WYNC05biUmYLYuoUVOYnGkk3pKDi+2Oq1qllWOUoBCjiwgItoCLLG gfMnd6/t6urKHqEdeScxb6pARUUFzpw5gxEjRqjTOOJcAnl5eXKGAwICnCbjusI8nDmdg8sVHugh glfXbojKL3f2QWCgv8VtaHMUKC9VeURQi10Xj2JsQ9oTa44Nt3Aayn5v4c04ePJ6XL1wHrkXr0LU nxJVi/Vw8/JDUHAf9Oxya6o2OdPn0DF2rl48BnwW5364DHEagOhGEO6deiD47r4I8G29fah8nlpt /+kKkXPmNHKvAT26uuPatUr0EOfAkAafA3XIOXZErC/OoV0rcFH87X9fGAJ964nUOcYOd8hctPr+ byWFEvFdW1DmBh830SmQ3g09A/ytBJ1bITO6EuRdKoCbjw/0ZWXw9vOHt+bmx6pOPOZfICpFiiYX UVbmDr8A31bNv7MeF9J+L6n0EtdTlaIdS8m6ufexTpy3L0E0Miifs338b9FxJYrV8mUV28gXnyO9 aFPRrUxca3jD39+72a9VG7qH0tPT0bdvX3h41PnVtaFJcDkKtLhAdXW13MZily5dWnxbTdnAzb+F mpI616UABShAgRYX0PgGYFB4awRC9fh6xxZDeUTbUqFtJKjY4jvIaTbghm69Q+SX02SZGa0l4Ab/ wH7yq9aMtv1W44vgQeFofF1MDYJDI9T1B7VtLZaukQLe4rvW29ewsvFPI1Nq4moabwQEGqum+TY8 Jxpvf/WJeztWa2JmnX91eb+3aDE04pxtWdO0RTdXT+ItX1ZR+9JffI7kPPharUleT/Y4iwIUcGAB PgrtwDuHWaMABSjgUAL6s9hpaODJSjs9DpVTZoYCFKAABShAAQpQgAIUoAAFWkGANRZbAZmboAAF KNAWBHRnj+GMaM1Hq+2DuY/WbaenLZSRZaAABShAAQpQgAIUoAAFKECBhgswsNhwKy5JgZsKSD02 ubm5ibZrykQbNqIRGw4UaEMCmn7TkFozrQ2ViEWhAAUoQAEKUIACFGhvAtK9mnTP5gy97ba3fcPy OqcAH4V2zv3GXDuogNTRkNQAcEFBgYPmkNmiAAUoQAEKUIACFKAABSjQfgWkezXpnk26d+NAAQo0 XYCBxaYbMgUKqAIdOnSQaypeuXJFncYRClCAAhSgAAUoQAEKUIACFHAMAeleTXq6TLp340ABCjRd gJ+kphsyBQpYCHTu3BnXr1/H+fPnLabzDQUoQAEKUIACFKAABShAAQrcOgHpHk26V5Pu2ThQgAL/ n717gauiTP8A/lNRVMgLGhoqqWtgAalFQRe8hbm2YCv5F41USoqMwpKoJRKVYqlQSwzNDQttTbGi DdnMRE1pU9PMGxVmSqikqHhFPXrQ/zvnMmfOOXM43G/9Zj/IXN955zunPQ/PzPu+tSPAxGLtOLIU CsgC0tOvDh064MiRI0wuyiqcoQAFKEABClCAAhSgAAUo0HACUlJR+htN+luN/eE33H3gmZufAAdv aX73lFfUwAJSXx0uLi7QarU4ePAgpFftu3btCldXV7Rv376Ba8fTU4ACFKAABShAAQpQgAIU+HMI XLx4ESUlJbq/yc6dO4fOnTvr/lZj/4p/jvvPq6wfgRbiP7Tr9XOq6p3l7Nmzuk5V2f9B9fx4VMMI XLt2DRqNBtKXl/QZPn/+vG65vLwc16836v/kGgaMZ6UABShAAQpQgAIUoAAFKFCLAtKoz1IC0dHR ETfccAM6duyoe1tRWmZ+oRahWVSdCUh5BSmHIH12G/PENxYb891h3ZqsgPRFJX1hderUCU5OTrqk 4pUrVyD9HwMTi032trLiFKAABShAAQpQgAIUoEATEZASi9LfZdII0NLfZq1bt9b9MKnYRG4gq9lk BJhYbDK3ihVtagLG5KKDg4Pui0yZVGRysandTdaXAhSgAAUoQAEKUIACFGgqAlJSUZqMyUXpbzM2 f24qd4/1bGoCTCw2tTvG+jY5AekLjF9iTe62scIUoAAFKEABClCAAhSgAAUoQAEK2BHgqNB2gLiZ AhSgAAUoQAEKUIACFKAABShAAQpQgAIUsBZgYtHahGsoQAEKUIACFKAABShAAQpQgAIUoAAFKEAB OwJMLNoB4mYKUIACFKAABShAAQpQgAIUoAAFKEABClDAWoCJRWsTrqEABShAAQpQgAIUoAAFKEAB ClCAAhSgAAXsCDCxaAeImylAAQpQgAIUoAAFKEABClCAAhSgAAUoQAFrASYWrU24hgIUoAAFKEAB ClCAAhSgAAUoQAEKUIACFLAjwMSiHSBupgAFKEABClCAAhSgAAUoQAEKUIACFKAABawFmFi0NuEa ClCAAhSgAAUoQAEKUIACFKAABShAAQpQwI4AE4t2gLiZAhSgAAUoQAEKUIACFKAABShAAQpQgAIU sBZgYtHahGsoQAEKUIACFKAABShAAQpQgAIUoAAFKEABOwJMLNoB4mYKUIACFKAABShAAQpQgAIU oAAFKEABClDAWoCJRWsTrqEABShAAQpQgAIUoAAFKEABClCAAhSgAAXsCDCxaAeImylAAQpQgAIU oAAFKEABClCAAhSgAAUoQAFrASYWrU24hgIUoAAFKEABClCAAhSgAAUoQAEKUIACFLAjwMSiHSBu pgAFKEABClCAAhSgAAUoQAEKUIACFKAABawFmFi0NuEaClCAAhSgAAUoQAEKUIACFKAABShAAQpQ wI4AE4t2gLiZAhSgAAUoQAEKUIACFKAABShAAQpQgAIUsBZgYtHahGsoQAEKUIACFKAABShAAQpQ gAIUoAAFKEABOwJMLNoB4mYKUIACFKAABShAAQpQgAIUoAAFKEABClDAWoCJRWsTrqEABShAAQpQ gAIUoAAFKEABClCAAhSgAAXsCDCxaAeImylAAQpQgAIUoAAFKEABClCAAhSgAAUoQAFrASYWrU24 hgIUoAAFKEABClCAAhSgAAUoQAEKUIACFLAjwMSiHSBupgAFKEABClCAAhSgAAUoQAEKUIACFKAA BawFmFi0NuEaClCAAhSgAAUoQAEKUIACFKAABShAAQpQwI4AE4t2gLiZAhSgAAUoQAEKUIACFKAA BShAAQpQgAIUsBZgYtHahGsoQAEKUIACFKAABShAAQpQgAIUoAAFKEABOwJMLNoB4mYKUIACFKAA BShAAQpQgAIUoAAFKEABClDAWoCJRWsTrqEABShAAQpQgAIUoAAFKEABClCAAhSgAAXsCDCxaAeI mylAAQpQgAIUoAAFKEABClCAAhSgAAUoQAFrASYWrU24hgIUoAAFKEABClCAAhSgAAUoQAEKUIAC FLAjwMSiHSBupgAFKEABClCAAhSgAAUoQAEKUIACFKAABawFmFi0NuEaClCAAhSgAAUoQAEKUIAC FKAABShAAQpQwI4AE4t2gLiZAhSgAAUoQAEKUIACFKAABShAAQpQgAIUsBZgYtHahGsoQAEKUIAC FKAABShAAQpQgAIUoAAFKEABOwJMLNoB4mYKUIACFKAABShAAQpQgAIUoAAFKEABClDAWoCJRWsT rqEABShAAQpQgAIUoAAFKEABClCAAhSgAAXsCDCxaAeImylAAQpQgAIUoAAFKEABClCAAhSgAAUo QAFrASYWrU24hgIUoAAFKEABClCAAhSgAAUoQAEKUIACFLAjwMSiHSBupgAFKEABClCAAhSgAAUo QAEKUIACFKAABawFmFi0NuEaClCAAhSgAAUoQAEKUIACFKAABShAAQpQwI4AE4t2gLiZAhSgAAUo QAEKUIACFKAABShAAQpQgAIUsBZgYtHahGsoQAEKUIACFKAABShAAQpQgAIUoAAFKEABOwJMLNoB 4mYKUIACFKAABShAAQpQgAIUoAAFKEABClDAWoCJRWsTrqEABShAAQpQgAIUoAAFKEABClCAAhSg AAXsCDCxaAeImylAAQpQgAIUoAAFKEABClCAAhSgAAUoQAFrASYWrU24hgIUoAAFKEABClCAAhSg AAUoQAEKUIACFLAjwMSiHSBupgAFKEABClCAAhSgAAUoQAEKUIACFKAABawFmFi0NuEaClCAAhSg AAUoQAEKUIACFKAABShAAQpQwI4AE4t2gLiZAhSgAAUoQAEKUIACFKAABShAAQpQgAIUsBZgYtHa hGsoQAEKUIACFKAABShAAQpQgAIUoAAFKEABOwJMLNoB4mYKUIACFKAABShAAQpQgAIUoAAFKEAB ClDAWoCJRWsTrqEABShAAQpQgAIUoAAFKEABClCAAhSgAAXsCDCxaAeImylAAQpQgAIUoAAFKEAB ClCAAhSgAAUoQAFrASYWrU24hgIUoAAFKEABClCAAhSgAAUoQAEKUIACFLAjwMSiHSBupgAFKEAB ClCAAhSgAAUoQAEKUIACFKAABawFmFi0NuEaClCAAhSgAAUoQAEKUIACFKAABShAAQpQwI4AE4t2 gLiZAhSgAAUoQAEKUIACFKAABShAAQpQgAIUsBZgYtHahGsoQAEKUIACFKAABShAgT+LgFYDjUb7 Z7laXicFKEABClCgVgUcarU0FtYkBa5dPIs/ik/gvFaL1uIKrrftjJt6dYNTq9q4HC3OlRzHidLz uNpaKh3o3LU7unV0qo3CWQYFKEABClCAAs1GgDFDy2tHkTl/GQ5cvoSeQ5/FxHtcm83dbawXojmU g5F3hWOfqGBQyjpkPD6osVaV9aIABShAAQo0SgEmFuv0tmjwvzci8fBX5zHY5brVmUpLS+Hi0hve gX/DmKARGOTeyWof44ryws/xgO98wHsf7nryf0gJ8zRuUv3d6uoB/HN8BNacEvs/uw0pY/9itZ+2 ZC8+WjgXse/mWG0TJ8Izb81AVPgIdGt5TWW7vVUa/Jz7b7z1+stYLUVqFpN38HN4Je55POjR0WIL FylAAQpQgAIU+HMJMGYw3u8WmlJ8mTQXq8WKwd3DajWx2OLY1wjx/ieuD3Yxnk7+3aJFKU6d6oLe 3j4Y9fAYBD4wCF2qFf/JRTaZmcJvPtUlFaUK58SuxIHHfNGvdXmTqT8rSgEKUIACFGhogRYXL160 zng1dK0U5z979ixatWqFli2bYqvtMqx4/GY8J0WHlZi8pyxA+szH0K+9dTBz9cBHuMn/BbmUtC3F CL2ljbxsOdPq0l5M6jVMF5gGpXwnnr56mO1yeutC3BKUYLZOfWECvjzwLu7uVPmPifS0fdGUAYiv xHWHvvU15j9xB5jhVtfnWgpQgAIUoEBzFmDMYH53W2n34pnuw7BCrFaL38z3rtrS1Z9FLBlgiiUr PnoI3lydiin39Kh4t2aw9cSaBNw6caH+Srzn4LfNT6Djteo8VG8GGLwEClCAAhRoVALXxPdReXk5 OnZs3C9kMZ9Txx8bR0X5oVEvomdbkaC7JFa2Ay6XHsGmDzPlp6T7ljwH/yWf4uMfV+HBXhW3Q466 Jxl+JxLRu4V1ElJ3StHq2FlxbuVsi5PfiDcklUnFYLyZ/jju83FHG+1p7F3/OaYkGAIsEdo+9Pdb kL/5eXSrVJClxbaUMLOkYtCzKQj/+33o3aklzv6+F/9JfRILNulrlPnSg+h32694wb+zsoqcpwAF KEABClCg2QswZqjXW6zvkUZ/Su8JiBnppjj9JRTv2IwVm4zNTDbh5eAB+O+ML7Bi2n1QxrOKg5rF 7I2jXsamL0bizFWg2+33MqnYLO4qL4ICFKAABepTgInF+tIO/hfmzQ6xCsxavvlPbF+9ECOnzDXU ZBMeHfQKtv4xx04zjAUIf2sEvnn53ipfwW9fZ8jJTAQvQP7SMEXSsDf6eg7C2EfH4Ol+I3RPzLEv EZ/tfgrP+LS1e65W2p+xMMUYlAJvrt2PKXcqmtz07ocBQ8bgkeVRGDotU1deUsoXeOJzPh22i8sd KEABClCAAs1IgDFDw93Mt9NTMbFfC6sKJBd9jyUzH8JrhlYnm197GNP77ETaaHerfZvPCid43Xdf 87kcXgkFKEABClCgngWYWKwv8HMaXBbNuR0t3vq71rIj7nw4DsfvuAcRg8bqmi4DS/D6J5HIeLRv hbXblzIaC0ccwjN33FDhfuYby7BrnbFPRW98nPKoIqlo2vNqp0F45YNQrHhCn/zL3fG7SCxW3K+j dPTlwl2GaxC9NMZmmycVTcVjwKMvYIpILC6R1m1ajYMXn8SgttbNTq5dPI49P+7GkdNXdEe3ce4G rzsGokcH5WN3U8HnSo7ivHjijHad0cOlPa6dO4o9e38Vx18A2nTDvcO8oS0phbSLg/ONYhAZ9ebk La+cxeET4hgxnE3XHq5WCeGq1UuL0qPHcU6UdmP3HmJQHC3+KNiLgt9P4MKVK3C97X7c3VfZv2YZ igry8cvvJRCb0ca5M9x734r+vRUJWlEWJwpQgAIUoEBTFqjdmEGLEwf34sefjsIQMcD1Fh8M8LzJ 6jvc0kz6Tv85/wCOni4T37vSF29n9PPyQf8eHSx3FctV/U4HWoryd/74sz4WESVI3+t9b/NBP1e1 8q1PaYxlSkQscwVt4Nq7PwZ4u9u9LuuSTGuuXL0sFkTzGYvJ2f1uTPvwKHzniz7CX9PHi5lPpOC5 Pxaiv2q/g1qU/PYzfvrtdxHT6Avr3PMWeN9+Kzqq9tFo7Sfdt/wDR8XxbdC5580YKOJN5QCCpYW/ 4Of9RThtuDfevnejt4t6HKivgajT7z/j14I/9MeIlRXXSSPitJO6BkVtO9+ELu2N3S9Z1hViP1GX fGNdnHGz5wD43Fxxq5uLpYXI/3k/jutiWXGN3W5Gf69bxXms416L28FFClCAAhSgQJMQYGKxHm+T g0VSUXnqVr2GYtHXiVj9oL6Jck70RzgwIRH9VJo6ewcPwb7V+rbECQ++goDDC+HTzkaTaOVJxHzL llpopAyXbuoCp7bSR0BKs1lPPf6aiK1b9X3x3OBWcZJTPvqqIaoUK1zaWgesxv3KW/TDy7u34kmp WbiDC3q3tayDBj98koSRU41Nso1H6n8/Pv+/eD3MzyKoLkPWuAF4cZ/YZ0gSPo+4iDETkxQHDsFX G8bgr8Of16+b8imOvTlUtX/HvR8+jCHxUkFA4sYjirc1q16v8sOr4THoSV1Z8Zmfo+XCMXjN0BRc WumdtAnfROoTi0e+y8SM0VFyclZ3kPGfIc/hi7dfxn3u5m+OXj9XiE2b9+GCcx8EDPdhEx6jF39T gAIUoEDjFqilmEF74nskPf2Q3M2K2UV7T8EXK5Jw303WIW/La8dF9yyJeOJ1/UNUs+PEgveEJKS/ +YxZ39dV+U4HNNj7yTwMm2pslWJ+Bu8pc5AePwX9OqjHcE43XBCxUIJ6LOT9HNZ9MguDbqx8H9jm Z69oyREBL8xF0uYcxOvilRVYsv4VpPz1JrODKnQXgwAmfr4UzwTcbHaM0u/N1WvR6uOReFHqUNJs Csan+zLwQJdfMe8pf/ntSeUuj8//Gslh1n10n9z9OWZPexIr9CGc8hAxL+qUKer0gHmdWl/+CU8O GAHpUr2TvhMxmb5fcrO6rs1D51VT8dQS64KlPtKXJ4ehh0UitdXFQqx6axYiVQdJBJ55JwcvP+YP J7NaanF417fYc6gMbv4PYNBN5jGf2a5coAAFKEABCjQSAeMjuUZSnT93Ndr7hmLOEKPBAmz5TXqa bD1NTfgXPn3O27BhBYa99IUIXSs3XbvWEf0HDzbsvAkPP/c+Cq+q9+d4rU0X9OvXT/fTTX56W/F5 2t/UH8ZL2PzaCCzZctTmAS499GX3E2/imYf7Zfh69kj1QNpQ2ofT/oYeL+egzKL0Dn0MKzbFWyQV 9esd+gci1njMkjU4oHLtLVseRY4hqQhMwfD+xpCvevW6prlgPCOSQs2TitIGlzb6qz+/cyEGWiQV vb2N91nsuGkBHr5jKr4/00Iur2XL40gd7Yux4eEIHzsEjy/ZI2/jDAUoQAEKUKAxC9RGzKAp/Bzd b7WRVJQuft8SPOzTHZ//ahkpleHTaV42k4q6Q1fEw9/9bRxXDCBY2e90iAhFimVsJRX1VXsR/n1f xC8X1eOwzKcftB0L7VuAEbfOwoHr6sdK5ddkunatCx6NT5SL+DBzi1nMpfnVjrvodCdhzJ0If+9H 8Y6naVL6vRysllSU9l2Nsd4hmDRePako7fHhtAeRsvW0NCtPV37NRP8HbCUVpd1EnULvRLLFcdcc HOBmKKW3oiGLWV1HBqgmFXWlij7SB0z7yiwWb9nyFBY+5GueVBQxnSKqw8LngzBR+Cin8zsXYFDg WEx+cjJG+IThx8sVvZmpPJLzFKAABShAgYYTYGKx4eytziwFcYMfCTKtt3yJz7DlQrkLHohfgAnG PVeEI2l9sXHJ7u9bhwea9ln9InxvCkDyB2uw97dilKk/NDftb2eu3KU/xAuV8iR1/D308TeR8798 HC29KK+vaOZ0XioeXWB8IuyNN7N24Pfjx3H8+O/YkfWmKShbEo5/bT1fUVG6tw2+/F40OxZNi3f/ 9CEGtumOv6cYjZdgwy+WqUnRyOm3b5FiKNU7Yazc9Kf26iWemH+0Frv378dPu3fjw7BbxZukp/BZ kv5tVenUMYvW4jfRZPubb77BHwd3YPGzxmTwaryUabQBWl0shnhZUZ425+w1C/zlDZyhAAUoQAEK NDKBmsYM0oPAd3z1LQKkS5PeHNsqmsweO3YMRfu3Ys4UUxrnyScXmyUIrx7IwlPym3ITkLHpR12s cfLkMfzy3acwHZqIj787VYGc9Xe6tLN5zCDeTpO+14tLcPLYUezb9LGi/CW4P2WzWfLN/GQiDlqZ Jx+7e+3b8gNcYAEWrz1ivnstLnW6PQDBcnmmxGyrVoV44x6TO4YkYN3eQhw7eRIlRfn4z1uPy0fl vCr66/7ZRkAr7SXevPxip3TsMfy2XbjLR26CvnHOBOH/i67sP8Q9XWC6MZib8pUi5inDZ/+Iko8O fe3f2CF9FlTqNPcfH5l9FuSD7M6Iz0nuPhw9Jq6zuABrFz1jOmLFo/jysCmIPrs7E/Iz6iGx+FL4 nBQx3Tcnj2LX+jT5Hm5+9XV8f8GUPCwWcaFp2oSdh+RmRqbVnKMABShAAQo0MgEmFhvZDbmx7wC5 RkeKz8jzZjOiX5xyBx+8teFNefXC0OdEsGJ6k03eoDLT1kc0C5phTFRJO+zD3JcmYpjf7bi5W1eE P/sGMtftEInACgJBlXKlVVJydOI7H8sBk7Ru32oxKvTDQzDAwx1dhz6O5IWf4HvR740pRJX20k9S gm3VDFOTofd3rMeUwb1FXzut0KqVE3oPnoJ1eW8bd0dSymc4pXiTQN4gZga/+AVyF0SK/gtFfzld uqGHoS+j/qMelXdblbXTKpj/ae0aefvUUfr7UXv1GiKa92zCM6PuFH1AusC1Rw90bHMNLcrP4/dN xtMmIfr/7pT7JmrdoTfGzZyHt6IeR5T4GadoCl3evi/CTFE/QiffZ9Gkxlgmf1OAAhSgAAUal0BN Y4azO1bJDwIx5WOsfXMC+on+lR3EG2jtXfrhCTE43ALjd6RuILqzMsA1x16IeeYZPCN+3t8yB0Fe vXSxhuifBV09huKtj96X9837uUSeN59R/06XWhMsU8Qy8Z//jETpe72NCLsdHNHd60HMWbPRlLRb kI6ftepvHqZt+RpTAkV/hYZje9w5EctF1znG6bc/Thlna/339Tau8DfmZg8V4cw1/Z8NZ/73uUhp GqbgOSj4/HnRZNdZ1/qkZftuuF/0yfjDElPS7YWFaxUJQOOB0u8JWPfV66KLF+lYB3TsI9x/zFDs IHx/eRcPenTVld1a3NPH3khXJB8Vu4rZnn+LwTMx4p7Gf4R/Rj0k+mEUnwWxXl+nZHxsTEru+xHF Nt4SNS9RuTQEXxx4D0EDu8NRFNpStOq58/8S8c3rxofVov/FC9fkA84fOSbPx8+Kwd3CRz85oueA UKSufBOPR0WJn0B0UDSh7iuaP5umKbivn/E401rOUYACFKAABRqbABOLjeyOOHftKtdo+6/H5Xm1 mXa3T8GXcoJwE8ZGfmgzyWZ+vCPum5aF3avfNgW1ih1yVs5B1IS/ikTgTQifvxbHDYGkYpcKZ1v1 ehD/KdqK1GdNwZZ8wL7VmJswFQ/d54MeXZ9DTv5JeZM0c714i/yEd/CMdRjT2zrQbn2reGJsfF1z 0yYUqQaHwZjxvHr/iS3c/LDA8FblvgVfmDWHlt5++O+rOfo6eSdgqKe+b5vaqtfg12djaPfrZtes W9BqYXqfcys27jf98SNtL2/RG0/MTsFs8fPMqL/oDpH+kZq2j13yG3b8sEP85GN+sx61Ub5szlCA AhSgQDMRqH7MoMUPq78wKIikz4y/WfS7rP+ODEtIk6WkgeiMk2OvoYhLTESi+Blzi6Nxtfy7ZW8f uWVIB6g/uLX1nX69eDte22coKngBngq4US7XOFPezgcpmz5Fxscf4+NPX4SHg+ltN+M+CP4Xgm5R tM01bHBSvEkotVQ4a+MBq1xONWeuXXPGjX0MB+/7BSVXpJhM9DW91ugOvB0fhi4qfYj3GROJ54zn XfEZ9qs06R38eqQYuM/8IXbL7v1kdwwZi7u6msdM5S1ugp8xWWwsX/fbCQFPxCExTtzTF0ap9Dft AJ+7vOQjHK6bkoDyygpmBr/+Ku7rZF5XaXevQFMicOfOIrkE7VWpE3H9tHtDHk5ZxNI9AqcgZfZs 8TMV/dub7n3rWyfi4E9STLcD+UXJcqsZY1n8TQEKUIACFGiMAtKDPE6NSODyRdPgJ943u9it2T3R 8xD7mq/+if2mF5HwUQDSwkTiyTr2sSqrxz0T8eHJCSgtPIB9u7ZjQ+56vLvSkFQz7J3zWhhyPk/A 7g3PW3VKbVWgYkV5+354dFYGxr90Cgfy9+L7bzdg/RcLsdoYaOv2XYHwISsQI57kxxmC7iunT8ul bP48G5/3K4RheEd5vRgQUYz0bFq0FRzaWi8l4wLFGwrYJA0MIzWHno3+PvoEorIZdNBTQfKI2bVV rw6O1n8gSFdS3ro3Rk0RtVkiLa1G+L2r4R08BeMeGApfEQh79umpf1tB2mwxSSOL9765o8VaLlKA AhSgAAWahkD1YgYN/ig0BhWbsPY/n6LEyTJZ1AatTu+QETpIAYTlVF6Go4cP48SJUzgjRoU+XXYa F0ov4MKJX6AINSyP0i3b+k5XxgxBI/xstiTo6jVUvCmpWrRuZdAIb9Vjr7dxwUBvES1Ily8Glq5o cEDbpdvf0rLlZZyTW+L2RmdHyVercJ+Agb2l+MmUGDOWeu1aD4wXXc8siJXiSvFGokoiT9WvhSmA DQryUb1+4zls/b5YehQHfz+Ks2cv4qK4n6fLxP28cB4F/823dYjd9R0cnVT3UfYfWXbF5HDz3dIT 7A91x+S89n/Iec0bj78YiiH+vvC+zRM9RSsaW3+EdXDtLd1WThSgAAUoQIEmI2DrO63JXEBzq+gf +/LkS7rlFusn3PJGw0x5i954ccf7SDH0MZQ5zQ+Bg09hbM/WuGC5s+qyA1x698dg6efvEzFrfhmO /bIdi0Xfggs2GQ4QzYf+mfV3pI11Vy2hopUt23eBx11DdT+PvZAIKdj74cvFGPO8abTnuWPmYMwf c/RPZU3dzIg21Asg+q62M63G94UX4HNrOzv7mW92u2+MeFtTJDrFaqk59FM+9+oCPFMzaG+EPygS tDA8Ka/zejnggZlbMeOA6Kjc4L5v9RLRjFyXadRVfvD4GfhHvGjazRECzW8mlyhAAQpQoFkIVC1m gNkbigufF0/n7Ew5OT+g7HEPOVlVuHkJwkNeFh3C1PKkiBkCBvWqfuFqfcaI0q5d64Re0puEUsXl xF/1T2PryBZXiiEahuinYA/c2EKfOJPf7wy+F33V3rQ0HOLQxpiMW4FdR+fBp58CxtZJzdarJILN tpsvtDp3AOmvv4TYDzabb2iApevdg/BDZjzuDE0ynH0fPpwjfuS6DEH8klfw1MN3yp9HeRNnKEAB ClCAAk1MgInFRnXDyrBri/RkVz9dMT20Na5S/d2q9xhsm58Lv2mZuu1PDpqPu4sehKvq3nZWin4M u4sn6DM/O4rA+ZF4+DV9fTJX/A//HNdbpWmJnfIsNrd36YGAxxJxPHA4xnmPhT5eXYL/HZiF/pbJ Qe9gPH5XV4sSzBcvnXBC/05VDVTFC51tfTBZ/A0i5e10zaFfCcBtjkWmZtDBkVbNb+Qz11G9pDc2 pgn30ds34av165A750ODj/7Mm1e+Bunn7bzDmGhpJVeOMxSgAAUoQIHmIVBxzGB+jUHjn8CN7QwP A8036ZYuXTqBdnf0lZORJ9YnwDfU9JBT2sl7SDB63+SEG7v0RJdL32NOLSSozp29IErurKtDU/vn cuEu3QNYm/UWrzNeFs2wnVSaQpsf4y3edqzb3pdaXS/EP/v6m/rclCogRmEO6i366b7xRvR0c8GO pLlmcZV5HWt/6eYHXsCJ/cHYsP5rrP1vLj7IUSY8NyFpivjJ/Rd+Sxtb4/i69mvPEilAAQpQgAKV F2BisfJWdb7ndbMRCqUOm9Wbl6hV5JaJiZiTlYkXdZm6RDw364iNHoHK8Nveg7jUQguHzp7o36O9 WnFinSMGR8UgWCQWpbf6KtvU5uLRAyg4fVkc0B4e3n1tPoVt1X0oUlKDcHe0KZEqnQZXTU3Bg55L RMojNXjSryvQ1j8O8At7U7Q9flnsICU234CP8/dyQPrMY4Hmda+3ejmiz10PYqr0849knCs9jkN7 v0X6zCis2Ke/lhdeXYOQz0LM62frMrmeAhSgAAUo0EgFahIztGyphUZ+W28C/rFgLvob3qizd7nS gGz/XWhKKj4+/7/4x//dgy5iMDXj1KrVARz9wB8rjCuq8lvxYDhv11G84N8UE4tlWJ30gnzVoX/T Dw5n5r5pq+jn+ll0aWtykw8QTaZPHf7DsNgHN3eV3j7Uv/Fo2qf25i7sXS/HcLqRppdNE4PCdDI7 wR9/OQKfJ/QP4c021OFCCzHgzAP/J/08gzeunMXxIwfxv+x0PP26oR4rnkL2tGBMrPLbnHVYaRZN AQpQgAIUqKJA3T4+rGJlmvvu2go61251fi/+4W8K4AanTKxSh83SyIpPLf5UHo158wcfqD6VvXYo B37DhmHo0BG4P2xVhR1+t9ReMrWwOadBRfXX3zsNNrzqjxFDh4qfu7H0FynBaHu6KP9BYNqn/U39 5WvI+Xi97cFotBqUlZWhTFP9INXZZ4jcsfh/N32HbZtzDRUJxpj73EyVEnP1US+tRgON+DH11+OA DuINzwFDQrEwbwdijTXatBEHbYweadyFvylAAQpQgAKNW6BmMYPUX3L/wYMNl7gCG348Y/NyNVK8 IH6MLYtblCma+A5ZgFlhfmZJRamgqwd+qF5SURzbvpenHMtsfvUzFLZqpVq3X0Tf0wnJyUh++5Mq D5SnWmAtriz4dBae0j1ZlgoNRkSQ1D2MfkAck/tqfLW9RLfe8p9Wl37GojnGN/Scgao3LrEsssLl IkVXQm8uesUqqQgxLvUP6+oxqSgG5ZNiOo0pqBMjSXfETX0HYezzafg5M0a+nq3biuR5zlCAAhSg AAWaogATi/V11zo4oq1qUxEtCrd8hL/3GSbemzNOwZg9foBxodK/r3QdivcyxaAkFUytew4wjba3 70V8sOmI6t7S0/zMmQ/JycnBgwdUopmGI279W6hcXkL8v1B4VT2YvvhTJoYaR18W4bdPL3031Vc7 DUSYcbQ/MRjNG6t+lsszzkhJ2Je798DNN9+Mm3u8jsLr6ucw7m/rd3mLfnjkdf0fJZtffRgPGpqS 47nJ8LEYpbCu63X1wEfo3qMHeoifwDe3W1X5+nURkYuO2nWT9y1wbWNq7nU2/2u8ERuL2Dc+wC/n TOutCuEKClCAAhSgQKMRqHnM4P23MfLVJDz4Ovaet44HCj6NRQ8pXhA/r35leIPOobWpu5hN+3HC Io5odbUQC16Mksuu6sxV5wF4fILxqAWYPm+znNQ0rm1x7Gs8PSUBC+fOxdykHTjfooVxU738btNa P2id5cmui34KP54VgvueNvUGGJQaZzZ6s9dDplhv7pgEfH/CvO4tW57Fmreek5tReydMgk8FfTFa 1qE6y+3amPol/73whFURxev/hfBqvX5qVVQlVpQh68nuupiuR/dH8M3JivuK7PkXF7nMltdOYf0H yYiNisWS3AOKh83yLpyhAAUoQAEKNDoBNoWur1uyejkWfnAGHa4bEj9t2qDFySPI+2KuxUjJ3kjb nAafdtV7E+/GB+KRMWGhzeCpvHV/RIpR+lboRukDksbcji+CY/FiRBC8e+o72T71ax7eHf+CHBBK RE+E3F4pqf5/jRDPtTP1x25KhO9NWYh562UEDbkNNzhcR8vLJfj284WInqNoAj3lOQxwNrYbckLw S2+Lzg/1b29++PR9+G1fKmZMuBPthN3pg//DnEkvywnPoNQJ6F3Jpk9qF+Dzt4nAq8Yn6vo93hzn pzJSX93Wq33Xvrq8odTaeV/KKIRfX4yYCQFw79QKpYd+wLLXHsUCQ1No71H3yKNV6/oUGvKonJT+ UOOJkzPvU7tUrqMABShAAQo0KoGaxgyOHqOxIPgFPKd7s24JhvU5gLdXzsTwW7tAc6YQmz6Zi9h3 jd/xwZg0pKe4/nKUt+4DP/EQc4nuuAXwHQt8PGMC+jq3xMXCLXjbIgaqOpojHpqeBqzQJyc3v/Yw euxKwKfTHkBXhys4vusrhD4/Vy42KGVw8LZOAABAAElEQVQK+tUglpELqsLM+n8vxpVextcI26BN mys4ujdP9CupiM+k8qZkYP5j/aVXFeXS29wiRnsOjjK4r8BDt+5F4kdvYHifTii/XIRPpZhF1zWP dIg3Zk2+W/yu2wefPe/0FefQJ0MXThQx6zuZePSe3mijPYWtK0Tc+a7FdUlVq7PJCb0GGYft3oSx /cOQ9lkshnr3QOvLJ/Dj2mUIfcnYFN8b9/STEot6n6NfvyG26a8DmR/iL7+cwtCudWtXZwwsmAIU oAAF/jQCTCzW8a02NruBSIUlvSRHWepnFQm+dW/9A4NurEkA4YiH39qICSuG2WzCc/uUufjXzhw8 ZXhyu291CsLFj60pJnMPgnpZvwWgtv9V50FYuOFtrB5ubNa9D3NfmghT+GxxlHcstr7+gOjR0ZRI bX3rRGxd8iv8p+iDrs3vRmPEuxbHSYveCUgaL4JdmIJdkzegbSG9kGsqVzrEcmpx82Akidgvfp9x Syz+6iUSrIoA2ril2vUy5kyNBan8vtrpPiz54HH4PaEPJnPmRCJnjsqO4n3Tt6PuFRsMhZafh1kj pMLjorEP2P+iGh3XUYACFKBAoxKoacwgNYd+LHUj9h8aZnj4tgkvjB+ueo0xn7+leGjriKBXROJv tT7xh00L8Kj4qdRUie90qZyWfUKxJ7MYtxtHBV6diLHix2oKXoC5UxSJO1H+BaudrFeYxTtSVzsq cYv1UaY1Oe++CnuptpglGxH7sA8crMp2wmNp36Lo0P1I0cVP+5AwMQgJpuLlubfXZmFoR0Vca8+v EtevvHbjiVr2CRIP1qPkB+sLnxfdyBg3qvw2ixFtndNeXVXKNa7yj3gPUxLvNzz4XY2oR3RZbONm +Xfo/MVmicNLpSfkbdLM4TOi7/GuxgSw2SYuUIACFKAABRqNgJR54VSHAo7O9goXI9Y9MQMf5/6I Yx++bDOpeP26qRmFS7uKb1t5Ox+8tUEMTGKcHI0z+t9Sf4whC45ha9bbCBZJNVvT4PEz8OXOI4h7 wLy/QVv7G9e3u32iGAXvW6Q+G2RcpfJ7COKXrMVvm+PQr7V18q/fw4n47buPMWWIyqHinchE3bHP o0dLU1IR4j1D94HGc7qiXSvlNrVypDi8C4JfNjUfD0oZgx5WAbTp2OrUq2XnbnJfSzd2UW96JJ3h L6NT8MumDDynelO88cxbmcgvTsMg+e1OkTZ1uBVTXzdeM/Dms0OZVDTdLs5RgAIUoEAjF6hpzFB+ gw9mby7AqrceV73SoCdeF7FMIeICTE1lpR3b3BKK37d/qvqdG/riB9h9cCtiDTGSUxvTw9XKfqdL 53ATowIf2fkFYlW/14eIWGYjfv9wAroo44627dBbOlhMyvPq15j+leNLtxtUEn+m/ZRzylhSuV45 7z1kAuLF2347Dp5AnJRUVG5UzJe374+4zb8h5x1TDKXYjMHCfeNPxzDxTlMzX2m7XT8H0/XLQ3gr CxY16uJquDGimyHT5ITRaTbq4z0B72/+RSR6Ywy7O8PBQREjKs1vqNq9bunYWe6pRhnjST4pxfn4 6K1n5O2muopn4+Jlgo83/YK0ME/lavzlwXAR5Rqm4Dl40EN5jcYN/E0BClCAAhRoXAItLl68qHiM 2LgqJ9Xm7NmzaCU6vW5ZwcAnja/WTalGWpQeLcTvR0txUerf58oVtG7fFTf37YNuHU3JzOpe0bWL p1B4sAinzl4UUbxUfBt06eGOPr27qceLKicqO3UcZ8rbwbnVJVyGM7p0cbIZ6KocXmer6rJeV4Tb 6fNAW5GHvHzZAZ26day0V51dMAumAAUoQAEK1KFAjWMGTRlKTp5BK2dnaC+LiKFTVzg5mhJFtqpe dvY4LmjbithCi7bOXcQxtvas/nrpHGc0rUUscxWXxbm6iO91W0m76p+lgY4sF+7H9O7lFy6gVecb 0aV9zWPIal+NqM/xkxdEDCXuqLadiBvbV7uoWjlQDDh46pQYXEgf1AE3dG5Yn1q5KBZCAQpQgAL1 IXBNPHwsLy9Hx44d6+N01T4HE4vVpuOBFKAABShAAQpQgAIUoAAFKEABClCAAhSofYGmklisuE1t 7buwRApQgAIUoAAFKEABClCAAhSgAAUoQAEKUKAZCDCx2AxuIi+BAhSgAAUoQAEKUIACFKAABShA AQpQgAL1LcDEYn2L83wUoAAFKEABClCAAhSgAAUoQAEKUIACFGgGAkwsNoObyEugAAUoQAEKUIAC FKAABShAAQpQgAIUoEB9CzCxWN/iPB8FKEABClCAAhSgAAUoQAEKUIACFKAABZqBABOLzeAm8hIo QAEKUIACFKAABShAAQpQgAIUoAAFKFDfAkws1rc4z0cBClCAAhSgAAUoQAEKUIACFKAABShAgWYg wMRiM7iJvAQKUIACFKAABShAAQpQgAIUoAAFKEABCtS3ABOL9S3O81GAAhSgAAUoQAEKUIACFKAA BShAAQpQoBkIMLHYDG4iL4ECFKAABShAAQpQgAIUoAAFKEABClCAAvUtwMRifYvzfBSgAAUoQAEK UIACFKAABShAAQpQgAIUaAYCTCw2g5vIS6AABShAAQpQgAIUoAAFKEABClCAAhSgQH0LMLFY3+I8 HwUoQAEKUIACFKAABShAAQpQgAIUoAAFmoEAE4vN4CbyEihAAQpQgAIUoAAFKEABClCAAhSgAAUo UN8CDvV9wj/L+QoKCv4sl8rrpAAFKEABClCgkQl4eno2shqZV4dxkrkHlyhAAQpQgAIUqHuBxh4f 1b1A3ZyBbyzWjStLpQAFKEABClCAAhSgAAUoQAEKUIACFKBAsxbgG4t1fHvvvffeOj4Di6cABShA AQpQgAJ6ge+++65JUTBOalK3i5WlAAUoQAEKNEmBphYfNTVkvrHY1O4Y60sBClCAAhSgAAUoQAEK UIACFKAABShAgUYgwMRiI7gJrAIFKEABClCAAhSgAAUoQAEKUIACFKAABZqaABOLTe2Osb4UoAAF KEABClCAAhSgAAUoQAEKUIACFGgEAkwsNoKbwCpQgAIUoAAFKEABClCAAhSgAAUoQAEKUKCpCTCx 2NTuGOtLAQpQgAIUoAAFKEABClCAAhSgAAUoQIFGIMDEYiO4CawCBShAAQpQgAIUoAAFKEABClCA AhSgAAWamgATi03tjrG+FKAABShAAQpQgAIUoAAFKEABClCAAhRoBAJMLDaCm8AqUIACFKAABShA AQpQgAIUoAAFKEABClCgqQkwsdjU7hjrSwEKUIACFKAABSjQfAW0Gmg02iZ1fRqNBk2rxk2Kl5Wl AAUoQAEKNGoBh0Zduz9h5cpKi3H85AVopTsj/nHu2g1uLk7NS0JbhuLi47hwWbosLRzaOqObmxuc qvBplJyOCicHcYxWOHXq3gOuHRxrz0nUsUTU8Yyoo4NUR+eucHNzEfOVnzTnSnD02BmpAFFCW3Tt 5gaXqlykOKq0pBgnRSWk82odnNG9hxtq8zKhOYei349BdyvEOdpW4zorL8I9KUABClCAAhSoSKDs 4FpMGBWNArFTYPxypE3yrWj3RrCtDBvmTcXUxdtEXUZj+ZZk+LpUJVqqhUvQlCDv80+QnfcTLraX yrsNMa9HoW8thoW1UEsWQQEKUIACFGi2AvX8zd9sHWt8YaX787B4fgoycqVQ0nzyDIxGQnwEfN0q GyFpsGPlPCR+vAWdpNB06CK8P304Knu0+dnVlqpZvrYUeZ8uRsTMDJVCPRE9NwERQb4V1/PcQSyb MwtJmVIAaz4FRs7FzOgguNboU63B7px0zIhJ1QX1ZmfwDERyQjxCfN3MVlsuaEp2Iz1lBlKzre9l YGQyXo4Kgbudm1G8IwtvJ8ZBpQhEJi9FZIg/apZuFvcwKw1hcYstqy+W/RC/6FU8OtyjSolUlYK4 igIUoAAFKECBKggUfpstxx+5Sdk4GOrbuBNkZQeQoUsqSheZjezvpsI3qG8VrriGu5btR8Idwcg0 K+Y8npoVhYoDSrMDuEABClCAAhSgQA0EapSCqcF5eahC4ODaZIyKzlCsMZ8tyE1FmPiZnbUd4706 mG+0XDq3H2lxwUjNVWzoVAKNWLSTy1IcUMFsdcvXHETy7aOQYbPoAqTGhCF1UzK2p4RA7So1xXl4 clgErFOK+kJzF8cgd/FeZG2Pgz0m9WqUYGVUAGYq7ZQ7FuQiLiwX6yt4g6B0xzLcE5akPMpsPndx nKjjevFEf76NJ/oa5KU9iYhUW1cJLI6bjMXrY7FxfgTcqvVfcCmyYu9BXLZZ1RQL25A0NRhJ4anY GTeyhglMRbGcpQAFKEABCvypBbTYuiwRH207hfZ/GY1Z062/Yzt362kS8uyHrrUSvJmKrPU5x864 VRRqjFrce3WtpVPYt5JOdHDt+4qkoici48eia5ueuKmxu9WSEouhAAUoQAEKNAYB9rHYwHdBU7TW LKnoFx6P5avXIS8vD1lLkxGoqN/MkDQclDKENqbirSsx+i6LpKJh31Y2jqnK6uqXr8HaJGVSUbwR l7oc68Q15q3LQnKk4iqz4zAn56B1tc7txnSzpOJopC5fI5w2Iit9tnjHzjhlIOSuNBRXo6Of3ctm K5KK0huUS3V13LhmFeJDPY0nQG5SGFbml8nL8oyo4wxlUnF0NJbq7uVGrFoUD0UJCJuRDZUSULQ2 ySyp6Bkaq/88bFyH5amxpjJyUzBs2kqck09e2RkNNiSbJxUjk9OxZmMe1onrTI4cbSooIxqpa4tM y5yjAAUoQAEKUKAGAhoU5mYiNzcX2btOo1ylJLeR0SL+W4ql6UuxJuNR1QetKoc13CoHd0zfmIV0 qc4iLgsfoPZouDrVs28FEUntWm98SuqJ9LwsTJ80CZPGD69h65Xq1JfHUIACFKAABf68AkwsNui9 1+L75WlyDULnrsayuEnw9XCHq6srvPxDkLZnNcLlPTKw4Re1VJJ4qpsehWGTZ8rNZzxNWSz56OrP 1Kx8bfH/EJ1pPHs4Vu9chkkjfeEurtHV3Qsh09OwZm64cQdkrvrWKmG2NX0G5BcJPSOxbk8KRvr2 FU5u8AoYj2VblouefYxTKt7+SiU5adys9luzH/9KMp7BD4s2foKoIH9dHd36DsCkxCwsjTalL2dm bxM9IJpP+7/8t1xHv8h05KdEwV93L90wYPgkZOWlmxKguXH4ttgiSyzqkG6CQmhyFrITRRN4qQw3 d/iOjED29lUINZ42dyZW7Vb7PBh3sP5dtv+/mJphXO+J1DU7MT0kAH3dXOEurjNkegry0qONOyAj bTVK5CXOUIACFKAABShQfQEHtLnBcLT4rf7Q10nEf/7wD/BH3/ruq7CaF+bo5oUAqc4iLqtWQwrV 81bGSnGg50h41qwvHEVhnKUABShAAQpQoCoCtff9X5Wzcl+DwEUc2lJgmA/H00Ee1jKOHghLDUeG oal0G9U7Jp7qbjYmxYDoRWsQNRhI8BqlaB5iXXTl19SsfM1pU5IvdNFkeKh0Dtj3r2EIj8nQN5W+ oY15sF2Wj48WG538sDRjunUfhS6+mLU6GdnBcbrLyo5Zg9igKLhW8iLLft8nJwU9o6Mx3Ko/Swf4 T4yGX2qYvrnPzyW4KMo2PZcvw74841NzPzwTEWAVXDu4BiAmNhDjUvT36vhpkVhUnKfswE7T/Qqc jZdDvKxr32EAXs6ajcyQmbptKf/ejAkDgirZXFmLnTkZcpnRS9Mxsq/1zXANmID4wFQkHZay0xpc ENV0dZQP4wwFKEABClCgngTEIGbFJbggztZFPEh0ctCi5GA+CgqP4eLV1ujYvSd8vDzMBn8rLdqP /QeO4OzVq0Drjrh14CC4u1T0JaYvc9+vxyCOEFNrdOnTHz4ebpXoQqayx2pxrqREDJR2GoWHdScB DotB6MQ6Z614TCkGZ3NzNUYUGnHNp3SDqrXt6KoY9M3SAmI/ca2/GK+1PXr284KXu4vhBDZ+ac9h /67dOHRKRDGthWGXnvDo7wGJSFtWipKz0nBubcUDzcoPWFeZ47RlJcjfuw/HzhqU23dB/wE+cLMa ka4yVu11nwutg8JT1PqM8NRKnlWufwkK9hbgyFkpshOT+Nz06X8bPNyM90S/2vSv5b3Qonh/Pn47 ckp8Lq+iyy13wbev4j7UgbmpLpyjAAUoQAEKNLyAapqq4av1Z6lBewTOWYXbzokgq514e8/GZbdt X1FArD/oihh8GOJdtuUb4/WDvIhk3Ckb5VVndU3Kd+r9EFYtH4irItZzvc3GVYrhnR09Rc2k/OF5 mDUPKhIdmetTcYBn5JPwV8Rqymtx8hiJ2YFxhubMqfj+YASCKjkkoFNXd4T6+aFQFPjQ/TY6HXfs gG7KE5rNO+EvAaHwOy9K6P13eNiIRW9w0Q1XaHakcaFcK/3ppJ8iHxlsM1no5Hm37q1F3Uug2Wtw YFYQBljnB41FmX5ri7BOTtBGYoy/jXsBF0xKK8Ak05GcowAFKEABCtS7gKboK9wzIkZ33vily4HP wiDGM7GYApG+cT4CuhQhbfoo8z6mDXuGzl6OhPG+Vg/8NCU7MO/FMGQYOwhUluwZiqXvxcNf8QBQ ublKx2oK8GxAiNwPoa6cgsUIDlisL9IzHtuzJ+kfVpb9gueHjdPt6xkrWi5E6B8ymlksz4Kz6Dom LlMKmswnz9DZeC9hvGofzCW7s/DiuDjzehgOj160GvefeR/jdB0w+2GVaF1SqdhCHF/w2fMISZIQ 1Y6TBoubJwaLyzCcyfxX6OyliB/vb0riVsbqkzuFkaVnqvBMNRSuVg/z8+qXKhrITsSco+PxzqxJ sHwGq7wX0YvSgYwIKLvG9oxdhWxDYrGuzNWuhusoQAEKUIACDSXAxGJDyevO6wA3jwGoeIzhUmS/ bwg8xTEuN6glGR3h/8py5Pn6mvqUEXfWdgqrqhddw/KdRFNgOyMpl+74EnLOq1tnU4Apqnr5dKlc 4bEjB8jz1jNOuHd0OJCbodv0/a/HRWLR3Xo3tTXijcfEZcvUtpjWnTokxjs0TJZvVYrVA8YnYtl4 4w5qv7UoLDD9EdCmtXkjqJOHTf0Zdu3mrFaAfp1DV/STWmXr/hA6j3NlImPrZP8/5bKDu+Q3Ij2j B+s+d9pzxdi1ey8OHD2tL9vZFT63+4o3HmxkRm3XilsoQAEKUIACtSqgvWx64JY0OcxG2bmIGPYE Av22IVctQSiOypwZhk698zBd8UCt7GAO7hilT1qqFlyQicnDMjF39U4EWTS1qPqxrWFsAa16LuVK 8aDV+BCzVxvTBjOLsBDTBou5gsyZGHapM/akjDSLpUq2piNgcorF3qbFVDFomzEtB1Fb+1GF6djW bYw1tjyuDGuTJyA6wxT7mI7Sz2XOnIzMn+ZiZ6Kx9UXlrCr2tKyH5Vml5XPISbgLMZlq2/TrCrKT MEp0fbM0bz78Fc2slfcidWqEVQGdDM2L6tLc6qRcQQEKUIACFGhAAfax2ID49k59rjgf6WL03hRj oByaihHuaolFB3j4K5KK9gqu8vY6LF80D8lfmy5GUjYFu3OnDlUEwxoc+smYzgvEnb0rTnh16dNH vrpTx8Wrj7U2lSHnPVN/mOGP+Nt8o9DWKcv2f4V35OA6EoMt/lDp4XGbfGjuN/vleasZMTK36Y+n bTh0wtB0x2pHyxVX5BVj/VyxOysZXncNQ1hENGbOnKn/iZmKkBF3YXTCSlh2ASkfzBkKUIACFKBA Qwh4hmPpuu3IL8jHljXppj6HxZM2/ffiaCxanSe2F2DPljWYrRh4bfHCDYpB04qxWJFUlN7yW7Nl J/Lz87FTHKccsC3mxQyLvoarcazo1mbezp3Ys2cjYqUHg9LkF4uNe/Zgp1i/c0V1BmkRg9it2og9 +QXI37MFy5PDdcXq/smOxroijWlZ9OGcokwqBsaKfp93okBy2r4Oc5WD6JmOqvFcSd5iRVLRE/Hp a7BTGOfn78SadMWgdpkxyNhqeIhcGStHL9kzPtBQTaXnznnwcqq4+sUb0sySipFzV2H7HtHMXny2 8lYvUny2cjF59qeKz45auZ6IFYMSbtyyBXkbN+LdUC/Rk0zDmKvVjusoQAEKUIACdS3AxGJdC1el fBGEJIhRVzwNP3eJZh4phpxaYOwibE80f/pclaIb074HcxLka/T0ugsh0cakoviDYM12i+bLWpyu Qptux7ad6+RS92fNEgGo4Ym7ZzQmD6/4PVOrSoim6bOCY+TBdSLTRTMly53amt5S3JaaCmOMbbnb 1o9SVZsxWe5nuSy6QZdXJYWNEM2dMuRlcUNM82JO98bD7ckVjkJudgAXKEABClCAAnUqMBqrVsTB X7xR7yD+59I3AAnrTO/YSc1w0/OSMdzDVfe2naNLX4xPeEeRIDJVrnTH51hsXBQPbT9JHC8GSnGC g3hb0EkcNynx36JrFcMOBanI3m1qOVHdYx2dnODo2FG0PDGUe4MzOjo6wkmsd6pEqwNjdfW/RX/T W8QgdgNEP5AOootGRxf4hsRhlejH2TiVnhetGQxT8f8+M7W4EH04b0mLgJerPvPm2MEdQWIQvVVy hs54VE1/ixY3KbIy5q75BJMC+ooGFuLuOTihb8AkrBB9Rhun1IU5MCpXxsq4jxw5mXmqPYQ3nkn6 XYLP38mQV8Qv34LpQQPQQcIUnx5Xj+FIVA6eKAbLW7u/TN7ffEZ87sSo2BFiUEI3FxfRN6WbKAdo GHPzmnGJAhSgAAUoUF8CTCzWl3RlzqO9hEIb+7XXXMQZWzGNjWMa6+pLpbauErhYquss0qzqpnSY 2WrVBQe3PorRoVV3qfJKqSlLsK7PIelQMZLyexHWScEKSy1B+tQQU1AfvgjRAVZpRTi6j8Dc0caC tmHyPVFYm19iXCE6VS9GzrwoTFZ25CNvtT9z/JAhMarY1S88WbylsQcF2dkoEG8QZC2KVWzNwPPp WxXLnKUABShAAQo0jIBf7GNWff45dFN85/s9hDsUzVV1tXTohoGmXJuh4lrsWrfWMC8SdC+qPbTt gLExyfKFbt5tHHGlJsfKxelnatCowi82WrW/6f6DA+ST7N171DBfhp1rMuT1ydPGiJ6UracBodNq NX7SFm9HiiHs8ItebvHQWH9+J6+xprhn2zYcthXnVsaqMvsYLltb/CNSjSFRYDIe8VUREW9OTl4U LkP9Z2uhPK+c8YuNQYCblJBUTg1jrqwB5ylAAQpQgAL1KWD5TVif5+a5LAWc+iE6NRlFV9vo3i0r /f17JKXqO3/JTo1Bduoaq35eLItoCsu9h0Yj2bkIbdqIlOGVUnz/nyRk6pp7ZyMmLBtrYpdjfoSp k3VTA177V6ctOSS/FWh/b/t7nNu90qxPosj09zDSRkfu6qWVYmVsgKk5u3jbcWPccN3bFNb7O+Kv sUuxKnuy4Y3EXESH5FrvVs01zh1vNDvSTzgvE87yJN4g8BoegZ2rXXCHYXTtgtSPkB/ub7dJkVwG ZyhAAQpQgAJ1IHCDod8686L1IwxL6wIDb61kFyUalBwxZpW2YeOXOTgpv/ZmLL21GHJ5l3FB0eNg TY6Vi6vxzA1t2qmWYXpHUTyovWKyuSD3mBIK75ttvM3neDMCQ4FsfdipWn5VVmpOG/puFgdtW7sO Of2OwTDstqkYwSwGY5an+vqjRFm3wABvm58bN5GsDkSGbgBB0bW26qT+uQQawly1glxJAQpQgAIU qAeB+voOr4dLaQ6ncILvyBCYUj1BmBTxNFa++jRmZkuRl+jnJeUr0SF3kKIPwqZ33U7uvggRP8Yp KGQSnt6xEsPCZupW5aaEIXv4ToTohuFzQOcuxj3t/9ZcOF1riUWpc/a7xunrJJ15dHIWpqu8aWi7 VlKn5eHi3hn3CEXWv6MqfNvRwdUfH+StQsqL49RHqRRFhSYvxyPi/cdxcVWL/h1dlH85heLViaZ7 YKyh9NvJYzTSIzMQoRtNJxc/FJ6Dl1cH5S6cpwAFKEABCjQygcqHtMocUcbMGLvXkZu7F2WTvHQJ qJoca/dEdbSDXOfAgehhI68IEVneMlA0m8iUg5aa1UYkDeWpIAMx0fKSjZl6jDcUdfPz6WGjPmK1 aLZtHAgxN68AZeP1nwHbB5i2NIi56fScowAFKEABCtSrQOWjsHqtFk8mCzi6YXzyOziUPUo8MxVT 9hr8MivIqjmQvH8TnXHzHY81cw9hVEyG7gr+822hSCyKzq9FoNvnNql9sBTo5mJvYZlIcun7BdLt aPHPqUOH5DVdXNSf6Ms7VDCjLc7DVEXH7qNni2RfiFSfyk5a5KVNVXRaLvqG2pKIyuTnHFwHIG7Z HoTt/h7fbd+DUxrpnI7ocrMn7r73btEPlCPy5iUaKhKIAXYGtJFrbHp5QbzaUdEfF2JESjdPcZji NQK5EM5QgAIUoAAFmo9A4OhQdKkgXLh06RTa+fRWfaBbk2MbRDC3EGfFidWjKC1K/jheN9XyDETo wIqfEl861Q4enW1mPeumXqLUK5ekIEtdBDBlID17drLR2sRO1RrK3E61uJkCFKAABShQmwJMLNam ZpXLKkPxweO4LI5r26mH6PTZRkDl0AMiJpPyarqpqd00TWkxjp7RXSV69BUdjesvw+rfHrdJySz9 ZOzbXFpq29kU8X/8zV6M9/I37GX5qww7sjPklQNvq+AptLyXykzpDsQNi5AHSAmMX46U8QNUdrS9 aveyOETIfSEGYvmWZAxQ6cLHdgmOcB8QoPux2kcM8pOte5tQ2tIF7Sr5gXC8UXyOxBG6dOH5ihuY O8iP2q3OzhUUoAAFKECBJixQjityf3yjMS05ER6V/B4FanKsBZky0LHYVNuLpm/8b/BbyXS4uaqd oRQ/rN2mtqF6666azhoYHoPEkL7VK0c6qratFHXbvOswItT6WJTOe/a4/Ii1V59uNuNXaVfLyXT1 9WhuWQkuU4ACFKAABepJgIO31BO02mm0RRsxbNQojBI/wzL2qu1iWKfBBTkIBpR96FRwUCPZpME3 ycN01zhq1NP48ZztamnPX5A3Ki4X7vc/Ivq40U9Sn387bJShObgRcYbkKxAJ/762UpjyaaxnysTI 3PeIptiGLX6iz8P5k9SbDFsfrF+zX4x6PS7JWEKgrl9MX5dK/NWiOYh5UZMQJf0k58BWH+bKkQY9 ox+CRyUv08HVC2P9DLXe9jG2Fdv6JJ3D9+uN9YcYwbKSJ7AFwvUUoAAFKECBRiPQAf38jF+G2di8 q9RmzTRlZSgTP7qGA7q9anKsxWlEzGMq12JbrS46wSdAavkhTQV4P3u3ftbi33M7sk0Dmlhsq86i 000eYpxu/ZT7n2/lEZ+tytJqdMZlGlsxiTiilq2UdduW/a0YI1p9yv9qpZxYVL69qL63cm3DmCtr wHkKUIACFKBAfQowsVif2hbnkkYzNCbMsDgRaw+qp5KK1qYjSX6IfBtustViw6L8yi6W5m/AvIQE JMxbhv3nKgjsKlug2X6iKfOdxqsswD/T1qoH0iKptnhGknzkwD6KgUacvDA+UnrXTppyEfbsMusg sCwfSYqmy4HJQVZ9Gdq9Tm0R5k0IRqb+RBgt3lRcFuFfpaYvRRvmIThGLkG8qZgGf8tRKg3lW/1q BZzJ3YZc6ScjBiu2Woe6moNr8fTUDPnQ8FE+8rxuRluKDcvmISE2Acs27LdIQrsgMCzcsH8Bpv4j A2q5xfysOZgpJ2jDcXuVBqsxrw6XKEABClCAAo1N4NYRD8lVSgl7B/kqDyzzsxJw+x134A7xk7S2 SN6/JsdKhchvsm37EYfrJ7MoBmYbpWuxIJ1/W8o4JOfkm8UHJbuz8FhYirTZ5mQ3hrI80sUHfzeG f9uS8E5WvuUewLl8JHjdrjO+4/YUFFmEoDW2shUTKetWkIqUZTvMPKSKlu3PQVySMRjyw8QHPazr X8Ga2jCvoHhuogAFKEABCjQqgUq8RtWo6tu8KuPoiYnRfsjVNZktQPSoOxA+exFChw9ENydHlJ0q xIZPF2LmYmNgIwbuSA2GaguW6sqIZNo7IVPlZFqmpg8K4gKqW5rqcR4PToSnyFRJTXALMqJx+8/h WBQTioG6ZiVlKNy9AQsjZhpbeou9wvH3u5VX6YCA8AT4LQ7TN08WAWrApKNYOmsyPDq1xYXD27Fg XLT8lqF0fMxoiwDQ7nWWYtm0EZBbGItauOAAVi77yfRHgHx1V3DlSnc8FC6Sl4r/gkp3L8OIqYvl veDpgqJvVuKnC3JobNp25QpcRCfpQb6K63Toi8eSRyMzTv+2YMrkABTFpuKxB30gLhN//PglxkUr Av/QVPxNN8CNqdii9e9gapIhsSmGduyTl48ARWLT7YEw8S5nBnS13JaCYV4FSF01FYNuEgO7XD6B DcvfxMwMOYuN8EWT4a64RtOZOEcBClCAAhRomgJOHg9hduBMw0O0TITcVYjZi2IwuP+NuHy6CN9m L0SS/F0o+ge8312+0JocK0YDgWsX6UGpFBHlYsb0NMQ+7ocOHdwxwEMRD8hnq6UZ1+F4RcSbkw1d tGTEhCBj1WiE9m6HS6d2ITtXqk8Fk90YSu1YJ4x8ZrZoSaIfBC8zLgSFBbMR88gdaCd2Lz20FQuj k0zdzswebRFv1NzKdkwk6jbNVLfspDAU7I3FK+GD4dL6Ko7szMbUmRnyRXlGPgN/F3mxcjM1Na/c WbgXBShAAQpQoFEIMGXQoLfBAf6RbyB62zAYu+PLmDkVGaaBiM1q5xeZjviRpuDWbKPlgnjqe1Gx rlwxbzZbfh6nlCuOnNA1wbX7UmRly5fKdvHHe+nRGBaRqj/TtgxMHZehn7f61w+L1k2HVStmF18s WpOKCaOi9c1SRBmTR6mVMVq8JRiLvpafbHvXWXYY20z5W12tMpJs3AjdVj/cNcE8sfjHblNCTrdL QQbi4nRzqv/4xd5lnlgUe3mEzMDsLdnySNKZKdHIVOQS5YIC45GXONKqv5/Lp83upujbUgMoEotw cMf0Latw5p5xhmRyNqLH6ROZctmGGb/odEwf7ma5mssUoAAFKECB+hFQDjqmdkaLWERtF5VHe2K3 DmJgvCwcOiwSbLqc2jbMnDpO7XBEpsfDfMy4mhzriIGjRbNkwxd7QW4qIqTYwzMe27MniVqJydY1 2bNQrb1ppX/UIqTjJdH/s3RCMW3LRqYibPGMnItYt+8RMTNTv135r70YShFxiurLk5PXeKwWA/MF x2To1m0TAa5q+OcZjfixXvJx+plKWIkdlffXMtatKCZy8hB1Sy1GcPRi3ekKslMwWfxYTaNnI326 Rd/elbwXNTK3qghXUIACFKAABRqvAJtCN/S9cXBD1LKdWJ4cLTdTsaqS52gkL1+HZdMDrBJJVvsa Vzi2Q0/jfG9n28dJb03GBhr3RPzj99scG0/eSZqpbPmGg9wCorBz3XJEjzY2aTYrTbcwOjIZ63Yu w3B39T79nPqORFbeKkSaqmtWiF/obHF8ClT7M7R3nQ4OaG9Wmr2FblZNpFs7V7EEZ+mZveUk/mBJ kT4PkTY/D6Gx6dieNkn1zdW+w8ebmteL5ONwD5UUscsAJO7ZiGRbkKKE2UvF5y2qCp83y8vgMgUo QAEKUKCGAg6dXeV++rq4qHxnOihiHdVBxxzQWfeGoKjIDRY7dPBCXPYWLIoPVa1lYGgslq/bjukB Kg/YanCsi284Vi+Kla9Ld/JObSB6Q9FPiviqvbNpVGK7FuJoh7ad5djB2ssJAVFp2LJ6KWIjQzFa JDhHixGxwyPjkZ61EdnTg9DN/FGzsUYi5qs4Vmzb2RhxWg8o5xEUJ84pWuMYO1w0lSrmAhE7d7lI qkaZtQAx7mLXSkRiyvsrGxoKsBcTeYycju1r0hEeqBab+iE2NQt7UsZbxVuVuRf6KtTA3IjA3xSg AAUoQIEmINDi4sWL1xtzPc+ePYtWrVqhZcumlQMtKNA9Ase9995beV6tGCW6qBDFpefFA2sH8b/W cHHrBXc3F6skVuULbXx7lolRogsPF+P8JREEizcLW7dzQa/e7nBxsnzN0HbdS4sP4nDxedzg2g7n Sy6hs3s/uLuqJNFsF9H4t4jPQ9HBQpy+1FqM/HwOpZfawd3DE24dKu9k7yI154pxYH+xeKvUBdrS Uji4uKNfX1fbiWh7BXI7BShAAQo0qMB3332nO7+np1qypEGrZnbyasVJZiXU4oKmDCWnzsLB2Rna y5fh1NEFTo6V/K6twbFaacAS8Sy1XPolBUR1OGk1GjGmNdDK0dFGTFmGlVF3GJqHB2LVzjQMqOWw qqy0BGe1beHscBlCWYQeTjbqYg1R11Zl50TdLjuIumlxQeuALq4uNY6FGoO5tSTXUIACFPhzCjSV +Mjy7ly7dg3l5eXo2LGj5aZGtVy3UUyjutQmUBkHJ7j19RI/TaCuNaiik4sbvMRPTSYXgSQXUcnW 4TU5X4McKz4P7h5eqMvLc+wg7oWv4V70beYfvAa5iTwpBShAAQo0egFHJ7i6GbJoHXQNkitf5Roc 62BIXtZxThGaohzcPiJGf02jk7EzJcSqdcq5/LWmgds8B6FXLScVpZM7ubgazttB3+y78sqoayun DqJuhltfxU+A6lU0FnPVynElBShAAQpQoJYFmFisZVAWRwEKUIACFKAABShAgcYi4NjtNowWldH1 qJwdhwntShH7yGB49uoK7YU/sPPrTMSkmPpWHP3UcDGAHaeaCNC8Jno8lgIUoAAFmpoAm0LX0R1r VE186ugaWSwFKEABClCAAo1LoKk09WGcVL+fm9Ldy3DPuCT7Jw1NxvbEkCq/UWi/4D/fHjT/891z XjEFKNB4BZpKfGQp2FSaQjetjgstlblMAQpQgAIUoAAFKEABClQo4DJgEnZuXIXY8ED1/fzEQIFL 1yCfSUV1n2qspXk10HgIBShAAQo0SQE2hW6St42VpgAFKEABClCAAhSgQOUFnNwGICIuDeHTy1Bq HKzmwgXAuSNcO9RBp4qVr1qz3ZPmzfbW8sIoQAEKUEAhwMSiAoOzFKAABShAAQpQgAIUaM4CDjUY cKY5u9TltdG8LnVZNgUoQAEKNLQAm0I39B3g+SlAAQpQgAIUoAAFKEABClCAAhSgAAUo0AQFmFhs gjeNVaYABShAAQpQgAIUoAAFKEABClCAAhSgQEMLMLHY0HeA56cABShAAQpQgAIUoAAFKEABClCA AhSgQBMUYGKxCd40VpkCFKAABShAAQpQgAIUoAAFKEABClCAAg0twMRiQ98Bnp8CFKAABShAAQpQ gAIUoAAFKEABClCAAk1QgInFJnjTWGUKUIACFKAABShAAQpQgAIUoAAFKEABCjS0ABOLDX0HeH4K UIACFKAABShAAQpQgAIUoAAFKEABCjRBASYWm+BNY5UpQAEKUIACFKAABShAAQpQgAIUoAAFKNDQ AkwsNvQd4PkpQAEKUIACFKAABShAAQpQgAIUoAAFKNAEBZhYbII3jVWmAAUoQAEKUIACFKAABShA AQpQgAIUoEBDCzCx2NB3gOenAAUoQAEKUIACFKAABShAAQpQgAIUoEATFHBognVu1lUuKy3G8ZMX oJXujPjHuWs3uLk4Na9r1pahuPg4LlyWLksLh7bO6ObmBqcqfBolp6PCyUEcoxVOnbr3gGsHx9pz EnUsEXU8I+roINXRuSvc3FzEfOUnzbkSHD12RipAlNAWXbu5waUqFymOKi0pxklRCem8WgdndO/h htq8zMpfDfekAAUoQAEKUIACFKAABShAAQpQgALmAlXJk5gfyaVaFSjdn4fF81OQkVtgVa5nYDQS 4iPg61bZxJkGO1bOQ+LHW9AJoryhi/D+9OGo7NFWFbBaUc3ytaXI+3QxImZmWJUIeCJ6bgIignwr rue5g1g2ZxaSMrdZlREYORczo4PgWqNPtQa7c9IxIyZVkjOfPAORnBCPEF838/UWS5qS3UhPmYHU bKsSEBiZjJejQuBu52YU78jC24lxUCkCkclLERnij6qnmzXImzcdEd+ch18ni0qrLZ45gzMDn8KK xKBqnEutQK6jAAUoQAEKUIACFKAABShAAQpQoDkJ1CgF05wgGvJaDq5NxqjoDJtVKMhNRZj4mZ21 HeO9OtjcT7fh3H6kxQUjNVexW6cSaMSinVyW4oAKZqtbvuYgkm8fhQybRRcgNSYMqZuSsT0lBGpX qSnOw5PDImCdUtQXmrs4BrmL9yJrexzsMalXowQrowIwU2mn3LEgF3FhuVgfvxxpk3yVW+T50h3L cE9YkrxsOZO7OE7UcT2Wb5kPXxe1//xE8i/tSUSk2rpKYHHcZCxeH4uN8yPgplaE5UnlZQ0O7RIX J/KdtkuXd9bPdLqAcotVXKQABShAAQpQgAIUoAAFKEABClCAApJAldISJKt9AU3RWrOkol94PKIf GQr3Tm1x4uC3WDhZJKIMp50Zkoa798Shr40MYfHWlXh68kzrN+3E8a1qoerVL1+DtUnKpKIf4lOj MXSQO9pePoFvP12IuMWGq8yOw5whA5EY1Ne8xud2Y7pZUnE0UpdPxSB34VSwGW9GzDQkyzIQclcH bMyPqmLSDdi9bLYiqSi9QfkKgu/uC4cLfyA3Y4Z4S1L/BmJuUhhW3rlTJHkt3hkUdZyhTCqOjsbS J4PRt5MD/tiXixlTkwz3JhdhM7KxMy3E6k3AorVJZklFz9BYJDz2INydgaK9XyMxOkVfRm4Khk1z xva08apJWHM841J7/D979wNdVXnn+/8zJRowgBrb0MY2VzIusn7mKtRGg96mV5hQioUsm/aSOLSQ mRUnTenNzILJ6s2PCsK9aW5XCqOnC2mmWV0hNdXQNuOKTilDCi7jiBEuFW30JuMv0ljjGGvAQJDY g/N7zr999vmXk3DOhuTwPl3h7LPP3t/9PK9nx0U/PHvvxffVqGLJ+AQhszm53napqTOwz4eBBd4R QAABBBBAAAEEEEAAAQQQQACBEAGCxRCOS/3BrRfbdlsHLdv5lAnUFlmfs7JKtfvl/2xm+q3xz/Rr 0aH/u1G5i8Pn87n1QvPfakNjIII0FxbnmYlpkVfiWrWntpBYfffQv6qmPXDECj11vE6LrEwuS6Wb dmvJIjNrc3OLd6P2fc/p702waO/lC80PWgGr8qp08OebrMuJs7LK1XrkZtXetU6+PMylf/j1KjWG h5OBJkR7H+/XP9YH/Aq15/CPtTxw6XlWltbv6NCiBX+tDf6ZhNs6e/S1/OUhyXz/rx6z2lhY1ayf bCqyvs9avl4d3Qv110X+GZdddXpu6MtaGTiGp02mDc1BKJU1dGhHab7V2qzsSnUevUNb71grL2fX Nu07ca8qI84Ha5ewhTQtLt2oxWFrwz8OHRo1wWKLd3XxvZ8LGYfwbfmMAAIIIIAAAggggAACCCCA AAJXrgBPhb6sY39ObxwJpH8V+qYtVLSalb5I61wV1sero0bB4zr5bCAUk2r27Fdnx36VWXslupBY /fFTA1YDyvZssIWK1mrlfmmdKgIf510dOsNyrFc/bQo4FWpvSzBUDOyizAI99FSD9bFz834NW5/i L4z9/ndWKJhXUxMMFa1d07T0GzUqDHx+bVjnAsve9zH9rjswza9Q36oMhoqBzdKyirS5tjjwUe+c GreWPQtjrx/3BYaeD8Xb9R1bqOhZ5X3NX6zvdGwPfFLjY89qzPqUhAUTbv5DdYu/UIm+9ZVgsJmE 6pRAAAEEEEAAAQQQQAABBBBAAIEUEogaU6VQ/6Z5V65R8Q/26ZbRP0lzspQVo7Wzr4lx7bNt+w/N w4dlosS2w1t8D3kxYdx7tu8TXUykfsZN92pf2xL9yS1l3RKjl+bxzulmlqX3Ot8zCrmv3+BzncHQ r+oBLc2M3puMRSu1vbjOfzmzSy8OVGp1rOvGw0pkfDxHZYWFOmnW3/v5sMuwA9umz9eCwHLEe4b+ vKhMhWdOSjfdp0X26Za2bedlXmP7FLp4wX3WWlH11S9EXCYd+DIj705vaOydtdi5X68/tFqLrRmg ga0u7r3/n3/sn/UplWx/QPnxT72LOxB7IYAAAggggAACCCCAAAIIIIDAjBcgWLysQ5im7EWLNfEz hkfU+eMmq5WZ86IlPela+v+2qbugIPhEZDOysSMsq9wkFxKsn5GtxXGepDxy7FeyJiUuuD7kHoDn T41Y7fzayoku5M3Q3SUVMjdE9G7/4r+9Y4LFHGvfCRfMjMcdra0TbqL33rBCN4XPqjR7Li7fodby iUq4dbIvMPNSuvqq0Dtf/vHNQWvnjy8wN1WM9Ur7uG72TJ30PoHljEbHTGKbkYRf5fFe/bguMOuy RA98JXhZfqymsB4BBBBAAAEEEEAAAQQQQAABBK5cAS6FnsZjPzrUq+bau9ToDZBMQ8tcWpETLVhM 06KltlAx6X1ysL57VL0Hms2TlButVu+svscWLJonGb8aCLuK9bmbYkwF9O99w8KFVp333jFTH5P2 GtPTPwreD7Piq0tjziiMdcix/l/r4ZZAsFilLwRvNOnd5cZFt1i7dj3Tby1HLJgnc3cFzgmTLr7x buhF2RHbT3JF/z+1WMFpScMDWhTtVJtkLTZDAAEEEEAAAQQQQAABBBBAAIHUF0jCNKfUR7pkPTT3 t9tqHtTivcQ17KDFtXvUULncFriFbTCDPg48vdU8qCVaL0u0Z/+DWh5y+bJbp6ZwTXf67Osdkejv eEib/U+FVl6NNiyfeJ5pRCPMpekPrdnsfyq0VNVcHjlTdXZwlmKPy6UX7m+Netn3Cz91+Z+AHXGU i19h2vfItkCAa2YrfpnZihePyZ4IIIAAAggggAACCCCAAAIIXBkCzFicTuPs/kAnY7TnmvFzOp3U p3TEONAlWP3BSKxeSudGvDeLDGnF1SGfJv6Qlr1QJRNvMuVvh19o1hrrEuE8uX5UGRkKTlh1WM3V pdZsQFXsUU1RZDCZnrNCO63G92jDXRt1oHfYquweG9LTuzZaT6a2vkjCQu8vH7XuY8lsxSSAUgIB BBBAAAEEEEAAAQQQQACBK0CAGYvTaZAzblaNq0GDf7panjBt5Pcvqt7lm9nX6dqsTtd+7e1+REuz Zvaw3XRPjRrmDurqq00vPxzRi0/Wq73HMxCd2ryuU/tr2/RIZYECvfxwCmPkHn7DmhU4hd1ibjp6 4gkVbQhepl3V/COtzJ7KNcIjeqK2KHg5u5nteLhuudW30AOn60u1e7Wvc4N/RmKXakqDT/sO3TaJ n8ZO6NH6wHGYrZhEWUohgAACCCCAAAIIIIAAAgggkNICzFicVsOboYKVpSpdvVqrzc/6jTvU9/Jh bS/J87eySxsaf63xadXmqTcmI6dApaWl3j6uLl1vHprSp8Nt261CXY3r1DkQmJ6ZputvsL6KuzB+ 9lTSgsWxgad1x9pt1jFLGjq0KcpMQ2uDiIUxHWiokHWFsXmWc8djGyec7ZiWtVQ/6d6nCs/DWWK8 yhratK+hLMa3U1994vF/tM1WrObeilMnZA8EEEAAAQQQQAABBBBAAAEErkiBwKSwK7LzM6LT6dkq b3hYb3SuUounwZ379X8fWq3FGTOi9ZNuZHZBufbvfMPce7HFu8+Tz51UaW6+WU7Xwls81wd77v/X pVdOjik/P3bn33vjDe/+nj9uyJxjLU91wT3UrepVm63dSrbvU2Oppz2TfbnVvbtaNdbDWkq078gO 5U/87Blv8bSsxaprfVnrTryo54++rPe8SXK6bvhPebrz7juVm5mu7l07/A0p1uI4D7SZsMWjx7Sz MTBbsczcWzF3ws35EgEEEEAAAQQQQAABBBBAAAEEEAgIECwGJC7L+5iGBt7ReXPs2dfdqGwTGEV9 pd2ovGLzjT//mWmDNj4ypLdOe3upG3OzYz6A5sZbAjMzpXk2iNnXBwPCnz3zisrzl9q+tS+O6Vhn i7ViyS03WstTWhg5prplldYDUoq3tKmxfPGUSpxorVOly3t9t9mvWG1HGrQ4cyol0pWzuMj7E7GX echPZ1Pg6dI3aE4CJ8SxfcEHwZQ0VDBbMQKbFQgggAACCCCAAAIIIIAAAgggEEuAS6FjyVyC9e7B w1q2apVWmZ9lLa9McMRxnT0T/NodXJwBS+N6pmGZt4+rVn1Tvx2N3WT3mbPWl7buKufzXzXRnO/V 5/qpjsWoMT5wWHWByXeq0tKQp0tbpSdeGDNP5r7LXIrt36rQ3PPwkfUFE+8T9m2/eer12vpAhWLv fTELMieR/o0PaNfG9dro+Wl4WoGLwcPKa+hff2m1L6/m3osPA0dekKsxEH6WqZrZiuHUfEYAAQQQ QAABBBBAAAEEEEAAgQkECBYnwHH6q7QFC63ATE07dMC6r2DokQcPNKs+kP/oFn0q9pXAoTtO8tNI 7yHt2rpVW3e1qn802bGluZT5c1YsqO/tPhD9HpEmVGt6sN5q8ZKFn7CWlZGv8qrAbMYurft2q4LP SvZvNtaretuly8UNqyPuZRi3n+5B7bp/jdr9JUvMTMXWyqUxHrQSbJ59afDQLq3ZbFUwMxV3T/5h O7Ok01096vL8tGzW4y9E9FLjAwf0zeoW65AVq261lr0L7hEdat2lrbVb1XqoXxON5rHHH7VmZZbs rNDF5LChB+cTAggggAACCCCAAAIIIIAAAghcSQKTmEZ1JXFc4r6m5+kbNYXq8l4y26eaVberYvse lS1fogUZ6Rp776QO/eJRbWuypuGpzLVGWclspgnTHi6ttsK09vGF6qsrSuYRtOiL31Deti7vQ1X6 Wmp022sV2rO5TEsWLjCXRY/p5IlDerRyW+BKb3PsCt13p72XaSqq2KrCpnW+IKynXkXr39LehzZo 0XWzdfbNo/rh2hprFp9n/80li0L7ELefI2r92xWyrjA2e2fqdT3R+qoin0r9oT788JO6t8KEl7bf oJETrVpR3RQ8bl6mBp95Qq+ejaxgCihzSYlWF9j6mZarrzeUqL3ON9uxcUORBmtd+voXb5Xppt7+ 7a+0tqYxWL/MpS/nhqbMg795WNX1/mCzs10Lu3tVFO0p4ma24g7rUm0zW/FL3FsxCMsSAggggAAC CCCAAAIIIIAAAghMRsAWi0xmc7ZJrkCallb9b9X0LFMg42nZVq2W4IOIQw5XWNWsLStzQtbF/GCm qp2zfXnBthyyeOGM3rOv+MO73ktwQ+Mq+wb+5cnW92yeuVQ/aq7RskqXb+eeFlWvbfEtR/xZqD0H N0XOnsss0J79Lt2/qsb31GdTY8OqaDVKzCzBWuWGn9nx+jn2pnqC+a23VS31MQbC+22h7rg/NFh8 +4Q1rdTXq74W1dX5FqP9WVh7R2iwaDZaVPqgth/ptJ4k3d5Yo3ZblmjVKd6i7h0rI+5Xef5UyGia e1uaJ79EBIvmwTIt37Oenl3mma0Y7mUdiAUEEEAAAQQQQAABBBBAAAEEEEAgugCXQkd3uXRr07K1 sfW42hpqFLjYN+LgeSVqaDuo1k1FEUFSxLaBFelz9OnA8k1zY+/nmTVZWxzYUlv+6vOKGyp6tp5s fX/l7KKNOn6wTTUlMXupkqoGHTzequU56VZ77AsZuSvV0b1PVcHm2r9WYdl2s3+jot7PMF4/09J0 TUi1eB8WRFwifdXcKVaYOyfKQearvNFzPlTFPB/Kapt1dPf6qDNXc5eXBy+vN+Hj8kVRRtM9pOes qZkVqmC2YpRxYBUCCCCAAAIIIIAAAggggAACCMQT+LNz5879R7yNLuf377//vmbNmqWPfWxmZaB9 fb6n9t59992T53Obp0QPntTQyBlzb7w087+rlJn9GeVkZ0aEWJMvOv22HDNPiT755pDOfCCZPE9X zcnUZ27KUWbG5KfNjQwN6M2hM5qXNUdnhj/Q9Tk3KycrSog2/bo/+RaZ82Fw4KROfXCVefLzqEY+ mKOczaipzAAAQABJREFURXnKnj95p8kfjC0RQAABBFJB4Pnnn/d2Iy8v9j/kTYd+XtTfk6ZDw2kD AggggAACCMw4gZny96Nw2I8++kgXLlzQtddeG/7VtPpMQjGdhiMtQ9m5+eZnOjUq+W3JyMxWvvlJ 5JVpkKwSk7w6PJHjXZZ9zfmQsyhfqdq9y2LKQRFAAAEEEEAAAQQQQAABBBBAIGkCM2saYNK6TSEE EEAAAQQQQAABBBBAAAEEEEAAAQQQSESAYDERPfZFAAEEEEAAAQQQQAABBBBAAAEEEEDgChUgWLxC B55uI4AAAggggAACCCCAAAIIIIAAAgggkIgAwWIieuyLAAIIIIAAAggggAACCCCAAAIIIIDAFSpA sHiFDjzdRgABBBBAAAEEEEAAAQQQQAABBBBAIBEBgsVE9NgXAQQQQAABBBBAAAEEEEAAAQQQQACB K1SAYPEKHXi6jQACCCCAAAIIIIAAAggggAACCCCAQCICBIuJ6LEvAggggAACCCCAAAIIIIAAAggg gAACV6gAweIVOvB0GwEEEEAAAQQQQAABBBBAAAEEEEAAgUQECBYT0WNfBBBAAAEEEEAAAQQQQAAB BBBAAAEErlABgsUrdODpNgIIIIAAAggggAACCCCAAAIIIIAAAokIECwmose+CCCAAAIIIIAAAggg gAACCCCAAAIIXKECBItX6MDTbQQQQAABBBBAAAEEEEAAAQQQQAABBBIRIFhMRI99EUAAAQQQQAAB BBBAAAEEEEAAAQQQuEIFCBav0IGn2wgggAACCCCAAAIIIIAAAggggAACCCQiQLCYiB77IoAAAggg gAACCCCAAAIIIIAAAgggcIUKpF2h/Z623R4fHdZb/35aMiPj1mx9fEG2MjOmMEzuMQ0NvqWz7jRT wi3Nvk435mQpfQo9HhsZ0lt/PKs0TxtMnes+eaOy5k+lwhQOdrGbjo9q8Pf/rvP+/WfP/biyszM9 bDP/5RnDoXd01ts5t9Jmz9WC7GxN5TRIBoLT50HC57rpZKI13GMjGnrnjzpvznPPb9zc6z6p7Kz5 yeCbdI3R4UH9+7tmsOd4drmI3/lJH4kNEUAAAQQQQAABBBBAAAEEEEiuQErkMMkluTzVxodPqLnx Qbk6+yIaUFzVoO9sLFVOnGxvoLtVD1XWqyeygnbu26bVi7MivglZMTqg1h88pPr2KBWqdmpbzWpl TeGMGR86pl31Lh05Y45iSm48+GOtjNeJkAZF+zCuYx27ta6uKcqXhdqy57v6y+WLogSM4+retUmV z5xR4XVRdg1fdfq0Ti/5Gz2+Y7Uywr9z6rN7RN2/aFLltpYoR8hTzc6tqlxdECUkTnLfknwehHcm Ged6wjXGBtXR9EPVNXWGN08qrtLe71RpaY6zI+/5/dhdv05NXZFNKCzbou/83V8qP3MKv3CRZViD AAIIIIAAAggggAACCCCAgKMCf3bu3Ln/cPQICRZ///33NWvWLH3sYzPrqu2+Pl9AePfdd8cVGDnW qrvW1cfZrlhtRx5RQdSgwQRLux9QpSsyELQXLdv5lHasXmRfZS2PD3XrgWWVUUJJaxOzUKGOo3XK n8SErv4Du7WmxmXfWVs6jmr9ZHYO2cv+YUQdtXepLkoWZN9KFS4dr1sZFgiOqnX9HaqfmCikjAq3 62hruSbR3dD9LubT+IAablullnj7ljToaGNpWJuS17dknwfh3Un8XJcSrTE+eEgPrKiOc65Ltc2H VVmUHd6FpHweOfGE7lq7LU6tPLn2P66Vuc4GnHEawdcIIDDDBJ5//nlvi/Py8qZ1y6fy96Rp3REa hwACCCCAAALTXmCm/P0oHPKjjz7ShQsXdO2114Z/Na0+Mx3mcg/H6Ak9aA8VS2q094E1yr0uTW// rksPVtfLF1F2ad2DnTq+uzQsMJN6nzAz8WyhYkmtS9X3flaz3e/q2bbva1uLL01r37xG1117WJvC wxLThk0hoWKJXG3V+mzObL3b96y+X7nNH8K0qPSO+Trcu1HZsc6c8UE9Uf9tbWuPnHmZGPW4DjWE hopVDc26b2me0s6/rWNPPhacfdZSI9ftB1W3Msd2yGu0+L4aVSwZjzLjL7CZmRL6tkvBSWwfBr5w +H1cB+rtoaKZeemq0T2fzdHs8+/quV88avrmn9bWWacf/NclJiDOtbUpSX1L5nlga521mIRzXYnW cA+ofoU9VMxTrWurvnirOVfODuhfHvueGv3nbmPlMs01YXh5QmG41XtrYXzwQGioWFil5u/cp7zr ze/8/3dMj1XWyZed96lmlUsHe+uUE+v3zarKAgIIIIAAAggggAACCCCAAAKXXoAZiw6ZT/Zf4vuf qNWabb4YobCqWT/ZVBRyGa97uFt/XRScSeg6/LJWZtuuiR7pVsldlf7wUarac1CbltsDNelEa63W 1gem+ZVp/8s7lGsr8cKuEm1o8geBeVU6+PNNoZddjxxT7V3r/GGHVLJzvxpDgi0fonv4Bf1t0QYF r+z0zJYIBowTzlg0lwEf+tnjeub1Ud2yokxfK8oNcRjr79Dta+r8oxV9Jtdw924VVbp82+TVqLtz o+Jc/O2vF3wbOtSgZdUt3hXF2zu0uzw/+KVDS+6hQ8pfVu2vXqGnjtdpUdgktYGnG7Rqc4tvm8It Zibl+rBZi/EbF69vCZ8HccYw4XPddDHRGgMdW7Wqrt2PFX0Gbq/ZpjSwzUVaxx6NMXVsvF11/l+S PDO79vGI2bVD2l2yTC7/r07N3m5tXDrVMzl2C/gGAQRSW2Cm/Iv8ZP+elNqjRe8QQAABBBBA4FII zJS/H4VbzJQZizPr+uJw5Rn/eUy/6w4EfoX6VmVoqOjpXlpWkTbXFls9fefUuLXsWej/lyes6K6w Zm9EqOjZZvH6h9RQ4lnyvNr15IvDvkXPn2O9+mkgVFSh9raEhYqebTIL9NBTDZ4l76tz837ZKgRW a/zd/mCoWFxjAsxOHdxZZn0/0cLgbx5WtbkfY3t7i7ZVrtKRYbdtc7eOP91ifa7Z2xz18tCsovu1 xUPlvfxrXGdDqaz9Yy6M9+sf/KGiiU/1ra9MECqODevEC906cOCA9+dQ9wsaGB6NWXqiL8ZPDVhf l+3ZEBEqer7M/dI6cyG6/zXvas0KLE/2PV7fknAeTDyGiZ/r5mRN8PdlTC8+GQgVpe0dNVEv688v /XttD/zK9dSra2BsssrxtxvuUUsgec+rVXNEqOgpka37t9Z6a3mi+dH3z3qX+QMBBBBAAAEEEEAA AQQQQACB6SbABXaXdUQy9OdFZSo8c1K66T4tinEzv3mZ10RvpXtQv9xmpRR64L8tjb6duXh6ZcV2 c29C3z3dmjpf1Mai1d5Lggef67TCwLyqB7Q0M3qJjEUrTdhSJ9/hXHpxoFKr7dMebbuVbW/TlnLf Q0b6z35g+yb24plT74V8+dZpkwoGnhRj+nnQCj+r9JWYs7cytX53n9aHVJr8h/5//nFwVub2B5Rv m9UZrDKuE+bhMWujPjzGZJrmoRsP//165YaNpXt0UEeOvKZz13xadxXlh8w2zLjpXu1rW6I/mSw1 65YYM9PMI7rTAxNAzcNwLgQbNKmleH1Lxnkw4RiaczChc93by0RrjCt4cXuVvpAfNi3Ukpyvu0tM IN7lCyGffO6kSnPtIbNbgyeO6LU3z+mTt39ei7ND60w01gMvPmP9Q0DF390bc0ZtZoGZhdxXabWI BQQQQAABBBBAAAEEEEAAAQSmowDB4mUelcXlO2SeDzLBy62Tff5rIs1WV19lm6t24YxGAnsW/6Um euhzRt6d3hlvLZ7tO1/RWw2rlWtG//wpq4K+tnJxoFqU9wwTtlSYsKXF+92L//aOCRZDL7lO/9RS 7e04oqX5MdLJKFUDq/K+UG7mS3b57uVYvEXLbdcCjw28ZOZZ+l55NV8w87kk9+iQXjrxil5/65Tv i7lZuvW2AuXnhCV6/v3ivo336sfWU2FK9MBXoj3kZkwHGu5XTUtwPMLr9rXXa1X76+Zy5h22mYfD avr6CuvS1sIt+8yDZGzWGdlaXODpVezXyLFfycpWF1w/wX0io9SYRN+ScR5MNIaeViV0rvu7lVCN 8dN6vcdfqDBbE93+9rpP3+zfUDr9xzPyzJ8N/Mdy5FiTVqxzBQpp3/FWLbayxYnGekwv7Q+cyYVa 4R1zt4b6X9IrvxvUqQ89sefVyropTwUFJnwOHNBqCQsIIIAAAggggAACCCCAAAIITC8B/q/r9BqP iNaM9f9aD1tBlpllZQvcxt95w5phV1x0a8gsuIhCaQuUV2zWeic4/kFnzIRApY3rjVc7/ZsW63M3 TRzK3bBwoVX2vXfMtLmwV1rmopgzHsM2jfiYll2k1t6XNWbalZERPlUwOM/sa4VZZsZgg5kx2BJR w7Mir2y7frSlXPbbUEbdMGxl/z+1WJYlDQ9oUXgTzPbD3U0hoWJFQ5s2fnmJ5s+6oKG+f9WP6qrl e+5Hu9a4Vqi3zn9p+9jb6rFlkT1dr2nMBItWFhXWlpCP7lH1/mafSmsardU7q++ZUrAYv2/JOQ8m HkOr+TEXJjrXY+4U9sWENdIXaIn5HWj3/A70/EqvjZarIMYp33/E+4vird73Ur/Oaan1+/X2q6/a jtqjEydHtTjwgJc4Y22dycXFyjp7Qg1fXyvr19tWVSZm3972v1UeJ3AO2YUPCCCAAAIIIIAAAggg gAACCFxiAe6xeInBp3Q4c9+7h9Zsti6drGo2gZmtgPu87d5rVmJh2yBkMU3XfdpzLa3v5UuU3Qq7 AjnwddT39NnXR12ftJVp6VFCRc9MsautQ9SvWxEaKnrvp2h9rb72bVp2W4MGPMHpZF/G+RH/A3Q8 91Z84MvRZisO6+eNTVbFmubDqist0Px0I2nanZ2/XDse75Anu/W+Wsy9LwNtyFio+6wvzBHW3jlh qDjw9FZzm8g830/+HbZQsUR79h+NeQl64NAh75PqWxLPgxhjGNKmaB/inOvRdolYF7dGmjJuCOzV I9dPXwh8CH03DyFyNQamNpqvwu5pedPnimzbl2npzbZ0Ms5YW2dyV71WLAsNFUNP5R5tW7dMDQeC 99+0HZRFBBBAAAEEEEAAAQQQQAABBKaFgC9fmhZNoRGhAsNqri61ZtGpYo9qiuyxYujW8T+l6yZv cmGbOmd2soKO+AWUlr3QxG7mSupJbJvMTd55I7TNntqFFQ16qOrLys00UwvdY+p99nGVVgdm9bXo 75qXqXNjrHtOhrau95ePWveZjDVb0T30W+tSZhVvV0W0scjI17aOZpW88yddddUC3WzNepyv0keO qmDotDnwbGXnxLiPor9ZH4ycDG2g7dO5EVMj/AaOtu/DFyfTN88+l/c8SMa5Ppka6brHnDdqr/My 9bg2aKNc2lbxF8rK8Pyn0FyWfOLXql+72XdJvncr80fY5NyM/HId7b5bp8+b0bwhW1nWOHt2mGCs 3e+oLzgR0l+9UA1tD+nLBbneWahjw716vLFUjf5fspaah7TsyE/MTGD+U+0H4w0BBBBAAAEEEEAA AQQQQGAaCfD/VqfRYASbMqInaotkTZrKq9HhuuXWPd6C201laTzkXo2BPeNOdAxsaN7dw29Ysydt qx1fnHvtJ0KOUVjbptbKguC6tAzlL6/U8acydfsaX2jU5/qpeiuWKubzOQJ7j53Qo/WBtCfWbEVp /JT/Xo5mv+Ki22POOMzKL9LK/EBx23vafOVM8v6PN91To4a5g7r6ahP3fThinmRcr3bvBLpObV7X qf2m/4+Y/sf95Z1k3zytvHznQTLO9cnXSM8t0d6aJ7XB5ZuR2OWqUVfgdom24Yq3OD8rx7o0OmLb WGOdNlefyDNbWzl5sfYe2R1y+4CMrHxVNh6XOZPNw5Y8lXv006f7tHR9tJMq4sisQAABBBBAAAEE EEAAAQQQQOCSCnAp9CXlnszBPA8IqZB1Za7K1PHYxpBLoANV0mbPDSxOYsqZW6f/YCUa3odReC4y vt66NDRYKtbS+NlTwUwk1kYOrE/PtPXTeHz3G7ZQ0Xa8jEUlaq7yJDeeV5f+j7n3XbzXicf/0TZb sTrqvRW9Na4KViq89cbgBweWMnIKVFpaqtWrV2t16XrtaO3T4bbt1pG6Gtepc2DM+hxrYdJ9u2zn weTP9Vh9lKZaI01LN/5E+8zvWOxXhdr2t5kzzf+aF1hI9D1DmZ8J1ihr2BwSKga/yVBpbbOsM7nn FdNLXggggAACCCCAAAIIIIAAAghMP4G4k56mX5NTuUVude+utj0gpET7juxQ4LkQ4T1PXxC8NLmr 24QP5fkxZ9LJ/Z7tMswbNM878ulaeEvg4uYuvXJyTPkTTPF77403rCbckDnHWnZ84U+2IxQv0Y0h l57avjMB2YLskClh9i8jl0ePaWdjYLZimbm3Ym7kNlHWnDnjiXkyonzj3KrsgnLt3/mGVm1u8R7k yedOqjR3gllsU+rb5TgPpnauR5e92BppWlxap97idTry7PN6+ffvecunz7tBeYvv1J2LzWXJI93a 4T9oceGtSRtt+8zQW/7zgujd8qy91jxsybx5/ykg7FLs2DvxDQIIIIAAAggggAACCCCAAAKXVoAZ i5fWe8KjnWitU6X/Ek1zwa3ajjRoceYEu8yaYy6Z9L+6fqVXRgIfIt/HBp5XS2B1yZ1WODf7+mBA +LNnXglsEeV9TMc6rQpackuSZ+2N9mrX+hLvA0s27jog+1zD9E/caM3e0hl7NBPZzLQp3Czw2D6X dS+9EjODbVHMwNIcxxZu9vzu7cgDJ7BmfGRIAwMD5mdI4xPUufEWT9Tke8WbRDelvpmSSTkPJhjD QLsD71M+1wM72t4TrZE2P0dFq8u1ceNG70/l+nIVeUJFc4yBZzqt2bnXzA3+jtgOfxGL6brxz4Nj +KHtnIpX7EK8DfgeAQQQQAABBBBAAAEEEEAAgcsgQLB4GdCjHbLfPAl4bX2n/ytz77XuR1QQ74EN abkq2VLs36dHj3aciFbarBvX4ce2Wd9VrLrdG554VuR8/qvWk4w99yU8Zk/0rD1MhQHzFOTA5D5V aWmuJ35J3qu/q0VNPb5LtbuaavTsYDBiSzP3nftaof9YPT9Tz5A7xoFH9eJvAoZS5rwJ2jhif/Jv marjzFbM+MzNsprQ+CsNxmhB79PNati1S7t2d2g4VjND9h3XMw3LtGrVKvPzTf02hr9nF/eZ4FPA J5zENsW+eWon4zyYaAw9xwi8LupcD+zsf7/YGgMHdmn9+o3en6f7Y11gPKgnfTc4NEcr1FfvyQ07 +sV+NDMl/8IzQ9j3+kVnj/+WBIE1wfex148HH5J00/XW72twC5YQQAABBBBAAAEEEEAAAQQQuPwC BIuXfww0eGiX1mxu97ekxMxUNA90yJrcVer5Xyq3ZvP1NK5V8wvDET3q76iXVd481/mr/yU7uI15 knG57b6E677dqogKY72qX7XZ2qe4YXXUez5aG1zEQnhvbbc0NNUyVbyuwl+1T9X/o0XRssXejh9o mxV+Vui27NjB4rHHHw3OVtxZobg56fxbtdbKhFr03d3dEbML3UOHVLe5US1NTWpyvaRgDCiN9B7S rq1btXVXq/pH7YmjuQz5c4FwuE/f230goq634+MDanqw3m8gLVn4CWs5fGHKffMUSMJ5MPEY+lqZ yLke6GciNdJ0Wj09Xd6fzf/r8chz3XvPxm+rKXCwkrX6bGbgg//dPaJDrbu0tXarWg/1R4SDscfa PDM6/4uq8Jfpa6lWywtDYcXNRzPz8/ulwX8IKPsv/w/BYqQSaxBAAAEEEEAAAQQQQAABBKaBQHgW MA2adGU1YeREq1ZUWzGGlJepwWee0Ktno1zy++GHylxSotUFWUGkrCITcBRqnf8R0o0bivRuw15t +PwizTbR1tGf/1A1ruAsvgrXfw+75DdNRRVbVdi0zhe09dSraP1b2vvQBi26zlR486h+uLYmOHvK xCKbSxYFj5+kpdyV1ap96Zx+a253d0PhN3RPTmgomP0X68w8STOr0XO8nkYty++Ta1+1Pvsp82CX 8+/qUNv3ta2lx2pNxZ4Nyol1dpsZfTusS87NbMUvTWZGWroZpwaps857jB5XpW57tUbNf3OPMtPc eueV36h6W3Aci7eUKTdwfPegHi6tViA6bh9fqL66Iquti774DeWZRLTPrOlrqdFtr1Voz+YyEx4u MIHSmE6eOKRHK7dZD5mRGYP77rSdA1Yls3BRffMUSPw8iDeGCZ/rnu4l+PuSc0+ZidbbfeezOY+K Sgbl2vp13ZpzndLOv63OH65VY/DXRTurV0SEeoO/eVjV9f7R7GzXwu5eFQX+ISDOWCstRxv2mDPZ /zvfuGGZ+mpdqr73s5przpd3+w7p+2asg2dylb65MsczQLwQQAABBBBAAAEEEEAAAQQQmHYCgehj 2jXsSmnQ2yeCEYK3z30tqvNlV1EJCmvvCA0WzVYFlXvkevd+66EvLXUbgvdTtFUp2dKmumghRWaB 9ux36f5VNb77yvW0aMOqFtuegUXPbMraYGAWWD3h+7kJv7W+zMhV5Y7d1seIBRPIbDqyT6fvWusP 6DpVs9aWANl2KKxp1qbltlmZtu/MBcXqbvmedf+8Ms9sxUn+FqTnlurgnrdNwOjyVexyqdL8RLyK t+t/rrc9WOXCGfkeD+Lf8g/vep/yaz3+JXOpftRco2WV/lrGv3ptS0RZ34pC7Tm4KcYMy4vvm7d2 oudBnDFMxrmecI30fD3YsV2dgRmBfe2qWReIfEPJa9u6tTrKVNbzp0JGU2+dHpcCwWK8sTaHyF6+ Sfu2n9babb7jdjaa4L4x9Ni+T56xjv5E+Ghbsw4BBBBAAAEEEEAAAQQQQACBSy3ApdCXWjzseFfN vSZszcQfF0R9kESGVtZ1aN/Oqhg7F2rL3oNqXF8Q43tzJWzuSnV071NVcfRNCsu26+Dxxvj3fQzb ffb1n7bWzJ0zy1q+qIXMxdrx8mE1xGqkuVvkdtPP1o1FEbPMrOO5h/Rck2duoOdVoYpJzVb0be35 M2f5Rh0/uNc45QVXWkuFqt25T8d3l5uLt22v9Dx9ozYIu+WvPh/xlOHsIk/dNtWURKvrq1VS1WDG oFXLw2ZzWkdKsG+eOk6dB57ayTjXk1Fjfn65jh9uizGGpqF5ZSZoP6pK+8xgTwf8r9zl5dZ9SVW8 RcsXWRGxNImx9pRZXL5Dh9sagnUCxf3vxRWe37cJxjpsez4igAACCCCAAAIIIIAAAgggcDkE/uzc uXP/cTkOPNljvv/++5o1a5Y+9rGZlYH29fnCq7vvvnuyXU3OduMjGnj9TZ25ap7m/emMeb9eN+fm KGOSs/I8jRgZGtCbQ2c0L2uOzgx/oOtzblZOli08SU5LE6oyPjqk1/vN/ekyM+UeGVFaZo7pZ1bs QDGho0XfeWx0WO+fTzOXsLp13j1bmVnzzQXFib/GzFOiT745pDMfmAuUTcGr5mTqMzflKHMqg5h4 M2bEeZBoN8eGB3Xy7VO6at4cjQ6PaE6W5zzKvoTn0biGBl6X+XVT5hy3Rj5IU/bCm5U9Pz3RrrE/ AghcoQLPP/+8t+d5ebH/oWo60Fy2vydNh87TBgQQQAABBBC4pAIz5e9H4SgfffSRLly4oGuvvTb8 q2n1ORk5yLTq0BXfmPRM5eaHzJebMklmdq4yA1cST9Pbu6XPz1Z+gb+RuZO5R+KUGeLukDE/Sxnz fZv53+LuM5kNMgx+vjUAk9nDmW1mwnmQaM8zTJCYb368r8tyGqUrOzffehjSZWlCoojsjwACCCCA AAIIIIAAAgggcMUKzKxpgFfsMNFxBBBAAAEEEEAAAQQQQAABBBBAAAEEppcAweL0Gg9agwACCCCA AAIIIIAAAggggAACCCCAwIwQIFicEcNEIxFAAAEEEEAAAQQQQAABBBBAAAEEEJheAgSL02s8aA0C CCCAAAIIIIAAAggggAACCCCAAAIzQoBgcUYME41EAAEEEEAAAQQQQAABBBBAAAEEEEBgegkQLE6v 8aA1CCCAAAIIIIAAAggggAACCCCAAAIIzAgBgsUZMUw0EgEEEEAAAQQQQAABBBBAAAEEEEAAgekl QLA4vcaD1iCAAAIIIIAAAggggAACCCCAAAIIIDAjBAgWZ8Qw0UgEEEAAAQQQQAABBBBAAAEEEEAA AQSmlwDB4vQaD1qDAAIIIIAAAggggAACCCCAAAIIIIDAjBAgWJwRw0QjEUAAAQQQQAABBBBAAAEE EEAAAQQQmF4CBIvTazxoDQIIIIAAAggggAACCCCAAAIIIIAAAjNCgGBxRgwTjUQAAQQQQAABBBBA AAEEEEAAAQQQQGB6CRAsTq/xoDUIIIAAAggggAACCCCAAAIIIIAAAgjMCAGCxRkxTDQSAQQQQAAB BBBAAAEEEEAAAQQQQACB6SVAsDi9xoPWIIAAAggggAACCCCAAAIIIIAAAgggMCME0mZEK6+gRo6P Duutfz8tmZFxa7Y+viBbmRlTGCb3mIYG39JZd5op4ZZmX6cbc7KUPgXDsZEhvfXHs0rztMHUue6T Nypr/lQqTOFgF7vp+KgGf//vOu/ff/bcjys7O9PDNvNfnjEcekdnvZ1zK232XC3IztZUToNkIDh9 HiR8rptOJlrDPTaioXf+qPPmPPf8xs297pPKzpqfDD5qIIAAAggggAACCCCAAAIIIJDyAimRw6TC KI0Pn1Bz44NydfZFdKe4qkHf2ViqnDjZ3kB3qx6qrFdPZAXt3LdNqxdnRXwTsmJ0QK0/eEj17VEq VO3UtprVyprCGTM+dEy76l06csYcxZTcePDHWhmvEyENivZhXMc6dmtdXVOULwu1Zc939ZfLF0UJ GMfVvWuTKp85o8Lrouwavur0aZ1e8jd6fMdqZYR/59Rn94i6f9Gkym0tUY6Qp5qdW1W5uiBKSJzk viX5PAjvTDLO9YRrjA2qo+mHqmvqDG+eVFylvd+p0tKc5I+8e+iQ/nbZwzozqZNQOm1+b/5m/x6t zk1+WyI7zhoEEEAAAQQQQAABBBBAAAEEpibwZ+fOnfuPqe1yabd+//33NWvWLH3sYzPrqu2+Pl9A ePfdd8cFGznWqrvW1cfZrlhtRx5RQWa0ZM8ES7sfUKUrMhC0Fy3b+ZR2rF5kX2Utjw9164FllVFC SWsTs1ChjqN1yp/EhK7+A7u1psZl31lbOo5q/WR2DtnL/mFEHbV3qS5KFmTfShUuHa9bGRYIjqp1 /R2qn5gopIwKt+toa7km0d3Q/S7m0/iAGm5bpZZ4+5Y06GhjaVibkte3ZJ8H4d1J/FyXEq0xPnhI D6yojnOuS7XNh1VZlB3ehYQ+j/W26vbSeL/roYdI/PcmtB6fEEAgtQWef/55bwfz8vKmdUen8vek ad0RGocAAggggAAC015gpvz9KBzyo48+0oULF3TttdeGfzWtPkdLqaZVA1O+MaMn9KA9VCyp0d4H 1ij3ujS9/bsuPVhdL19E2aV1D3bq+O7SsMBM6n3CzMSzhYoltS5V3/tZzXa/q2fbvq9tLb40rX3z Gl137WFtCg9LTBs2hYSKJXK1VeuzObP1bt+z+n7lNn8I06LSO+brcO9GZcc6c8YH9UT9t7WtPXLm ZWJjOa5DDaGhYlVDs+5bmqe082/r2JOPBWeftdTIdftB1a3MsR3yGi2+r0YVS8ajzPgLbGamhL7t UnAS24eBLxx+H9eBenuoaGZeump0z2dzNPv8u3ruF4+avnX52tBZpx/81yUmIM61tSlJfUvmeWBr nbWYhHNdidZwD6h+hT1UzFOta6u+eKs5V84O6F8e+54a/eduY+UyzTVheHlCYbjVe+9C+qcWq6ai QuPpsacfe7464Gry/96b3cwdDXghgAACCCCAAAIIIIAAAgggMB0FmLHo0KhM9l/i+5+o1Zptvil4 hVXN+smmopDLeN3D3frrouBMQtfhl7Uy2xZKjHSr5K5KK4So2nNQm5bbAzXpRGut1tYHpvmVaf/L O5RrK/HCrhJtaPIHgXlVOvjzTaGXXY8cU+1d6xSoULJzvxpDgi0fonv4Bf1t0Qb5IzCzMs/8BAPG CWdemcuAD/3scT3z+qhuWVGmrxXlhjiM9Xfo9jV1/tHKk2v/41oZdnnocPduFVW6fNvk1ai7c6Pi XPztrxd8GzrUoGXVLd4Vxds7tLs8P/ilQ0uey2Pzl1X7q1foqeN1WhR25evA0w1atbnFt03hFjOT cn3YrMX4jYvXt4TPgzhjmPC5brqYaI2Bjq1aVdfux4o+A7fXbFMa2OYireOPxkRbDGlX3jI1eTcp UcfxRuWHnQ8T7c13CCBwZQvMlH+Rn+zfk67s0aT3CCCAAAIIIJAMgZny96Pwvs6UGYsz6/ricOUZ /3lMv+sOxHWF+lZlaKjo6V5aVpE21xZbPX3n1Li17Fno/5cnrOiusGZvRKjo2Wbx+ofUUOJZ8rza 9eSLw75Fz59jvfppIFRUofa2hIWKnm0yC/TQUw2eJe+rc/N+2SoEVmv83f5gqFhcYwLMTh3cWWZ9 P9HC4G8eVrW5H2N7e4u2Va7SkWH7NC23jj/dYu1es7c5IlT0fJlVdL+2eKi8l3+N62wolbV/zIXx fv2DP1SUSvStr0wQKo4N68QL3Tpw4ID351D3CxoYHo1ZeqIvxk8NWF+X7dkQESp6vsz90jpzIbr/ Ne9qzQosT/Y9Xt+ScB5MPIaJn+vmZE3w92VMLz4ZCBWl7R01US/rzy/9e20P/Mr11KtrYGyyyknZ bqDjH/yhojkLtz9AqJgUVYoggAACCCCAAAIIIIAAAgg4IRDrglYnjkXNCIEM/XlRmQrPnJRuuk+L YtzMb17mNRF7ele4B/XLbYH5gXl64L8tjb6duXh6ZcV2c2/Cbd7vmzpf1Mai1d5Lggef67TCwLyq B7Q0M3qJjEUrTdhSJ9/hXHpxoNI8UMI27dG2W9n2Nm0p9z1kpP/sB7ZvYi+eOfVeyJdvnTapYOBJ MaafB63ws0pfWRprHmKm1u/u0/qQSpP/0P/PPw7OyvQEOlG7N64T5uExa6M+PMZkmmVb9PDfr1du 2Fi6Rwd15MhrOnfNp3VXUX7IbMOMm+7VvrYl+pPJUrNuidE384ju9MAEUPMwnAuT75Z3y3h9S8Z5 MOEYmnMwoXPd24tEa4wreHF7lb4QcxrgfN1dYgLxLl8I+eRzJ1Waaw+Z3Ro8cUSvvXlOn7z981qc HTqdcKKxjjtsJgDeY91EtEQVX4l+T9S4ddgAAQQQQAABBBBAAAEEEEAAgUsgQLB4CZAnOsTi8h0y zweZ4OXWyb4+6/urr7LNVbtwRiOBb4r/UhM99Dkj707vjLcWz/adr+ithtXKNaN//pRVQV9buThQ Lcp7hglbKkzY0uL97sV/e8cEi6GXXKd/aqn2dhzR0vwY6WSUqoFVeV8oN/Mlu3z3cizeouW2a4HH Bl4y8yx9r7yaL8jzOA336JBeOvGKXn/rlO+LuVm69bYC5eeEJXr+/eK+jffqx7ZA54Gogc6YDjTc r5qW4HiE1+1rr9eq9tfN5cw7bDMPh9X09RVy+Xcr3LLPPEjGZp2RrcUFnl7Ffo0c+5WsbHXB9RPc JzJKjUn0LRnnwURj6GlVQue6v1sJ1Rg/rdd7/IUKszXR7W+v+/TN/g3Nk5n/eMZ7m8PAfyxHjjVp xTpXoJD2HW/VYitbjDPWVtXoC/3/ZAu3G2KF29H3ZS0CCCCAAAIIIIAAAggggAACl1og8P+VL/Vx Od4kBcb6f62HrSDLzLKyBW7j77xhzbArLro1ZBZcRPm0BcorNmu9Exz/oDPjZjltXG+82unftFif u2niUO6GhQutsu+9Y6bNhb3SMhfFnPEYtmnEx7TsIrX2vqwx066MjPCpgsF5Zl8rzDIzBhvMjMGW iBqeFXll2/WjLeWy34Yy6oZhK/v/qcWyLDGBzqLwJpjth7ubQkLFioY2bfzyEs2fdUFDff+qH9VV y/fcj3atca1Qb53/0vaxt9VjyyJ7ul7TmAkWrSwqrC0hH92j6v3NPpXWNFqrd1bfM6VgMX7fknMe TDyGVvNjLkx0rsfcKeyLCWukL9AS8zvQ7vkd6PmVXhstV0GMU77/iPcXxVu976V+ndNS6/fr7Vdf tR21RydOjmpx4AEviYy1uRz9x/77rXouxX/gy8xWtEGziAACCCCAAAIIIIAAAgggMA0FuMfiNBwU q0kmaHhozWbrHopVzSYws740s/bOnw1+CmZvwXUhS2m67tOea2l9L1+i7FbYFciBr6O+p8++Pur6 pK1MS48SKpr8U1dbh6hftyI0VPTeT9H6Wn3t27TstgYNeILTyb6M8yNxA51h/byxyapY03xYdaUF mp9uJE27s/OXa8fjHfJkt95Xi7n3ZaANGQt1n/WFiYzW3jlhqDjw9FZzm8g830/+HbZQsUR79h+N eQl64NAh75PqWxLPgxhjGNKmaB/inOvRdolYF7dGmjJuCOzVI9dPXwh8CH03DyFyNQamNpqvwu5p edPnimzbl2npzbZ0copjbSuk3qcejRtu27dnGQEEEEAAAQQQQAABBBBAAIHLLeDLly53Kzh+FIFh NVeXWkGDKvaopsgeK0bZZcJV6brJG8LZps6Z7YOR3YQ7e79My15o5lGZK6njb5rULd55I7TNnuKF FQ16qOrLys00UwvdY+p99nGVVgdm9bXo75qXqXNjrHtOhjav95ePWveZjDVb0T30W+tSZhVvV0W0 scjI17aOZpW88yddddUC3WzNepyv0keOqmDotDnwbGXnxLiPor9ZH4ycDG2g7dO5EVMj/AaOtu/D FyfTN88+l/c8SMa5Ppka6brHnDdqr/My9bg2aKNc2lbxF8rK8Pyn0K2hE79W/drNvkvyvVuZP8Im 52bkl+to9906fd6M5g3ZyrLG2bPD1MY6cAiNndCj1v1Sma1oubCAAAIIIIAAAggggAACCCAwrQUI Fqfl8IzoidoiWZOm8mp0uG65mbmXyGs85F6NgUpxJzoGNjTv7uE3rNmTttWOL8699hMhxyisbVNr ZUFwXVqG8pdX6vhTmbp9jS806nP9VL0VS+M/UdcT6NQHLnuNHeiMn/Lfy9Ectbjo9pgzDrPyi7Qy P9g0ayltvnImef/Hm+6pUcPcQV19tYn7PhwxTzKuV7t3Al2nNq/r1H7T/0dM/+OeD5Psm6eNl+88 SMa5Pvka6bkl2lvzpDa4fDMSu1w16grcLtEarPgL87NyrEujI7aewlgH9u395T/GDbcD2/KOAAII IIAAAggggAACCCCAwHQR4FLo6TISVjs8DwipkHVlrsrU8djGkEugA5umzZ4bWJzElDO3Tv8hOPPP 7d0zTddbl4YGS8VaGj976rIEi+mZtn4aj+9+wxYq2hqbsahEzVV5/jVd+j/m3nfxXicetwc61VHv reitcVWwUuGtNwY/OLCUkVOg0tJSrV69WqtL12tHa58Ot223jtTVuE6dA2PW51gLk+6biSgvz3kw +XM9Vh+lqdZI09KNP9E+8zsW+1Whtv1t5kzzv+YFFhx6Hz2m71vhdhn3VnSImbIIIIAAAggggAAC CCCAAALJF4g76Sn5h6RibAG3undX2x4QUqJ9R3Yo8FyI8P3SFwQvTe7qfkVj5fkxZ9LJ/Z76AhPz dIPmeUc+XQtvCVzc3KVXTo4pPz8j/DDW5/feeMNaviFzjrXs+MKfbEcoXqIbQy49tX1nArIF2Z5g MRig2r+NWDaBzs7GAIon0MmN2CTaijNnPKFebKdo+yS6LrugXPt3vqFVm1u8pZ587qRKc6NNjfQf aUp9uxznwdTO9eh+F1sjTYtL69RbvE5Hnn1eL//+PW/59Hk3KG/xnbpzca7SR7q1w3/Q4sJbHR3t E/tc1qXXJSbwXBTz/I6uwFoEEEAAAQQQQAABBBBAAAEELpcAMxYvl3yU455orVOl/xJNc8Gt2o40 aHFmlA0Dq2bNkfV116/0ykjgi8j3sYHn1RJYXXKnFc7Nvj4YEP7smVcCW0R5H9OxTquCltyS5Fl7 o73atb7E+8CSjbsOyD7XMP0TNyowD1FnJr5oN20KNws8NpVAxxZu9vzu7Sg+F79qfGRIAwMD5mdI 4xOUufEWS0HxJtFNqW/mmEk5DyYYw/BuTflcDy9gPidaI21+jopWl2vjxo3en8r15SryhIqm9sAz nVY8fc3c4O9IlGYktsobAPsuy5aZIznZcDuxg7I3AggggAACCCCAAAIIIIAAAskRIFhMjmPCVfrN k4DX1nf66xRrb/cjKsiMM6E0LVclW4r9+/To0Y4TMdoxrsOPbbO+q1h1uzc88azI+fxXrScZe+5L eMye6Fl7SOMD5inIgcl9qtLSXE/8krxXf1eLmnp8Mw27mmr07GAwYkvLytfXCv3H6vmZeoZ8F3JH Hn1UL/4mYChlzpugjSP2J/+WqTrObMWMz9wsqwmNv9Jg5MG9a3qfblbDrl3atbtDw7GaGbLvuJ5p WKZVq1aZn2/qtzH8Pbu4zwSfAh72PJGQippi3zw7J+M8mGgM7Q28qHPdXsAsX2yNgQO7tH79Ru/P 0/2xLicf1JN1gfOoUF+9Jzfs6Mn7eOynttmKO5mtmDxZKiGAAAIIIIAAAggggAACCFwKAYLFS6Ec 5xiDh3ZpzeZ2/1YlZqbibi3NihMq+rfO/1K5NZuvp3Gtml8Yjjhaf0e9rPLmuc5f/S+2p0ubJxmX 2+5LuO7brYqoMNar+lWbrbrFDauj3vPR2uAiFsJ7a7uloamWqeJ1Ff6qfar+Hy2Kli32dvxA1oN1 VaHbsmMHi8cefzR4+akJdOLmpPNv1VrPVePeV4u+u7s7Ynahe+iQ6jY3qqWpSU2ulxSMAaWR3kPa tXWrtu5qVf+oPXE0lyF/LhAO9+l7uw9E1PUecnxATQ/W+48vLVkY+kAb6wuzMOW+eXZOwnkw8Rj6 WpjIue6rICVSI02n1dPT5f3Z/L8ejzzXvfds/LaaAgcrWavPZgY++N/dIzrUuktba7eq9VC/eZZ0 6Cv2WIdu5w2ArRnKJtxe4VyAGXZkPiKAAAIIIIAAAggggAACCCCQFIHwLCApRSkyeYGRE61aUW3F GFJepgafeUKvno1yye+HHypzSYlWF2QFD5BVZAKOQq3zP0K6cUOR3m3Yqw2fX6TZJto6+vMfqsYV mH0lVbj+e9g93NJUVLFVhU3rfEFbT72K1r+lvQ9t0KLrTIU3j+qHa2tkq6DNJYuCx0/SUu7KatW+ dE6/Nbe7u6HwG7onJzQUzP6LdWaepJnV6DleT6OW5ffJta9an/2UebDL+Xd1qO372tYSuKTU9HPP BuXEOrvNjL4d9kDnS5MJdNLNODVInXXeHve4KnXbqzVq/pt7lJnm1juv/EbV24LjWLylTLmB47sH 9XBptQLRcfv4QvXVFVlyi774DeWZRLTPrOlrqdFtr1Voz+YyEx4uMDNLx3TyxCE9WrnNemqw6Z3u u9N2DliVzMJF9c1TIPHzIN4YJnyue7qX4O9Lzj1lJlpv953P5jwqKhmUa+vXdWvOdUo7/7Y6f7hW jcGTXTurV1izez1Kntfgbx5Wdb1/NDvbtbC7V0WBfwiIM9a+Cr4/X7CF22WTCbftO7OMAAIIIIAA AggggAACCCCAwDQQCEQf06ApV2YT3j4RDMO8An0tqvNlV1FBCmvvCA0WzVYFlXvkevd+66EvLXUb gvdTtFUp2dKmupU5tjX+xcwC7dnv0v2ranz3letp0YZVLZHbmUim7UhtMDCLskXkqnORq6KtychV 5Y7d0b7xrUvL0aYj+3T6rrX+gK5TNWttCZBtz8KaZm1abpuVafvOXFCs7pbvWffP8wY6k/wtSM8t 1cE9b5uA0eWr2OVSpfmJeBVv1/9cb3uwyoUz8j0exL/lH941caHt8S+ZS/Wj5hotq/TXMv7Va1si yvpWFGrPwU0xZlhefN+8tRM9D+KMYTLO9YRrpOfrwY7t6iz13xqgr1016wKRbyh5bVu3VkeZynr+ VMho6q3T41IgWIw31v5DuIe79T1buF0xqXA7tH18QgABBBBAAAEEEEAAAQQQQOByC3Ap9GUegavm XjOlFiyI+iCJDK2s69C+nVUxahVqy96DalxfEON7E3LlrlRH9z5VFUffpLBsuw4eb4x/38ew3Wdf /2lrzdw5s6zli1rIXKwdLx9WQ6xGmrtFbjf9bN1YFDHLzDqee0jPNXnmBnpeFZpqoJOzfKOOH9xr nPJ8JUL+LFTtzn06vrvcXLxte6Xn6Ru1Qdgtf/X5iKcMZxd56rappiRaXV+tkqoGMwatWh42m9M6 UoJ989Rx6jzw1E7GuZ6MGvPzy3X8cFuMMTQNzSszQftRVdpnBns64H/lLi+37kuq4i1avsj2hPBJ jLWnzPDvnruocDvQBt4RQAABBBBAAAEEEEAAAQQQmA4Cf3bu3Ln/mA4NidWG999/X7NmzdLHPjaz MtC+Pl94dffdd8fqmjPrx0c08PqbOnPVPM370xnzfr1uzs1RxiRn5XkaNTI0oDeHzmhe1hydGf5A 1+fcrJwsW3jiTMunVHV8dEiv9w+Z2y9myj0yorTMHNPPrNiB4pSqT27jsdFhvX8+TXPNpdDn3bOV mTXfXFCc+GvMPCX65JtDOvOBuUDZFLxqTqY+c1OOMqcyiIk3Y0acB4l2c2x4UCffPqWr5s3R6PCI 5mR5zqPsS3oeJdoH9kcAAQTsAs8//7z3Y15e7H+osm9/uZYv29+TLleHOS4CCCCAAAIIXDaBmfL3 o3Cgjz76SBcuXNC1114b/tW0+pyMHGRadeiKb0x6pnLzQ+bLTZkkMztXmYEriaNcOT3lgg7skD4/ W/kF/kbmTuYeiclvRMb8LGXM99X1vyXlIBkGP98agKSUvKgiM+E8uKiO2XbKMEFivvnxvi7PaWRr DYsIIIAAAggggAACCCCAAAIIzCyBmTUNcGbZ0loEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWH lo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgW U3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAABBFJW gGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAABBBBA IGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAABBBBA AAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAABBBBA AAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAABBBBA AAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBA AAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBA AAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBA AAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBA AAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRG AAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpn S2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADB onO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALO CRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAII IOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAII IIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAII IIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAII IIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAII IIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAII IIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAII IIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAII IIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aO IYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2 aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBg MWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBl BQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAAB BFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAAB BBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAAB BBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAAB BBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAAB BBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAAB BBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAAB BBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgAB BBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tl BBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJz tlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQ LDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCLEb0iIAAEAASURBVCCAAAII IIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAII IIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAII IIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAII IIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aO IYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2 aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBg MWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBl BQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAAB BFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAAB BBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAAB BBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAAB BBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAAB BBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAAB BBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAAB BBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgAB BBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tl BBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJz tlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQ LDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDg nADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCA AALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCA AAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCA AAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCA AAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCA AAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCA AAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCA AAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGA AAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjp GAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFl h5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUI FlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRS VoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQ QCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQQAABBBBAAAEEEEAAAQQQ QAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZURgABBBBAAAEEEEAAAQQQ QAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6Z0tlBBBAAAEEEEAAAQQQ QAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwAwaJztlRGAAEEEEAAAQQQ QAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAACzgkQLDpnS2UEEEAAAQQQ QAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAACCCDgnADBonO2VEYAAQQQ QAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAACCCCAAALOCRAsOmdLZQQQ QAABBBBAAAEEEEAAAQQQQAABBFJWgGAxZYeWjiGAAAIIIIAAAggggAACCCCAAAIIIOCcAMGic7ZU RgABBBBAAAEEEEAAAQQQQAABBBBAIGUFCBZTdmjpGAIIIIAAAggggAACCCCAAAIIIIAAAs4JECw6 Z0tlBBBAAAEEEEAAAQQQQAABBBBAAAEEUlaAYDFlh5aOIYAAAggggAACCCCAAAIIIIAAAggg4JwA waJztlRGAAEEEEAAAQQQQAABBBBAAAEEEEAgZQUIFlN2aOkYAggggAACCCCAAAIIIIAAAggggAAC zgkQLDpnS2UEEEAAAQQQQAABBBBAAAEEEEAAAQRSVoBgMWWHlo4hgAACCCCAAAIIIIAAAggggAAC CCDgnADBonO2VEYAAQQQQAABBBBAAAEEEEAAAQQQQCBlBQgWU3Zo6RgCCCCAAAIIIIAAAggggAAC CCCAAALOCRAsOmdL5f+fvTuB86Ku/wf+ZrnkVhFQ0bzQNPEqrzKlvEoDzbTIjDzII4jK1C6vUqkU j9KwslDL/hpaWeKRP4/EK7zyQvPCK1FBEJFLYNn9z+zu97vfZXdhl2Vgd/Y5j8fyne/MfD7z+Tw/ A8LLz8wQIECAAAECBAgQIECAAAECBAgQyK2AYDG3Q6tjBAgQIECAAAECBAgQIECAAAECBLITECxm Z6tmAgQIECBAgAABAgQIECBAgAABArkVECzmdmh1jAABAgQIECBAgAABAgQIECBAgEB2AoLF7GzV TIAAAQIECBAgQIAAAQIECBAgQCC3AoLF3A6tjhEgQIAAAQIECBAgQIAAAQIECBDITkCwmJ2tmgkQ IECAAAECBAgQIECAAAECBAjkVkCwmNuh1TECBAgQIECAAAECBAgQIECAAAEC2QkIFrOzVTMBAgQI ECBAgAABAgQIECBAgACB3AoIFnM7tDpGgAABAgQIECBAgAABAgQIECBAIDsBwWJ2tmomQIAAAQIE CBAgQIAAAQIECBAgkFsBwWJuh1bHCBAgQIAAAQIECBAgQIAAAQIECGQnIFjMzlbNBAgQIECAAAEC BAgQIECAAAECBHIrIFjM7dDqGAECBAgQIECAAAECBAgQIECAAIHsBASL2dmqmQABAgQIECBAgAAB AgQIECBAgEBuBQSLuR1aHSNAgAABAgQIECBAgAABAgQIECCQnYBgMTtbNRMgQIAAAQIECBAgQIAA AQIECBDIrYBgMbdDq2MECBAgQIAAAQIECBAgQIAAAQIEshMQLGZnq2YCBAgQIECAAAECBAgQIECA AAECuRUQLOZ2aHWMAAECBAgQIECAAAECBAgQIECAQHYCgsXsbNVMgAABAgQIECBAgAABAgQIECBA ILcCgsXcDq2OESBAgAABAgQIECBAgAABAgQIEMhOQLCYna2aCRAgQIAAAQIECBAgQIAAAQIECORW QLCY26HVMQIECBAgQIAAAQIECBAgQIAAAQLZCQgWs7NVMwECBAgQIECAAAECBAgQIECAAIHcCggW czu0OkaAAAECBAgQIECAAAECBAgQIEAgOwHBYna2aiZAgAABAgQIECBAgAABAgQIECCQWwHBYm6H VscIECBAgAABAgQIECBAgAABAgQIZCcgWMzOVs0ECBAgQIAAAQIECBAgQIAAAQIEcisgWMzt0OoY AQIECBAgQIAAAQIECBAgQIAAgewEBIvZ2aqZAAECBAgQIECAAAECBAgQIECAQG4FBIu5HVodI0CA AAECBAgQIECAAAECBAgQIJCdgGAxO1s1EyBAgAABAgQIECBAgAABAgQIEMitgGAxt0OrYwQIECBA gAABAgQIECBAgAABAgSyExAsZmerZgIECBAgQIAAAQIECBAgQIAAAQK5FRAs5nZodYwAAQIECBAg QIAAAQIECBAgQIBAdgKCxexs1UyAAAECBAgQIECAAAECBAgQIEAgtwKCxdwOrY4RIECAAAECBAgQ IECAAAECBAgQyE5AsJidrZoJECBAgAABAgQIECBAgAABAgQI5FZAsJjbodUxAgQIECBAgAABAgQI ECBAgAABAtkJCBazs1UzAQIECBAgQIAAAQIECBAgQIAAgdwKCBZzO7Q6RoAAAQIECBAgQIAAAQIE CBAgQCA7AcFidrZqJkCAAAECBAgQIECAAAECBAgQIJBbAcFibodWxwgQIECAAAECBAgQIECAAAEC BAhkJyBYzM5WzQQIECBAgAABAgQIECBAgAABAgRyKyBYzO3Q6hgBAgQIECBAgAABAgQIECBAgACB 7AQEi9nZqpkAAQIECBAgQIAAAQIECBAgQIBAbgUEi7kdWh0jQIAAAQIECBAgQIAAAQIECBAgkJ2A YDE7WzUTIECAAAECBAgQIECAAAECBAgQyK2AYDG3Q6tjBAgQIECAAAECBAgQIECAAAECBLITECxm Z6tmAgQIECBAgAABAgQIECBAgAABArkVECzmdmh1jAABAgQIECBAgAABAgQIECBAgEB2AoLF7GzV TIAAAQIECBAgQIAAAQIECBAgQCC3AoLF3A6tjhEgQIAAAQIECBAgQIAAAQIECBDITkCwmJ2tmgkQ IECAAAECBAgQIECAAAECBAjkVkCwmNuh1TECBAgQIECAAAECBAgQIECAAAEC2QkIFrOzVTMBAgQI ECBAgAABAgQIECBAgACB3AoIFnM7tDpGgAABAgQIECBAgAABAgQIECBAIDsBwWJ2tmomQIAAAQIE CBAgQIAAAQIECBAgkFsBwWJuh1bHCBAgQIAAAQIECBAgQIAAAQIECGQnIFjMzlbNBAgQIECAAAEC BAgQIECAAAECBHIrIFjM7dDqGAECBAgQIECAAAECBAgQIECAAIHsBASL2dmqmQABAgQIECBAgAAB AgQIECBAgEBuBQSLuR1aHSNAgAABAgQIECBAgAABAgQIECCQnYBgMTtbNRMgQIAAAQIECBAgQIAA AQIECBDIrYBgMbdDq2MECBAgQIAAAQIECBAgQIAAAQIEshMQLGZnq2YCBAgQIECAAAECBAgQIECA AAECuRUQLOZ2aHWMAAECBAgQIECAAAECBAgQIECAQHYCgsXsbNVMgAABAgQIECBAgAABAgQIECBA ILcCgsXcDq2OESBAgAABAgQIECBAgAABAgQIEMhOQLCYna2aCRAgQIAAAQIECBAgQIAAAQIECORW QLCY26HVMQIECBAgQIAAAQIECBAgQIAAAQLZCQgWs7NVMwECBAgQIECAAAECBAgQIECAAIHcCggW czu0OkaAAAECBAgQIECAAAECBAgQIEAgOwHBYna2aiZAgAABAgQIECBAgAABAgQIECCQWwHBYm6H VscIECBAgAABAgQIECBAgAABAgQIZCcgWMzOVs0ECBAgQIAAAQIECBAgQIAAAQIEcisgWMzt0OoY AQIECBAgQIAAAQIECBAgQIAAgewEBIvZ2aqZAAECBAgQIECAAAECBAgQIECAQG4FBIu5HVodI0CA AAECBAgQIECAAAECBAgQIJCdgGAxO1s1EyBAgAABAgQIECBAgAABAgQIEMitgGAxt0OrYwQIECBA gAABAgQIECBAgAABAgSyExAsZmerZgIECBAgQIAAAQIECBAgQIAAAQK5FRAs5nZodYwAAQIECBAg QIAAAQIECBAgQIBAdgKCxexs1UyAAAECBAgQIECAAAECBAgQIEAgtwKCxdwOrY4RIECAAAECBAgQ IECAAAECBAgQyE5AsJidrZoJECBAgAABAgQIECBAgAABAgQI5FZAsJjbodUxAgQIECBAgAABAgQI ECBAgAABAtkJCBazs1UzAQIECBAgQIAAAQIECBAgQIAAgdwKCBZzO7Q6RoAAAQIECBAgQIAAAQIE CBAgQCA7AcFidrZqJkCAAAECBAgQIECAAAECBAgQIJBbAcFibodWxwgQIECAAAECBAgQIECAAAEC BAhkJyBYzM5WzQQIECBAgAABAgQIECBAgAABAgRyKyBYzO3Q6hgBAgQIECBAgAABAgQIECBAgACB 7AQEi9nZqpkAAQIECBAgQIAAAQIECBAgQIBAbgUEi7kdWh0jQIAAAQIECBAgQIAAAQIECBAgkJ2A YDE7WzUTIECAAAECBAgQIECAAAECBAgQyK2AYDG3Q6tjBAgQIECAAAECBAgQIECAAAECBLITECxm Z6tmAgQIECBAgAABAgQIECBAgAABArkVECzmdmh1jAABAgQIECBAgAABAgQIECBAgEB2AoLF7GzV TIAAAQIECBAgQIAAAQIECBAgQCC3AoLF3A6tjhEgQIAAAQIECBAgQIAAAQIECBDITkCwmJ2tmgkQ IECAAAECBAgQIECAAAECBAjkVkCwmNuh1TECBAgQIECAAAECBAgQIECAAAEC2QkIFrOzVTMBAgQI ECBAgAABAgQIECBAgACB3AoIFnM7tDpGgAABAgQIECBAgAABAgQIECBAIDsBwWJ2tmomQIAAAQIE CBAgQIAAAQIECBAgkFsBwWJuh1bHCBAgQIAAAQIECBAgQIAAAQIECGQnIFjMzlbNBAgQIECAAAEC BAgQIECAAAECBHIrIFjM7dDqGAECBAgQIECAAAECBAgQIECAAIHsBASL2dmqmQABAgQIECBAgAAB AgQIECBAgEBuBQSLuR1aHSNAgAABAgQIECBAgAABAgQIECCQnYBgMTtbNRMgQIAAAQIECBAgQIAA AQIECBDIrYBgMbdDq2MECBAgQIAAAQIECBAgQIAAAQIEshMQLGZnq2YCBAgQIECAAAECBAgQIECA AAECuRUQLOZ2aHWMAAECBAgQIECAAAECBAgQIECAQHYCgsXsbNVMgAABAgQIECBAgAABAgQIECBA ILcCgsXcDq2OESBAgAABAgQIECBAgAABAgQIEMhOQLCYna2aCRAgQIAAAQIECBAgQIAAAQIECORW QLCY26HVMQIECBAgQIAAAQIECBAgQIAAAQLZCQgWs7NVMwECBAgQIECAAAECBAgQIECAAIHcCggW czu0OkaAAAECBAgQIECAAAECBAgQIEAgOwHBYna2aiZAgAABAgQIECBAgAABAgQIECCQWwHBYm6H VscIECBAgAABAgQIECBAgAABAgQIZCcgWMzOVs0ECBAgQIAAAQIECBAgQIAAAQIEcisgWMzt0OoY AQIECBAgQIAAAQIECBAgQIAAgewEBIvZ2aqZAAECBAgQIECAAAECBAgQIECAQG4FBIu5HVodI0CA AAECBAgQIECAAAECBAgQIJCdgGAxO1s1EyBAgAABAgQIECBAgAABAgQIEMitgGAxt0OrYwQIECBA gAABAgQIECBAgAABAgSyExAsZmerZgIECBAgQIAAAQIECBAgQIAAAQK5FRAs5nZodYwAAQIECBAg QIAAAQIECBAgQIBAdgKCxexs1UyAAAECBAgQIECAAAECBAgQIEAgtwKCxdwOrY4RIECAAAECBAgQ IECAAAECBAgQyE5AsJidrZoJECBAgAABAgQIECBAgAABAgQI5FZAsJjbodUxAgQIECBAgAABAgQI ECBAgAABAtkJCBazs1UzAQIECBAgQIAAAQIECBAgQIAAgdwKCBZzO7Q6RoAAAQIECBAgQIAAAQIE CBAgQCA7AcFidrZqJkCAAAECBAgQIECAAAECBAgQIJBbAcFibodWxwgQIECAAAECBAgQIECAAAEC BAhkJyBYzM5WzQQIECBAgAABAgQIECBAgAABAgRyKyBYzO3Q6hgBAgQIECBAgAABAgQIECBAgACB 7AQEi9nZqpkAAQIECBAgQIAAAQIECBAgQIBAbgUEi7kdWh0jQIAAAQIECBAgQIAAAQIECBAgkJ2A YDE7WzUTIECAAAECBAgQIECAAAECBAgQyK2AYDG3Q6tjBAgQIECAAAECBAgQIECAAAECBLITECxm Z6tmAgQIECBAgAABAgQIECBAgAABArkVECzmdmh1jAABAgQIECBAgAABAgQIECBAgEB2AoLF7GzV TIAAAQIECBAgQIAAAQIECBAgQCC3AoLF3A6tjhEgQIAAAQIECBAgQIAAAQIECBDITkCwmJ2tmgkQ IECAAAECBAgQIECAAAECBAjkVkCwmNuh1TECBAgQIECAAAECBAgQIECAAAEC2QkIFrOzVTMBAgQI ECBAgAABAgQIECBAgACB3AoIFnM7tDpGgAABAgQIECBAgAABAgQIECBAIDsBwWJ2tmomQIAAAQIE CBAgQIAAAQIECBAgkFsBwWJuh1bHCBAgQIAAAQIECBAgQIAAAQIECGQnIFjMzlbNBAgQIECAAAEC BAgQIECAAAECBHIrIFjM7dDqGAECBAgQIECAAAECBAgQIECAAIHsBASL2dmqmQABAgQIECBAgAAB AgQIECBAgEBuBQSLuR1aHSNAgAABAgQIECBAgAABAgQIECCQnYBgMTtbNRMgQIAAAQIECBAgQIAA AQIECBDIrYBgMbdDq2MECBAgQIAAAQIECBAgQIAAAQIEshMQLGZnq2YCBAgQIECAAAECBAgQIECA AAECuRUQLOZ2aHWMAAECBAgQIECAAAECBAgQIECAQHYCgsXsbNVMgAABAgQIECBAgAABAgQIECBA ILcCgsXcDq2OESBAgAABAgQIECBAgAABAgQIEMhOQLCYna2aCRAgQIAAAQIECBAgQIAAAQIECORW QLCY26HVMQIECBAgQIAAAQIECBAgQIAAAQLZCQgWs7NVMwECBAgQIECAAAECBAgQIECAAIHcCggW czu0OkaAAAECBAgQIECAAAECBAgQIEAgOwHBYna2aiZAgAABAgQIECBAgAABAgQIECCQWwHBYm6H VscIECBAgAABAgQIECBAgAABAgQIZCcgWMzOVs0ECBAgQIAAAQIECBAgQIAAAQIEcisgWMzt0OoY AQIECBAgQIAAAQIECBAgQIAAgewEBIvZ2aqZAAECBAgQIECAAAECBAgQIECAQG4FBIu5HVodI0CA AAECBAgQIECAAAECBAgQIJCdgGAxO1s1EyBAgAABAgQIECBAgAABAgQIEMitgGAxt0OrYwQIECBA gAABAgQIECBAgAABAgSyExAsZmerZgIECBAgQIAAAQIECBAgQIAAAQK5FRAs5nZodYwAAQIECBAg QIAAAQIECBAgQIBAdgKCxexs1UyAAAECBAgQIECAAAECBAgQIEAgtwKCxdwOrY4RIECAAAECBAgQ IECAAAECBAgQyE5AsJidrZoJECBAgAABAgQIECBAgAABAgQI5FZAsJjbodUxAgQIECBAgAABAgQI ECBAgAABAtkJCBazs1UzAQIECBAgQIAAAQIECBAgQIAAgdwKCBZzO7Q6RoAAAQIECBAgQIAAAQIE CBAgQCA7AcFidrZqJkCAAAECBAgQIECAAAECBAgQIJBbAcFibodWxwgQIECAAAECBAgQIECAAAEC BAhkJyBYzM5WzQQIECBAgAABAgQIECBAgAABAgRyKyBYzO3Q6hgBAgQIECBAgAABAgQIECBAgACB 7AQEi9nZqpkAAQIECBAgQIAAAQIECBAgQIBAbgUEi7kdWh0jQIAAAQIECBAgQIAAAQIECBAgkJ2A YDE7WzUTIECAAAECBAgQIECAAAECBAgQyK2AYDG3Q6tjBAgQIECAAAECBAgQIECAAAECBLITECxm Z6tmAgQIECBAgAABAgQIECBAgAABArkVECzmdmh1jAABAgQIECBAgAABAgQIECBAgEB2AoLF7GzV TIAAAQIECBAgQIAAAQIECBAgQCC3AoLF3A6tjhEgQIAAAQIECBAgQIAAAQIECBDITkCwmJ2tmgkQ IECAAAECBAgQIECAAAECBAjkVkCwmNuh1TECBAgQIECAAAECBAgQIECAAAEC2QkIFrOzVTMBAgQI ECBAgAABAgQIECBAgACB3AoIFnM7tDpGgAABAgQIECBAgAABAgQIECBAIDsBwWJ2tmomQIAAAQIE CBAgQIAAAQIECBAgkFsBwWJuh1bHCBAgQIAAAQIECBAgQIAAAQIECGQnIFjMzlbNBAgQIECAAAEC BAgQIECAAAECBHIrIFjM7dDqGAECBAgQIECAAAECBAgQIECAAIHsBASL2dmqmQABAgQIECBAgAAB AgQIECBAgEBuBQSLuR1aHSNAgAABAgQIECBAgAABAgQIECCQnYBgMTtbNRMgQIAAAQIECBAgQIAA AQIECBDIrYBgMbdDq2MECBAgQIAAAQIECBAgQIAAAQIEshMQLGZnq2YCBAgQIECAAAECBAgQIECA AAECuRUQLOZ2aHWMAAECBAgQIECAAAECBAgQIECAQHYCgsXsbNVMgAABAgQIECBAgAABAgQIECBA ILcCgsXcDq2OESBAgAABAgQIECBAgAABAgQIEMhOQLCYna2aCRAgQIAAAQIECBAgQIAAAQIECORW QLCY26HVMQIECBAgQIAAAQIECBAgQIAAAQLZCQgWs7NVMwECBAgQIECAAAECBAgQIECAAIHcCggW czu0OkaAAAECBAgQIECAAAECBAgQIEAgOwHBYna2aiZAgAABAgQIECBAgAABAgQIECCQWwHBYm6H VscIECBAgAABAgQIECBAgAABAgQIZCcgWMzOVs0ECBAgQIAAAQIECBAgQIAAAQIEcisgWMzt0OoY AQIECBAgQIAAAQIECBAgQIAAgewEBIvZ2aqZAAECBAgQIECAAAECBAgQIECAQG4FBIu5HVodI0CA AAECBAgQIECAAAECBAgQIJCdgGAxO1s1EyBAgAABAgQIECBAgAABAgQIEMitgGAxt0OrYwQIECBA gAABAgQIECBAgAABAgSyExAsZmerZgIECBAgQIAAAQIECBAgQIAAAQK5FRAs5nZodYwAAQIECBAg QIAAAQIECBAgQIBAdgKCxexs1UyAAAECBAgQIECAAAECBAgQIEAgtwKCxdwOrY4RIECAAAECBAgQ IECAAAECBAgQyE5AsJidrZoJECBAgAABAgQIECBAgAABAgQI5FZAsJjbodUxAgQIECBAgAABAgQI ECBAgAABAtkJCBazs1UzAQIECBAgQIAAAQIECBAgQIAAgdwKCBZzO7Q6RoAAAQIECBAgQIAAAQIE CBAgQCA7AcFidrZqJkCAAAECBAgQIECAAAECBAgQIJBbAcFibodWxwgQIECAAAECBAgQIECAAAEC BAhkJyBYzM5WzQQIECBAgAABAgQIECBAgAABAgRyKyBYzO3Q6hgBAgQIECBAgAABAgQIECBAgACB 7AQEi9nZqpkAAQIECBAgQIAAAQIECBAgQIBAbgUEi7kdWh0jQIAAAQIECBAgQIAAAQIECBAgkJ2A YDE7WzUTIECAAAECBAgQIECAAAECBAgQyK2AYDG3Q6tjBAgQIECAAAECBAgQIECAAAECBLITECxm Z6tmAgQIECBAgAABAgQIECBAgAABArkVECzmdmh1jAABAgQIECBAgAABAgQIECBAgEB2AoLF7GzV TIAAAQIECBAgQIAAAQIECBAgQCC3AoLF3A6tjhEgQIAAAQIECBAgQIAAAQIECBDITkCwmJ2tmgkQ IECAAAECBAgQIECAAAECBAjkVkCwmNuh1TECBAgQIECAAAECBAgQIECAAAEC2QkIFrOzVTMBAgQI ECBAgAABAgQIECBAgACB3AoIFnM7tDpGgAABAgQIECBAgAABAgQIECBAIDsBwWJ2tmomQIAAAQIE CBAgQIAAAQIECBAgkFsBwWJuh1bHCBAgQIAAAQIECBAgQIAAAQIECGQnIFjMzlbNBAgQIECAAAEC BAgQIECAAAECBHIrIFjM7dDqGAECBAgQIECAAAECBAgQIECAAIHsBDplV7WaU4EHH3wQBAECBAgQ IECAQAMC/p7UAIpNBAgQIECAAIE2JGDGYhsaLE0lQIAAAQIECBAgQIAAAQIECBAg0FoEOixcuLCy tTSmoXbMnTs3OnbsGGVlMtCGfGwjQIAAAQIECBAgQIAAAQIECBDIl0BFRUUsW7Ys+vTp06o7Jq1r 1cOjcQQIECBAgAABAgQIECBAgAABAgRap4BgsXWOi1YRIECAAAECBAgQIECAAAECBAgQaNUCgsVW PTwaR4AAAQIECBAgQIAAAQIECBAgQKB1CggWW+e4aBUBAgQIECBAgAABAgQIECBAgACBVi0gWGzV w6NxBAgQIECAAAECBAgQIECAAAECBFqngGCxdY6LVhEgQIAAAQIECBAgQIAAAQIECBBo1QKCxVY9 PBpHgAABAgQIECBAgAABAgQIECBAoHUKCBZb57hoFQECBAgQIECAAAECBAgQIECAAIFWLSBYbNXD o3EECBAgQIAAAQIECBAgQIAAAQIEWqeAYLF1jotWESBAgAABAgQIECBAgAABAgQIEGjVAoLFVj08 GkeAAAECBAgQIECAAAECBAgQIECgdQoIFlvnuGgVAQIECBAgQIAAAQIECBAgQIAAgVYtIFhs1cOj cQQIECBAgAABAgQIECBAgAABAgRap4BgsXWOi1YRIECAAAECBAgQIECAAAECBAgQaNUCgsVWPTwa R4AAAQIECBAgQIAAAQIECBAgQKB1CnRqnc1q+62aMmVKm+pEZWVlVXs32WSTNtXuTTfdtE21V2MJ ECBAgACBCH9PWjNXgb8nrRlnZyFAgAABAu1ZwIzF9jz6+k6AAAECBAgQIECAAAECBAgQIEBgFQXM WFxFuKYWO/DAA5t66Fo97vbbb686/1ZbbbVW29HUk0+bNq2phzqOAAECBAgQaKUC/p6UzcD4e1I2 rmolQIAAAQIE6guYsVjfxBYCBAgQIECAAAECBAgQIECAAAECBFYiIFhcCZDdBAgQIECAAAECBAgQ IECAAAECBAjUFxAs1jexhQABAgQIECBAgAABAgQIECBAgACBlQgIFlcCZDcBAgQIECBAgAABAgQI ECBAgAABAvUFvLylvslq3VJZWbla68u6srbW3qw91E+AAAECBAhkJ9DW/t7R1tqb3cipmQABAgQI ECBQLSBYdCUQIEBgFQUqFs6IV16fE0uryneOXuv3i4H9e69ibdkWm/nva+JX97wR3dYZFMd9e3gM KKto8gnLKqbHH8//Y/xv0aLY8pBvx/Bd+za5rAMJECBAgAABAgQIECBAIL8CgsX8jq2erTaBBTHp eyPi2IfvjX12vyquuWBY9Kipu8Pb/xdfGPzTqNxn/QbP9u67HWLz3XeLQ780PIbtukWsid9wHWbd E8ds++OYm7Spw7vvxuw9To1bzh9abHODDW11G1u3eVnF7Lj10rPiq+dNrC83ZGT87qyT47CdNqy/ by1umfPcXXH5RTcnLRgSn/3GV2LAOk0PFjssfjfuuuiimJSU3mfjowSLa3EcnZoAAQIECBAgQIAA AQKtSWBN5Bytqb9tvi2DBw+u6sPUqVPbfF/aUgfmv3NvREJ+b9/5UV6WPJq0ojqUWTJnRkyu2tF4 b6ZOnRw3X3lhxLCx8egVo2LzzssaP7iFe8rK5saVJx5RFQBF0uSqpe+8Om1u4SnWWPHWat5x4XPx 04M/GeMa+y04eUIcv9+EuPOXD8T4oz68xrxWdqJOXQpxeO/oVNn0ULGq3s4RPWtO0Ltrh5Wdyn4C BAisNQF/T1pr9E5MgAABAgQItFMBwWI7HXjdbp5A15LDO9WEilWbksCluAweGacfum588EH1lnXW iXjqH8ksr0IANen02PXLvWPajUdFn9I6ihW0fOXVv58Xp06uX0+dNtff3Sq3tEbzsrIZcXGdUHFI nP/ns+OzO/aNJe+8GLf/4dI448rqRHfit/eKPfd4K0YMKr1IWiW1RhEgQIAAAQIECBAgQIAAgVUS ECyuEptCBOoLXHL1z2PE5svN5jr5tJj+7+viqGEnp/MaIyaPiSsfHRonf7RX/QpauKXL3Hvia8dd 1cJa2lbxNW0+45bxcW4hKI6RccerF8cuPaufsBj9B8ZJF3wqPrnt6PjU96pvkT75d/+KI88/cI3c At+2Rk5rCRAgQIAAAQIECBAgQCAPAoLFPIyiPrQKgSWL0qmK3ZZrS6cY+PERccPEN2K74RdV7Rs7 8bEY89FPVYVNC2bPiPc+KE+2d44NBvaP0ll6pRW9P3N6zEvyq049+8WAPl1Kd9WsL4g/f+eI6vAy 2XL+3Y/Gpv9v1/jKhAYObeam9AUl/338v/HKnPnVJbusF4O23yG2HdjYS0rK493pM+L95Oh+Gw6M Hh3L463nn47nX3sn5i9ZEv0/8snYfct1m9mKhg9fk+ZlZbPjlt9fXtOQwXH14xfUhoolzdvpyJPi yCRYfLrqqQVLYnGyr3l/0JbHzNf+Gy8+/1bMSbzSZb1Nto7BO24XfVbywpWyirnx3GOPxwszkrHq 0iXWW2+z2Han7aJvl6bd+vz+9OfiP8+8lIxTUrznevGhzbeLbTevfn5ozehXtaf0l8K1Gd3Wi4Hr d4+K96fHU0+/GG+k10uXAfHx/feIvnXaXR7vvPx0PP7s9KjuXZfov/UOsdOHN2r0+q8+34J4/fln 4rnXZkbKsnz7SttUur7w3Vfjmf++EDPmpGdLTAYkJtsnJt1XbJJe9089/mTSj5pW9hwQ23905xjY e8UzUFf1fKVttk6AAAECBAgQIECAAIG2ItC8f++2lV5pJ4FWJrDhkKFxZFwU16XteumtWJA8p7FP xby46YTtY0zNrcvXPjc7Dtygsl7LO89/OA75yMHVoeHgC2PavcfVu5X6nfsujRPSN2uky8hrY+SO G8XfLqn+uuq/Lo7Hbrg4PvON6kB0+XoGH3lh/P78kTGoe91nRi7736TYZpfjqw4/feKNUXb5YXFu ye3Zg8dOjntOXD3B4vJtKv2+us3Xfe3ftbeZH3lqHLBp/bFKz7+s2w5x2axZpU1p8vqsJ2+Mn3z7 +LhuakNFBsc5E/8Qo/bbrKGdMffZG+O4fY5PnvlZfzn9xsfi4F7d6++o2ZKGprf99JQ46sKb6x+T PBv0/rGfiP719yRbFsTfvrRTnJq2d8jYuPHrC+OwEWNLjhwSd7xxU/SteVFM+TsPx9iTDo7LGmpk 8iiBf1w3NvbaqP5/lt54cGKcecjo6meHltRetTpkTPzjku/HXh9Knj1QsnRc+Gpcf8GP48RfNdCn 5LhRv7g5vv/VPRt4qVF63Y9NrvtCiFxSabJ67C9vifOO2qNeCLrq56tbv28ECBAgQIAAAQIECBBo SwLJWygsWQpUVlbG6vwptHV11pnWZVmDAslEv+pnHvaI/UedUjzxP+55rbheuvLmQ3cVZyIO/+be 9ULFjoueju8dVgj/hsUdZ34uKV5eNVOutJ7mrKcvgbn5+wMbDRXTuqZed2rs+aGvxQPv1K25YvH8 4oaxw+uGiumO9bvUD46KBbJaWQ3mi957vdi6UZ/fqypYWjjzpXjwlhvjmmuuiWsmTIiJt0yOl96t uTW6eHTTVpa8ODG23a+xUDGtY2qcNfxj8bMpc+pVOO+xCbFVI6FievDYwz4WezVym3waKl559Icb DhXTwsmzQT+546ejscmvvbdID0qWyacvFypWby78uvjVG2PD7RoJFdODpk6IQ3fYMG58MZ3jWbvM +8/lsfNyoWLh5QxVR02+LA796Dfi4fc6FAulfbr84F3rhorJi6+qJpHWHHX5d4bGiN88XixTvbIg /u8nn2k0VEyPuerbn4uB3785iVRrl1U/X20d1gi0V4Gs/j6TVb3tdZz0mwABAgQIECDQmIBgsTEZ 2wmsRoGy+e/Hm4X6knuEq94snXzfeK/PxrCa7ROvuzvmpm+crrMsjof+XggNh8RX9t+2zt40QLzv 0jHFmVyjJtbentvYbdXLVdDg1xl3XBTHlCRJp0z4V0x7c2bMmvV2PPdgMiOyWGpSHPq96+qELMVd xZVkpt01t8eTL7wQzz75ZFx11HbFPVmurG7z1x59uNjc7Td6L/71y2PiQx/ZMw45+vg4+eST4+Tv fz9GH3147LnNRjH61/c3MJbF4g2sLIi//mB0cfvwc/8Uj77werydzHyc+foz8fcLji3uu+gH18SM kuukY+VLcd5nvl/cH0NOizuefjWmv/12vPXyo3HVqfvU7mtgbfrffx6nFma7Jvurx/rNmD59ejx+ 1+9iSANlVrRp8JFj49aHk1vfk9uWn3z2qthlnaVRVjY9frFr9SzWtOzgkZfFlLR/SRtff2FKXDiy NvI7/vjfFvuXBnZ/HXtW8XSn/Pr2mDbz3bjnnnuq+vbbbxb6Nim+NzGdNlm9zH1yYpxe+Jp43Jp4 zErK3DNrejxx1/hin+4947x4eH7trc1zkpm/X7msUHBwnP+3R+O1GTNixozX4tG/nV8bTE44Jq6Y Mq9wuljV8xUrsEKAAAECBAgQIECAAIE2KrAWpg61USnNJrBSgcZ+Oy2IG392aPEW1X0O2KE463Dp OjvE0WMGx6Q0zJh8dTw089jkdujaE3WenwRxVfdPJ9uGHRU7r1t3NtzS/14Xh4yrCUKGXRanHDAg ooVvnE7ffHztubW3gZ5/+ysx8mO9ahpVFhtsc2Bc+Nb90X2jT8Zl6dZJY+LmFw+P4Vs39OzHIfGX qX+LT21YOiu2oqau1fGx5sw7delRbPCvR+0WUwv5U7I1nUE3tWTDxDM/HxMfviym/aHpbwDf5HOn xKhdF0Ws8/E4ZfTBxWskug+ITx73s7j2+UeSZ2YmJ536eLy5sGMMqLm9eNb9N9TOJkxuR37mxm/E gMI10HvzGPaD6+PWbl+Pg8+9udj+wko61teXzGQ85+YXY9Se6xV2x6Y7HRY3/bd/HLJd7fVb3NnA yj6n/iOu/8Fe9Z4pOffR62Nc4fjkVv3bkxfaFILvTusPiuPG/SO6ztwqxqQB59Rz4q9PHhujdugV HZbNi9cmFwqOjW998WPJrcvV10/npG9fOvvimFs5Pl5LDhlQciv0vDfeLhSK0398SuxevL26a2yy 0/C49M/z4xf3pTNQN4zeNc9/TEPM688shPgRv3v0rjhs84419fSIzfdJXtZzX5fYaO+Tq7aNHffX +NqNx0XfxHpVzldsoBUCBAgQIECAAAECBAi0YYHlp0e14a5oOoG1K7B47nuxeMGCmDt3bvKzMBYm n/975p44//DNSmb/DY5vHbFDSUM7xR5fGlHzfWosfzv0zMfvKgaSpxz36TrPg0tngV1eE3Ik0VZc +7Ov1IZRJWdo7mrlm4/Uvvl42BXx5WKoWFvTss7bxqiJo4obJt7/SnG9dGWf836yXKhYurfl62va vNDiQoZ47AV/j2den1k1g27mm8/HLb+snVmYBq4X3fJGochKPnvE3sf9MM754TlxzskHNTCOnWKH 3bYv1tGpshDOLo5Hbq4Nw84/77jaULH26Pj46FOSZ3zWX5a+lox1YXMSTB9dEioWNi/tt1dc8Mvh ha8r+BwWZ36n+qVEdQ8qj8cm/aNm05D4R3KrfiFULBxXUdEnjjprfOFr3PloGhUmS3l5LKxeS36d Ev96YW7xW7qyrMPmcdxPxsVPkp9RB21V3Fe+NAloa5Yn774vZlfU/U/dwP1Hxrif/CT5+UZsW/OM 0Mo3/12c5bjPmXeUhIqFmpJXLG13ZFxdgJw8OV5PAt50WZXz1dZqjQABAgQIECBAgAABAm1XoLHp Pm23R1pOYC0JnDV0uzhrJecedc0f4lPLvaCl5+D9YkxSLp39l94O/dMvFV7OsjgeuL4QGh0ZQz++ QXLEsuIZXrz+p8VQaOi4X8WBdWYFFg9r9sqSObXP8Bt6wM51wszSyjbe67DkNu7Lq27D7t21Q+mu 4nrvrg3NYizubvHKmjYvbfApE5+KH+63cXFTWZe+scdR4+KpDdePHWveAH75iGvixHd/GAMLMwiL Rze+svDd6fHya9Orw+kFc2LOgvkxf/68eP6WZxooVB6zZxY2Hxm7b52+wKT2GinsWdZpm/h0Eohd V5j9WrOjYn7pWO/R6Fhv8Yl9khITC9U1+lkbeJYesjjeerUwvXNy3P73v8TMHoVgtHBcl+g459HC l+idvL05XZZ13jwOGhmRPL4yWSbFMZ+YFIOHjYwv7fep2DUJWj+8xSbRp0vd0DA9crPd0xu4r0pX 4+Zzv5j8DI5jTx0eQ/bcNQZ/5MOxSf/e9WZVll739954U9w46NWoeW11VT1VvyTNeurp2q+F/q7K +WprsUaAAAECBAgQIECAAIG2KyBYbCVjt+OOO1a95KWpzdlhh9JZb42Xevrpkn8FN35Ys/fcd999 zS7TlAJ77713Uw5rg8cMi9/dNS4O2ykNB+suy5ZtHoePGxqXnZbcqjq59nbo0tugB592ZOzQqTYw 6vzeA/G9k2qCnsGnxdiROy53C3TJb+3eXeuFKHVbsNy32kfOxd67bLrcztqvFZ06Rc+arzffMTUW fGWbRoOp2lJrcm31mtdp+eCxccIBmyxnXn3EJgccF2cOvqhm1udzMTOZ1Taw5rblOnUs96Xj+y/F 78/7Xpx25b3L7Vnx1+Lsv2GfiC1LrpG6pbrGTnsmsw6vWy4crDPWG9UtUvKt86YfqZrxuFwuWXLE ileLbUwOu/w7SVK4kuXmmx+LBcem11On2O/sKXHmS3sW3yw+ddKESH8Kyz5fPjN+cPqJye3OtW+F rtxwaDw28fT42PCxNYdNjasuTH4KhZKnLJ4+4UdxwqHprdU1S4lFTL0sjj+6sKOxz0nx8KvzY4ft usUqna+xam0nQKBBAX9PqmbJ79+TGhx2GwkQIECAAIE2IFCSPrSB1rbBJq7tNy439/xNPb6pxzV3 yLKqt7ntWJXj0xduHLNjr1iwtPQ5iJ2jz0Zbxkc+vFG92z9Lz7HDQUdEpMFi8ubf9HboA4/4UJTe Bj3ykN1KDl8cd/yy5Jl3e2wf8559Mh5fVF48pkuXufHQpJqvkx6KyU9sGesuWRLrD9olBq1fmqAU izS4snjRB8n2Ro6vrN0+ePP1mxdeNni25m9cc+aJQq/uxQYOPfrTVc/WK24oWamoGBD7HJbM8Jta HRAWZrWVHFJvtWPlq/HTLfesfQ5hekTy3Mahm28ePfr1i002Xj8eHXtR8bb4ehWkG95/Pz5IXurS o5HZkYuWlL7HuH4Ni0uun+X3ln1QHvOX37iK34d++bjo162y0dKLFr0T3T66ZfH3y7Lug+Lbf50e hzwyOf551x1x54VX1XG498/nRvpzyX3/ixFJyFdYNtvv5HjnhWFx913/F7ffcmdceXNpYDs5CeOT nzuviGnjj6h/6/ngYXHsbhsUqmrwc9E7PWLbdWt/D7TofA2ewUYC7UNgbf93v7nnb+rxTT2uuaOc Vb3NbYfjCRAgQIAAAQIFAcFiQWItfz6ZvC23KUv6f+zT5amnnmrK4Zkd4/+Y16fd84DPxG6DGr4l uP7Rdbd02HjvuHBIxKmTq2+HvuCIESW3QZ8W+26fzPkqBkbl8darJeUnHBOfrJ3AVbKjsDoheZt0 9QGDx06Oe06sfVZf4Yg6n0uXFL/e+fBrMeqjtW/sLe5IVjrOfTsK82E333rjYhBUekzW62vOPGKj j1T/3kv79OrMus/6q9vP8pj73rt1N63k2/yn76oNFQePiX/88dux14fWrVPqra3eiB2OqzvjsKys PBYnbxmvWiZPSZ75983o28DsyLKyufH0zWlwvdzSxLFe+L//FN88vlwNK/1ap43JvMcfXHZRbNth 2UrL1T2ga2yx24HxjfTnBz+L99+dEa88fX/8/uzRcd3U6iNPPuO2+MJfv1A7AzHZ3CF5Mcx+X0x/ RsXPl8yNGW+8HA/c9Ps46bwax+tOiJu+PSxGDEoCwhKLoWPOiXGHb1q3CU341qzzNaE+hxAgUCvg 70m1FtYIECBAgAABAq1JoP7DqVpT67SFQBsSWLI0nd23akv68orPHH9sdeHJk+KRF6bE7TX3nQ4d d1j9Z/QVwqRmnm79Liv/fwndN9o2uVG0ern3z3fHjGQWXEPL05OuTuZXFpaV11s4cnV+rknzdQbu XHwBytRxf4nnlnZssCsdl74Ut6Vv+a5Zyjs07FfYn36+PrX20QLn//pH9ULFiAXx2B11Q8W0XEVF j9hqt/T5h+kyKf75SPGBi9Wban7tNPPx+G0SWi+/9Oi3VfLan+rl3jNuiemNjPUjN12zfNEmf0+v 7W33KbTxurj78fcaLZu+/GhB8rO45IjyxYtjcfJTOx+3U/Ref2DsNGR4XH7fo3Fa4djJ/4qXy2vG JHnpS1pmcW2hKOvSJzbacpc44jvj478TTymUiikPvV61Xnrd33ztXTG7EYsoX1zVxgWLS8LRVThf sQFWCBAgQIAAAQIECBAg0IYFVv4v3jbcOU0n0JYEPvTJL9YEepPjiE8cGtW54uD4ykEfXq4bPWL4 NdPi+eefb/Tn5ZeT59IVEqPBZ8WUl1+uOvaary1f13JVJ1+XrrtzHDWsZvvU5C3Fv3+0JNSp3r74 xRvjxKpbt9PvQ+L4g1deb02Nreqj6ebJi0S67RDHnVkIyCbESRffVScAq+7Ygrjzoh9F9fzQZMuR w2KbdUpvjW+4+9269CvueO3Vd4rrhZU377oijqm+IAqbaj47xS6Hfq647aLDzoqH36k7a7asbEZc cdoRJSFw8fAo779LnFgY62TO5OkTHqs31u8+NiEOGVcblNaWbvra4M8dVjz4rAPPi6fn1Q9ln//L aTFws81is+TnjH++VXX80peuiQ0HDoyByc/+5z9SrKOwUpnejl+8zreO/l3SW6wXxN+O37CqzMAN D497Zq34BUKbbLV+9blKr/vJp8bPr/9v4TTFz47zno7vbziwqo2bDTwvXq1M+7Fq5ytWaoUAAQIE CBAgQIAAAQJtWECw2IYHT9PzJbCR7DnFAAAxb0lEQVS0505x4sjl+jTkxNhj47pBUXpEWfc+0bdv 30Z/evfeKDbdoqauLfrFRr17Vx3bo36es9wJ0689YtjplxS3T/zegbH/mN/GA888H88993Tc9aez YuDHjy8GVYNP+0Hste7Kw7Niha1opTnmabN3P/oHxdmcU8cdEQOPvTQeeP6tmDFjRrz+/ANx/rGb xRcvvLfYw/HfHVrn1tzijuVWNvnYrsUtl4/YMc76013x3LRp8fLzD8e1Pz4mecv02OL+5Ve6bv/5 GFsI15I4+uDthsTlt01Jxuq5ePLBG2P0PtvHqYXnbS5XOJ1NmN72W1huPu2AmrF+JgmiH49//np0 bPOZ7xd2r/Jn120OicuKAeaE+PQWn49r7nwqpk9P3oD9zANx1Y+/EHuddFVN/cPia0OSF+MkS/cN tizmhlPHHRTH/Pyv8fRrM5M3Zs+OV574vzj7sJ2ikHkOPujjMaDqcQE9YtNdCiBJSL/tUTFx8rMx Y/bceHf6S3HXlWfFdjVv7U5TyY8Pqg4Wq67779Ve91edtFd84cfXxuNJgJ9a/vvWCfH5LT5dDI2H XnpkbF51S/eqnq+muz4IECBAgAABAgQIECDQhgXWzv2LbRhM09unQJ1bM9NbJIvPO1ydHl1jn+FJ yDPhrGKlo0btX//FEsW9K14ptjm5bbq8mW3uPGhEPHTNG7HHiIuqTjL1utPj0IZmzB15WUz84R51 PVZTxlhsf9KC5rZ/xTKle5tnvnTd3ePaR66Oz+x2THWwOumcODT5aWgZNWFKDN9ixbPlCuXKthga Vx85ujgr8fLvJLf5FnY28Fl9e3X1rbgVFX3jpL/fGlMGHVzzHMSpcdaIoVF7FaUVDI4hg6fG5JqJ h6Xle330hPi/C56JA79Xfat1Q2M9eMiQmDq5gXupk5rrjFPVbd8ltwjXtD0NML966b/ihVc+HdV3 iU+Ok7+8b83euh+n3HhB7NCtuo6l6+4VE648NvY4rjp0vPnCE+PmC+seX/3tyLhk9CeS1eqLb8+v /yZGnvPJmhBwUow+vOFkdfgvfxuf2iCd5Vi9dN5uREyZ8GLsObJa/95ffSsO+FVhb8lnMgt47Je3 TTZUVG1c1fOV1GiVAAECBAgQIECAAAECbVIgSUgsBAisTKBrz5ojBvWKdUpCxcrK2uCoS+eW5/Q9 djkwxhQbc2QcttfGxW/NW+kUffvXzNrq3TU6lbS5qfVsddAP47VH/hJjhhVmf5WWHBLnXHN/TL/s yJpZYrX7ytYbUJzV16/vOrU7mrnWWs27JiHgPS/+K846siGXpJNDRsa1D06Lcw4d1Iwe94hDxk+L m38xqn6ZwUfG7+59Lp4qPhewZ3TqVB1oFQ6uTALPP74+JS795j6FTcXPwcNOi1v/e2dc9v1C3f2j W8fS8p3io8eNjyf/dklx3IqFk0DylF/fHnf8+aLiddmjV+m0107xoZ2H1hy+fL21taRry3rtED+5 9/m4/oJj6+6o+Tb0uPPi1v+8Gj/cu/a28HTXVoeMi+cmX93IdTg4Rl0wMZ55c3zs0rM20V7WfdsY 9+Yzcc0Fo4ozHktPmppcO/m5GH9U/Vv4Bx16Tkx78NoYOaS0RGF9WJwz4faYdu93YmBZrWFLzleo 2ScBAgQIECBAgAABAgTaokCHhQsX1k7XaIU9mDt3bnTs2DHKGnuQfitsc9qkKVOmVLVs330bnpWz qs3eaaedqoo29e2ITT3PXXfdVXVoW3nb8yuvvFLV3k033bSpXXRcCwQWzJ0R7y3uHD07Lo35yzrH Bv3XXytvgW5BFzIp+v7Ml2Laq+9Gt769Y9HsRdFr4Gax+cD1o0UR87IFMWPW/FhnnU5RXt4tuYW9 e7PaviS5TfidxR2iZ9fKKO/cK/p2rw2/V17R4uR24VlR2bNnMk20PHomt9t3XXmh5h+xeEHMnPVe dEzOU/7BB9Fz3Q2iR9fSwLLhKpcsnB1z5kViE/HBB51i3QF9Vt6+5GUrs2cnL4ypLhTRa70mmyyY nVz3y7ol1/2iSFqZjEWPlY9tC87XcK9tJZBPAX9PynZc/T0pW1+1EyBAgACBNSFQkUwQWrZsWfTp 02dNnG6Vz9Gif/+u8lkVJECgTQn06DOg+KzA1v1H2ppl7d1/UOzSv+acW62mc3fsEQMG9Fjlyrr0 6RsDV7l011g/eVFK5kvXHtF/YE0fm/EfyS7d+8aAmpy1ycU6dY2+AwZUd6nJhaoP79G3cN33jiZf 9y04X+buTkCAAAECBAgQIECAAIHVLOBW6NUMqjoCBAgQIECAAAECBAgQIECAAAEC7UFAsNgeRlkf CRAgQIAAAQIECBAgQIAAAQIECKxmAbdCr2bQrKtb3c9WzLq96idAgAABAgQIrCkBf09aU9LOQ4AA AQIECBCoFjBj0ZVAgAABAgQIECBAgAABAgQIECBAgECzBQSLzSZTgAABAgQIECBAgAABAgQIECBA gAABwaJrgAABAgQIECBAgAABAgQIECBAgACBZgt4xmKzyZpXoLKysnkF1vLRba29a5nL6QkQIECA AIEWCLS1v3e0tfa2YGgUJUCAAAECBAg0ScCMxSYxOYgAAQIECBAgQIAAAQIECBAgQIAAgVIBwWKp hnUCBAgQIECAAAECBAgQIECAAAECBJokIFhsEpODCBAgQIAAAQIECBAgQIAAAQIECBAoFfCMxVKN DNb/9a9/ZVBrdlW++uqr2VWuZgIECBAgQIBAiYC/J5VgWCVAgAABAgQItEEBMxbb4KBpMgECBAgQ IECAAAECBAgQIECAAIG1LdBh4cKFrfq1xXPnzo2OHTtGWZkMdG1fLM5PgAABAgQIECBAgAABAgQI ECCQvUBFRUUsW7Ys+vTpk/3JWnAGaV0L8BQlQIAAAQIECBAgQIAAAQIECBAg0F4FBIvtdeT1mwAB AgQIECBAgAABAgQIECBAgEALBASLLcBTlAABAgQIECBAgAABAgQIECBAgEB7FRAstteR128CBAgQ IECAAAECBAgQIECAAAECLRAQLLYAT1ECBAgQIECAAAECBAgQIECAAAEC7VVAsNheR16/CRAgQIAA AQIECBAgQIAAAQIECLRAQLDYAjxFCRAgQIAAAQIECBAgQIAAAQIECLRXAcFiex15/SZAgAABAgQI ECBAgAABAgQIECDQAgHBYgvwFCVAgAABAgQIECBAgAABAgQIECDQXgUEi+115PWbAAECBAgQIECA AAECBAgQIECAQAsEBIstwFOUAAECBAgQIECAAAECBAgQIECAQHsVECy215HXbwIECBAgQIAAAQIE CBAgQIAAAQItEBAstgBPUQIECBAgQIAAAQIECBAgQIAAAQLtVUCw2F5HXr8JECBAgAABAgQIECBA gAABAgQItEBAsNgCPEUJECBAgAABAgQIECBAgAABAgQItFcBwWJ7HXn9JkCAAAECBAgQIECAAAEC BAgQINACAcFiC/AUJUCAAAECBAgQIECAAAECBAgQINBeBQSL7XXk9ZsAAQIECBAgQIAAAQIECBAg QIBACwQEiy3AU5QAAQIECBAgQIAAAQIECBAgQIBAexUQLLbXkddvAgQIECBAgAABAgQIECBAgAAB Ai0QECy2AE9RAgQIECBAgAABAgQIECBAgAABAu1VQLDYXkdevwkQIECAAAECBAgQIECAAAECBAi0 QECw2AI8RQkQIECAAAECBAgQIECAAAECBAi0VwHBYnsdef0mQIAAAQIECBAgQIAAAQIECBAg0AIB wWIL8BQlQIAAAQIECBAgQIAAAQIECBAg0F4FBIvtdeT1mwABAgQIECBAgAABAgQIECBAgEALBASL LcBTlAABAgQIECBAgAABAgQIECBAgEB7FRAstteR128CBAgQIECAAAECBAgQIECAAAECLRAQLLYA T1ECBAgQIECAAAECBAgQIECAAAEC7VVAsNheR16/CRAgQIAAAQIECBAgQIAAAQIECLRAQLDYAjxF CRAgQIAAAQIECBAgQIAAAQIECLRXAcFiex15/SZAgAABAgQIECBAgAABAgQIECDQAgHBYgvwFCVA gAABAgQIECBAgAABAgQIECDQXgUEi+115PWbAAECBAgQIECAAAECBAgQIECAQAsEBIstwFOUAAEC BAgQIECAAAECBAgQIECAQHsVECy215HXbwIECBAgQIAAAQIECBAgQIAAAQItEBAstgBPUQIECBAg QIAAAQIECBAgQIAAAQLtVUCw2F5HXr8JECBAgAABAgQIECBAgAABAgQItECg1QeLZWWtvokt4FeU AAECBAgQIECAAAECBAgQIECAQF2BysrK6NChQ92NrfBbq0/t0mCxoqIiUlALAQIECBAgQIAAAQIE CBAgQIAAgTwLpBlY+tOxY8dW381WHyx27dq1ClOw2OqvJQ0kQIAAAQIECBAgQIAAAQIECBBooUAh WEwzsda+tPpgsVOnTpH+pLMW0x8LAQIECBAgQIAAAQIECBAgQIAAgTwKFPKvQh7W2vvY6oPFFLB7 9+5RuCXabdGt/ZLSPgIECBAgQIAAAQIECBAgQIAAgeYIpLMUC6Fi+mzFNAtrC0uHhQsXtomHF6bA ixYtiqVLl1aFjG3hAZZt4QLQRgIECBAgQIAAAQIECBAgQIAAgbUnULj1Of1MZyqmoWJbyb3aTLBY GN5ly5bF4sWLo7y83AtdCig+CRAgQIAAAQIECBAgQIAAAQIE2qRAepdu+qKW9JmKbeGFLaXIbS5Y LG28dQIECBAgQIAAAQIECBAgQIAAAQIE1o5Am3jG4tqhcVYCBAgQIECAAAECBAgQIECAAAECBBoT ECw2JmM7AQIECBAgQIAAAQIECBAgQIAAAQKNCggWG6WxgwABAgQIECBAgAABAgQIECBAgACBxgQE i43J2E6AAAECBAgQIECAAAECBAgQIECAQKMCgsVGaewgQIAAAQIECBAgQIAAAQIECBAgQKAxAcFi YzK2EyBAgAABAgQIECBAgAABAgQIECDQqIBgsVEaOwgQIECAAAECBAgQIECAAAECBAgQaExAsNiY jO0ECBAgQIAAAQIECBAgQIAAAQIECDQqIFhslMYOAgQIECBAgAABAgQIECBAgAABAgQaExAsNiZj OwECBAgQIECAAAECBAgQIECAAAECjQoIFhulsYMAAQIECBAgQIAAAQIECBAgQIAAgcYEBIuNydhO gAABAgQIECBAgAABAgQIECBAgECjAoLFRmnsIECAAAECBAgQIECAAAECBAgQIECgMQHBYmMythMg QIAAAQIECBAgQIAAAQIECBAg0KiAYLFRGjsIECBAgAABAgQIECBAgAABAgQIEGhMQLDYmIztBAgQ IECAAAECBAgQIECAAAECBAg0KiBYbJTGDgIECBAgQIAAAQIECBAgQIAAAQIEGhPo1NgO2wkQIECA AAECBAgQIECAQJ4FKioqYtmyZZF+WtqPQFlZWXTs2DHSz9a0uB5b02isuba01uuxqQKCxaZKOY4A AQIECBAgQIAAAQIEciHwwQcfxMKFC2PRokWxePHiqnCxsrIyF33TiRULdOjQoSpU7Nq1a3Tr1i26 d+8e66yzzooLZbzX9ZgxcCuuvjVej83l6pD8YepPz+aqOZ4AAQIECBAgQIAAAQIE2pxAGh6+//77 MXfu3OjUqVP07t07+vTpE126dGlzfdHgVRdYsmRJ1TWQXgvl5eVV10B6LaQhz5pcXI9rUrv1nqu1 XI+rKiRYXFU55QgQIECAAAECBAgQIECgTQmkgeJ7770X66+/fvTv379NtV1jsxGYOXNmvPvuu7Hu uutWBYzZnKXhWl2PDbu0561r83pcVXe3Qq+qnHIECBAgQIAAAQIECBAg0GYE0ttN0yBHqNhmhmyN NLQQMM+ZMyfS26PX1G3Rrsc1Mrxt7iRr63psCVTrelJpS3qiLAECBAgQIECAAAECBAgQaEQgfaZi +pKEwj/cGznM5nYokF4T6bWRXiNranE9rinptneetXE9tkRJsNgSPWUJECBAgAABAgQIECBAoNUL pG/bTV/Ukj5P0UKgIYH02kivkTXxhnDXY0MjYFupwJq8HkvPuyrruQ4Wly1bFkuXLo30QZjpT7qe brMQIECAAAECBAgQIECAQPsRSP8dmM4QEyy2nzFvbk/TayO9RtZEZuB6bO7otL/j1+T12FLdXD1j Mf3NuXjx4uJPGiamb3gq/B+HdGpz+uav9I1f6bMTCj8dO3ZsqaPyBAgQIECAAAECBAgQINBKBdJ/ E6YTTdJ/A1oINCSQXhvpNVLIDxo6ZnVtcz2uLsn81rMmr8eWKuYiWEwDxQULFsS8efMifQBq586d o1u3brHBBhtUPXg1XU+XdFpzur9wbPrmp/TBrL169YoePXqEgLGll5PyBAgQIECAAAECBAgQaJ0C a2ImWuvsuVY1VWBNXiNr8lxN7b/jWpdAW7lG2nywmIaE6Zu90tmJ3bt3j4022qgqJGzockjDw/Sn b9++VbvTsrNmzap6tfz8+fOrpsWn+y0ECBAgQIAAAQIECBAgkC+BysrKVtGhd998LabPfr+mLZ2i 2/p9Y/OB/aPN/+N8NehWLHkt/nDB72PaB4viQ58aFSfsv+VqqLXpVazJa2RNnqvpAqv3yMrKRTHz 9fR6Xxq9+3aLhcl136X3gNhss42jW+cOq/dkOaytrVwjbfbPrjS5ff/99+O9996rmnW45ZZbNnta eyFoTG+fnj59esycOTPWXXfd6N27t9mLOfxNqUsECBAgQIAAAQIECBBYWwJvPzopxp15Skya1lAL toqjz/5BjPrKPrFeh/YbuFQumh23/XFiPJEQDer3xTUeLDY0MrY1XyANFP/91/Fx7o+uiAYv99gg jv7hz2LUMQ1f75WV8+L/jR4e5zzxUgza+ayYOP6o6NXA74v0uBtOHRm/nDI/ele+FNO2OTMeu+qr DR7b/F4o0VSBNvnylvS5iXPmzKmaqdivX79YlVCxFCi9dz2tI60rnf2Y1p2ew0KAAAECBAgQIECA AAECBFoikIYsd1x6bOzzlcZCxbT2afGHnxwfe3x4dNz3xuKWnK5tl02mPnWv6UHPtt2Tdtv6ZbOf jjMO3imOaTRUTGlmxR9+llzve50aD81o+HqfN+ul9LB46ZV50XA6Ux63njc8zpj0RLzzThIqztog LvrRMKHiWrjy2tyMxXSmYjpLMb2NeeDAgVWzC1eXWxospiHjm2++WVXleuutZ+bi6sJVDwECBAgQ IECAAAECBNqdQHnccd7h8c1rkpCksGywf/zozC/HxzbvF4uT8OTuv18Tv0/Ckerlzhi578nx10cu ix36eMlogcxn2xBYNvuhGPnxEfFgSXMH7T8ivnHkQbFxl2URlQvi/ht+E+ML1/usSTFi7//Fb+7+ Y+y7yTolpSK6lHxrKLh6+DfHx8klv69+dMMtMWybdUtKWV1TAg2Nz5o69yqdJ739OX0e4sYbb7xa Q8VCY9LboNP72NNwMX2ZSxouWggQIECAAAECBAgQIECAQHMF5jxyZZ1QcecRl8SEMw4umVW1Xey6 97A44aS740efOynurDrBnXH4OTfFsxcd5rmLzQV3/FoTSGfmXntKaai4QZz6+z/FCfvUfU7mx/bc N7505HVx3FfOrrlN+ok46btXxWMTTyr5fbHibjx3w5nx1YsfKB405up74pidZDdFkDW80qaCxXSW YjpbMX35Sp8+fVZK9crsivjns8ti2juV8cHSyujXq0N8fMuy2G+bTtFxBTeBp3Wnb4+ePXt2dOnS pdGXway0AQ4gQIAAAQIECBAgQIAAgXYpkAYtN4+/sNj3QV+8JK4983MNhoXrbr1vXHzzz2LHoT+s Pn7SdfHYWYfEHvVmLZbH9Jeeiuf+Oz3eS15gmi7rDdw6dvnYDrFegy/DKI+Zr02P9FUxAzb+UPRK jpnx6tMx9elXq8t37hFbfGSX+OigAVV1Nf5Lebzx38di6rNvxIKqgzon5x2UnHe7Rs5bqKm63H+S cktryvXfesfYdYfNolsDz8wrlPLZ9gQWv3hrnFsyVfEnyQzCIxsJ+zba9ci48faese9nTknvdo54 4pL467NfjWO277XSjr85+bI45PSJxeOO/sVtMeYTGxe/W1nzAm0mWExvgU6ff5jeqjxgwIr/0FtW EXHeP5fEpIeWRWWyXrrc9O9lMaBfeVw8vEtsO6DxdDE9RzozMj3nOuus45boUkTrBAgQIECAAAEC BAgQILBCgbpBy85x3vc+22CoWKhknW0OjXM/8cM4syqceSIefuH92GO32llY//v3dXHmKWfHg1VJ TKFU4XODOGHcFXHqoYMLG6o+571wQ3xy6NlV62N+9/+ix8TvxM/vfKfOMemXfvufHNf+4sTYrEv9 fyMvfuOhOOf4EXFDg2/h2CDGjPtdjDl0+3p1Lnjjvjjr+JENv6wmuR38N//vgth3i571ytnQFgXK 47bfXlxs+KARv200VCwctM4Ww+KS0dfEiPHVjwH46fhbY/j4LzUYOBeesTjnyeviU8dfVqgiDjn7 b3H6wVsVv1tZOwL1/9RYO+1Y6VnT2YrpLML0uYorWy64c0mkAWIaKg76UFmMPLBTjP5cp9h7p7Io Sx5TMSOZwXj8lUti5rzKFVaVnis9Z3puCwECBAgQIECAAAECBAgQaKrAvFlvFg/t98Wj46P1Zh8W d9esdIovXPZQ3H///cnPQ/GNklBxzpNXx35HNxYqpsVnxRWnfSHOvOO1OpWWL5xX/H7Z8Uc1GCqm B7xz5yVxwAk3xKLksWCly3vP/jU+vW9joWJ65Ky47LTD4tgr/1NaLOY8c13ssm8joWJVsTvjpM98 NK57ck6dcr60TYH07cxvP1sbWI/86seb1JGPDT8ueT90zfLEa1F7tRY2Vn+mM+I+eOWf8ZUvVofk 6da9vvunuPCoukF69dF+XdMCbSJYTGcrzps3r+qW5HT24IqWt96vjL89mDwUNFmGD+kYE4/vGqP2 7hzH7dk5fnFE17jsmC7RIen1woWV8avJ1ZOxG6svPVePHj2qzp22wUKAAAECBAgQIECAAAECBJoi 8PJT9xUP+/Lndy+ur2ilc6/1on///snPesXZjWlo8+cf/LRYbK/jz4tb7380nn3hhZj66D3xi28e UNw38ew/xJsVy922V9ybrnwifvaH2+PJZ56PZ568P6744SG1ex88M/7+4vzi94qK12Lc539Yfatq unWrL8aEW+6tOu8TU+6IC0rO+8DPvxmT/vdBVdm03IWH1QZA6WzIm+5L2vvss/HofTfF6P37Fc9x 9jcuW0l7i4daacUCFQtfiX8VZrRuNTr23bxrk1rbccBeMWLnmkNnPRqvvN/AtTugZ1S8PzUJor9V 80zGiJ2//qv43UlN+z3VpIY4qEUCbSJYXLx4cSxatCg22KCYZTfa6btfKI+KJAPs1q1DnPzpLvWO 23PzjvGRLaq7/eTrDVy0y5VIz5meO22DhQABAgQIECBAgAABAgQINEWgc/RoymFNOmazg4bHIV86 JA752ti4+NQvxqD+vauCxy69N46Dv/XLOK8Q1s2aGv9r9M68reI39/4+Dv/4FtEtedZi527941PH XhhXfb2Q7CTzD+cWbjqNePvuP8UNhdZt9dW445ZzY++tN6w6b/f1N4vPf2t8XPPdQtlZ8etbnq06 +u37Ssrtf27cOf6k5DFkSXs7dYreA7aNb42/OU4uFvtTXDvl7cJZfLZhge6FtvfqUgzFC5tW9Fma 2nRu6MAHfx1fPujwOm+aHnPifs06R0PV2rb6BNrEMxbTUK+srCx69lz58xcG9SuL4w7oFBv2Tv6g TG57bmjZsE+HeCbZ8UH1s24bOqS4LT1neu60Dd27F3+rFPdbIUCAAAECBAgQIECAAAECWQl06NAr CQ/PjYMbPUGn2HHXbSJqnp3YYDiTlB309e/FvhvWjwB2PHD/iN8/UVX7fx57JaLqFuzyeOi2W4tn HHPON2Kz5N/Fyy+7fW1cXNrvyUj/ab3JHh9Ofk3K3VQolwSZ5xxe75l5HTqsF8ec/aO45LDqWZh3 P/JynOrlG8vTtt3vjd3P3GCPFsX06kuvwb3VG2fFtFl1d4/89rXx2FVfbfJbpOuW9m11C9T/U2V1 n2E11Jc+57Bbt25NqmmPzTpG+tPYkj4y4qmamYqb9evQ2GF1tqfnTttgIUCAAAECBAgQIECAAAEC a0vg/ZmvxYsvvx5z31sQ8xfMiXeTR4bNm/d+/Pe2F1bapJ5dG54oUztHMWLB4urHhaVvtH77f4Vn 5n0i9vrI+g3WX9Z9s/js4ZsV91U9a69Yblrc+teJMaP38oFkl6h455FimZ7RWBRaPMRKWxJY+Yud S3rTLQams1dXGi6WFElXHzw3vvXb7eOqkz663A5f14ZAqw8W02cbpqFev361z2FYVag0VBx7+5J4 Z1aykixf3q1p3e/Vq1e88847kbalY8fGQ8tVbZdyBAgQIECAAAECBAgQIJAvgaWLS18C2rR/ezYm UPHuc3HZGd+N8Xe+1Nghq3178RbVnfeIrbsvHw42frpiueSQmy76SdzU+KFVe574539i3rd2N/ts JU6teneSTi8sNHDekmTe6qotjb4FY+fR8dDEb8X7t50VB3xnYlXlD1z85bjiYw/ECbu1PCtatdYq VRBo2Z9uhVoy/KxIHjy7dOnSFt+GnL4B+rS/LYmpL1U/V/Gg3TvGvts0LSRMb4FO25C2RbCY4WCr mgABAgQIECBAgAABAjkR2GK33ZOeVE/Fuu2fT8SY3T69Sj2rWPJSnLnnIbXPO0xrSd4FsPMmm0SP ZALOJhutH4/+cWLxxRardJIVFXojmRWZzNLp1aFpd/yVVrXzXgdEv4YnSlYdtnDhO9F9l0H1bpcu rcN66xco671F7LVVcrWnL3CZNjEeeuPE+OymK37xbtqrZbMfib8UZituMDg27dXQNTYsbrp6TKyX XH/rHXx2XPLA3XHyDdWzaS88anTs9O/rYo++Tct2Wr9k22xhqw8WK5M/wMrLy5t8K3RDwzD1rYr4 xtVLqt4E3Sl5SO3oz3aMr+3e9OnW6a3QaRvStlgIECBAgAABAgQIECBAgMDKBLr1GVg85KVr/hBP f3ef2KHHigOQ52+7Iv704Myk3Dox9JtjYo8BXWP2o7fVhoobDIvf/OG02Dd5iUrp8tzmb8Qh5zxQ uqnF68VXEsz6V0ybc0ps3LcpVZbHkuIz9j4RZ/7m0tih64r73JRaHdPaBdaJDbdI2lj1ZuhZceXf nozPfnuPlTb6qZuuqQ3Et9miKjysV2jnQTEweTlv9dIpDjr32njwhgNqfk88ESO++qu4/9ZvRf9V CL7rncuGVRJo+nzmVap+9RRqSaC3NHlD9Heuqw4V11uvQ/zpG12aFSoWetCSNhTq8EmAAAECBAgQ IECAAAEC7UOg50eG1r79OHmn7bm/n7LCji9b/HT88tsXxsSJf0x+roiX51ZHey8/dV+x3JhfnlEv VEyfa/jInas3VExfGLPDroNqzjst/nz3i8U2lK4sm/1QjDv1jDjjjFPj6nv/F+mLWbb9RKHcg3H7 lBmlh9dZX1T1fMh5scgEnjoubfFLhw7d4uDRPyo2/YnxP45/vrLi91SUv313nP7z2ut2zOihDc9c LQbV1dWXlW0WZ95+UWxQONu08XHMuHsK33yuBYFWHyx2SFLn9GfBgtLnUzRd6rH/LYs5c6pnGv7s iM6xdfLW6OYu6bkL7WhuWccTIECAAAECBAgQIECAQPsTSMO5w79zQrHjT4w/Nkb/5oEGnz9XseTN uO5HJ8WdhaM3GB37bd2z6lv3rrXPkHvt1fpB3Qs3XRrnPlgouPo+d/rcl4qV3XH6yTHphfnF79Ur 5fHPi78bv7vp+rj++pti8uvvVW3eedjni8ddcfx58Z/Z/7+9O42xqywDAPxOO9N2uu+0iBRStNpo bKhARAMGARWFmBBaFIISjTai/qDID5YfShDDFiABBBdCUGOCRm3dIkhIkGDdQmJsLbbIljZpobSU MnSh9byX3ttLO+3MnencM4c+Jzmdu5xzvvc839c7ue98S9HbZ7/tr/cVQ1gXLoyFxX7Fz1fv966n VRQYP//8pkT62vjGxy+J5Sv3W855741t/u8f4nOnLdnXW3HuZXHxByf3+7bHHH9uPHDb4sbxa37w lbj+4Wcbzz1or0DrWbb2xhcjiiXtOzs7o6enZ0Alr9vyZlJxZDHo+6RjB9YFO8vOGDIWGwECBAgQ IECAAAECBAgQ6I/AjA9dFtedue/Ih269NOYvujqW/2VlrFu3Ltas+mf8+p7r4yPv+2h8e3l9FeaI q+6+pDG087iTT2pcYNnV58UV9/wq/rVqVawqejJ+b+miOPeb9zfeP5wPxs9fHNeeWr/i2lj66RPj +vsejv+sWRN/f2x5XL3o9MZcdxELYskn59cOnvyBC5oSTA/HhR/6dNy77Il49tlnY+U/Honbl54T F9/w0N4LL4gvnv2ueiF+VlggE+mX3nJHzG3cw5Ox9DOnxqXX/ShWrHomNmzYEM+s+Wf85KbL4uRP faNpIejpccvtX+x9GHTjWgc+mJvzLV6wL+l+/1eXxB+eP3QvyQOv4pXDIVCk24b3louljB49OjZv 3hwzZ85sOdh3TO6Ik+ePiO7mpalavEqWnTFYuKVFOIcTIECAAAECBAgQIEDgCBbIIaKL7lwRHddc FNc8uHdF5ycfjKWXPHhQlS/f9fv4wgemNN7PnmDXnvqdRq/EZbdcWay23Hj7gAdvWVn3LU8OOPSQ L2TsF921LP53/nnx49rceRH33/DVYj/wtK9//7bGAho5HPrLd/8s1px7YSyvdVhbGzdf8fm4+cDT YvFtN8SJk5o6ADWvLtzL8V4a3gJj3vmJ+OUj34slZywpBv+/uT3+wHcj9963BXHHb++NT+ztndt8 TGOOz+LF3leZ3n++xaKX5OIb46FHr4k5o3QKa7Yc6seV0M6k3muvNRYvb8nklDkj4+7Pjo5bzx/d 0nnNB2fZGYONAAECBAgQIECAAAECBAi0IpCJtkXX/y5+c/dVRb++g28LFl0ev3jsX3HFmfv6fOXR 2RPs4vtWxJ1Lzzvw5Omnxrd++qdYdlN9WOjY6GrqPtQ1fXajB9mM6b0vz9w1dlpjvrr9jxkx9j1x 7e/+UZS9uHFMcxAnnPmleOCPf4uvn35088sxctqJcfPjf44bv3bWW16vP1lw1pfih799Iq47Z797 7R4b79x70LjRXfXD/ayQwJhjzoj7/n3wuq/fyoeLYfKPPvmzIqnY+xDoUfXmevz4Yimj3rf6fIuN VvTij+PGB//d+8FeHTKBjiJpNuyXOt6yZUut2/T8+fNjwoQJQ4bR24W3FhPKrly5MubMmROTJk3q 7RCvESBAgAABAgQIECBAgMAwFti+fXusXr06Tjml75Vqh/I29uzpiXVr18TTz22MUdOnx57iu27H pFlx/PHHxcwJfSfS9uzcGus3bo3u7s7YubO7GNXXvu/HtbLXbYrOiRNjVzFdWPeEGTGlPzH3FDFv 2HfehCkzYkJ33/c6lPVwsGuvWLEi5s2bN+Qdi4ZLezyYw+F6fU/Py/GflU8VbXZbxLjiqsWPrhmz Y967T+hXez9ccVT1Ou1qj4P1afpbxmAvNXTnd3d31/5jr1+/vuXE4jObdsfND+2MUcWdXnnWqJg1 sb5Mef/izTKzt2LGYCNAgAABAgQIECBAgAABAgMVyOHF7zjh/cU+sCt0dE2Io49uXzKxOcpa2XP2 lj1l31Dt5mN6e9zRXcQ8gPN6u5bXqiXQ0T0l3rvwlHhvtcIWbYsClUgsdnV1xZTigysnt81hyWPH 1vvE9n23V/1yZ6x+ZnftwF1v7Ig7FvV/SHOW9dJLLxUf3EdHxmAjQIAAAQIECBAgQIAAAQIECBAg QOBNgUrMsdjR0VHrqZg9B59++umW6m5L00jvrS0uEJRlZZk5/DpjsBEgQIAAAQIECBAgQIAAAQIE CBAg8KZAJRKLGWom+KYXc1DkfIsvvPBCv+vv8rM7Y3KxMvS0qR3xldP630Ezy8iyssws20aAAAEC BAgQIECAAAEC1RQYMWJEdHZ2xuuvt9jbpJq3K+oBCGTbyDaSbWWoN+1xqIWrf/12tsfBavU/0zbY kgZ5fv7Hy8VTXn311Xj++edryb4ZM2b0edWPzeuM3FvZNm7cWCsjh19nme34YGklPscSIECAAAEC BAgQIECAQP8FRo4cWfsO+fLLL8fs2bP7f6IjjxiBbBvZqSjbylBv2uNQC1f/+u1sj4PVGvpU/GAj bDo/5znMZGLOsbh27drIBODh3vKaee0sI8syt+LhFnY9AgQIECBAgAABAgQItFcgO4vkd7ycQ99G oDeBbBvZRtrRsUh77K0GvNYs0M722FzuQB5XKrGY8xzm6sxHHXVUjBkzJp566qmWhkX3BZTDn/Oa ee0sI8syt2Jfat4nQIAAAQIECBAgQIDA8BcYN25cbSj0c889N/yDFWFbBbJN5NDTbCPt2rTHdklX r5wy2uNglFobIzyYkg7TudllOP8Dzpo1KzZs2FDrXbhp06aYO3fugD8Etm3bVrtOdjXN4c8zZ86s XasdXaAPE4vLECBAgAABAgQIECBAgMAhBPJ75OTJk2P9+vW1o4499thDHO2tI0UgkzjZJqZNmzbg nMJArLTHgai9/c8pqz0ORrbjtdealk0ezJXafO6uXbtqf1HIZOCLL74Y+TyHLh9zzDG1VZz7E87W rVtrPR5z+HNO0poLtWRiMXss5nMbAQIECBAgQIAAAQIECLx9BHp6emodVPI75Pjx42Pq1Km175E5 Ws125AhkO8g8QHZSynUcMheQHYza3Q60xyOnzR3qTodLezxUjId6r7KJxbypN954I3bs2BFFcjQ2 b95c27dv3177K0P+JSr3nCMh/xKQW/ZMbD42n+fkrM3Hjho1qi2TtdYC8g8BAgQIECBAgAABAgQI tE1g9+7dtQ4qr7zySmQnlUwq5RDY/G65Z8+etsWhoPIEcrqzHJ2YHYoyuZydiyZOnFh73o75FZvv XHts1jgyHw+n9jjQGqh0YjFvOj/8d+7cWUswZlIxk4W55y+HfJ7v1X9BZIXlYiyZTMwPkUw45p7P M6GY75lTcaBNyXkECBAgQIAAAQIECBAY/gKZzMkOKs17vlb/3jj870CEgxHI7/yZQMwcQPPe7qRi /R60x7rEkflzuLXHgdRC5ROL9ZvO/4w5HLq+1/9z5vP6L4issBzinB8e+aGRj+t7WR8i9fj9JECA AAECBAgQIECAAIH2CWQvxdybk4r1747ti0JJ7RSodySqJ3Oy5+JwWVtBe2xnSxgeZQ3n9tiK0Nsm sVi/6fxFkL8Y6ns+r/9yyEqrf4BkIjH3ekXWz/eTAAECBAgQIECAAAECBAgQIECAAIG+Bd52K5Rk onA4/dWh7ypwBAECBAgQIECAAAECBAgQIECAAIHqCYyoXsgiJkCAAAECBAgQIECAAAECBAgQIECg bAGJxbJrQPkECBAgQIAAAQIECBAgQIAAAQIEKiggsVjBShMyAQIECBAgQIAAAQIECBAgQIAAgbIF JBbLrgHlEyBAgAABAgQIECBAgAABAgQIEKiggMRiBStNyAQIECBAgAABAgQIECBAgAABAgTKFpBY LLsGlE+AAAECBAgQIECAAAECBAgQIECgggISixWsNCETIECAAAECBAgQIECAAAECBAgQKFtAYrHs GlA+AQIECBAgQIAAAQIECBAgQIAAgQoKSCxWsNKETIAAAQIECBAgQIAAAQIECBAgQKBsAYnFsmtA +QQIECBAgAABAgQIECBAgAABAgQqKCCxWMFKEzIBAgQIECBAgAABAgQIECBAgACBsgUkFsuuAeUT IECAAAECBAgQIECAAAECBAgQqKCAxGIFK03IBAgQIECAAAECBAgQIECAAAECBMoWkFgsuwaUT4AA AQIECBAgQIAAAQIECBAgQKCCAhKLFaw0IRMgQIAAAQIECBAgQIAAAQIECBAoW0BisewaUD4BAgQI ECBAgAABAgQIECBAgACBCgpILFaw0oRMgAABAgQIECBAgAABAgQIECBAoGwBicWya0D5BAgQIECA AAECBAgQIECAAAECBCooILFYwUoTMgECBAgQIECAAAECBAgQIECAAIGyBSQWy64B5RMgQIAAAQIE CBAgQIAAAQIECBCooIDEYgUrTcgECBAgQIAAAQIECBAgQIAAAQIEyhaQWCy7BpRPgAABAgQIECBA gAABAgQIECBAoIICEosVrDQhEyBAgAABAgQIECBAgAABAgQIEChbQGKx7BpQPgECBAgQIECAAAEC BAgQIECAAIEKCkgsVrDShEyAAAECBAgQIECAAAECBAgQIECgbAGJxbJrQPkECBAgQIAAAQIECBAg QIAAAQIEKiggsVjBShMyAQIECBAgQIAAAQIECBAgQIAAgbIFJBbLrgHlEyBAgAABAgQIECBAgAAB AgQIEKiggMRiBStNyAQIECBAgAABAgQIECBAgAABAgTKFpBYLLsGlE+AAAECBAgQIECAAAECBAgQ IECgggISixWsNCETIECAAAECBAgQIECAAAECBAgQKFtAYrHsGlA+AQIECBAgQIAAAQIECBAgQIAA gQoKSCxWsNKETIAAAQIECBAgQIAAAQIECBAgQKBsAYnFsmtA+QQIECBAgAABAgQIECBAgAABAgQq KCCxWMFKEzIBAgQIECBAgAABAgQIECBAgACBsgUkFsuuAeUTIECAAAECBAgQIECAAAECBAgQqKCA xGIFK03IBAgQIECAAAECBAgQIECAAAECBMoW+D8mLppjhREaTQAAAABJRU5ErkJggg== --000000000000dbc7af058e720f2d-- From nobody Wed Jul 24 12:12:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 74117120676 for ; Wed, 24 Jul 2019 12:12:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6b-FqyN0y1dE for ; Wed, 24 Jul 2019 12:12:46 -0700 (PDT) Received: from mail-ua1-x931.google.com (mail-ua1-x931.google.com [IPv6:2607:f8b0:4864:20::931]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4663C120609 for ; Wed, 24 Jul 2019 12:12:46 -0700 (PDT) Received: by mail-ua1-x931.google.com with SMTP id j2so18856960uaq.5 for ; Wed, 24 Jul 2019 12:12:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Sv3Y4eoz4WbkljYeFreCS4H6cbziMJOuTVIwDTB6IjY=; b=q/PIGgg8/eHuN9VBIKdGDezwZer8QTdKr92Jl8jPlovaLQgyetE/G3oC1IUe7Xqzch danerfReYgWn4RG2DQKuV7dcda2MjXSujSi50SUIrCrNvRc8yMzcgcVbHqCM3eTShjBw tyc9nEurThmkWhhnK36AuaRhR6VgGAxhsSDqrGLDZzMZ5x3bf8GjXFpdeZ0yLLekZvF2 YouTJ7nHQWcDbHABSwFzF+JFAPlHEI1bWkMTSa4+6pe88N6zAaI1o5Ac80hjpanPPueN hbASnDZwepvLVRx154FP340lU7Tk6S2JAYZzUvdLhOJ/xY90iOmIyFcIIfE3J9gI+IZB X4IQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Sv3Y4eoz4WbkljYeFreCS4H6cbziMJOuTVIwDTB6IjY=; b=WvF4i/lcujE3s3AuOrPLQ4WHI4G9BCvK6I0IYZh2y/NialAd62gRaDZpt/f4JWR5s1 5XemJXUmEFRVUq8HBD1RPLl7k87rG3nHkVQldlTqmfEzY9i4RCphroCnd/B8H5W7O8Zc zRyPO6kYxMGh1lQcPQ2JpLlARshpRcGZ3nj4A/+SGLhnkWicKq1Xa6nYP9b4uUmImlGh Ma0mYn9Ai5/RH7AMBGkfE5yQ0zB4LNpTu8OypXjdt1iic6hrG6gt7GTenz2mFnwzxph4 l+N2jKMdKnk95swel3nqnC1fQwINrfFObTe4hkKReKUTxJ9CDf+4W0HhKQUlyND4BAnX R/RA== X-Gm-Message-State: APjAAAXQysRQAs4truwcizdzXqn2Fxp5M/K86FSVqIdwbp+sY6y961e6 vT7VpCsqC+tsYAFVbvDEt8Oq87FRxCT/da+aJHcbENgOHNs= X-Google-Smtp-Source: APXvYqw49DWSxsqolXJA0waSCgk6hzi5SmQ6Z+LeoCUJlmKpvudcEDUm2+S8Ak4VGWNtlsfimrEbefBQiS9RCuh5h1Y= X-Received: by 2002:ab0:168a:: with SMTP id e10mr6853986uaf.87.1563995565347; Wed, 24 Jul 2019 12:12:45 -0700 (PDT) MIME-Version: 1.0 References: <06B41162-5936-4BF7-A9D6-3D864BB93ED2@gmail.com> <23864.43175.591553.553075@gro.dd.org> In-Reply-To: <23864.43175.591553.553075@gro.dd.org> From: Brian Dickson Date: Wed, 24 Jul 2019 15:12:34 -0400 Message-ID: To: Dave Lawrence Cc: "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000001a5941058e72189f" Archived-At: Subject: Re: [Add] Followup from ADD session today X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 19:12:53 -0000 --0000000000001a5941058e72189f Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 2:51 PM Dave Lawrence wrote: > On Jul 23, 2019, at 10:14 PM, Bret Jordan wrote: > >> Imaging an app being installed on a device that allows a user to > >> browse the web. It has a hard coded DoH server that it wants to use, > >> that points to the DoH server of its choice. The app can add as > >> many other headers it wants to ensure that it can fully track that > >> user and application, no matter where they are. So no matter where > >> that client is, you will always be able to have a perfect telemetry > >> of everything they have done and when they do it. > > Ted Lemon writes: > > Do you know of a way to detect such a client and prevent it from > > behaving in this way? > > Additionally, how is this particular to DoH? > It is particular to DoH as opposed to DoT, in the following regards: - If an app was installed with a hardcoded DoT server, the unique port used for DoT would enable detection of the connection to the specific DoT server (e.g. if it were not on a white list of DoT servers), and could be blocked (via white-listing/black-listing methods based on IP+port). - If no other apps were doing DoH client stacks, the development effort would be greater than using an already deployed DoT proxy (assuming such a proxy existed and was available on the device). The intrinsic argument is, please, let's identify the cost-value proposition of DoT as an alternative to DoH, and seriously consider DoT instead. Having malware or users make local changes in choice of DoT servers, is compatible with the detection/blocking of numerous environments, including the enterprise use case. Not having any apps which do DoH, means malware is, by definition, unable to hijack those apps in order to evade that detection and blocking. The specific use case of end-users in hostile locations, while a genuine use case, IMHO should involve deployment of distinct versions of browsers which do DoH, with lots of warnings to end users about the personal risks of using them, and the ability for managed-device systems to identify those versions (and if necessary, block their use or installation). Brian --0000000000001a5941058e72189f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 2:51 PM Dave = Lawrence <tale@dd.org> wrote:
<= /div>
On Jul 23, 2019, at = 10:14 PM, Bret Jordan <jordan.ietf@gmail.com> wrote:
>> Imaging an app being installed on a device that allows a user to >> browse the web. It has a hard coded DoH server that it wants to us= e,
>> that points to the DoH server of its choice.=C2=A0 The app can add= as
>> many other headers it wants to ensure that it can fully track that=
>> user and application, no matter where they are.=C2=A0 So no matter= where
>> that client is, you will always be able to have a perfect telemetr= y
>> of everything they have done and when they do it.=C2=A0

Ted Lemon writes:
> Do you know of a way to detect such a client and prevent it from
> behaving in this way?

Additionally, how is this particular to DoH?

=C2=A0It is particular to DoH as opposed to DoT, in the following reg= ards:
  • If an app was installed with a hardcoded DoT server= , the unique port used for DoT would enable detection of the connection to = the specific DoT server (e.g. if it were not on a white list of DoT servers= ), and could be blocked (via white-listing/black-listing methods based on I= P+port).
  • If no other apps were doing DoH client stacks, the develop= ment effort would be greater than using an already deployed DoT proxy (assu= ming such a proxy existed and was available on the device).
T= he intrinsic argument is, please, let's identify the cost-value proposi= tion of DoT as an alternative to DoH, and seriously consider DoT instead.

Having malware or users make local changes in= choice of DoT servers, is compatible with the detection/blocking of numero= us environments, including the enterprise use case.
Not having an= y apps which do DoH, means malware is, by definition, unable to hijack thos= e apps in order to evade that detection and blocking.

<= div>The specific use case of end-users in hostile locations, while a genuin= e use case, IMHO should involve deployment of distinct versions of browsers= which do DoH, with lots of warnings to end users about the personal risks = of using them, and the ability for managed-device systems to identify those= versions (and if necessary, block their use or installation).
Brian
--0000000000001a5941058e72189f-- From nobody Wed Jul 24 12:24:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5070B120429 for ; Wed, 24 Jul 2019 12:23:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.128 X-Spam-Level: X-Spam-Status: No, score=-1.128 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FROM_WORDY=1.571, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=protonmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9WWYlLXsLJo4 for ; Wed, 24 Jul 2019 12:23:57 -0700 (PDT) Received: from mail1.protonmail.ch (mail1.protonmail.ch [185.70.40.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B32A120409 for ; Wed, 24 Jul 2019 12:23:57 -0700 (PDT) Date: Wed, 24 Jul 2019 19:23:52 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=default; t=1563996235; bh=vChas4b/S7pBL8a7oHJ0T4grXYnGZyRmV65JjCPpU18=; h=Date:To:From:Cc:Reply-To:Subject:In-Reply-To:References: Feedback-ID:From; b=e7a0jOehBRfRI02g5E2vzTpinwkjW88lCpa+xwwz5tleuCu2Wm/kIm2KzVGpB6Mtc pOW4eEdgZ9UsczAG0ZN0KsmHd73Ov+7qrVJqG3FYdDVz0tdCSuxlR+qrTbHrqqm8nG XGXe885L/zkGW0wJZWEp9mtsbCtJ8QGiNNybMfJk= To: Lars Eggert From: "Arnaud.Taddei.IETF" Cc: "add@ietf.org" , Barry Leiba Reply-To: "Arnaud.Taddei.IETF" Message-ID: In-Reply-To: <093DF50A-009F-404F-BE6C-01C4D0E6E36E@eggert.org> References: <093DF50A-009F-404F-BE6C-01C4D0E6E36E@eggert.org> Feedback-ID: kou6vaSHQeY5dgFN9dCIYKo4z6hnnNmKuV4IBJw2wx4vSVPtftyhWUTBigri6zMJ3K1hxYJjI-3RAIGaizMt5g==:Ext:ProtonMail MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Add] on being cut from the mic (Re: Followup from ADD session today) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 19:23:59 -0000 Thank you for the explanation, I could not hear a lot of things and the end= of the meeting was a bit confusing to me I clearly over-reacted in a certain paranoia context and I present you my a= pologies Best Regards Sent with ProtonMail Secure Email. =E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90 Original Me= ssage =E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90 On Wednesday 24 July 2019 06:16, Lars Eggert wrote: > Arnaud, > > On 2019-7-23, at 21:38, Arnaud.Taddei.IETF Arnaud.Taddei.IETF=3D40protonm= ail.com@dmarc.ietf.org wrote: > > > As a matter of fact today I was cut on the mic and yet after me, Barry = had the chance to speak and then another person had the chance to speak so = it gives me the continued appearance that it is difficult to work in the IE= TF. > > as I started to explain when you complained to me after the session and t= hen walked away, I had closed the lines long before you got up to queue. > > Barry is the AD sponsoring the BOF. It's his show. Of course he gets to s= peak, he is expected to figure out what to take forward out of the BOF, and= in which shape. If he wants to make a statement or ask the room a question= , that's his prerogative. > > Lucy got up to queue after Barry, and I asked Barry if he wanted to grant= Lucy a minute after he was done. He seemed to indicate to me that he wante= d to do this, which is why Lucy got to speak. > > Lars > > -------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= - > > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Wed Jul 24 13:20:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9228612063C for ; Wed, 24 Jul 2019 13:20:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.648 X-Spam-Level: X-Spam-Status: No, score=-1.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EstJxSsIdcRY for ; Wed, 24 Jul 2019 13:20:18 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [92.243.4.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3006912025D for ; Wed, 24 Jul 2019 13:20:17 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id A5D20A052F; Wed, 24 Jul 2019 22:20:14 +0200 (CEST) Received: by godin (Postfix, from userid 1000) id A8AA4EC0AFD; Wed, 24 Jul 2019 22:17:08 +0200 (CEST) Date: Wed, 24 Jul 2019 16:17:08 -0400 From: Stephane Bortzmeyer To: Joseph Lorenzo Hall Cc: Tommy Jensen , Jim Reid , "add@ietf.org" , Bret Jordan , Rob Sayre Message-ID: <20190724201708.GA4202@laperouse.bortzmeyer.org> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 20:20:20 -0000 On Wed, Jul 24, 2019 at 06:19:09AM -0400, Joseph Lorenzo Hall wrote a message of 86 lines which said: > For example, the privacy policy of 1.1.1.1 is pretty amazing from > the perspective of data retention, secondary uses, etc. (e.g., I > know my resolutions will be removed from their logs within 24 > hours). I'm sure you know it but let's repeat anyway: promises are just promises. There is no technical way to check they are enforced. (Same thing for the ISP's promises.) From nobody Wed Jul 24 13:20:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 918F1120637 for ; Wed, 24 Jul 2019 13:20:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.649 X-Spam-Level: X-Spam-Status: No, score=-1.649 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2rQQo-YLJTDx for ; Wed, 24 Jul 2019 13:20:18 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [IPv6:2001:4b98:dc0:41:216:3eff:fe27:3d3f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC74C1205F8 for ; Wed, 24 Jul 2019 13:20:16 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id AC31BA0531; Wed, 24 Jul 2019 22:20:14 +0200 (CEST) Received: by godin (Postfix, from userid 1000) id 40E78EC0AFD; Wed, 24 Jul 2019 22:19:56 +0200 (CEST) Date: Wed, 24 Jul 2019 16:19:56 -0400 From: Stephane Bortzmeyer To: Bret Jordan Cc: Joseph Lorenzo Hall , Jim Reid , "add@ietf.org" , Tommy Jensen , Rob Sayre Message-ID: <20190724201956.GB4202@laperouse.bortzmeyer.org> References: <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <343D8DDD-CCEC-4DAB-85D9-B6ED8ABAB91B@gmail.com> <10762BA8-491F-474B-B23A-B7E5BD94F480@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <10762BA8-491F-474B-B23A-B7E5BD94F480@gmail.com> X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 20:20:20 -0000 On Wed, Jul 24, 2019 at 07:42:01AM -0400, Bret Jordan wrote a message of 171 lines which said: > Especially when the query is over http and can easily allow extra > headers so the end user can be fully tracked. There is a draft about that, asking for a specific profile for DoH, draft-dickinson-doh-dohpe. I observe there was no real interest for it. Too bad, I would prefer people work on concrete issues like this one. From nobody Wed Jul 24 13:22:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ABD9E12049B for ; Wed, 24 Jul 2019 13:22:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.996 X-Spam-Level: X-Spam-Status: No, score=-6.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xm_MEGXDYMIK for ; Wed, 24 Jul 2019 13:22:12 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [217.31.204.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B2B4912025D for ; Wed, 24 Jul 2019 13:22:11 -0700 (PDT) Received: from [IPv6:2001:1488:fffe:6:d2f5:375b:759f:bc7e] (unknown [IPv6:2001:1488:fffe:6:d2f5:375b:759f:bc7e]) by mail.nic.cz (Postfix) with ESMTPSA id D184713FBC8; Wed, 24 Jul 2019 22:22:09 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1563999729; bh=wCyYgSysCRg4abDvLFZA6IXKVk7nCq0vkDWmXvJL0Dw=; h=To:From:Date; b=r3dsvsNHytUYSlJm7NAK2pquDCvLwepTJ137jANR4y2EvC3e9AmvsvJlbA8KjzH3P HTVBaX4uZHcv7Kc+XuO+nsrRfLA2B+f1l0wpNzWfMWZl1ghzJrF6+/GEWvV+bF8/45 3aTUJz2dxX9p1gKN5mTDuEc+AH3rzOHEJSt9wA7k= To: add@ietf.org References: <20190724165643.GA29051@laperouse.bortzmeyer.org> <2457067b-49fe-c2cf-d554-95f524573eea@gmail.com> From: =?UTF-8?B?VmxhZGltw61yIMSMdW7DoXQ=?= Cc: Thomas Peterson Openpgp: preference=signencrypt Autocrypt: addr=vladimir.cunat+ietf@nic.cz; prefer-encrypt=mutual; keydata= mQINBFgDknYBEADHEQwLBlfqbVCzq7qYcBFFTc1WCAFtqiKehOrsITnKusZw4nhYwlKQxcum gj01xJOhbfHBCBeGlDydYqemKg4IfY2nwSyPwZZYMJn7L7AGrCeytr4VMvDJ7o7qDZjjim4i fv+GUwdk3plXx6oMF4nctesI8aAOuLUHAn0PfrGfNhWoaglOKgdOI6DGjhI/aGkvy+jrI/+X sdMV+3f1RuEOfI+Yu4SXFjJyhAmqEOBRxxdHqKreIIpz3Lg38yWwiVGfwgQT+nFIz9BpHH3l Wg1uS8xM3ezceBmRYV8zT9PvbeZ57BlaTR6rLae5RYwV397PSLBqqLkB5H0TDRUFBnwBsUob LebYHmJCOydvyNv5AFkLmLZ7O4j2jFo1WPSMt3ThM6wRwqrnB4Gi+6onyrZfE1DnVZMqbxZ3 VXa+E4S5YwrfCLUErGEn+d40OtoRZmQXhRPVAsdjimMj9oFM9RoxSgUrDg6Ia3n0IrKFb++z HAFbqkR5g4qzXiOMEG621GYEex2sDEKz/PD4CVKlNI9eld4ToH592kAwzJmd+sAi+Rfos0NE zxuFd0ekAOeWoURo0zoYTSWPlMOmFMvcpH6LP3leJmY7x4z/b1ng/+7UnKonVALVPFbRbElO kIfAtLKcUEofwV1jr7DyYGPalJtiDJPomB041ZHCj2RxyXY/oQARAQABtDBWbGFkaW3DrXIg xIx1bsOhdCAod29yaykgPHZsYWRpbWlyLmN1bmF0QG5pYy5jej6JAlQEEwEIAD4CGyMFCQlm AYAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AWIQS2AGRgtgqA54IGJEnnR98flXWjqgUCWg3w 3gAKCRDnR98flXWjqmD6D/96U4cDZBrHQ5LhqybocZr/N2IS5Wr2SLLB4k2F5/W/wbL05gq6 Ha9/2TMqXoxRkhug+EAHFHxylPR43yN9rz0pjBXHrra87FAPHMqq/qqrOEUdhkytEqa6WIho aoEkdhaMhUyctjVjL2WZ0+MWeRjqedLQX+VCrOVPcVbLreRRhA9N3KPgNwbp9zCg6hEPi4l2 zZKedHkTNjKIAwJ0xZoMwFa1Y+vL8Em8Or+IBZuGBMP/ZMtasPOIQaT/Gvsyx1DDorwsoCdX 6zaTZy5DOWP3FIrMzus/YDbzwAYxSpWk/jF44ySbnJzdjU67EfG3UrsK+RRGw8aJqs3/4qHK ZMZZnNL+4wJpEdnZyFic/MXcw6FBszQEwrIOaM1WEfwzn2ExUYk2pM5zaBwq76OgrmGMzMEi cfMDyqLodwEQqR70PvRbkrh+R02LphwQ9c5AFXcrLjKMmeQlbQVarTUsrELcTK6rElC1ojS7 M37j0XzFE+kgNWn2fyBRgtnGDWEa7r+oDaueXJnEf0/4Ww28IwxakNc7r0N41GIBekwSxKdk epKFZgtVGGSDlFei5hb5LLWFljA1OS7CRVJKpbHafQjdPdb1vNqZAj4y2SJXvVVpI1KO5kq+ dFdYipORv0N2Iho6MNYbQUT1EBeU46G5N0viCoLS15/PxLhIAo+PzKpW97kCDQRYA5J2ARAA yHww3huLEtsdyqgjiGMhtEKOLmp7yFl450HY9oPcHS02U5BC1370ssNShrdOCi2ACDbe41Zx x85WcuaO1OVqung2umX047mj2xQsiTAFRDLZsQu8cQFoEy/DBL2bk7ThfK1Lh+NyZAs0UaPp DkGodS0De9osA+4T6Nf4POYaeavbYVFSdDKS4lUboBqApKnD/TzKFxFcpuFx6FN92lteTbOo jGMiLoZvELY86Kn9KuFZ8FM2ZSNHx1Z75KouufGrdkeCoZYVYiuzT+fnt2it4dIpIlnF+yxM t5LB/MSrmECB5CAFJtxzuMccm6yDUZQSWWi9vUgxIJwvt5w0CIBT353DGeP4WnH0r5YoBKoR bh7i4fT0lWvMXTG/V2lqyzBdClMebyHffMgba26Kj6oeDygDfC5aGsVaqw1Ue/qQ5QRqTJcJ V7xVLTtS1EamVqkfKwPS0zTfnrF1jQtnO/P4qkfgBRRG9BXGGrykHpXOyqmX6Z0wbV2P4j+p 02oSecDl5yVXplJfsXfbS/xXnaSkaN/7mCU29ul26cAVNxDkDPunztSFi9K9LM2T/XWYJQGX M71OpmONQJGF24lx7Wp/kobnHtbjGDzjDPC4eSL7MA56qtrWaLM+4ePKANct2q0q6c0uSLs0 Q2zochS64Mcg0YzL1sinWPN1rXLDk3lwpIsAEQEAAYkCJQQYAQgADwUCWAOSdgIbDAUJCWYB gAAKCRDnR98flXWjqn4yEACA0f1XBAg+WMaNPtIt0k15yFPfhdbOg9GhDcYGgvFIOxRuaFWw 9SLUt7OGuUnIpKxKRXtQJss98fHkijo70ONYWPuLhfRGK/wg9Ao6MuFw5G8m431CBS/awrie b6iPjvAARXJCPTTBZk/NC988jiKdCh8PbTCHDsl+gSDytP15QUrdqSfS2Wf4653ej7+jtuTj xZzmGgvNSi6JDlb9KNtmBQKQAgpnOQM46ItESmzHDnmdcvhPLUDsjwkpIJ6clasOzaObwxJi ba7iFPcGwcClCSwYjMNXFtneCGUnEAa5RBIx+i+LV1iqB3VRvTC6tMIUueoQ7cdTy6afNkhw QYXm4/pDmNT8UMdnzwnlTpFQ0CegDQRDWc+dIDDBHGEEEYBh2vTOE04KrmYUp1bQsNegPfvL woHib0jEvohPMJ2fJtZAd1SJElgwPbM8H7emKBiTsHwF8gL7G2jo7AoGpqYjqXkCRS0tSLTN r+qHh+7Ltrkbu/ZVTTfh4Q/qw3VaLYQh4C0tBma/YevQy1O2c3TZXXFz1QF8b9/Hj/3sq2Kg T1AcZ51E+xG+cb6cUqgkihmgm39xx24GPlNAdCRuq01+iILol+Wox6OwF6hmqx1EMSmxcmGo UREr0rkMnFVsWeAYeVoE4q689qxCPu9iCMJMJnkRe1o9oQYSN7my+S98gA== Message-ID: <5009606a-4fcb-92c7-85c6-208d359147c8@nic.cz> Date: Wed, 24 Jul 2019 22:22:09 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <2457067b-49fe-c2cf-d554-95f524573eea@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-US X-Virus-Scanned: clamav-milter 0.100.3 at mail.nic.cz X-Virus-Status: Clean Archived-At: Subject: Re: [Add] Not a good BoF meeting X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 20:22:15 -0000 On 7/24/19 8:16 PM, Thomas Peterson wrote: > On 24/07/2019 17:56, Stephane Bortzmeyer wrote: >> * discovery of local DoH resolvers (in my opinion, a flawed idea from >> the >> start: if you trust the local network, you don't need DoH, if you >> don't, you won't trust its DoH announces anyway), > > As the author of a draft (draft-peterson-doh-dhcp[0]) that provides > discovery of DoH resolvers, I disagree as "trusting the network" is > more complicated when there may be many operators and users in a given > network, any of whom could be a threat. To me it is a positive if > operators can provide secure means of DNS resolution within their > network, and clients can choose to use them or not. I'm fairly sure this has been mentioned a few times, but let me repeat it: if you don't (fully) trust the network, how can you bootstrap your trust? (e.g. over insecure DHCP)  You may get some certificate name or key pin, but if you can't first "secure" the channel over which you obtain those, I don't think you get much more real security.  With some additional "approval" from the user perhaps, but that would again run into the same informed-consent issues - and the attacker could e.g. be running a service with just a tiny "typo" in the domain name. >> On 24 Jul 2019, at 17:56, Stephane Bortzmeyer wrote: >> >> I suggest that this list does not do anything useful at this time. > Plenty of others have a different PoV. I agree that the ADD "group" is still struggling with finding a "charter", basically, and I'm afraid I can't see much forward progress (e.g. since the previous IETF) or satisfaction of a larger fraction of the participants so far. Much of the struggle seems about *who gets the control* over DNS or even other traffic (by default), which might be really hard to get a true consensus about, and... even if IETF manages to publish a position that some parties should relinquish (part of) this control, I'm a bit skeptical whether that act itself would have a significant impact.  In this case it doesn't even seem viable to technically enforce that apps don't tunnel information somewhere (without drastic measures like MITM everything).  It's surely worth trying to discuss this and work towards some compromise to diminish the arms-race, but how to progress the discussion forward? --Vladimir From nobody Wed Jul 24 13:37:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2C0E120637 for ; Wed, 24 Jul 2019 13:37:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.648 X-Spam-Level: X-Spam-Status: No, score=-1.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K6F52e1TGRSD for ; Wed, 24 Jul 2019 13:37:23 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [92.243.4.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 081B3120623 for ; Wed, 24 Jul 2019 13:37:23 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id 0CE68A052F; Wed, 24 Jul 2019 22:37:21 +0200 (CEST) Received: by godin (Postfix, from userid 1000) id 2FB8EEC0AFD; Wed, 24 Jul 2019 22:35:54 +0200 (CEST) Date: Wed, 24 Jul 2019 16:35:54 -0400 From: Stephane Bortzmeyer To: "Arnaud.Taddei.IETF" Cc: "add@ietf.org" , Barry Leiba Message-ID: <20190724203554.GA5078@laperouse.bortzmeyer.org> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Add] Followup from ADD session today X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 20:37:24 -0000 On Wed, Jul 24, 2019 at 01:38:25AM +0000, Arnaud.Taddei.IETF wrote a message of 231 lines which said: > As a matter of fact today I was cut on the mic and yet after me, > Barry had the chance to speak It is always frustrating when the line close (I was still wondering if I would intervene or not) but I feel sympathy for the BoF chairs: there were a lot of people and not enough time. IMHO, this should be seen as a symptom of "no clear delineation of the BoF, no clear idea of what we were discussing". This is why there were so many people in line and you couldn't speak. > I would have asked clarification questions on the UX implications on > how the user would chose the right DoH server from the vetted hard > coded one vs the proposed new one, etc. which UX was expected Talking of UX and UI is fine but remember we are the IETF: we are not experts on UX and, while our input is certainly interesting, we are not expected to standardize the user experience or interface. > The other aspects are, as Vasily Dolmatov said, the fact that we are > implicitly accepting a default of configuration at application level We are accepting nothing. The IETF has no authority over the software authors. This is a good thing, not because they are perfect and always make good choices, but simply because we do not have the moral authority to force them to do this or that. (We still can provide reasonable guidance, relying on our moral authority.) > I am surely very naive here but if what we are facing here are > applications that need to find their DoH server and perhaps other > resources, why are we not more ambitious and why don't we reconsider > a protocol that is for application configuration and thus it could > be managed by service providers, would keep the alignment to > infrastructure semantics, It seems to me a bad idea. If you use DoH, it's because you don't completely trust the infrastructure. IMHO, the choice of a DoH server should not depend on the local access network. From nobody Wed Jul 24 13:41:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A103E1206CB for ; Wed, 24 Jul 2019 13:41:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.648 X-Spam-Level: X-Spam-Status: No, score=-1.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xktRVCIEFTkc for ; Wed, 24 Jul 2019 13:41:45 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [IPv6:2001:4b98:dc0:41:216:3eff:fe27:3d3f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DBE861206A3 for ; Wed, 24 Jul 2019 13:41:44 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id 9030AA052F; Wed, 24 Jul 2019 22:41:43 +0200 (CEST) Received: by godin (Postfix, from userid 1000) id 76CDDEC0AFD; Wed, 24 Jul 2019 22:38:35 +0200 (CEST) Date: Wed, 24 Jul 2019 16:38:35 -0400 From: Stephane Bortzmeyer To: philippe.fouquart@orange.com Cc: "andrew.fidler@bt.com" , "chris.box@bt.com" , "add@ietf.org" Message-ID: <20190724203835.GB5078@laperouse.bortzmeyer.org> References: <30950_1563958271_5D381BFF_30950_9_1_B5939C6860701C49AA39C5DA5189448B939E9268@OPEXCAUBMA1.corporate.adroot.infra.ftgroup> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <30950_1563958271_5D381BFF_30950_9_1_B5939C6860701C49AA39C5DA5189448B939E9268@OPEXCAUBMA1.corporate.adroot.infra.ftgroup> X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 20:41:49 -0000 On Wed, Jul 24, 2019 at 08:51:11AM +0000, philippe.fouquart@orange.com wrote a message of 88 lines which said: > regarding your call for call for inputs yesterday, we would support > this work and be happy to contribute on some of these items. Part of it is already done. For instance, the message you quote mentions "authentication requirements for DoH and DoT resolvers" which are already covered in the RFCs standardizing DoTH. From nobody Wed Jul 24 13:46:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4AE0E120640 for ; Wed, 24 Jul 2019 13:46:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.648 X-Spam-Level: X-Spam-Status: No, score=-1.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ebCbmZAXTvet for ; Wed, 24 Jul 2019 13:46:00 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [92.243.4.211]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4312F120285 for ; Wed, 24 Jul 2019 13:46:00 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id 54439A052F; Wed, 24 Jul 2019 22:45:57 +0200 (CEST) Received: by godin (Postfix, from userid 1000) id C7C6FEC0AFD; Wed, 24 Jul 2019 22:41:44 +0200 (CEST) Date: Wed, 24 Jul 2019 16:41:44 -0400 From: Stephane Bortzmeyer To: Jim Reid Cc: Rob Sayre , "add@ietf.org" Message-ID: <20190724204144.GC5078@laperouse.bortzmeyer.org> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 20:46:01 -0000 On Wed, Jul 24, 2019 at 02:56:15AM +0100, Jim Reid wrote a message of 16 lines which said: > BTW, using DoH or DoT in the above scenario doesn't necessarily make > things "secure". It just changes the security landscape by swapping > one set of concerns for another. A cynic (or realist) would say > they'd just replaced one DNS resolver they probably didn't/shouldn't > trust to another that isn't necessarily more trustworthy. On the Internet, we often have to make decisions about who to trust. We decide to register a .com or a .cctld, we decide to use Signal or Telegram, we decide to do searches at Google or at DuckDuckGo, etc. Sometimes, we make wrong assessments but I disagree with the nihilist view that "everything is rotten, there is no point in choosing the provider". From nobody Wed Jul 24 13:48:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7899012060C for ; Wed, 24 Jul 2019 13:48:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TzqAOteqAuUs for ; Wed, 24 Jul 2019 13:48:26 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7EA49120285 for ; Wed, 24 Jul 2019 13:48:26 -0700 (PDT) Received: from dhcp-8a04.meeting.ietf.org (dhcp-8a04.meeting.ietf.org [31.133.138.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 7D089242109D; Wed, 24 Jul 2019 20:48:23 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <20190724204144.GC5078@laperouse.bortzmeyer.org> Date: Wed, 24 Jul 2019 21:48:21 +0100 Cc: "add@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <20190724204144.GC5078@laperouse.bortzmeyer.org> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 20:48:27 -0000 > On 24 Jul 2019, at 21:41, Stephane Bortzmeyer = wrote: >=20 > I disagree with the nihilist view that "everything is rotten, there is = no point > in choosing the provider". Nobody has expressed that view. From nobody Wed Jul 24 13:50:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E3F9120637 for ; Wed, 24 Jul 2019 13:50:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.648 X-Spam-Level: X-Spam-Status: No, score=-1.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LXJvQI63iCkK for ; Wed, 24 Jul 2019 13:50:12 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [92.243.4.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A89D12060C for ; Wed, 24 Jul 2019 13:50:12 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id 06CA4A052F; Wed, 24 Jul 2019 22:50:11 +0200 (CEST) Received: by godin (Postfix, from userid 1000) id 52522EC0AFD; Wed, 24 Jul 2019 22:46:50 +0200 (CEST) Date: Wed, 24 Jul 2019 16:46:50 -0400 From: Stephane Bortzmeyer To: Bret Jordan Cc: Arnaud Taddei , "add@ietf.org" , Barry Leiba Message-ID: <20190724204650.GD5078@laperouse.bortzmeyer.org> References: <06B41162-5936-4BF7-A9D6-3D864BB93ED2@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <06B41162-5936-4BF7-A9D6-3D864BB93ED2@gmail.com> X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Add] Followup from ADD session today X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 20:50:14 -0000 On Tue, Jul 23, 2019 at 10:14:55PM -0400, Bret Jordan wrote a message of 334 lines which said: > Imaging an app being installed on a device that allows a user to > browse the web. It has a hard coded DoH server that it wants to use, > that points to the DoH server of its choice. The app can add as > many other headers it wants to ensure that it can fully track that > user and application, no matter where they are. So no matter where > that client is, you will always be able to have a perfect telemetry > of everything they have done and when they do it. Imagine an app being installed on a device that allows a user to browse the web. It uses a lot of trackers and send a lot of data to many actors everywhere. You have just described the vast majority of apps that one can found today on Google Play or App Store. (See .) In what way is it a DoH issue? Apps can send tracking data and they actually do it, and they did it long before RFC 8484. Why was there no complaint? Why using this as an anti-DoH argument? From nobody Wed Jul 24 13:50:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E8B6512060C for ; Wed, 24 Jul 2019 13:50:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GuofQ93Pp-z1 for ; Wed, 24 Jul 2019 13:50:12 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5001D120285 for ; Wed, 24 Jul 2019 13:50:12 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45v6tB6h9kzKtS; Wed, 24 Jul 2019 22:50:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1564001410; bh=bRNPSxyRCH3/kqSBsUTuCTMjFYcSiobPmw9q8pGDZ3A=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=uMqE5SSTNyDWMIWnr7xK2DSy8up8jKgBEFK5oI4wNywbHTGoer0MB3tC8rlNIVpHQ yyiD81A4Z43hGMj+HoSzElzWrK/ePR+F24VLDWG2A2B1u2egNiyql/vwSrIysffXoG oIoT8neUbMtw06EpiYEFtWScshJea7UW7YjAzSW0= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id hijjo8gHpEun; Wed, 24 Jul 2019 22:50:10 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Wed, 24 Jul 2019 22:50:09 +0200 (CEST) Received: from [10.169.186.107] (199-7-156-131.eng.wind.ca [199.7.156.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id 19534353F94; Wed, 24 Jul 2019 16:50:08 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 19534353F94 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Paul Wouters X-Mailer: iPhone Mail (16F203) In-Reply-To: <5009606a-4fcb-92c7-85c6-208d359147c8@nic.cz> Date: Wed, 24 Jul 2019 16:50:06 -0400 Cc: add@ietf.org, Thomas Peterson Content-Transfer-Encoding: quoted-printable Message-Id: <590021BB-6BA8-4CDB-8537-6335498C63E2@nohats.ca> References: <20190724165643.GA29051@laperouse.bortzmeyer.org> <2457067b-49fe-c2cf-d554-95f524573eea@gmail.com> <5009606a-4fcb-92c7-85c6-208d359147c8@nic.cz> To: =?utf-8?Q?Vladim=C3=ADr_=C4=8Cun=C3=A1t?= Archived-At: Subject: Re: [Add] Not a good BoF meeting X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 20:50:14 -0000 Sent from mobile device > On Jul 24, 2019, at 16:22, Vladim=C3=ADr =C4=8Cun=C3=A1t wrote: >=20 > I'm fairly sure this has been mentioned a few times, but let me repeat > it: if you don't (fully) trust the network, how can you bootstrap your > trust? (e.g. over insecure DHCP) You may get some certificate name or > key pin, but if you can't first "secure" the channel over which you > obtain those, I don't think you get much more real security. The preconfigured dnssec root key. > I agree that the ADD "group" is still struggling with finding a > "charter", basically, and I'm afraid I can't see much forward progress > (e.g. since the previous IETF) or satisfaction of a larger fraction of > the participants so far. The discussions on the list and in the group only showed the problem is touc= hing so many issues that it=E2=80=99s hard to contain. I=E2=80=99m not sure I see a useful future for =E2=80=9CADD=E2=80=9D, but it= was a terrible name to start so letting it die isn=E2=80=99t the worst. Paul From nobody Wed Jul 24 13:53:39 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 829E112060C for ; Wed, 24 Jul 2019 13:53:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ducksong.com header.b=YN0A+VVK; dkim=pass (2048-bit key) header.d=outbound.mailhop.org header.b=sGd6Yy0X Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SPx730uFi9A9 for ; Wed, 24 Jul 2019 13:53:35 -0700 (PDT) Received: from outbound1g.eu.mailhop.org (outbound1g.eu.mailhop.org [52.28.6.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C88B9120285 for ; Wed, 24 Jul 2019 13:53:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564001613; cv=none; d=outbound.mailhop.org; s=arc-outbound20181012; b=Pa2KIONwpMDrkYx+KPj6magS8bE0lWXmOrSnWfSusSH01MqglboA8AYXOFObR8aksj1nqq7yMa0jX ZB1X7J/um6ckKKFhH7o9XWTgz31+1Gzw7USt5tABm0eKyNxYUWTTs1oYgAqzvRtPHlaQxPzxus8kOS BybCyBlh+uMLlQPESb/9/oSxl7NFK7wVyibsj36+KboTu4kWB1Do7L/o1sNl3VEjBoWMf3/u4126JG OYlawnUdIW9ikf6nMRuIMkBiVdTCh8R4lCGDzuAjnO6ffeKK0MJXK1FwhjH1f4DjnLFfOUVqPzWddH OjtMw+lvNEAbQ9oAO3YzG8cvlNuD9Ig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=arc-outbound20181012; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:dkim-signature:dkim-signature:from; bh=If/0zu3G+VAc3XWwnMtS+MnZonfy9MielZKdupS5KQQ=; b=PBscxgNKQ+OErwRQ83K9xzS+L+Zr+FxVLiG/zo0UatsYxNRcqS6dI5AS92s7u/ujGb1hmy8POptcd qu+KMludlh0eHH1MBU8qlZUt6W5RjnoYnltDbJEzrUWEklsXK6IuHkSQ7MCWKR0KoZM1qFYc+5M957 lClWLNb4j6Jn87TqSjzUcHUrHa6xaBmJfXebNUf2pRmZYode7+ByBcEvznaT42OvjVEB2xBbPjOypF DIgSy0bl2S/UXZ6+SzqXJFvUCNvPHYDhX729KNMrB1ga6aGKNNbk3WsCwy2Y7ZDliLRVXg0MhPTyai Rk1kPEuJa3aQ9nXNBLMniWqTC/yKcDw== ARC-Authentication-Results: i=1; outbound3.eu.mailhop.org; spf=pass smtp.mailfrom=ducksong.com smtp.remote-ip=209.85.167.181; dmarc=none header.from=ducksong.com; arc=none header.oldest-pass=0; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ducksong.com; s=duo-1537391512170-ea99bbb3; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=If/0zu3G+VAc3XWwnMtS+MnZonfy9MielZKdupS5KQQ=; b=YN0A+VVKhU9cLBz76OYzvlJZEKWAYnbQ0n6XuFXegC1xwPs8M5hkaVY59rJ/cToYrYUJ5i/ocks0G 6tYB2Ay2HY3DUpKqs98AJUhnrjx2ZvyUJ3h5G4/OWMTUMfG61TeVxWwkyJlzvN+iJlACUY2uGTDUUq khmghkaMOp3xjxek= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=dkim-high; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=If/0zu3G+VAc3XWwnMtS+MnZonfy9MielZKdupS5KQQ=; b=sGd6Yy0XbXvIo3bmqNcTa4T31oaflcqLBCVWdzOGkde3ouI4iBNqmCeMDK9XvGwqbssJytR7UXLgd FcohV8wlhVMK67zzeG0MoJMD3xZlEsJ/bQBQ2tVOrZAtgLaECNKeiEI51v7nKs276zRltKlB4hQX9i /omCa7x15myPm2Ehi1RdaniBXyeU7DHO5NS+nru6fSjRg1A0m1SqlxqnegW5iiCXmbh3cVTIW4kUMM ZHxrXIjJrirrbtRFo7W/IT9BCKz29BfEtT69g/IEcsEtFTz3pclRnwB3xYHPbgPcM1/rCKQf4lpw6X Q+21uh4oj6VSDvjgBU9diutkLDSGV6Q== X-MHO-RoutePath: bWNtYW51cw== X-MHO-User: 1793c7ef-ae55-11e9-af75-8714a675f328 X-Report-Abuse-To: https://support.duocircle.com/support/solutions/articles/5000540958-duocircle-standard-smtp-abuse-information X-Originating-IP: 209.85.167.181 X-Mail-Handler: DuoCircle Outbound SMTP Received: from mail-oi1-f181.google.com (unknown [209.85.167.181]) by outbound3.eu.mailhop.org (Halon) with ESMTPSA id 1793c7ef-ae55-11e9-af75-8714a675f328; Wed, 24 Jul 2019 20:53:31 +0000 (UTC) Received: by mail-oi1-f181.google.com with SMTP id m206so36043501oib.12 for ; Wed, 24 Jul 2019 13:53:30 -0700 (PDT) X-Gm-Message-State: APjAAAWmguTCda9T1t7cX9fGmnddg9JoaOjAWbAfjfjmODUfiyE9aWgP ykma6fQdXCmq905mtWZGcyGA084TEWPCeOT/fW0= X-Google-Smtp-Source: APXvYqyVPrgLxhiAL0vMniE8/VQrzHc6A6S8wY/uvzJKhZT7DZcRXFnr2VIFBqTIGizkcMGSN+Sgz7RZNAp2qmGjpvk= X-Received: by 2002:aca:ad0f:: with SMTP id w15mr8108295oie.58.1564001610000; Wed, 24 Jul 2019 13:53:30 -0700 (PDT) MIME-Version: 1.0 References: <20190724203554.GA5078@laperouse.bortzmeyer.org> In-Reply-To: <20190724203554.GA5078@laperouse.bortzmeyer.org> From: Patrick McManus Date: Wed, 24 Jul 2019 16:53:18 -0400 X-Gmail-Original-Message-ID: Message-ID: To: Stephane Bortzmeyer Cc: "Arnaud.Taddei.IETF" , "add@ietf.org" , Barry Leiba Content-Type: multipart/alternative; boundary="000000000000646f57058e7380b4" Archived-At: Subject: Re: [Add] Followup from ADD session today X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 20:53:38 -0000 --000000000000646f57058e7380b4 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 4:37 PM Stephane Bortzmeyer wrote: > > It seems to me a bad idea. If you use DoH, it's because you don't > completely trust the infrastructure. IMHO, the choice of a DoH server > should not depend on the local access network. > > I mostly agree with this - trust is not a feature of the network, and you can't generally can't even be certain what network you are using. OTOH the locality of a resource is an interesting optimization. So if you can discover something locally and then find an out of band way to ratchet up your trust (e.g. a PVD based discovery shows you a resolver that turns out to have a certificate signed by a trust anchor you trust to vet resolvers separate from the web PKI) then maybe you've done something useful. --000000000000646f57058e7380b4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 4:37 PM Steph= ane Bortzmeyer <bortzmeyer@nic.fr> wrote:
It seems to me a bad idea. If you use DoH, it's because you don't completely trust the infrastructure. IMHO, the choice of a DoH server
should not depend on the local access network.



--000000000000646f57058e7380b4-- From nobody Wed Jul 24 14:07:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ACB011205CD for ; Wed, 24 Jul 2019 14:06:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ruVWMAK2vcsU for ; Wed, 24 Jul 2019 14:06:57 -0700 (PDT) Received: from mail-vs1-xe2b.google.com (mail-vs1-xe2b.google.com [IPv6:2607:f8b0:4864:20::e2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 17384120285 for ; Wed, 24 Jul 2019 14:06:57 -0700 (PDT) Received: by mail-vs1-xe2b.google.com with SMTP id u3so32279723vsh.6 for ; Wed, 24 Jul 2019 14:06:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jSlojbmFKQFSNW3bMUnvEpjLELBgzX7FDRDIR6W2F28=; b=CIiAOOu8zA45/OtTo5IFkKHs7J3jsutvDwndGVekwdFoop3kEclafFqxo7XJzHpN42 W9CrkA10oBuDHg+PMPMDwRTusAEFuk3YkUsl0y1BQCL+K0v7O91b5M6aVnIvYh9S/kvx paoATyIGcw4NPryY7FNzR8DC8SwDlx+OM5Lnx9vftSub/LBopBqHIZtRbNyipalaI8K2 eu0Oz1Jtgr2Br34V5omILkw1jVR5QHT2S+nOyAxWvkgfBOVE6Q5VhcV0zvBSonVw+yCQ AFpwuoCxx/ZEPPWokoN0crsu9hKOlFGG9LyGd3v3vm6hETFpGM6yGBtbuPP3FI9vKdpk jy1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jSlojbmFKQFSNW3bMUnvEpjLELBgzX7FDRDIR6W2F28=; b=shjj8MafRVwdUkyvjMFBzZaZPs47cvpylXtGMvCkfqPAO1AvDDRHZkfuRy5Ojc7gqy uxEtrhCU8kxbkdmxUU6rxnA1ye4QGeFjZlC3qK5YW/YnWGhxq17rQs7fjgt1QRFzI5iE ot12Q8XDyWnHl3BtaZ5jKpdj3H+PQXdm3O1EokG4cCcBeWIdVEZ4zbxvom6tR4kHIv9d eJBXzi6tIDr0auAvIJIeYSwssAR1S94S4F00tdmtCvG+niUHhoLCLqxquoitaTknqYCr Heqn4/RIMgn8K76fFvVAuKaq1APJu1Ky0ZO8xXYgOKbuRnFJQnbzDvqNWw+ByaF/4t7d 1h4w== X-Gm-Message-State: APjAAAVbMk73ZhITp0TpymYVSBZOOBaRYkZ/t599iKhTzMFyVyxWqeCU Wyv0airJZSgqoNANr0BI4O4NdRmO/Nu4VK9PTKE= X-Google-Smtp-Source: APXvYqwVck5jkQnfCINCulEh0+acl14gWxY9NRviGRNIuY+WqnPjj/BgvS67muRE1gEbEUc1BZNhfzOhuF2W/eev7FY= X-Received: by 2002:a67:c419:: with SMTP id c25mr53681394vsk.136.1564002416189; Wed, 24 Jul 2019 14:06:56 -0700 (PDT) MIME-Version: 1.0 References: <20190724165643.GA29051@laperouse.bortzmeyer.org> <2457067b-49fe-c2cf-d554-95f524573eea@gmail.com> <5009606a-4fcb-92c7-85c6-208d359147c8@nic.cz> <590021BB-6BA8-4CDB-8537-6335498C63E2@nohats.ca> In-Reply-To: <590021BB-6BA8-4CDB-8537-6335498C63E2@nohats.ca> From: Brian Dickson Date: Wed, 24 Jul 2019 17:06:44 -0400 Message-ID: To: Paul Wouters Cc: =?UTF-8?B?VmxhZGltw61yIMSMdW7DoXQ=?= , Thomas Peterson , add@ietf.org Content-Type: multipart/alternative; boundary="00000000000071e5f3058e73b049" Archived-At: Subject: Re: [Add] Not a good BoF meeting X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 21:07:00 -0000 --00000000000071e5f3058e73b049 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 4:50 PM Paul Wouters wrote: > > > Sent from mobile device > > > On Jul 24, 2019, at 16:22, Vladim=C3=ADr =C4=8Cun=C3=A1t > wrote: > > > > I'm fairly sure this has been mentioned a few times, but let me repeat > > it: if you don't (fully) trust the network, how can you bootstrap your > > trust? (e.g. over insecure DHCP) You may get some certificate name or > > key pin, but if you can't first "secure" the channel over which you > > obtain those, I don't think you get much more real security. > > The preconfigured dnssec root key. > And just to complete the picture for those less familiar with DNSSEC and DANE: - the root key gives you validation of signatures in the root zone, including for the chained trust links across DNSSEC-secure delegations (= to TLDs) - The DNSSEC-signed TLDs (with KSK and ZSK signed by KSK, whose finger print is the chained trust record "DS"), give you similar chained trust links downward... - Eventually, you end up inside a DNSSEC-signed zone, which contains - signed A/AAAA records (thus you have cryptographic proof of the values for the IPv4 and IPv6 addresses), plus - signed TLSA records which provide cryptographic proof of values for either the CA or the end entity cert (EE), - as either full certificate or as fingerprint, - Thus, completing the secure bootstrap to a TLS certificate (or fingerprint) plus IPv4/IPv6 address(es) The above supports some forms of aliasing along the way (CNAME and DNAME), as well, which are also DNSSEC-compatible (e.g. signed CNAME or DNAME records, if they point to DNSSEC-signed targets) You can see why the DNS folks are proponents of DNSSEC and DANE, in this discussion. Without these, secure bootstrap is a very difficult problem. With DNSSEC and DANE, the problem is already solved, modulo deployment of DNSSEC by zone owners, and modulo implementation of native DANE in browsers= . Brian --00000000000071e5f3058e73b049 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 24, 2019 at 4:50 PM Paul = Wouters <paul@nohats.ca> wrote:=


Sent from mobile device

> On Jul 24, 2019, at 16:22, Vladim=C3=ADr =C4=8Cun=C3=A1t <vladimir.cunat+i= etf@nic.cz> wrote:
>
> I'm fairly sure this has been mentioned a few times, but let me re= peat
> it: if you don't (fully) trust the network, how can you bootstrap = your
> trust? (e.g. over insecure DHCP)=C2=A0 You may get some certificate na= me or
> key pin, but if you can't first "secure" the channel ove= r which you
> obtain those, I don't think you get much more real security.

The preconfigured dnssec root key.

And = just to complete the picture for those less familiar with DNSSEC and DANE:<= /div>
  • the root key gives you validation of signatures in the ro= ot zone, including for the chained trust links across DNSSEC-secure delegat= ions (to TLDs)
  • The DNSSEC-signed TLDs (with KSK and ZSK signed by K= SK, whose finger print is the chained trust record "DS"), give yo= u similar chained trust links downward...
  • Eventually, you end up in= side a DNSSEC-signed zone, which contains=C2=A0
    • signed A/AA= AA records (thus you have cryptographic proof of the values for the IPv4 an= d IPv6 addresses), plus
    • signed TLSA records which provide cryptogra= phic proof of values for either the CA or the end entity cert (EE),
    • as either full certificate or as fingerprint,=C2=A0
  • = Thus, completing the secure bootstrap to a TLS certificate=C2=A0 (or finger= print) plus IPv4/IPv6 address(es)
    • The above supports some= forms of aliasing along the way (CNAME and DNAME), as well, which are also= DNSSEC-compatible (e.g. signed CNAME or DNAME records, if they point to DN= SSEC-signed targets)

    You can see why the DNS= folks are proponents of DNSSEC and DANE, in this discussion.
    Without these, secure bootstrap is a very difficult problem.

    With DNSSEC and DANE, the problem is already solved,= modulo deployment of DNSSEC by zone owners, and modulo implementation of n= ative DANE in browsers.

    Brian
    --00000000000071e5f3058e73b049-- From nobody Wed Jul 24 14:22:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1CB7120372; Wed, 24 Jul 2019 14:18:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.999 X-Spam-Level: X-Spam-Status: No, score=-6.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nlnetlabs.nl Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A_-Zk3iRKwwq; Wed, 24 Jul 2019 14:18:09 -0700 (PDT) Received: from dicht.nlnetlabs.nl (dicht.nlnetlabs.nl [IPv6:2a04:b900::1:0:0:10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 511441202A7; Wed, 24 Jul 2019 14:18:09 -0700 (PDT) Received: from [10.0.1.190] (modemcable171.137-178-173.mc.videotron.ca [173.178.137.171]) by dicht.nlnetlabs.nl (Postfix) with ESMTPSA id B9FBF113D0; Wed, 24 Jul 2019 23:18:04 +0200 (CEST) Authentication-Results: dicht.nlnetlabs.nl; dmarc=fail (p=none dis=none) header.from=nlnetlabs.nl Authentication-Results: dicht.nlnetlabs.nl; spf=fail smtp.mailfrom=willem@nlnetlabs.nl DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nlnetlabs.nl; s=default; t=1564003085; bh=p6stGxKZbKPizs+mW8CTrg0eBwswg9fgLlduVG20WjA=; h=To:Cc:References:From:Subject:Date:In-Reply-To; b=KhFdwQKbTqIZjA16hI6E6bYwKfEl4aNIwkgHRYTS9/bhTFd1cGGOOl/lnSQEtQEy9 qPFciFCqeP91L7o1/Y+vmPyk7OdBNY/PELCQWyNzsJ4pZ+GJ5ABrROStd+VmzkNrV5 6GrpwInQdO8NZQXUUZ3xG3nMSDJa2fpO6JH77WIg= To: Puneet Sood , Kevin Borgolte Cc: DoH WG , add@ietf.org, pschmitt@cs.princeton.edu, dnsop WG , feamster@uchicago.edu, jordanah@princeton.edu, dns-privacy@ietf.org, Rob Sayre , ahounsel@cs.princeton.edu References: <402781F4-33D8-4FD4-8087-FDCEFFF2D549@iseclab.org> <267CBE74-9DC5-40D8-A61F-7C566644A1CB@iseclab.org> From: Willem Toorop Openpgp: preference=signencrypt Autocrypt: addr=willem@nlnetlabs.nl; prefer-encrypt=mutual; keydata= mQINBE1s81EBEACuJzGgccrmYEAzHc//vBq66gH7orM0GtKfQZHh4uR1FMxZXl07WevUYNuB ywTpinU9rpY1Q3S4w6QgNklgpsaHXmbOpyFjJ8FpllV8TRPiXiNrNxTpMnlb6InoszopX69t kBVHTP6cJkNgPx6R4BM0ARqEGQmOL8mAcoWyGVzbsamuGRaia54zs/kc3i9yiqEzRkoQmfwr 7sr49n7gOpmaqXvonOSiUvgEziep77emMcqVa/qZxR1r7KUq85qTNTqsQwl2cQdKS7WwOeuG 6ZIJmJ1bakriKzLBYF5xIHKSYJW0ZA20tNFrVKgTkEjiXvAJh4HlJEIi35tqa/IzWUJSc1ai nhBjxbwSl8BRq5aaPgwB+xXiDqY6BrQW1slvl5TF2A6Xr7JJ0rkH3EZgXxABAZ3WJ3RLwq1z 8jnNYj+UW/mSLsbOtgfOiBhFUXMZneHvVVvz6F6XAtyrejDl5sD2gnzm1VDfK6T6bvLtR7zr kWre0lpycDmgmUKgaEiXzfLvwT9RaWk8GdqU2GG+QOiwf+hT0peDieuodjMr59sUbx7GqVe/ 45rJBRSx+HCl2Jm7Th2Xr0kpStCd7ebVoEq9wpMyu+dM9wOTtibA9P3+9u4rAdimpAdQxEbh WbRNCng2EVhThbqRK3cTZLbtqKaWgAJqa/IQVpL9b5ps8Z4JVQARAQABtCNXaWxsZW0gVG9v cm9wIDx3aWxsZW1AbmxuZXRsYWJzLm5sPokCPgQTAQIAKAIbIwYLCQgHAwIGFQgCCQoLBBYC AwECHgECF4AFAlbUE5oFCRDr7kkACgkQ5fj4IS93pJiGfA/8C1+/M+EaQItVzQ/iPCbagBTq WOSispMzJne9gmimJzPs+lxgnrXOuYlIBywHpWB2Jmz45h+Cc4+di48WQfV9tHENn9MVFkwK zSdcY6v5eot6xSY5FRHS226MPR9UJ8/z5PvlizZUVbbM+Ngxg3Rx045Q0FnQm0o5VasEJ1Po R3CSiELJoZ13ukTk5pQlKyVknUKH1E1ds+Xtg1jpZBqiLiBzcLkKWYqBvrXI6XAEPr+woRgj 3xV8P24Uj232uK7xoe82jWIeZWXt/AbHBSmNOWPIgMd9i3FjdeTDml5sZSy3BlDYMr8hINen hYLhdLpJnXwPcsaj0ivcV+xSjLtSh0mE4gudcVhk5XR1M6emSlATC6+Bqn0M9JNTn4SHhkNS yo87aPwKqWFDlvjAZlRyPym9miJBlzech2uOlYSk6GFuead7MpGAipf5PwNNRKDMDi3y+H47 YG2izbrqj3cOZdqZmErwrzCU8xVkxzY/EY6w/MNMFNeqmXVGxzIZ8y9KAjH6JO96M/AxS4mX HJh1ocfHtSm90Ahy/HPJK+2+5+IgkAymKsvyIbvjs7FccMUo+OiSPWYi+xO/NXA4pBlUuGmV 55Kog7ym1flzo8OD9uHfLPrVORBHgnsITbzf9vgJ0emy8fxMCkzFT334gC1OVhD1ff1frbPX yVbcGI8AO+q5Ag0ETWzzUQEQAKTs4hWz94K66PtsHj/cBtHmJCJx9BsHP8eoUjd4iBR7cWgT Tgt1PGCNBzCPGIuUia808dqxu1L8OWjQpwXDCjXqAibn0mCJMRONVszxJKkjYnZGKGOo8cg7 OmQBZyEd6qrfxVf/dwHLsdQTJZzz9bGOxuYVAAu0q3PHW5gGFc+pp3eN47qzGMxEjsoETj/c laxjqisohG13/hkP6PvDoD7OOdOGdQQP8b4GRBD6rZ/FqMLv4C80zDnzCH1rLpNGQplf1any 06WTAsDL4f6gEALH62TIxOX4U7WxeuvHxyKXOAuN+ex/MvF2az124YbcWC7t1dqVW3ys20zK aememyXSKxV6aMn4KBcJF3CdM1oABZDyviL9el7Q/yQylpZC6El4QowaPIOAuzOdIc6cuM6P TWvBArcKVgQhWfJshfeFmfkxpz/hWc9K40yCjmb+hPZIr3RbXSsQItUUkBqOSMHNroIgX+Ia WMq3e7yMHdMqlKr0lU52lfBbfECjleB/NO4K3SGJBPzTgLtze+LsWxSJQoQMWKv6ISwQrW3r smUjqgQNrSGROX3rRy8Nvuzravs4a3FmdUpHIWw2KfY2M6AsX9HBFuRsimgqFjQm5VbqXA7N tHJCnA1RvqXlg/iJ5w+DElHosxwjHS+UbejDGmVQ+ITqlh3991osPjZq1Iy1ABEBAAGJAiUE GAECAA8CGwwFAlbUE5oFCRDr7kkACgkQ5fj4IS93pJjBwxAAnko5CSFDX/ZqW97satNacACH SAOOM8/jz1p2QtJSwbrbLsJRMpN1mSnjXWPBTmXoP4SGHGtxTVZxrYCpSMEHMqOV4yK3QlUn QXnf+CSvo2Ud3rpCh/lFLVHqG2Sy5Ietf/T+GGsoPd9DIdTHO0aFlW2yRQPxSrbYpv1v2aAC gRO4114qkex2j36diqlLod/OU4OQ51nuSesjTrUM9Fz6ikBJ1UDjakjAXe/HiRxUmdv4LANC mso+Gn17Co5lUdpn3fa8zTwNNAgLm6RBiBSSdaYExM9ir6pHrcWL5N+iZKnVmfE5CBufziZq 7V1E3I4FRuvDN4echbf58c6YxBQDsd9VZMJeFWY60w4JEXpHQdt129GS1FN/2PQ8NmAUXYCk YYk6Lv1tnGJCSLnD3ObLyWm+sjA5yAK2H8WU+nutsDF63yFJujNMpmB3bi9+699TzsyQNVKd 2fH38cgk1gZFb6Nbx9+lrTIwzAJJlOu8UwbR0HgGuRmrWp0EIm3tcy4xqWF3CavnM22BAOKK KH+qnwx8BRrx58coHQFMswW4W7Bo+jpKbQJ4RV2cXUEbmHbYUoXDHZyv/RzOI46dXAoWFc3o CoqLqpsZYZstJ4UJHXB5aHi1zxJDwzKxsflmSKfIUr3glRWCy/ylcPMEXzPBb3qbGFMUboio UjqLuNV4SSY= Message-ID: <0e59fc40-e25d-68b0-6759-b20484277086@nlnetlabs.nl> Date: Wed, 24 Jul 2019 17:18:03 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: X-Mailman-Approved-At: Wed, 24 Jul 2019 14:22:16 -0700 Subject: Re: [Add] [DNSOP] [dns-privacy] Do53 vs DoT vs DoH Page Load Performance Study at ANRW X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 21:18:11 -0000 On 21-07-19 16:26, Puneet Sood wrote: > * The experiment was run from Princeton, New Jersey in Northeast US. > The location is in a very well connected part of the world between > network peering points in NYC and Washington DC. You will not see much > difference (due to network latency) between the cloud providers and > the default (local) Do53. Running the experiment from locations which > are further away from cloud providers would provide another > interesting set of data. Thanks for this Puneet and for stating this at the microphone during the presentation. I have some numbers that support this. At the hackathon at the African Internet Summit in Kampala Uganda one month ago, I participated with a team using RIPE Atlas to compare response time of the locally configured resolvers of RIPE Atlas probes in the Africa region, to the cloud resolvers 1.1.1.1, 8.8.8.8 and 9.9.9.9. On UDP, on the median, local resolvers returned responses 27 times quicker than the fastest cloud resolver: 2ms RTT for the local resolver versus 55ms for the fastest cloud resolver (which was 9.9.9.9). On TCP, local resolvers provide responses at least 6 times quicker. 14ms versus 94ms (again Quad9). We also measured DoT which had +-3 times longer response time than TCP on the cloud DNS providers. There were only very few probes with resolvers other than the quads that supported DoT, but those were also remote given their long round trip times. See also our post/report on: https://labs.ripe.net/Members/willem_toorop/hackathon-africa-internet-summit-2019 From nobody Wed Jul 24 14:30:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3898120372 for ; Wed, 24 Jul 2019 14:30:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZCVlFJPk2CML for ; Wed, 24 Jul 2019 14:30:08 -0700 (PDT) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13CB41202A7 for ; Wed, 24 Jul 2019 14:30:08 -0700 (PDT) Received: by mail-io1-xd31.google.com with SMTP id k20so92705352ios.10 for ; Wed, 24 Jul 2019 14:30:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=OfcQoD27fKdGqMRQS7v1gDjV16WIGyAQmfucNrMmjbY=; b=Vd2lEyW8m1yeBBz71FE4/j9gTbSBgSV81yA4KGWEwbQ9EtIYd5ckexteMRAQu+R8Pb nanLmXo9iRs7CZP+hWCMqSnxdsH0uTRhpBnblr76z3G9VsGi7BkyC6UkRlU7WKxorGtH UtyHJdyEWrn1KmgyD1cZAp3XEq9POdqOFTXzwtY1HPt5ROcwbZ/9EOHJQYtGbZCnZS7g 1G0ZqobjBwJrOX+TSiisD+6MDmf2OPhPAlQJKM+6eBnbLr+JAm3RhSHP+n7v7btxUGTg g489hYmQoWYD/JuoaiqMAaWmOklIhnVOqOFa0uvWrVq8RWOUcNOV+mvMXhXitVaUtRa3 0+CQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=OfcQoD27fKdGqMRQS7v1gDjV16WIGyAQmfucNrMmjbY=; b=W/7B1BKkc/FER37OI7pdR3Jrt29sFlua8dEnF8FevtlN71fyCXbskHcXmBMuuOYjY2 CGFY9dbmP8YblicRuaLS3bHcvgEGwWHm4SvKHOu3udhzkgSplyfDne+bUZExQy2uiQJG Rhtm97QLMER5k7LgNLEKUFsVJuG33vqrprX2LZwWzQDtpVc409Yu+9gtMR+toYo1nlDa YkDmy89T560MSsZwhKH5SQwLwbMEwF/CcJ6Kjq6Di7kOtyXg4KH3iv3lpweDZLjWbel5 JHtqIyBXAcu64R6qlDkFeaVFEz8YSVjEgNR9o+ijjIcQJ4kqZo2+D3dcXkDfU2WexsUE +M1w== X-Gm-Message-State: APjAAAV0nMb1GMgymCeagKCxy9EIkcW8WaZuixt/44s3WmAXWun5Mhu3 xOuJl5J5UeEQ5dU3ZtpcbSFtxMF/gScWTj5dAus= X-Google-Smtp-Source: APXvYqyqefUCG84E1KgllGfXrzFC1sV8Dfrhm2K4PCfhhT1TuM/9ZDbM00CkSkAdDBP2JnGrjjkm9aWLOkn3AsNoJD0= X-Received: by 2002:a6b:6d07:: with SMTP id a7mr13729239iod.254.1564003807273; Wed, 24 Jul 2019 14:30:07 -0700 (PDT) MIME-Version: 1.0 References: <20190724165643.GA29051@laperouse.bortzmeyer.org> <2457067b-49fe-c2cf-d554-95f524573eea@gmail.com> <5009606a-4fcb-92c7-85c6-208d359147c8@nic.cz> <590021BB-6BA8-4CDB-8537-6335498C63E2@nohats.ca> In-Reply-To: From: Rob Sayre Date: Wed, 24 Jul 2019 14:29:56 -0700 Message-ID: To: Brian Dickson Cc: Paul Wouters , =?UTF-8?B?VmxhZGltw61yIMSMdW7DoXQ=?= , Thomas Peterson , add@ietf.org Content-Type: multipart/alternative; boundary="0000000000005c2863058e740399" Archived-At: Subject: Re: [Add] Not a good BoF meeting X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 21:30:10 -0000 --0000000000005c2863058e740399 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 24, 2019 at 2:07 PM Brian Dickson wrote: > > And just to complete the picture for those less familiar with DNSSEC and > DANE: > I think it would be good to define some terms here. DNSSEC was first standardized in 1999, as RFC 2535. It was then obsoleted in 2005 by RFCs 4033-4035. DANE is RFC 6698, standardized in 2012. thanks, Rob --0000000000005c2863058e740399 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On Wed, Jul 24, 2019 at 2:07 PM Brian Dic= kson <brian.peter.dicks= on@gmail.com> wrote:

    And just to complete the picture for those less= familiar with DNSSEC and DANE:

    I think it would be good to define some terms here.

    DNSSEC was first standardized in 1999, as RFC 2535. It was then ob= soleted in 2005 by RFCs 4033-4035.

    DANE is RFC=C2= =A06698, standardized in 2012.

    thanks,
    R= ob
    --0000000000005c2863058e740399-- From nobody Wed Jul 24 16:40:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EB091203C2 for ; Wed, 24 Jul 2019 16:40:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mh8EtPVtyNyk for ; Wed, 24 Jul 2019 16:40:43 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A73131202E2 for ; Wed, 24 Jul 2019 16:40:43 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id h6so6755563iom.7 for ; Wed, 24 Jul 2019 16:40:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=g/amcf2+VWrGHMau7LO5jVrSdhrrEBriEYuruGiUNe4=; b=KEJWuLxmHDRsXJcTHcawZplq5nVAYdL/m2xv8xybIim/mGh/TxLv86xziN0y/4li/L LpY0Y8eaPtyFhEMKNNyXz9FTK6cV7NtC7FfCR4kzoXGQkvRNWIvEh4eLEKm5NlGclr4E oisX7uLr+4pdTOGGXd6fxZmP6SPW/MloKR+A5VjXOoIe56oj14K0txtv2fNpGlUyYAeI WDloBnBIAse1kNgjfADwC3o5b3aES/FiNb5DYV1Fg10w1mksdcJodnNTD7Rjg9U4m2E5 2IgjnUpUdSLSrKN4V+536rFt7/N00J8LZS7DJd0SBzICxWMiZ2/VoV+ovu0+D3e4T7pp Zsew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=g/amcf2+VWrGHMau7LO5jVrSdhrrEBriEYuruGiUNe4=; b=YzpgHqofSFFDOg0pji+bSatebdU4P+sBUcrquPSjN1/fe2Gjp9DndXlrxELq558uke EdE3vVP0C3qWeFgC3kTmZF7O2L/BgHH1UQp7K2j6zSuOkVTQmlCT5jMXRcUtUq6xDIzD x/Z/SjopCrkoUyAxowjOdZegM0gNCRXzULIjX9SvEDTBa/G1qFL1SAh987oh2EAclmo6 orAUxf25D/eMng1aTIEQz6WV5LKtcccJAtxwlHrdKeFuj8xJYlkQ2nup3oVvgOU7DS5b 9QuDFlwfk9DiyUdcTasGVanbum9liRgWGFTjUU1+JRP+MKaHEvD12EV6fChNOKccd8nn pVkw== X-Gm-Message-State: APjAAAWRXfKIexsl8RvyMDbgz0senBnUJ5BlJTNK9bipBtYlqE8dS+CG 3LTtg0jGk/rw32DXwkbirmP7XxxcTXwVoMV/kUs= X-Google-Smtp-Source: APXvYqwftHrQS3vtYzEp/LtPNLORyCJpVbpi1D3m63ojDvRa1NdjyZYlYJRyk4o2sTFCSZFpBD+BfArMKIK1TeH30eA= X-Received: by 2002:a6b:6d07:: with SMTP id a7mr14233598iod.254.1564011642798; Wed, 24 Jul 2019 16:40:42 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> In-Reply-To: From: Rob Sayre Date: Wed, 24 Jul 2019 16:40:31 -0700 Message-ID: To: chris.box@bt.com Cc: add@ietf.org Content-Type: multipart/alternative; boundary="00000000000064cacd058e75d6c5" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 23:40:46 -0000 --00000000000064cacd058e75d6c5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 4:53 AM wrote: > This is a good point; there are valid reasons why 1.1.1.1 can be the righ= t > provider for some users. Please allow me to clarify some possible > misunderstandings. > > > > I=E2=80=99m not against DoH. > > I=E2=80=99m not against privacy and security. > > I=E2=80=99m not against user choice. > > > > These are all valuable things we should strive for. Let=E2=80=99s do it i= n a way > that works for everyone, by identifying and documenting best practice. > I think the issue is that this request for collaboration can be viewed as a request to undermine DoH with follow-up RFCs. I understand that people come to the IETF with many different viewpoints, so I don't see this disconnect as a problem. But it is worth pointing out, and trying to understand. thanks, Rob --00000000000064cacd058e75d6c5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On Wed, Jul 24, 2019 at 4:53 AM <chris.box@bt.com> wrote:

    This is a good point; there are valid reasons = why 1.1.1.1 can be the right provider for some users. Please allow me to cl= arify some possible misunderstandings.

    =C2=A0

    I=E2=80=99m not against DoH.

    I=E2=80=99m not against privacy and security.<= u>

    I=E2=80=99m not against user choice.=

    =C2=A0

    These are all valuable things we should strive= for. Let=E2=80=99s do it in a way that works for everyone, by identifying = and documenting best practice.


    =
    I think the issue is that this request for collaboration can be = viewed as a request to undermine DoH with follow-up RFCs.

    I understand that people come to the IETF with many different viewp= oints, so I don't see this disconnect as a problem. But it is worth poi= nting out, and trying to understand.

    thanks,
    =
    Rob
    =C2=A0
    --00000000000064cacd058e75d6c5-- From nobody Wed Jul 24 19:19:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 309C412017E for ; Wed, 24 Jul 2019 19:19:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8r1FajaQysRO for ; Wed, 24 Jul 2019 19:19:11 -0700 (PDT) Received: from mail-ua1-x933.google.com (mail-ua1-x933.google.com [IPv6:2607:f8b0:4864:20::933]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A80212015E for ; Wed, 24 Jul 2019 19:19:11 -0700 (PDT) Received: by mail-ua1-x933.google.com with SMTP id g11so19232534uak.0 for ; Wed, 24 Jul 2019 19:19:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=pa0gsjrXKUn7dI18SQUnc2zd1qW39C3E6VPxWzbdv80=; b=oS7N18K6+CvRa6su4v/Bpm9Wuj52DTuZezUzYmy+fzSeKQc7ixpm1DPisac+5U2Xfb Kt5xFOgk7Mg1aFdO/hdbwBpvx1L0qboxeddrOPuN/YCvWiISSsxT9EsChkZLDeiswgGd DmuyxKaShnRVov/th/BvCcPAqpUt0a3wWMo5s9+RlBWvbxFIgMR3SPGY69F37P7fq5Xp KwOqMsB32I8/X6cIuO2nc8Ft96hzW1C2vA/WpbPVMJc92hNEG5HgvC1q4kFMYV7uvOiu ba4LeBzicwSaGqau+Oq/rBv8JPMqUJLQrVK37BadXWZa4HTRT2Nka8VRQTr7t+5p3yBe UEpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=pa0gsjrXKUn7dI18SQUnc2zd1qW39C3E6VPxWzbdv80=; b=BeczQBfDij1blC0kcEtFllSKjiKS/k3qxMDzz5oQNhbR67WFKpOZSPRf79YSoqbIbh wMW2sH5fw+BSgle61D9ryQkro1uupB/gJ9fLuR2hFuuHjd/Elh+JCRk6LdftMq1hitLu pRod3IrUIh5AKqQssqC8geKQO68u3nJbKgyzToUCFmnvDrUd0DDDyB6u6nhwwxRebpmS M/7oMsE3iT7qudXDzVb16Z0bXvn3TBm/zPWOAdN8HYToy4K5gqCy69LBJhEr5OH4oSll R2QUp2l0F84LoGYQ5YJqwoI0dnlmxUBTEt1dPVe61xAEpHD+PleGwxn9aRlGTz5N3JCN 5z6A== X-Gm-Message-State: APjAAAXuXV0mMGcOiVcqzEcfLIYZbTN2un3/xj7Ctb2x/TTfr/8gElmo SM+U9U8pOYNw52DUcxQt1fl0RjlM4mAakPhtPzQ= X-Google-Smtp-Source: APXvYqxnTVso5uB/h7PO9WgaqxGTjzrijBFO/cHmRCNL9jsJqrx1vbV/JoNLcYqf4SdSGvkgQ457vusZzi+HB7g1F68= X-Received: by 2002:ab0:2994:: with SMTP id u20mr24045935uap.114.1564021150228; Wed, 24 Jul 2019 19:19:10 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> In-Reply-To: From: Brian Dickson Date: Wed, 24 Jul 2019 22:18:58 -0400 Message-ID: To: Rob Sayre Cc: chris.box@bt.com, add@ietf.org Content-Type: multipart/alternative; boundary="00000000000014a496058e780dd7" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 02:19:14 -0000 --00000000000014a496058e780dd7 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 7:40 PM Rob Sayre wrote: > On Wed, Jul 24, 2019 at 4:53 AM wrote: > >> This is a good point; there are valid reasons why 1.1.1.1 can be the >> right provider for some users. Please allow me to clarify some possible >> misunderstandings. >> >> >> >> I=E2=80=99m not against DoH. >> >> I=E2=80=99m not against privacy and security. >> >> I=E2=80=99m not against user choice. >> >> >> >> These are all valuable things we should strive for. Let=E2=80=99s do it = in a way >> that works for everyone, by identifying and documenting best practice. >> > > I think the issue is that this request for collaboration can be viewed as > a request to undermine DoH with follow-up RFCs. > > I understand that people come to the IETF with many different viewpoints, > so I don't see this disconnect as a problem. But it is worth pointing out= , > and trying to understand. > I'll jump in ... There are some generally positive benefits to having some (but certainly not all) applications speak DNS natively. (The precedent of mail transport software doing its own DNS is a good example, including understanding why: mail software needs direct access to e.g. MX, SPF, DMARC, and DKIM records, and to a lesser degree, PTR.) In particular, having some applications be able to request record types other than A/AAAA/PTR via POSIX interface (getaddrinfo/gethostby* calls) is an important benefit; doing DNS more directly avoids having to address the whole POSIX API thing. (That can be done at a later date, or not at all.) Speaking "DNS" facilitates lots of very useful use cases to applications, in particular to browsers, that are not otherwise feasible today. (E.g. DNSSEC validation, DANE records, HTTPSVC, etc.) However, there is no specific requirement that these applications "doing" DNS need to bypass the ENTIRE host OS' DNS stack or avoid using other host-local DNS services/mechanisms. E.g. it would be reasonable to have a local forwarding-only caching server (which forwards to a full-feature resolver, using an unspecified transport), which better scaling attributes including cache hits, and avoids divergent application-specific resolution including different choices of full-feature resolver. Also, privacy can be implemented on that caching server, by either of DoT or DoH. There is approximately zero trade-off between the two (DoH vs DoT), other than the larger issues (monitoring/filtering DNS resolver destinations at a network level). NB: the new DNS RFC for DNS stateful operations (DSO, DNS Stateful Operations) covers a lot of the details on how clients and servers can optimize their interactions, including (IIRC) some DoT guidance. Some of the concerns regarding how to resolve the natural tension between user choice, and client (host) administration, is probably better handled by having the "user" choice be restricted (by design) to admin-priv operations. I would definitely prefer that DoT be the solution of choice for privacy, primarily because it avoids almost all of the pitfalls of DoH when it comes to any environment that relies on DNS-based security and monitoring. There is a place for DoH, but I don't believe it should see wide deployment in general-purpose browsers. I have yet to see any use case other than the very specific "dissidents" used to justify DoH. All of the testing (which I've basically just glanced at as summary info) suggests that DoH and DoT perform very similarly. And, finally, from what I understand, all of the major public resolver operators offer their services on both DoT and DoH (and v4 and v6, and in many cases with or without filtered results). So, in my version of a perfect world, the integrated browser DNS stack would be: browser <-> (local/internal loopback-type interface) <-> caching DNS forwarder <-> (DoT) <-> {enterprise | home | public} full recursive resolve= r And the browser would speak native DNS, with DNSSEC validation, DANE support (natively, not plug-in), HTTPSSVC, CNAME/DNAME following, etc. The caching DNS forwarder would have all the same stuff plus DNS cookies, not do fragmentation, and potentially have multiple full resolvers configured in a structured priority flow (not just round robin). IMHO, this is what ADD is supposed to be about, discussion the what and the how. And, also IMHO, it does not preclude comparison of DoT and DoH on the respective merits and risks/costs. Brian P.S. Any animosity towards DoH has very little to do with the process by which it was developed, and everything to do with the incompatibility with existing practices and ecosystems, especially unintended impacts. It isn't the encapsulation of DoH that is the problem (it's slightly annoying), but rather the re-use of port 443 instead using a dedicated port the way DoT uses 853. P.P.S. The responsible approach to adopting a flawed protocol, would be to acknowledge the flaws, find a better solution, and kill it off, rather than defend it or justify it based on sunk cost or other rationales. I would advocate this approach even if it was my sacred cow that was being gored. --00000000000014a496058e780dd7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Wed, Jul 24, 2019 at 7:40 PM Rob S= ayre <sayrer@gmail.com> wrote= :
    On Wed, Jul 24, 2019 at 4:53 AM <chris.box@bt.com> wrote:

    This is a good point; there are valid reasons = why 1.1.1.1 can be the right provider for some users. Please allow me to cl= arify some possible misunderstandings.

    =C2=A0

    I=E2=80=99m not against DoH.

    I=E2=80=99m not against privacy and security.<= u>

    I=E2=80=99m not against user choice.=

    =C2=A0

    These are all valuable things we should strive= for. Let=E2=80=99s do it in a way that works for everyone, by identifying = and documenting best practice.


    =
    I think the issue is that this request for collaboration can be = viewed as a request to undermine DoH with follow-up RFCs.

    I understand that people come to the IETF with many different viewp= oints, so I don't see this disconnect as a problem. But it is worth poi= nting out, and trying to understand.
    I'll jump in ...

    There are some ge= nerally positive benefits to having some (but certainly not all) applicatio= ns speak DNS natively.
    (The precedent of mail transport software = doing its own DNS is a good example, including understanding why: mail soft= ware needs direct access to e.g. MX, SPF, DMARC, and DKIM records, and to a= lesser degree, PTR.)

    In particular, having some a= pplications be able to request record types other than A/AAAA/PTR via POSIX= interface (getaddrinfo/gethostby* calls) is an important benefit; doing DN= S more directly avoids having to address the whole POSIX API thing. (That c= an be done at a later date, or not at all.)

    Speaki= ng "DNS" facilitates lots of very useful use cases to application= s, in particular to browsers, that are not otherwise feasible today. (E.g. = DNSSEC validation, DANE records, HTTPSVC, etc.)

    Ho= wever, there is no specific requirement that these applications "doing= " DNS need to bypass the ENTIRE host OS' DNS stack or avoid using = other host-local DNS services/mechanisms.
    E.g. it would be reason= able to have a local forwarding-only caching server (which forwards to a fu= ll-feature resolver, using an unspecified transport), which better scaling = attributes including cache hits, and avoids divergent application-specific = resolution including different choices of full-feature resolver.
    =
    Also, privacy can be implemented on that caching server, by = either of DoT or DoH. There is approximately zero trade-off between the two= (DoH vs DoT), other than the larger issues (monitoring/filtering DNS resol= ver destinations at a network level).

    NB: the new = DNS RFC for DNS stateful operations (DSO, DNS Stateful Operations) covers a= lot of the details on how clients and servers can optimize their interacti= ons, including (IIRC) some DoT guidance.

    Some of t= he concerns regarding how to resolve the natural tension between user choic= e, and client (host) administration, is probably better handled by having t= he "user" choice be restricted (by design) to admin-priv operatio= ns.

    I would definitely prefer that DoT be the solu= tion of choice for privacy, primarily because it avoids almost all of the p= itfalls of DoH when it comes to any environment that relies on DNS-based se= curity and monitoring.

    There is a place for DoH, b= ut I don't believe it should see wide deployment in general-purpose bro= wsers.

    I have yet to see any use case other than t= he very specific "dissidents" used to justify DoH.

    =
    All of the testing (which I've basically just glanced at as = summary info) suggests that DoH and DoT perform very similarly.
    <= br>
    And, finally, from what I understand, all of the major public= resolver operators offer their services on both DoT and DoH (and v4 and v6= , and in many cases with or without filtered results).

    =
    So, in my version of a perfect world, the integrated browser DNS stack= would be:
    browser <-> (local/internal loopback-type interf= ace) <-> caching DNS forwarder <-> (DoT) <-> {enterprise = | home | public} full recursive resolver
    And the browser would sp= eak native DNS, with DNSSEC validation, DANE support (natively, not plug-in= ), HTTPSSVC, CNAME/DNAME following, etc.
    The caching DNS forwarde= r would have all the same stuff plus DNS cookies, not do fragmentation, and= potentially have multiple full resolvers configured in a structured priori= ty flow (not just round robin).

    IMHO, this is what= ADD is supposed to be about, discussion the what and the how.
    And, also IMHO, it does not preclude comparison of DoT and DoH= on the respective merits and risks/costs.

    Brian
    P.S. Any animosity towards DoH has very little to do with the proc= ess by which it was developed, and everything to do with the incompatibilit= y with existing practices and ecosystems, especially unintended impacts. It= isn't the encapsulation of DoH that is the problem (it's slightly = annoying), but rather the re-use of port 443 instead using a dedicated port= the way DoT uses 853.

    P.P.S. The responsible appr= oach to adopting a flawed protocol, would be to acknowledge the flaws, find= a better solution, and kill it off, rather than defend it or justify it ba= sed on sunk cost or other rationales. I would advocate this approach even i= f it was my sacred cow that was being gored.
    =C2=A0
    --00000000000014a496058e780dd7-- From nobody Wed Jul 24 19:30:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A664D1201C5 for ; Wed, 24 Jul 2019 19:30:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id avWULk6gmIai for ; Wed, 24 Jul 2019 19:30:44 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32F101201A8 for ; Wed, 24 Jul 2019 19:30:44 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id q22so93940804iog.4 for ; Wed, 24 Jul 2019 19:30:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=g8AsrGz9IxBY8b2YvkgxV8HxcIAlWqBbwhHHvtHI664=; b=WHzbb1Yaoxr4Bo38hzP9EKJVjLT6HExBc0TyWFLVmTPFDxgx7AX8ofwR8PZb9VqLtz t3MIvcPOnd+EG5haidjfXIh+w+644GS4vi3FhZi/Fd4qoZu4ad4yoboLZ4e8AvmY7iW1 g3t0uV4ZUTScySfGL6Zv+YS3AvON5NkH8MbUuQK9RyIeghVNLdfhigamc1wve03rW2qr BnM3a5PEFIY1eXalu/v3MSaxAP92/j25m+xVsWZU4n77zWVzmLuji2xZVK38ByMKp9OP pRYaoNuqdd9wgYl1DM0jGKkSZQVqPrWeyVH1F6FdjFpqBwjnKBqPjUupdV3o2JYjauaR J03g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=g8AsrGz9IxBY8b2YvkgxV8HxcIAlWqBbwhHHvtHI664=; b=phWcRcPgY6ReThp5x3kJDpeqPIugo8M2GnEoHeqrL4IDbW90E8kv1g81P7TcG4gMNE RiHtAAVfhwtDv/OiH2zhjkV6Tk4vPuUVfzTq50KiniM0IKoZEXnw7NiD22BC5LqC/Zy1 W9nzqqULhQpZupqjiMJqKlOT8e3D7FXyX5XmYb/9JRlN30cYLfc2HPmOnukJ/Uve7mgF PrJmNiuCO1Q4LZa6eJwwfF1GMNVlNQfaByhRXfWDjULQNq/SUdSAwQi8rqw7ML2sT61o 2CG2SthuSEUw5K8V5G4Ww0tagIwBRrfCsPtqYmcVaK8G7yPMviuIFyFY1buE75HmD2Pq Lklw== X-Gm-Message-State: APjAAAUCSnaYyMw6OkGqZJTJz82ZNMgrJPuOu1Q7wuYF4ixdJzE4FF4U M8XHa06JnOUawBMoXQJPPBXq9qmh+LIa4R14L9E= X-Google-Smtp-Source: APXvYqz5Q+ZZBkbQLvTleKRqSX86cUEnnWQseLBqkQq5yB/yZrRcNp6Iljho2i59O2ivWNk7yNXJvayb3eX6tZPCzMg= X-Received: by 2002:a6b:bc42:: with SMTP id m63mr64657936iof.189.1564021843339; Wed, 24 Jul 2019 19:30:43 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> In-Reply-To: From: Rob Sayre Date: Wed, 24 Jul 2019 19:30:31 -0700 Message-ID: To: Brian Dickson Cc: chris.box@bt.com, add@ietf.org Content-Type: multipart/alternative; boundary="00000000000064b076058e7836d2" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 02:30:47 -0000 --00000000000064b076058e7836d2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Brian, I'm not sure what you're trying to say. thanks, Rob On Wed, Jul 24, 2019 at 7:19 PM Brian Dickson wrote: > > > On Wed, Jul 24, 2019 at 7:40 PM Rob Sayre wrote: > >> On Wed, Jul 24, 2019 at 4:53 AM wrote: >> >>> This is a good point; there are valid reasons why 1.1.1.1 can be the >>> right provider for some users. Please allow me to clarify some possible >>> misunderstandings. >>> >>> >>> >>> I=E2=80=99m not against DoH. >>> >>> I=E2=80=99m not against privacy and security. >>> >>> I=E2=80=99m not against user choice. >>> >>> >>> >>> These are all valuable things we should strive for. Let=E2=80=99s do it= in a way >>> that works for everyone, by identifying and documenting best practice. >>> >> >> I think the issue is that this request for collaboration can be viewed a= s >> a request to undermine DoH with follow-up RFCs. >> >> I understand that people come to the IETF with many different viewpoints= , >> so I don't see this disconnect as a problem. But it is worth pointing ou= t, >> and trying to understand. >> > > I'll jump in ... > > There are some generally positive benefits to having some (but certainly > not all) applications speak DNS natively. > (The precedent of mail transport software doing its own DNS is a good > example, including understanding why: mail software needs direct access t= o > e.g. MX, SPF, DMARC, and DKIM records, and to a lesser degree, PTR.) > > In particular, having some applications be able to request record types > other than A/AAAA/PTR via POSIX interface (getaddrinfo/gethostby* calls) = is > an important benefit; doing DNS more directly avoids having to address th= e > whole POSIX API thing. (That can be done at a later date, or not at all.) > > Speaking "DNS" facilitates lots of very useful use cases to applications, > in particular to browsers, that are not otherwise feasible today. (E.g. > DNSSEC validation, DANE records, HTTPSVC, etc.) > > However, there is no specific requirement that these applications "doing" > DNS need to bypass the ENTIRE host OS' DNS stack or avoid using other > host-local DNS services/mechanisms. > E.g. it would be reasonable to have a local forwarding-only caching serve= r > (which forwards to a full-feature resolver, using an unspecified > transport), which better scaling attributes including cache hits, and > avoids divergent application-specific resolution including different > choices of full-feature resolver. > > Also, privacy can be implemented on that caching server, by either of DoT > or DoH. There is approximately zero trade-off between the two (DoH vs DoT= ), > other than the larger issues (monitoring/filtering DNS resolver > destinations at a network level). > > NB: the new DNS RFC for DNS stateful operations (DSO, DNS Stateful > Operations) covers a lot of the details on how clients and servers can > optimize their interactions, including (IIRC) some DoT guidance. > > Some of the concerns regarding how to resolve the natural tension between > user choice, and client (host) administration, is probably better handled > by having the "user" choice be restricted (by design) to admin-priv > operations. > > I would definitely prefer that DoT be the solution of choice for privacy, > primarily because it avoids almost all of the pitfalls of DoH when it com= es > to any environment that relies on DNS-based security and monitoring. > > There is a place for DoH, but I don't believe it should see wide > deployment in general-purpose browsers. > > I have yet to see any use case other than the very specific "dissidents" > used to justify DoH. > > All of the testing (which I've basically just glanced at as summary info) > suggests that DoH and DoT perform very similarly. > > And, finally, from what I understand, all of the major public resolver > operators offer their services on both DoT and DoH (and v4 and v6, and in > many cases with or without filtered results). > > So, in my version of a perfect world, the integrated browser DNS stack > would be: > browser <-> (local/internal loopback-type interface) <-> caching DNS > forwarder <-> (DoT) <-> {enterprise | home | public} full recursive resol= ver > And the browser would speak native DNS, with DNSSEC validation, DANE > support (natively, not plug-in), HTTPSSVC, CNAME/DNAME following, etc. > The caching DNS forwarder would have all the same stuff plus DNS cookies, > not do fragmentation, and potentially have multiple full resolvers > configured in a structured priority flow (not just round robin). > > IMHO, this is what ADD is supposed to be about, discussion the what and > the how. > > And, also IMHO, it does not preclude comparison of DoT and DoH on the > respective merits and risks/costs. > > Brian > P.S. Any animosity towards DoH has very little to do with the process by > which it was developed, and everything to do with the incompatibility wit= h > existing practices and ecosystems, especially unintended impacts. It isn'= t > the encapsulation of DoH that is the problem (it's slightly annoying), bu= t > rather the re-use of port 443 instead using a dedicated port the way DoT > uses 853. > > P.P.S. The responsible approach to adopting a flawed protocol, would be t= o > acknowledge the flaws, find a better solution, and kill it off, rather th= an > defend it or justify it based on sunk cost or other rationales. I would > advocate this approach even if it was my sacred cow that was being gored. > > --00000000000064b076058e7836d2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Hi Brian,

    I'm not sure what you'= ;re trying to say.

    thanks,
    Rob


    On Wed, Jul 24, 2019 at 7:19 PM Brian Dickson <brian.peter.dickson@gmail.com> wr= ote:


    On Wed, Jul 24, 2019 at 7:40 PM Rob Sayre <sayrer@gmail.com>= ; wrote:
    On Wed, Jul 24, 2019 at 4:53 AM <chris.box@bt.com> wrote:

    This is a good point; there are valid reasons = why 1.1.1.1 can be the right provider for some users. Please allow me to cl= arify some possible misunderstandings.

    =C2=A0

    I=E2=80=99m not against DoH.

    I=E2=80=99m not against privacy and security.<= u>

    I=E2=80=99m not against user choice.=

    =C2=A0

    These are all valuable things we should strive= for. Let=E2=80=99s do it in a way that works for everyone, by identifying = and documenting best practice.


    =
    I think the issue is that this request for collaboration can be = viewed as a request to undermine DoH with follow-up RFCs.

    I understand that people come to the IETF with many different viewp= oints, so I don't see this disconnect as a problem. But it is worth poi= nting out, and trying to understand.
    I'll jump in ...

    There are some ge= nerally positive benefits to having some (but certainly not all) applicatio= ns speak DNS natively.
    (The precedent of mail transport software = doing its own DNS is a good example, including understanding why: mail soft= ware needs direct access to e.g. MX, SPF, DMARC, and DKIM records, and to a= lesser degree, PTR.)

    In particular, having some a= pplications be able to request record types other than A/AAAA/PTR via POSIX= interface (getaddrinfo/gethostby* calls) is an important benefit; doing DN= S more directly avoids having to address the whole POSIX API thing. (That c= an be done at a later date, or not at all.)

    Speaki= ng "DNS" facilitates lots of very useful use cases to application= s, in particular to browsers, that are not otherwise feasible today. (E.g. = DNSSEC validation, DANE records, HTTPSVC, etc.)

    Ho= wever, there is no specific requirement that these applications "doing= " DNS need to bypass the ENTIRE host OS' DNS stack or avoid using = other host-local DNS services/mechanisms.
    E.g. it would be reason= able to have a local forwarding-only caching server (which forwards to a fu= ll-feature resolver, using an unspecified transport), which better scaling = attributes including cache hits, and avoids divergent application-specific = resolution including different choices of full-feature resolver.
    =
    Also, privacy can be implemented on that caching server, by = either of DoT or DoH. There is approximately zero trade-off between the two= (DoH vs DoT), other than the larger issues (monitoring/filtering DNS resol= ver destinations at a network level).

    NB: the new = DNS RFC for DNS stateful operations (DSO, DNS Stateful Operations) covers a= lot of the details on how clients and servers can optimize their interacti= ons, including (IIRC) some DoT guidance.

    Some of t= he concerns regarding how to resolve the natural tension between user choic= e, and client (host) administration, is probably better handled by having t= he "user" choice be restricted (by design) to admin-priv operatio= ns.

    I would definitely prefer that DoT be the solu= tion of choice for privacy, primarily because it avoids almost all of the p= itfalls of DoH when it comes to any environment that relies on DNS-based se= curity and monitoring.

    There is a place for DoH, b= ut I don't believe it should see wide deployment in general-purpose bro= wsers.

    I have yet to see any use case other than t= he very specific "dissidents" used to justify DoH.

    =
    All of the testing (which I've basically just glanced at as = summary info) suggests that DoH and DoT perform very similarly.
    <= br>
    And, finally, from what I understand, all of the major public= resolver operators offer their services on both DoT and DoH (and v4 and v6= , and in many cases with or without filtered results).

    =
    So, in my version of a perfect world, the integrated browser DNS stack= would be:
    browser <-> (local/internal loopback-type interf= ace) <-> caching DNS forwarder <-> (DoT) <-> {enterprise = | home | public} full recursive resolver
    And the browser would sp= eak native DNS, with DNSSEC validation, DANE support (natively, not plug-in= ), HTTPSSVC, CNAME/DNAME following, etc.
    The caching DNS forwarde= r would have all the same stuff plus DNS cookies, not do fragmentation, and= potentially have multiple full resolvers configured in a structured priori= ty flow (not just round robin).

    IMHO, this is what= ADD is supposed to be about, discussion the what and the how.
    And, also IMHO, it does not preclude comparison of DoT and DoH= on the respective merits and risks/costs.

    Brian
    P.S. Any animosity towards DoH has very little to do with the proc= ess by which it was developed, and everything to do with the incompatibilit= y with existing practices and ecosystems, especially unintended impacts. It= isn't the encapsulation of DoH that is the problem (it's slightly = annoying), but rather the re-use of port 443 instead using a dedicated port= the way DoT uses 853.

    P.P.S. The responsible appr= oach to adopting a flawed protocol, would be to acknowledge the flaws, find= a better solution, and kill it off, rather than defend it or justify it ba= sed on sunk cost or other rationales. I would advocate this approach even i= f it was my sacred cow that was being gored.
    =C2=A0
    --00000000000064b076058e7836d2-- From nobody Wed Jul 24 19:38:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5E401200DB for ; Wed, 24 Jul 2019 19:38:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id stD_yv0Q3-hr for ; Wed, 24 Jul 2019 19:38:09 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [213.121.35.75]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66F1A120090 for ; Wed, 24 Jul 2019 19:38:09 -0700 (PDT) Received: from tpw09926dag15e.domain1.systemhost.net (10.9.212.15) by BWP09926080.bt.com (10.36.82.111) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Thu, 25 Jul 2019 03:38:05 +0100 Received: from tpw09926dag08h.domain1.systemhost.net (10.9.202.47) by tpw09926dag15e.domain1.systemhost.net (10.9.212.15) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 25 Jul 2019 03:38:06 +0100 Received: from bwp09926082.bt.com (10.36.82.113) by tpw09926dag08h.domain1.systemhost.net (10.9.202.47) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Thu, 25 Jul 2019 03:38:06 +0100 Received: from GBR01-LO2-obe.outbound.protection.outlook.com (104.47.21.55) by smtpe1.intersmtp.com (10.36.82.113) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Thu, 25 Jul 2019 03:38:05 +0100 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=k29aJitWIzFFC1kX+3Kv/6GcgmErKoFnpXEuU++zr6xwtb8JiAJ2Ri6Du41rDaklRv7DgoaSIrVM3G53Edm/xsRKiWgXmj5lVdGQARr5hHVZf/WK2L2kD76UCECDbA4q1wQiJSEv/Uw7TXwjs9jRc41/c6bzxJbLDTaWqH7/37H/72xi68Iaol8Q+BojXHehoX81EESWS29YIdeVE+WxMPFuZ33cuFlEVJg4t507pMCs6a3Uiqg8WeFDlsDRMUKTrnTtLH4YRa0zCD0nycscLapyKhaOvIkW6dQQmLSMu3HX2qp9P1PH+Gcbv58PHNMMjo979uFFeANcgfuUBRfk0Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CJNcsLzmPfCcSewpCmXwXnbxWcX2Ye/K5HG0MKVxeZA=; b=JLJ3pi+/H2ARQJxYo+cO+P2DYw6ORK3gqay5PBuowFHbYL2ctvDaGlAJQ9Azwh/2wpwOZ7f3I1zEBcOhkpMTqrPW9ZjMG7vA+/KqttYWR7sbkSP8uIPnjKpU10eimZlvCAHlKWMDro5UirOjqqw30Cjyb1pgOL/+F6ssg7FajcY1sNNwnNXTM83Le/JpgMsLahqePjM8f9GodfcRDBpJL4DY36K8np//W+K5EAuxPi92YbJCD8qQmHIXuwKerXKL6mYFBhpwad3hs80bBcGYGTyxksK7SMuxq6PnoG7gKQwbo92UTjYnTkEC0P4AT5AImwMduCju9H3HlekDIhnzaw== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=bt.com;dmarc=pass action=none header.from=bt.com;dkim=pass header.d=bt.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CJNcsLzmPfCcSewpCmXwXnbxWcX2Ye/K5HG0MKVxeZA=; b=dzkB3JVYyO8lQUqHa+pPppdSLzxpvXPbJhmJiBOZ3S/5lBjbY05EMrUDDXUDJAb52rTnAGzDhHO1M3/j3nFy7Fe2MDI4fTvQvrlXc3Z3Wi//FN+QrD0R/XLkoq1yeFum61vPUZuOnswr26ByuFYIJYB24VB6i1uHQdihbG7jL78= Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM (20.176.158.15) by LO2P123MB2288.GBRP123.PROD.OUTLOOK.COM (20.176.157.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Thu, 25 Jul 2019 02:38:05 +0000 Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::4061:47b7:52f1:6836]) by LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::4061:47b7:52f1:6836%3]) with mapi id 15.20.2115.005; Thu, 25 Jul 2019 02:38:05 +0000 From: To: Thread-Topic: [Add] fixing coffee shop brokenness with DoH Thread-Index: AQHVQcJI+jqXeCJLjU2M+OG81Si+56bZBa+AgAACZgCAAADiAIAAAcuAgACEL4CAABWygIAAyjSAgAAsRQCAAAO34A== Date: Thu, 25 Jul 2019 02:38:05 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=chris.box@bt.com; x-originating-ip: [2001:67c:1232:144:1152:6a76:9cd5:4223] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: be88e639-4dec-46fd-ac97-08d710a91f14 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P123MB2288; x-ms-traffictypediagnostic: LO2P123MB2288: x-microsoft-antispam-prvs: x-antispam-2: 1 x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 0109D382B0 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(136003)(396003)(346002)(366004)(376002)(189003)(199004)(66946007)(6506007)(53546011)(102836004)(4744005)(53936002)(7736002)(74316002)(66574012)(99286004)(186003)(25786009)(55016002)(46003)(9686003)(6306002)(8936002)(476003)(446003)(6246003)(486006)(68736007)(33656002)(81156014)(76116006)(81166006)(66476007)(66556008)(66446008)(561944003)(1730700003)(5640700003)(54896002)(7696005)(76176011)(790700001)(6116002)(256004)(8676002)(2351001)(2906002)(316002)(71190400001)(2501003)(6916009)(64756008)(86362001)(229853002)(478600001)(14454004)(5660300002)(11346002)(52536014)(6436002)(71200400001); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P123MB2288; H:LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: bt.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: wufn5+Y+c5QNwX++kkF0pGJdbeXTUCUx0C5PZ7sjTcpBk9HgBWn+J5bxjQnwqWfO26TlfUqgqD7pmln0L5yGfvKh0H8k2yAvBoWR9GYocdk7N65tVksqN26rXkYBsUkbpQjSG7v3DfW3Jl2a0ge3+NCcc32ZrSwRS1DouRkiNnM10ocEMWWl8UV+TyVc0UQ89WaP8UU/rdMHe7TflvvHcAZ1z/JktEfYc73l0wZejpdalcHWlNW3OshrF4Qw8OgNcqMc184cdIH5deAo7N3oSRBQxPAaJya3ierJlcw4SZAEKvPcjvqVrzh3iddysMyMnIAI9FimQgBP/G9OPCLdQcJSowB1z1eocS+YBgm1+jfk35YROFthnTxGGU6Yi0JeYBRCuVULv1I/w4dMoJSLpYsxikZkMyQlmso3Kkg3WXc= Content-Type: multipart/alternative; boundary="_000_LO2P123MB2256EB5193EF6D66B167EF959BC10LO2P123MB2256GBRP_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: be88e639-4dec-46fd-ac97-08d710a91f14 X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jul 2019 02:38:05.1241 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a7f35688-9c00-4d5e-ba41-29f146377ab0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: chris.box@bt.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB2288 X-NAI-Spam-Flag: NO X-NAI-Spam-Level: X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0.6 X-NAI-Spam-Report: 4 Rules triggered * 0.6 -- TS_MSG_REP_20 * 0 -- EDT_SDHA_ADR_FRG * 0 -- EDT_SDHA_DMN_FRG * 0 -- RV6597 X-NAI-Spam-Version: 2.2.0.9309 : core <6597> : inlines <7126> : streams <1828339> : uri <2872237> X-OriginatorOrg: bt.com Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 02:38:13 -0000 --_000_LO2P123MB2256EB5193EF6D66B167EF959BC10LO2P123MB2256GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhpcyBwcm9wb3NhbCBoYXMgYSBsb3QgZ29pbmcgZm9yIGl0OiBubyBmcmFnbWVudGF0aW9uIG9m IEROUyBjb25maWd1cmF0aW9uIGF0IHRoZSBhcHAgbGV2ZWwsIGp1c3Qgb25lIGxvdCBvZiBzZXR0 aW5ncyBpbiB0aGUgY2xpZW50IGRldmljZeKAmXMgY2FjaGluZyBmb3J3YXJkZXIsIHdpdGggc2Vj dXJlIHRyYW5zcG9ydCBvdXRzaWRlIHRoZSBkZXZpY2UsIGFuZCBmdWxsIHZhbGlkYXRpb24uDQoN ClNlZW1zIGxpa2UgYSBnb29kIHN0YXJ0Lg0KDQpGcm9tOiBCcmlhbiBEaWNrc29uIDxicmlhbi5w ZXRlci5kaWNrc29uQGdtYWlsLmNvbT4NClNlbnQ6IDI0IEp1bHkgMjAxOSAyMjoxOQ0KVG86IFJv YiBTYXlyZSA8c2F5cmVyQGdtYWlsLmNvbT4NCkNjOiBCb3gsQyxDaHJpcyxUTFcxIFIgPGNocmlz LmJveEBidC5jb20+OyBhZGRAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbQWRkXSBmaXhpbmcgY29m ZmVlIHNob3AgYnJva2VubmVzcyB3aXRoIERvSA0KDQpbc25pcF0NCg0KYnJvd3NlciA8LT4gKGxv Y2FsL2ludGVybmFsIGxvb3BiYWNrLXR5cGUgaW50ZXJmYWNlKSA8LT4gY2FjaGluZyBETlMgZm9y d2FyZGVyIDwtPiAoRG9UKSA8LT4ge2VudGVycHJpc2UgfCBob21lIHwgcHVibGljfSBmdWxsIHJl Y3Vyc2l2ZSByZXNvbHZlcg0KQW5kIHRoZSBicm93c2VyIHdvdWxkIHNwZWFrIG5hdGl2ZSBETlMs IHdpdGggRE5TU0VDIHZhbGlkYXRpb24sIERBTkUgc3VwcG9ydCAobmF0aXZlbHksIG5vdCBwbHVn LWluKSwgSFRUUFNTVkMsIENOQU1FL0ROQU1FIGZvbGxvd2luZywgZXRjLg0KVGhlIGNhY2hpbmcg RE5TIGZvcndhcmRlciB3b3VsZCBoYXZlIGFsbCB0aGUgc2FtZSBzdHVmZiBwbHVzIEROUyBjb29r aWVzLCBub3QgZG8gZnJhZ21lbnRhdGlvbiwgYW5kIHBvdGVudGlhbGx5IGhhdmUgbXVsdGlwbGUg ZnVsbCByZXNvbHZlcnMgY29uZmlndXJlZCBpbiBhIHN0cnVjdHVyZWQgcHJpb3JpdHkgZmxvdyAo bm90IGp1c3Qgcm91bmQgcm9iaW4pLg0KDQoNCg== --_000_LO2P123MB2256EB5193EF6D66B167EF959BC10LO2P123MB2256GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJ bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6 NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0K ZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1h eD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9 IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9k eSBsYW5nPSJFTi1HQiIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJX b3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJl YXN0LWxhbmd1YWdlOkVOLVVTIj5UaGlzIHByb3Bvc2FsIGhhcyBhIGxvdCBnb2luZyBmb3IgaXQ6 IG5vIGZyYWdtZW50YXRpb24gb2YgRE5TIGNvbmZpZ3VyYXRpb24gYXQgdGhlIGFwcCBsZXZlbCwg anVzdCBvbmUgbG90IG9mIHNldHRpbmdzIGluIHRoZSBjbGllbnQgZGV2aWNl4oCZcyBjYWNoaW5n IGZvcndhcmRlciwgd2l0aCBzZWN1cmUgdHJhbnNwb3J0IG91dHNpZGUgdGhlDQogZGV2aWNlLCBh bmQgZnVsbCB2YWxpZGF0aW9uLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1z by1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5TZWVtcyBsaWtlIGEgZ29vZCBzdGFydC48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZh cmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIj5Gcm9tOjwvc3Bhbj48L2I+PHNw YW4gbGFuZz0iRU4tVVMiPiBCcmlhbiBEaWNrc29uICZsdDticmlhbi5wZXRlci5kaWNrc29uQGdt YWlsLmNvbSZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiAyNCBKdWx5IDIwMTkgMjI6MTk8YnI+DQo8 Yj5Ubzo8L2I+IFJvYiBTYXlyZSAmbHQ7c2F5cmVyQGdtYWlsLmNvbSZndDs8YnI+DQo8Yj5DYzo8 L2I+IEJveCxDLENocmlzLFRMVzEgUiAmbHQ7Y2hyaXMuYm94QGJ0LmNvbSZndDs7IGFkZEBpZXRm Lm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0FkZF0gZml4aW5nIGNvZmZlZSBzaG9wIGJy b2tlbm5lc3Mgd2l0aCBEb0g8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPltzbmlwXTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5icm93c2VyICZsdDstJmd0OyAobG9jYWwvaW50ZXJuYWwgbG9vcGJhY2stdHlwZSBpbnRlcmZh Y2UpICZsdDstJmd0OyBjYWNoaW5nIEROUyBmb3J3YXJkZXIgJmx0Oy0mZ3Q7IChEb1QpICZsdDst Jmd0OyB7ZW50ZXJwcmlzZSB8IGhvbWUgfCBwdWJsaWN9IGZ1bGwgcmVjdXJzaXZlIHJlc29sdmVy PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BbmQg dGhlIGJyb3dzZXIgd291bGQgc3BlYWsgbmF0aXZlIEROUywgd2l0aCBETlNTRUMgdmFsaWRhdGlv biwgREFORSBzdXBwb3J0IChuYXRpdmVseSwgbm90IHBsdWctaW4pLCBIVFRQU1NWQywgQ05BTUUv RE5BTUUgZm9sbG93aW5nLCBldGMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5UaGUgY2FjaGluZyBETlMgZm9yd2FyZGVyIHdvdWxkIGhhdmUgYWxs IHRoZSBzYW1lIHN0dWZmIHBsdXMgRE5TIGNvb2tpZXMsIG5vdCBkbyBmcmFnbWVudGF0aW9uLCBh bmQgcG90ZW50aWFsbHkgaGF2ZSBtdWx0aXBsZSBmdWxsIHJlc29sdmVycyBjb25maWd1cmVkIGlu IGEgc3RydWN0dXJlZCBwcmlvcml0eSBmbG93IChub3QganVzdCByb3VuZCByb2JpbikuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8 L2h0bWw+DQo= --_000_LO2P123MB2256EB5193EF6D66B167EF959BC10LO2P123MB2256GBRP_-- From nobody Wed Jul 24 19:40:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 422E3120136 for ; Wed, 24 Jul 2019 19:40:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 91tv_K9HJXl6 for ; Wed, 24 Jul 2019 19:40:46 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1280B120090 for ; Wed, 24 Jul 2019 19:40:46 -0700 (PDT) Received: from dhcp-9fe5.meeting.ietf.org (dhcp-9fe5.meeting.ietf.org [31.133.159.229]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id E499D242109D; Thu, 25 Jul 2019 02:40:43 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Thu, 25 Jul 2019 03:40:41 +0100 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <9EFCE9D2-FD7B-4C30-9397-2089CDD94A14@rfc1035.com> References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> To: Rob Sayre X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 02:40:47 -0000 > On 25 Jul 2019, at 00:40, Rob Sayre wrote: >=20 > I think the issue is that this request for collaboration can be viewed = as a request to undermine DoH with follow-up RFCs. I fail to understand how anyone could possibly hold that view. The core DoH protocol is done. It's not going to be changed in the = forseeable future. If the IETF decides to do further work, it's most = likely to be on the operational and deployment aspects of DoH. Or maybe = document the security/privacy trade-offs. That wouldn't "undermine DoH" = because the effort should focus on how to make best use of DoH and = deploy it effectively. From nobody Wed Jul 24 19:44:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28A031201A8 for ; Wed, 24 Jul 2019 19:44:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ISg5_crDn-hs for ; Wed, 24 Jul 2019 19:44:20 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DE3C120187 for ; Wed, 24 Jul 2019 19:44:20 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id o9so94105875iom.3 for ; Wed, 24 Jul 2019 19:44:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=+v8FT0usI+WfRYQKbyXTzNGriMFMw/9ezuqGFLi2nIY=; b=Nn5SkZgYS6rbwY/gHSzWCchd4S4XaJrUgOB2qCIUJak/g3hA706A2zEC/3kSwj9e1C 8duagOFedAonMg3k0ZEVHnQl4sIJkkbztV8wR26tnEsrjKKq1/s2wmp9yuPWIiTZtaep m+BIkEIPe4Nb2/A3tHRu8KicdRWbLyjl4m1m96sFiuzm1gRSkR+dqTBLdmabUHkI/NOH ZiePMPe0LyHzPfjPawil07x6mqrUUWcg2xzou6fJlCSk6NCun7/KKs348TN0hxEVXe+Y s3wMkladixlJejArgeIzh87g+tASukmjntCtEm5iOVhum3grWhx5cgFf0rjvkTLRGr8q 2Nfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=+v8FT0usI+WfRYQKbyXTzNGriMFMw/9ezuqGFLi2nIY=; b=c2+IGcxAtWperppXTbP6XYU5OD2OZ5o7mHp13Ipfi/SiROUe6ijtq4F+Pj7C8xR0dq tV3fxQTVAaUtBFl7TqsphprXkS41Z0LR/gkTGNz/bQIaUlp7IGbjTRFhrao0JfJTyhER zsI2B/SwpmaJHKNT7WSI1IZ0MynHNgsxTSRrDkoI7H306lYLINIuk3N3ODOneurcVypE 06FbEihgdnIRaZHGuCmXavtmLm5up8IglwWUvRk5Jizbgp7rwsl6ADHAejz7QhFoIjKi Zv5BLcP7dkG39Q+FUVD6TlMtejQYk4KE6mVDLSXYexyK0yeDbq3Q3e0XCfN9gZh7Tw+J OkDg== X-Gm-Message-State: APjAAAVk17AbKyHcKACyF3m4vO/6XpbISfec5/zbAxIQTAITVgOpspZW a69K3ePTVcp+dTUUw7ogHkunOlPJkEtHxvuYo+c= X-Google-Smtp-Source: APXvYqw6h30Y36fGLW35M43uPlIfwSUuIXdKgQJUHUD5esyaGX+2px43R/gDmYpksm3oIsZfXT22X0/BPvMf2RybEwY= X-Received: by 2002:a5e:c00e:: with SMTP id u14mr47729878iol.196.1564022659834; Wed, 24 Jul 2019 19:44:19 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> In-Reply-To: From: Rob Sayre Date: Wed, 24 Jul 2019 19:44:08 -0700 Message-ID: To: chris.box@bt.com Cc: add@ietf.org Content-Type: multipart/alternative; boundary="0000000000000f8c41058e78672d" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 02:44:22 -0000 --0000000000000f8c41058e78672d Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 7:38 PM wrote: > This proposal has a lot going for it: no fragmentation of DNS > configuration at the app level, just one lot of settings in the client > device=E2=80=99s caching forwarder, with secure transport outside the dev= ice, and > full validation. > Well, I'm still not sure why this is a good idea, but I have an open mind. I do think like minds should focus their energies there. One of the nice things about the Internet is that there are no limits. Just go try that idea out. :) thanks, Rob --0000000000000f8c41058e78672d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On Wed, Jul 24, 2019 at 7:38 PM <chris.box@bt.com> wrote:

    This proposal has a lot going for it: no fragm= entation of DNS configuration at the app level, just one lot of settings in= the client device=E2=80=99s caching forwarder, with secure transport outsi= de the device, and full validation.


    <= /div>
    Well, I'm still not sure why this is a good idea, but I have = an open mind. I do think like minds should focus their energies there.

    One of the nice things about the Internet is that ther= e are no limits. Just go try that idea out. :)

    tha= nks,
    Rob
    --0000000000000f8c41058e78672d-- From nobody Wed Jul 24 20:00:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C21212012B for ; Wed, 24 Jul 2019 20:00:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rKa65xAmO9f7 for ; Wed, 24 Jul 2019 20:00:03 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [62.239.224.237]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28D10120026 for ; Wed, 24 Jul 2019 20:00:02 -0700 (PDT) Received: from tpw09926dag17h.domain1.systemhost.net (10.9.212.41) by RDW083A010ED66.bt.com (10.187.98.36) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 25 Jul 2019 03:59:07 +0100 Received: from tpw09926dag17e.domain1.systemhost.net (10.9.212.17) by tpw09926dag17h.domain1.systemhost.net (10.9.212.41) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 25 Jul 2019 03:59:59 +0100 Received: from bwp09926082.bt.com (10.36.82.113) by tpw09926dag17e.domain1.systemhost.net (10.9.212.17) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Thu, 25 Jul 2019 03:59:59 +0100 Received: from GBR01-CWL-obe.outbound.protection.outlook.com (104.47.20.55) by smtpe1.intersmtp.com (10.36.82.113) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Thu, 25 Jul 2019 03:59:58 +0100 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eNSRmTWfyscxgqTpOR2mPOSELilynDlTYHg/IY5ozdjbtbE6Lk0JMYfZTsif6H67UDrxhHU9VfEWIaNbrfE5RwJPQ4x8U+3K11WmqdG99s1wFwqz62NGfCtgkp8Az6cTdfH+GyCQxDSnucW1jj3i8iNREXp3AyQgx6iIIKVqOjO9E83mP1SDbyyklSdUNeGHym/qtUEtx+2ghnjcv7aNzFINbnKP7SpdIoEsIthyMjt9VTWLLoGGMwwJ9t9bhuVRFaSD3BwwXgnicrQgf+mMq1aSFDy7yaoww3V5DJxgpbOge6MS/L2lbFlqwfnXXmjacHxUKdV84HKn2U99ZqXhRg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=H926xNt0PWQr2Wb7QCisdTqeUaVX7+mdnoOT31ZSaSQ=; b=Gt0TjLmHPsrbsu8C6DGRvv/ZBg+2H+39/OwQ2w237pSKWjVTzDQi1ul6CTeztX+Jj4qkM7hWzSD7mvkDFAtH3xeemsBLBxUnoiWulv3LQy4IWKS72Qu1XHgGtz86eC1YhbECaiOTsyDplRJNZzlaqc0urAxrc1oHTKTmVIN+0ILfqb23bTAm05G32US5v3Tlb8416QVSsyQecYLLAuWLhLQtSYJyQV0YVtIb24NA256mA51Ro8dDBbXQwDU8I3BG4o7RPbaDZjZDrfBnlN8WwugMApxFQqaebGtxbaWJJ+FYCUwaCkxi//VDF1B07lIbXf8vnl3wdlT6zCALiZPBWQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=bt.com;dmarc=pass action=none header.from=bt.com;dkim=pass header.d=bt.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=H926xNt0PWQr2Wb7QCisdTqeUaVX7+mdnoOT31ZSaSQ=; b=ddr+ZEFVr2ZcxXP8EIAWWibHJfqkDwufoKmdU83f2E0kUXgj6CSRVqTJDAcU2Ihk13DQNomt+ifxUs6Q1gFvbTbDiuVE4yJN2ydT0BQz8GPYZ1XKH9K5jR8IKa0lSGVpk/j1bwBCmQ/TfYXFLzRVtG7K+zTbqnSuJ4+1SaQumC8= Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM (20.176.158.15) by LO2P123MB2350.GBRP123.PROD.OUTLOOK.COM (20.176.156.209) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Thu, 25 Jul 2019 02:59:58 +0000 Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::4061:47b7:52f1:6836]) by LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::4061:47b7:52f1:6836%3]) with mapi id 15.20.2115.005; Thu, 25 Jul 2019 02:59:58 +0000 From: To: Thread-Topic: [Add] Thoughts on a DoH (and DoT) BCP? Thread-Index: AdUx1uEEFvBhHUWqSHedXSRbiDMGggQJZbkQABjS84AAANIqwA== Date: Thu, 25 Jul 2019 02:59:58 +0000 Message-ID: References: <30950_1563958271_5D381BFF_30950_9_1_B5939C6860701C49AA39C5DA5189448B939E9268@OPEXCAUBMA1.corporate.adroot.infra.ftgroup> <20190724203835.GB5078@laperouse.bortzmeyer.org> In-Reply-To: <20190724203835.GB5078@laperouse.bortzmeyer.org> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=chris.box@bt.com; x-originating-ip: [2001:67c:1232:144:1152:6a76:9cd5:4223] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 38edc6b9-e8c2-4729-3c06-08d710ac2dc9 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P123MB2350; x-ms-traffictypediagnostic: LO2P123MB2350: x-microsoft-antispam-prvs: x-antispam-2: 1 x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 0109D382B0 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(136003)(366004)(376002)(346002)(39860400002)(13464003)(199004)(189003)(53936002)(55016002)(6436002)(76116006)(6506007)(478600001)(52536014)(86362001)(102836004)(14454004)(5660300002)(6246003)(64756008)(7736002)(305945005)(2501003)(2906002)(53546011)(229853002)(5640700003)(66946007)(66446008)(66476007)(74316002)(66556008)(2351001)(186003)(99286004)(7696005)(76176011)(33656002)(6116002)(9686003)(316002)(446003)(8676002)(81166006)(81156014)(1730700003)(8936002)(6916009)(486006)(68736007)(46003)(11346002)(256004)(71190400001)(71200400001)(476003)(25786009); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P123MB2350; H:LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: bt.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: i6ElaOXQHroa5vQFaxivtV75c5cYNP5ntqVWyFyXp3ihvvhkbxikEGqVWDDuSICG+MPmRqMIGncFiWZc2uG5OarGR7sSU3nAQZzwZMN1sK7LSi+08oKd4CuRT1zoGvLlyNMaVCf6ZJNkDVuL4s1VcRDHqSllM1F/n6UmuhcuD6e+CMQ/Ej67OpBBqqAz6s8JpGmD7BVBIm9p3rx/D1F/ScaI817NvuELLViwINMOIe/UakPft9z/qeQqsC0/Oq2be9MVn3H8LU6knnUvZW4E6yIBjvy+ys9kiXw2rSWwvOErKKw52QV4neJXlvsZTsjPQXpzo2UznOQzl2zIkYppJPEnkFVolBQFj9/YJljVmos+8GYMMUe9PzrQgHJnGByj5mRtsnzTim0zkq212tBc+UgDoP+1feTAHxZyafW1KFo= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 38edc6b9-e8c2-4729-3c06-08d710ac2dc9 X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jul 2019 02:59:58.3427 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a7f35688-9c00-4d5e-ba41-29f146377ab0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: chris.box@bt.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB2350 X-NAI-Spam-Flag: NO X-NAI-Spam-Level: X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0.2 X-NAI-Spam-Report: 5 Rules triggered * 0.1 -- GEN_SPAM_FEATRE * 0.1 -- THREAD_INDX_INVALD_VAL * 0 -- EDT_SDHA_ADR_FRG * 0 -- EDT_SDHA_DMN_FRG * 0 -- RV6597 X-NAI-Spam-Version: 2.2.0.9309 : core <6597> : inlines <7126> : streams <1828341> : uri <2872240> X-OriginatorOrg: bt.com Archived-At: Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 03:00:06 -0000 As Jim mentions, the core DoH protocol is done. But Stephane (below) raised authentication of resolvers, saying that was al= so done. Is it? RFC8484 simply says that RFC2818 authentication occurs, i.e. that the certi= ficate matches the name in the configured DoH URI template. If this DoH URI template was automatically discovered from the local networ= k, and has the name dns.mcdonalds.com, how is the client system to know tha= t the user trusts McDonalds? It feels like there's a step missing where the= user grants trust to particular providers. Unless it is documented somewhe= re that I haven't seen. Chris -----Original Message----- From: Stephane Bortzmeyer =20 Sent: 24 July 2019 16:39 To: philippe.fouquart@orange.com Cc: Fidler,AJH,Andy,TQG R ; Box,C,Chris,TLW1 R ; add@ietf.org Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP? Part of it is already done. For instance, the message you quote mentions "a= uthentication requirements for DoH and DoT resolvers" which are already cov= ered in the RFCs standardizing DoTH. =20 From nobody Wed Jul 24 20:33:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBD0B120179 for ; Wed, 24 Jul 2019 20:33:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.996 X-Spam-Level: X-Spam-Status: No, score=-6.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id atp0mH1meP8B for ; Wed, 24 Jul 2019 20:33:43 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [217.31.204.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E0C5612004F for ; Wed, 24 Jul 2019 20:33:42 -0700 (PDT) Received: from pc-cznic19.fit.vutbr.cz (unknown [207.115.96.130]) by mail.nic.cz (Postfix) with ESMTPSA id 4635C140B6B for ; Thu, 25 Jul 2019 05:33:40 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1564025620; bh=OjtJAu9wsF7sFys9QN23meekfAM9u/vhz9V3NdT17T4=; h=To:From:Date; b=IgFLaolk8hn1wBbyzRdV2AF2onDH7+u9NIR4f5bsTPfbCuXgWRmg4HLFxgMfQajAg ldBCdoRBWsLFeVcA/xc7uMxX/JfIF9N1TmGlpdra3/yDLvoMyUZGfzKR9wvDpsMM6K Ww1YjC0fC97V+C/sibVgtLDVX8DOQC3aUfNncOSo= To: add@ietf.org References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> From: =?UTF-8?B?UGV0ciDFoHBhxI1law==?= Openpgp: preference=signencrypt Autocrypt: addr=petr.spacek@nic.cz; prefer-encrypt=mutual; keydata= mQINBFhri/0BEADByTMkvpHcvPYwyhy0IDQ1B2+uU6AWP0QJQB3upM/YqxoJBeMQ5SxpO+W6 BsU0hTIF90AKIgiiDtMH1oNhHnzRXqePKORIgL3BbH5OxGcbqCYk1fIKk43DliCN1RcbTyRV REnCRQGWMTUbRS/jQ3uyTAX4rT0NhPWhPy6TMLGEg6WJJz0IzhBEw3TitvAlq6XHbi5EZYwU AHqIcuqr3sS+qkWqlIBlahu1hqhTcmYGz7ihjnWkOFi1rjRfLfudAtgFpUSmsixh2tifdy+C d8OBQbtF2kM7V1X5dUzw/nUBXm1Qex2qohRmCspwqivu7nlDMrLoilmPaeoR5evr5hpIDdfP cJAPTJk4n56q6MTHFJWkGa0yq13AJHLANNjQ/dF+W6Dhw9w2KBpuw0iGZQBBf5G9SQ1xJ+tU 9filaldsTAX1gMkVso//kGEbuRIJnJr7Z8foE/zofFyoAv21VWy2vpgQ3CnEWOZMSmYH7/gZ qcM7nfkjk4zAijpjYA3qlXoWa44/nrkAGvt7sAMsxY1C2H7tr3h3/rwyfbBqQ9nMpNwYLXXa Dil7uzyqlpKDjwWCzYd3sH7ATyT4htrd0BY5+IFimSfHyLwixhakH8E14YYyV9tzkrB7fiWd g7+zDThLtZMvtrehtkjVDPT50xg8TMr68hd3GRWBUJHszMTnlQARAQABtCBQZXRyIFNwYWNl ayA8cGV0ci5zcGFjZWtAbmljLmN6PokCVAQTAQgAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIe AQIXgBYhBL4m67nL4FmzkQyjW86N1qGlCiHkBQJcEOXhBQkFp4LgAAoJEM6N1qGlCiHkxNwQ ALFyQ7Rrghf0rM9GN2+kgP92Qvot21h8/Je3bRTvoLyhYUXcAMRmODZQ/0EsjExFc+pRwn+E 0GD2TpiorDnRMpJYEmHqenYGIrZ5TE0lHwwu0fi/X3evDY4j68OFlim5Q6+7pHOlZWaRsSm5 T6blSwIaNDFYtBhI0X1ZXTGqbXIUBFuGxolo/xEgUkeDy+6D4R8yT17CTHkuGYYrfUYnoBTr j3xMVil/lNMievaklAL8kRNVl0It4M8VzHTyEdMq7pG0CJ0CfU8COizCsu4+zy8dsxMVE0Su hju05LSsClZ9X1csxSK9HjKq+TG1Hx2qciFHRB1qC2mNIvWTm10Gkj4tLTWcJp3k2Wyv+1K2 sLFxreGOwbx0uR7XtIIBTiiZAiVsjBH0D39qG2ZLz+bJkQvlTDZQuXzsMS51wROvTVxPYcXX p069hON2+/QqJasmpOHhOydGkB3uokA0crqvMOnK+EcueKQQspvdLGiFLefJPuM8VVyR9fFZ YjnX2vfGZbE+MxY8wG4mDbhgxsUORAEtNUH/G0dvTv66fzKpl5q9GIZs7el+1IU31w7KivgS 7fsWcOsdzq4KzZzNBRJtEDoxX4b9lQ8P6ttMlPi7PnQ+iN0OUxKSnAnKQiqKMFRO1zH22vn7 iiF4JMO32//0HcpsyV8oEdjDkSJsFRnDfLW2uQINBFhri/0BEADFp4ZfxSoKTAad0IkFK9CV oZ6XKywYLFNPPhzw++gbvHL2EX7QqhEsqbsWMYpH4jc/Kq55OYYU/lIcULuD0Y9oDR26XFQo u0FeSNnzRGb607U8OFOPQ+ei92Mm1YPQ33GPj8GqbQpkAp35sfjJ64TH/EQY38RN33jsHRkh wtWU/6yo+RZs7cFRuihuLl8FuoP0A5u/x+lNNeIBk8f27LVYrF81NSDDDYjnObCah+QLzGAw GDtjWkBVawpoHWwq58OQSx5piwyOCnFJeFONRcTRgOz239rsEA5LeYfmOGcnNwG6CHoJ5ZdW Jw5OV9BoA7UTHG95xVHV5QiEm6q6igI6wKV2RtFS7Roe0Wt8H7gC41JeqaKTUsGkz6uJraF8 mmKyS8E+mSh3djmqdJNHF1pJqKxAxPYA9Y0jPnYWeEH4fPeOR2YvBjztsye9nOv1AuKNu03d uzocyU95DfP/lwNJr5SH918Vf1t7WcJj9dg6J9Jc5LOwg13Qr31TuZijrMdqM7LJKC/0tOkS eXNoMlHJOIqbqm7N414I0HytbENf7AiyDxNA5TzJKkB0eBPLm2FMQCHLfasJHgbCrQut6nYw 3f3Gn3+PDzGEHI9sfQv/mYvO77oRSGw+3Hy1ToxIncIirAyRpa5KdPLklDpADvpfkXjuL6If ZZ0OIWKLSRa/DQARAQABiQI8BBgBCAAmAhsMFiEEvibrucvgWbORDKNbzo3WoaUKIeQFAlwQ 5fcFCQWngvoACgkQzo3WoaUKIeTg+w/9Gyp5EcB4AoR3vKVxP0SAh1zBher3bh9uGaKTAWt0 +0v8fyZYGEPqZr//9rkodPnXbQnr9ogzjJmZpsPvGPyRZikWjYIwkfM2Vb4BCyr5wQ9++9KB kob5zCQmUw2o7s/gISpFsCC5B0eYusArVDnrCyrroyaxbN6MpUb5lzVMEOCzYljtdrPRAXPL FKRm3ijLV0RcYPzJJVOPV5EzUfCtGsGTXXRI9Y9O/7lFaJ+iWnwygo/Xoi0IgBHvOAj9Gp3Q 0BY+sI6Rgzm9dbddm8gYJ4+FjfZivI7fbdfSubTWvrtFmFdHovIPJYLvXK7hUG22ww4CneIF D4oZSVy9xUoqJf0qQNruzEqTr7y7lbZIzxgPCSVmH0jpgJ1po6RLaJllNA+ZklOQ76fCMiaD 5yQuJluwD5w+acPWTbmZX6DijGHPZSjzeUkiMKctYSRqVUo6JmK0dgwwm3l1/Orb4D3YsLVP QDa4ZrCfSldrGC3zkEJ8iCVSYQwlc0JfIxyn8C3LLxToPYeFv/bQTeDYBjaV7a0SQ/xKUdpg RFzrGrxj7CM2WHcpxCLVK0agobuUO7YXoufHRM6y0rfMwT10baDjh+hLKMshxTqsP55lWvtM SleSGjheVTiZChb3jK0rUPCC4Rg3gDTEQsptC3TgN48PtLpmhsNc4JPm64zlrreInZQ= Organization: CZ.NIC Message-ID: <3a36e97f-7709-8e6d-bc61-61d8f5cf7b85@nic.cz> Date: Wed, 24 Jul 2019 23:35:09 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: cs Content-Transfer-Encoding: 8bit X-Virus-Scanned: clamav-milter 0.100.3 at mail.nic.cz X-Virus-Status: Clean Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 03:33:46 -0000 On 24. 07. 19 13:14, Eric Rescorla wrote: > > > On Wed, Jul 24, 2019 at 9:00 AM Jim Reid > wrote: > > > > > On 24 Jul 2019, at 16:11, Eric Rescorla > wrote: > > > > See my response to Ted. From the perspective of the client, acting > accordingly looks basically identical to how you behave with a valid > NXDOMAIN, and so DNSSEC doesn't change the situation very much. > > Not really. A validation failure is a fairly strong indication that > the resolver is lying to you. > > > Not really, no. Our current belief is that there is going to be quite a > high rate of non-malicious validation failures. Could you please elaborate why you believe so? According to APNIC measurements, any site which has DNSSEC-related problem will become unreachable for > 20 % of Internet users [0]. In my coutry (CZ), more than 60 % of users are behind a DNSSEC-validating resolver [1]. As far as I can tell, telco support lines are not ringing because of DNSSEC. What data indicate some DNSSEC-related breakage? Thank you. [0] https://stats.labs.apnic.net/dnssec/XA [1] https://stats.labs.apnic.net/dnssec/CZ Petr Špaček @ CZ.NIC > > > Or should be. So a security-aware application would know the current > resolver can't be trusted (or is at the very least suspcious) and > take suitable countermeasures. That's what I meant by "act accordingly". > >   > What do you believe those countermeasures are? > > -Ekr From nobody Thu Jul 25 00:57:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C8C3120326 for ; Thu, 25 Jul 2019 00:57:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2i_0IzNgtmUT for ; Thu, 25 Jul 2019 00:57:28 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A73DE120309 for ; Thu, 25 Jul 2019 00:57:27 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id DF1236A32E; Thu, 25 Jul 2019 09:57:22 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1564041442; bh=hEDiXEXLkPBXBQiDJAr3UPH2i1HHTZqbxtxnKK0nObc=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=88BwRhPC7PG3IGGtmNzmK4cGvRlKfwS/d8RDRqLafPfsSnGFYdOvhY7wTYPJQuDhp 1g2/UNAikOT8ZQKvf4sz93CFHKaNEvKYLR5+UHIn33TyCInkCpK80t+VvDujUJKaha Ipkm//1CNXgj5fIb4DyoeBjTK2STm5b0jeExaFC5hJKVAJy38MLb7uEk+D1RoMU8MH 7P2tF98UGuDOESODIigdtUnIjTLifVFkpuHxRT29gabnSfa9pSSMGfcigdRt1Mk2Lx p6wJU3Zy1iVd47OF+VMcDOThsHU3g4XlIdLnP8/qLBw3OBqlwtLUdiUwyKKzUiCw7z Lu8MYlORUaGxg== Received: from [192.168.1.128] (host217-42-7-160.range217-42.btcentralplus.com [217.42.7.160]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id A32DB3C02A7; Thu, 25 Jul 2019 09:57:22 +0200 (CEST) From: Neil Cook Message-Id: <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F1DA972A-9CA4-4364-AF86-AE8CF771F598" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 25 Jul 2019 08:57:21 +0100 In-Reply-To: <20190724165951.GB29051@laperouse.bortzmeyer.org> Cc: Jim Reid , add@ietf.org, Rob Sayre To: Stephane Bortzmeyer References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 07:57:30 -0000 --Apple-Mail=_F1DA972A-9CA4-4364-AF86-AE8CF771F598 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Stephane, > On 24 Jul 2019, at 17:59, Stephane Bortzmeyer = wrote: >=20 > On Tue, Jul 23, 2019 at 11:45:07PM +0100, > Jim Reid wrote=20 > a message of 16 lines which said: >=20 >> And FWIW the success of DoH deployment -- for some definition of >> success -- seems to rest solely in the hands of a very small number >> of dominant players. >=20 > It depends on us. Or, rather, on it depends on a more general group, > the group of people who write, install and manage DoH resolvers. The > more they will be, the less users will depend on a few servers. >=20 > My hope is we will see many DoH resolvers (not always public). >=20 Running a public resolver takes a large amount of money and time, with = no monetary reward for your efforts. Very few companies can afford to do = that. Thus it seems far more likely that we=E2=80=99ll end up with a = small number of dominant players as Jim suggests. But let=E2=80=99s say I decide to run my own non-public DoH resolver on = my network at home. Firefox won=E2=80=99t have it on their list of TRRs, = and if as you suggest, the discovery drafts are pointless and so don=E2=80= =99t proceed, no application will ever find out about it, unless I = configure it manually on every single application and computer in my = house (not even mentioning those IoT devices that I can=E2=80=99t = configure).=20 It is also possible that we end up with a large number of public DoH = resolvers which mine your personal data for profit. Given the current = business model of the internet that is entirely possible.=20 Neil > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_F1DA972A-9CA4-4364-AF86-AE8CF771F598 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Stephane,

    On 24 Jul 2019, at 17:59, = Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:

    On = Tue, Jul 23, 2019 at 11:45:07PM +0100,
    Jim Reid <jim@rfc1035.com> wrote =
    a message of 16 lines which said:

    And FWIW the success of = DoH deployment -- for some definition of
    success -- seems = to rest solely in the hands of a very small number
    of = dominant players.

    It depends = on us. Or, rather, on it depends on a more general group,
    the group of people who write, install and manage DoH = resolvers. The
    more they will be, the less users will = depend on a few servers.

    My hope is we will = see many DoH resolvers (not always public).


    Running= a public resolver takes a large amount of money and time, with no = monetary reward for your efforts. Very few companies can afford to do = that. Thus it seems far more likely that we=E2=80=99ll end up with a = small number of dominant players as Jim suggests.

    But let=E2=80=99s say I decide to run my own = non-public DoH  resolver on my network at home. Firefox won=E2=80=99t= have it on their list of TRRs, and if as you suggest, the discovery = drafts are pointless and so don=E2=80=99t proceed, no application will = ever find out about it, unless I configure it manually on every single = application and computer in my house (not even mentioning those IoT = devices that I can=E2=80=99t configure). 

    It is also possible that we end up with a large = number of public DoH resolvers which mine your personal data for profit. = Given the current business model of the internet that is entirely = possible. 

    Neil

    --
    Add mailing list
    Add@ietf.org
    https://www.ietf.org/mailman/listinfo/add


    Neil Cook
    neil.cook@open-xchange.com

    ---------------------------------------------------------------= ----------------------
    Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
    Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
    Chairman of = the Board: Richard Seibt

    European = Office: 
    Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
    Managing Director: Frank Hoberg
    US Office: 
    Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
    ---------------------------------------------------------------= ----------------------

    = --Apple-Mail=_F1DA972A-9CA4-4364-AF86-AE8CF771F598-- From nobody Thu Jul 25 01:29:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D77681200C5 for ; Thu, 25 Jul 2019 01:28:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.996 X-Spam-Level: X-Spam-Status: No, score=-6.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yiDm09AZ7_La for ; Thu, 25 Jul 2019 01:28:57 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [IPv6:2001:1488:800:400::400]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DF6612003F for ; Thu, 25 Jul 2019 01:28:56 -0700 (PDT) Received: from [IPv6:2001:1488:fffe:6:bf9a:dd67:8feb:de6f] (unknown [IPv6:2001:1488:fffe:6:bf9a:dd67:8feb:de6f]) by mail.nic.cz (Postfix) with ESMTPSA id 7B31D140AB8; Thu, 25 Jul 2019 10:28:54 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1564043334; bh=MFaZJ3t+RuNkEc2YRuqfl4QToBUTmmKntAeISxD27WU=; h=To:From:Date; b=RrsQDZFZa4x9tvH45MOXU/1QZMHS3mtazWNV0pDErmgGg1HdFgpBboVUR9zidqneA Ky1koaZcqTX03U0yfrDZddgZmxi8t4+KSri/O9iDkafzHii0Zdxxudhh2qBMWbK+/5 kVrFJTx+7vVwimsUxz800Y9mrdke8TJTb3+rcwT4= Cc: Paul Wouters , Thomas Peterson References: <20190724165643.GA29051@laperouse.bortzmeyer.org> <2457067b-49fe-c2cf-d554-95f524573eea@gmail.com> <5009606a-4fcb-92c7-85c6-208d359147c8@nic.cz> <590021BB-6BA8-4CDB-8537-6335498C63E2@nohats.ca> To: add@ietf.org From: =?UTF-8?B?VmxhZGltw61yIMSMdW7DoXQ=?= Openpgp: preference=signencrypt Autocrypt: addr=vladimir.cunat+ietf@nic.cz; prefer-encrypt=mutual; keydata= mQINBFgDknYBEADHEQwLBlfqbVCzq7qYcBFFTc1WCAFtqiKehOrsITnKusZw4nhYwlKQxcum gj01xJOhbfHBCBeGlDydYqemKg4IfY2nwSyPwZZYMJn7L7AGrCeytr4VMvDJ7o7qDZjjim4i fv+GUwdk3plXx6oMF4nctesI8aAOuLUHAn0PfrGfNhWoaglOKgdOI6DGjhI/aGkvy+jrI/+X sdMV+3f1RuEOfI+Yu4SXFjJyhAmqEOBRxxdHqKreIIpz3Lg38yWwiVGfwgQT+nFIz9BpHH3l Wg1uS8xM3ezceBmRYV8zT9PvbeZ57BlaTR6rLae5RYwV397PSLBqqLkB5H0TDRUFBnwBsUob LebYHmJCOydvyNv5AFkLmLZ7O4j2jFo1WPSMt3ThM6wRwqrnB4Gi+6onyrZfE1DnVZMqbxZ3 VXa+E4S5YwrfCLUErGEn+d40OtoRZmQXhRPVAsdjimMj9oFM9RoxSgUrDg6Ia3n0IrKFb++z HAFbqkR5g4qzXiOMEG621GYEex2sDEKz/PD4CVKlNI9eld4ToH592kAwzJmd+sAi+Rfos0NE zxuFd0ekAOeWoURo0zoYTSWPlMOmFMvcpH6LP3leJmY7x4z/b1ng/+7UnKonVALVPFbRbElO kIfAtLKcUEofwV1jr7DyYGPalJtiDJPomB041ZHCj2RxyXY/oQARAQABtDBWbGFkaW3DrXIg xIx1bsOhdCAod29yaykgPHZsYWRpbWlyLmN1bmF0QG5pYy5jej6JAlQEEwEIAD4CGyMFCQlm AYAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AWIQS2AGRgtgqA54IGJEnnR98flXWjqgUCWg3w 3gAKCRDnR98flXWjqmD6D/96U4cDZBrHQ5LhqybocZr/N2IS5Wr2SLLB4k2F5/W/wbL05gq6 Ha9/2TMqXoxRkhug+EAHFHxylPR43yN9rz0pjBXHrra87FAPHMqq/qqrOEUdhkytEqa6WIho aoEkdhaMhUyctjVjL2WZ0+MWeRjqedLQX+VCrOVPcVbLreRRhA9N3KPgNwbp9zCg6hEPi4l2 zZKedHkTNjKIAwJ0xZoMwFa1Y+vL8Em8Or+IBZuGBMP/ZMtasPOIQaT/Gvsyx1DDorwsoCdX 6zaTZy5DOWP3FIrMzus/YDbzwAYxSpWk/jF44ySbnJzdjU67EfG3UrsK+RRGw8aJqs3/4qHK ZMZZnNL+4wJpEdnZyFic/MXcw6FBszQEwrIOaM1WEfwzn2ExUYk2pM5zaBwq76OgrmGMzMEi cfMDyqLodwEQqR70PvRbkrh+R02LphwQ9c5AFXcrLjKMmeQlbQVarTUsrELcTK6rElC1ojS7 M37j0XzFE+kgNWn2fyBRgtnGDWEa7r+oDaueXJnEf0/4Ww28IwxakNc7r0N41GIBekwSxKdk epKFZgtVGGSDlFei5hb5LLWFljA1OS7CRVJKpbHafQjdPdb1vNqZAj4y2SJXvVVpI1KO5kq+ dFdYipORv0N2Iho6MNYbQUT1EBeU46G5N0viCoLS15/PxLhIAo+PzKpW97kCDQRYA5J2ARAA yHww3huLEtsdyqgjiGMhtEKOLmp7yFl450HY9oPcHS02U5BC1370ssNShrdOCi2ACDbe41Zx x85WcuaO1OVqung2umX047mj2xQsiTAFRDLZsQu8cQFoEy/DBL2bk7ThfK1Lh+NyZAs0UaPp DkGodS0De9osA+4T6Nf4POYaeavbYVFSdDKS4lUboBqApKnD/TzKFxFcpuFx6FN92lteTbOo jGMiLoZvELY86Kn9KuFZ8FM2ZSNHx1Z75KouufGrdkeCoZYVYiuzT+fnt2it4dIpIlnF+yxM t5LB/MSrmECB5CAFJtxzuMccm6yDUZQSWWi9vUgxIJwvt5w0CIBT353DGeP4WnH0r5YoBKoR bh7i4fT0lWvMXTG/V2lqyzBdClMebyHffMgba26Kj6oeDygDfC5aGsVaqw1Ue/qQ5QRqTJcJ V7xVLTtS1EamVqkfKwPS0zTfnrF1jQtnO/P4qkfgBRRG9BXGGrykHpXOyqmX6Z0wbV2P4j+p 02oSecDl5yVXplJfsXfbS/xXnaSkaN/7mCU29ul26cAVNxDkDPunztSFi9K9LM2T/XWYJQGX M71OpmONQJGF24lx7Wp/kobnHtbjGDzjDPC4eSL7MA56qtrWaLM+4ePKANct2q0q6c0uSLs0 Q2zochS64Mcg0YzL1sinWPN1rXLDk3lwpIsAEQEAAYkCJQQYAQgADwUCWAOSdgIbDAUJCWYB gAAKCRDnR98flXWjqn4yEACA0f1XBAg+WMaNPtIt0k15yFPfhdbOg9GhDcYGgvFIOxRuaFWw 9SLUt7OGuUnIpKxKRXtQJss98fHkijo70ONYWPuLhfRGK/wg9Ao6MuFw5G8m431CBS/awrie b6iPjvAARXJCPTTBZk/NC988jiKdCh8PbTCHDsl+gSDytP15QUrdqSfS2Wf4653ej7+jtuTj xZzmGgvNSi6JDlb9KNtmBQKQAgpnOQM46ItESmzHDnmdcvhPLUDsjwkpIJ6clasOzaObwxJi ba7iFPcGwcClCSwYjMNXFtneCGUnEAa5RBIx+i+LV1iqB3VRvTC6tMIUueoQ7cdTy6afNkhw QYXm4/pDmNT8UMdnzwnlTpFQ0CegDQRDWc+dIDDBHGEEEYBh2vTOE04KrmYUp1bQsNegPfvL woHib0jEvohPMJ2fJtZAd1SJElgwPbM8H7emKBiTsHwF8gL7G2jo7AoGpqYjqXkCRS0tSLTN r+qHh+7Ltrkbu/ZVTTfh4Q/qw3VaLYQh4C0tBma/YevQy1O2c3TZXXFz1QF8b9/Hj/3sq2Kg T1AcZ51E+xG+cb6cUqgkihmgm39xx24GPlNAdCRuq01+iILol+Wox6OwF6hmqx1EMSmxcmGo UREr0rkMnFVsWeAYeVoE4q689qxCPu9iCMJMJnkRe1o9oQYSN7my+S98gA== Message-ID: <57dce8e1-586f-d64f-a6f8-1b66be12477c@nic.cz> Date: Thu, 25 Jul 2019 10:28:54 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <590021BB-6BA8-4CDB-8537-6335498C63E2@nohats.ca> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-US X-Virus-Scanned: clamav-milter 0.100.3 at mail.nic.cz X-Virus-Status: Clean Archived-At: Subject: Re: [Add] Not a good BoF meeting X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 08:29:00 -0000 On 7/24/19 10:50 PM, Paul Wouters wrote: >> On Jul 24, 2019, at 16:22, Vladimír Čunát wrote: >> >> I'm fairly sure this has been mentioned a few times, but let me repeat >> it: if you don't (fully) trust the network, how can you bootstrap your >> trust? (e.g. over insecure DHCP) You may get some certificate name or >> key pin, but if you can't first "secure" the channel over which you >> obtain those, I don't think you get much more real security. > The preconfigured dnssec root key. To be clear, I only had DNS *privacy* in mind, as validation of DNSSEC seems a much easier problem here, not really interesting in ADD.  For privacy, web CAs or DNSSEC+DANE (yay! more details written by Brian Dickson) can be used to authenticate the DoT/DoH connections *against a name*, but for that to be meaningful you need to determine that name in some secure way.  Otherwise you can end up "securely" sending all your DNS to https://black.hat.com/doh BTW, even if we found a technical way how to securely determine that a certificate/name/server belongs to "current network provider" (without interacting with the user), it might still be questionable to assume that the user actually wants to trust this particular network provider.  For example, Firefox apparently isn't generally comfortable with such an assumption.  But *if* we had this technical means, I'd personally be satisfied with a simple dialog asking the user whether the current network is to be trusted (e.g. "public" vs. "private" button in Windows). --Vladimir From nobody Thu Jul 25 01:46:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3CB7120335 for ; Thu, 25 Jul 2019 01:46:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.697 X-Spam-Level: X-Spam-Status: No, score=-2.697 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=gmx.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m0vsvbwnoMvg for ; Thu, 25 Jul 2019 01:46:03 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 737D81200B6 for ; Thu, 25 Jul 2019 01:46:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1564044357; bh=6DPlaQyJx4tDQsTnQBiQdTOiYYyeXcsOW3ulNupu2aM=; h=X-UI-Sender-Class:From:Subject:Date:In-Reply-To:Cc:To:References; b=U7Owg6gWH8Od656c6/9baYwBtZcFJCvHFdWcS9DjCHpo1r9Z7IIDq57WMkFHzcoqO xkYBYZi80NTyxoQhER3ai6+AEG2HzjnGNcLxyoP4g8/x+aI8MWMLf2qqkNX464eoF/ U4TD6+2uubFPkICNL/HWe+vJKGWdp3ALT4DYBDqc= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from [192.168.1.171] ([80.159.240.8]) by mail.gmx.com (mrgmx104 [212.227.17.168]) with ESMTPSA (Nemesis) id 1MoO24-1iATsb2XY8-00ok5O; Thu, 25 Jul 2019 10:45:57 +0200 From: Normen Kowalewski Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_CE80E8C5-6698-4784-97E5-47F4AA8E5CC1" Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) Date: Thu, 25 Jul 2019 10:45:55 +0200 In-Reply-To: Cc: Vittorio Bertola , "add@ietf.org" To: Joseph Lorenzo Hall References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <9E8BD2C4-D750-4B8C-BA34-AC4425F2951D@gmail.com> <520325278.24189.1563973538937@appsuite-gw1.open-xchange.com> X-Mailer: Apple Mail (2.3445.100.39) X-Provags-ID: V03:K1:92BtvFu6/uYP6yxwD2dWHe4+YHxU8ZiM+QGjW0MmBkJHf4EGUJF R4qKjojoNKG6FylfbWAkGQNUDefqK/zIoI+p4PItTn2iFSF8fUML3gZtQMTmbXUZ9vteg/0 zXnDBKnvivQfn1ZDzCxx/0taEjWnsP5NmreHNW2UjvvXeVsYRTQXuoIcXU0wHTGjkeM0sPy DmSNmhKXWz7Oame6/8XgQ== X-UI-Out-Filterresults: notjunk:1;V03:K0:p7pPHlhsN1w=:lXX2kVhS+65BO2RfYJ3oyt vEa9+YKKToLA3OlsGrUGNkCky5VO4hlk6r3EcuWehxY7rR+kWZVGNeN37k1OGebZmAjGinVSK ow4oW8DlS870YzlHtw9DBIbtOOtKxRCNpVHwFvxpiCs7QHYCsmU3nuW1kv15nZVYh9gljvFDd EpztNb0ZUtxkNmDiw08WfitaCeKGOr6JpQZfnruo/Ihqx4EGtqMvEdWcBM0A6KeNSXcaUGWAv 5G9R1qMTSl5/9zvnP1hdbEITjZtlMfnEHYcfc0h5Kl23y5pwGAYNxApfu/oTHHKBTZnoteuh6 adKeLfWAfFqIdI3ImPshj05XzxJaQx0Kj7mbtICHHroU2t9zfT597U9PO9hlu7/C+2+XLQ9yN 8SLrDGx1HRdi5+lcJ7oLAV0bJC5IXEQUnoo/5J5tk4BTbzlTNltSMYT9cvbidEUrZaLHdZttk kbKVPp1EXWyoXBGVJPC4H+FYpBQvYMKci9+SrujgHk3uEbuYll63NUV3x4v3Lho/6INANEVK9 DSv8E6+xsvu+9lwfYlcldonLYQm4KmUV1WRI8Ds2U0PnYvThFtGJ92A8C75j9tYlIKrMV35Rc DEVR3QIZt6hdoTuM8alhZyrujxdxKEzq3aNY7RpzlRCV0KdukUpqzwrTIO/xCOzFDsKY/BCdx POj0e87vUmXkIl/tc3Pe2AX9JN0pQhqCBVNulYzYhikYf9ZIZDK/uv0aw5+7ZiaiXEmvKdw0N LRfnCZvlq0LGtaLpxbw0A6hs6CAjHbU/ois2hqercM/RwBQWIOgsnCfClrlhIWr8u9BUkYXM/ pRzxEn9aRgn4uNRJ8HfDjAbLdanymKEVQmkNmbvDpMwk2n5JatUS9Vlz9Eun7E7NWIvnqz8Lo n5hgkLgZGfd67x1D6KLsWD4abGOL/zB6sv0ZezrwSMUXkJW2RQuqiR7ueOkXv8jnjeiMjSmpa L/IkmrhlYAq7C3UH5+fx4RTW02hFX9BKiZ0Tve/4Y4WP/rbT1ZlBdnEIwOprDBBkE92RSurF+ XdyFsLdV6V6PKNf5ZsNPSY6ja4OkaDGURl1unBJvLObPscrrVXPIR1VjI6WBqcarI+jcWktKw jCd44kViESwDAPwbmNU9ag5i4xyQO40weIP Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 08:46:07 -0000 --Apple-Mail=_CE80E8C5-6698-4784-97E5-47F4AA8E5CC1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Lorenzo, AFAIK use of DoT - if found - is default used as DNS protocol choice in = Android 9 (Pie) out of the box = https://android-developers.googleblog.com/2018/04/dns-over-tls-support-in-= android-p.html Hint: Ideally that and implementation details are best confirmed by = folks on this here list who coded this ;-)=20 Google/Jigsaw INTRA was done to do purely DoH https://github.com/Jigsaw-Code/Intra says: "An experimental tool that = allows you to test new DNS-over-HTTPS services on Android =E2=80=9C Its most recent update added a user managed per application exception = function for local apps that don=E2=80=99t like their DNS to be = redirected through DoH=20 BR,=20 Normen > On 24. Jul 2019, at 16:03, Joseph Lorenzo Hall wrote: >=20 >=20 >=20 > On Wed, Jul 24, 2019 at 9:05 AM Vittorio Bertola = > wrote: >=20 >> Il 24 luglio 2019 12:19 Joseph Lorenzo Hall > ha scritto: >>=20 >>=20 >>=20 >>=20 >> On Tue, Jul 23, 2019 at 22:26 Tommy Jensen > = wrote:=20 >> > Are people selling DNS logs to ad tech companies? Is that the = ecosystem being disrupted?=20 >>=20 >> Given how many valid points have been brought up in the last few = weeks about the drawbacks of centralized app-configured DNS, I don=E2=80=99= t think the glib tone is constructive. >>=20 >> Tone aside, to some users, centralization is a benefit in that they = don't have a bunch of unknown privacy policies applying to the = resolution of the names they need. For example, the privacy policy of = 1.1.1.1 is pretty amazing from the perspective of data retention, = secondary uses, etc. (e..g., I know my resolutions will be removed from = their logs within 24 hours).. >>=20 >> This may seem small but it seems to be lost in the = centralization/choice discussion. > What you seem to want above, however, is not made possible by = centralization, but by user choice, i.e. the user being able to tell all = the applications to use a specific resolver that has a privacy policy = they like. Centralization might make your choice easier, since you have = less privacy policies to compare, but might also make it impossible for = you to find one that you actually like - the fewer they are, the easier = it is for them to form a cartel and impose conditions that are only good = for them. >=20 >=20 > These are good points.... in the case I'm talking about it's = definitely having user choice, having understandable privacy policies = (to people like me, not end-users necessarily), and having usable ways = of turning this on (e.g., the 1.1.1.1 app from Cloudflare or the Intra = app from Google for older Android to use DoT). > =20 > (I will also note that all this focus on privacy policies is a U.S. = bias - in Europe, all resolvers have a pretty restrictive basic privacy = policy which is mandated by the requirements of the GDPR, though of = course there still are differences that deserve giving users a choice.) >=20 > So true... We're actively working on generic data protection laws in = the USA, wish us luck! best, Joe >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add = --Apple-Mail=_CE80E8C5-6698-4784-97E5-47F4AA8E5CC1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Lorenzo,

    AFAIK use = of DoT - if found - is default used as DNS protocol choice in Android 9 = (Pie) out of the box
    https://android-developers.googleblog.com/2018/04/dns-over-tls-= support-in-android-p.html

    Hint: Ideally that and implementation = details are best confirmed by folks on this here list who coded this = ;-) 

    Google/Jigsaw INTRA was done to do purely DoH
    https://github.com/Jigsaw-Code/Intra says: "An = experimental tool that allows you to test new DNS-over-HTTPS services on = Android =E2=80=9C

    Its most recent update added a user managed per application = exception function for local apps that don=E2=80=99t like their DNS to = be redirected through DoH 

    BR, 
    Normen

    On = 24. Jul 2019, at 16:03, Joseph Lorenzo Hall <joe@cdt.org> = wrote:



    On Wed, Jul 24, 2019 at 9:05 AM Vittorio Bertola = <vittorio.bertola@open-xchange.com> wrote:

    Il = 24 luglio 2019 12:19 Joseph Lorenzo Hall <joe@cdt.org> ha scritto:




    On Tue, Jul = 23, 2019 at 22:26 Tommy Jensen <Jensen.Thomas=3D 40microsoft.com@dmarc..ietf.org> wrote: 
    > Are people = selling DNS logs to ad tech companies? Is that the ecosystem being = disrupted? 

    Given how many valid points have been brought = up in the last few weeks about the drawbacks of centralized = app-configured DNS, I don=E2=80=99t think the glib tone is = constructive.

    Tone aside, to some users, = centralization is a benefit in that they don't have a bunch of unknown = privacy policies applying to the resolution of the names they need. For = example, the privacy policy of 1.1.1.1 is pretty amazing from the = perspective of data retention, secondary uses, etc. (e..g., I know my = resolutions will be removed from their logs within 24 hours)..

    This may seem small but it seems to be lost in the = centralization/choice discussion.
    What you seem to want above, however, is not made possible by = centralization, but by user choice, i.e. the user being able to tell all = the applications to use a specific resolver that has a privacy policy = they like. Centralization might make your choice easier, since you have = less privacy policies to compare, but might also make it impossible for = you to find one that you actually like - the fewer they are, the easier = it is for them to form a cartel and impose conditions that are only good = for them.


    These are good points.... in the case = I'm talking about it's definitely having user choice, having = understandable privacy policies (to people like me, not end-users = necessarily), and having usable ways of turning this on (e.g., the = 1.1.1.1 app from Cloudflare or the Intra app from Google for older = Android to use DoT).
     
    (I will also note that all this focus = on privacy policies is a U.S. bias - in Europe, all resolvers have a = pretty restrictive basic privacy policy which is mandated by the = requirements of the GDPR, though of course there still are differences = that deserve giving users a choice.)

    So true... We're actively working on generic data protection = laws in the USA, wish us luck! best, Joe

    -- 
    Add mailing list
    Add@ietf.org
    https://www.ietf.org/mailman/listinfo/add

    = --Apple-Mail=_CE80E8C5-6698-4784-97E5-47F4AA8E5CC1-- From nobody Thu Jul 25 01:50:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92FDE120417 for ; Thu, 25 Jul 2019 01:50:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qzxqrUxhn3vp for ; Thu, 25 Jul 2019 01:50:03 -0700 (PDT) Received: from mail-lf1-x12a.google.com (mail-lf1-x12a.google.com [IPv6:2a00:1450:4864:20::12a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E0D571200B6 for ; Thu, 25 Jul 2019 01:50:02 -0700 (PDT) Received: by mail-lf1-x12a.google.com with SMTP id c9so33893475lfh.4 for ; Thu, 25 Jul 2019 01:50:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:mime-version:references:in-reply-to:date:message-id:subject:to :cc; bh=GKDscbZ5GSIiY6qruKu2m5xpYdTYXxGKw0AX/AVEKNk=; b=KoSDGFfSQcNxT68+zCniO8rM7KdwmA8CmoUvHOcuI/seLcWS59KN0JflGstxn8xHNV g33wQ+JVLpYguXCKcEIMH6VsTNOsy2JXurHHEShczQMluSQ48IOKzH1O8/OHCyUGJLwB jasSpbs4qdLvIBpYbywYqTDM8egE/WZromDHo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:references:in-reply-to:date :message-id:subject:to:cc; bh=GKDscbZ5GSIiY6qruKu2m5xpYdTYXxGKw0AX/AVEKNk=; b=MA5aFl4F1YiDzkdcyPdhSHbGFKkcgsw2t0wet1Ht7U/Fy2vzklkdEYD9mzYREErX/P GAEk/FPaRbqIdXpIWi+n7M1DhvBp2g2xAgCdgxsEymBGKcPH0IbSM3BzRHgCoif6luWI jSzBPfrW40aDOdBdWxd3OiyOTWUeo8nXxC5fnCqBjNqdYVAWbBktZ4FVCaE9jTKRhxu1 ibxs5WhbnvGOkOLezUSQtNUnU7udvJUT/8bs2QAzqMk4CKPXUohIkkbWSIQcnAy/sWL5 FClpcBwI1qGQxxEXGiMYiFT/lUOgdgc5fnjJnc9OCiDbmqMbsNjlh7hjB4hmNxp4m44w KkMQ== X-Gm-Message-State: APjAAAVeOSyz+aQrYqRcTj6qItEhlneRS28MzpMCyTy1dgCJeyoq+Dk2 XIJUfqUhxULIy5zfRAjcPpnzyO2fALtGrYCd/yU= X-Google-Smtp-Source: APXvYqwB4MbvxiinK71iTdc3v1CnPoJaOC0DFNnbPk4lq/kuDV4fgtdPq7a01vgIm8pRLkK4uOVeeC/Yz30JB9l4dtE= X-Received: by 2002:ac2:5b49:: with SMTP id i9mr40192181lfp.116.1564044601019; Thu, 25 Jul 2019 01:50:01 -0700 (PDT) Received: from unknown named unknown by gmailapi.google.com with HTTPREST; Thu, 25 Jul 2019 01:49:59 -0700 From: Joe Abley Mime-Version: 1.0 (1.0) References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> In-Reply-To: Date: Thu, 25 Jul 2019 01:49:59 -0700 Message-ID: To: Eric Rescorla Cc: Brian Dickson , Jim Reid , "add@ietf.org" , Ted Lemon , Rob Sayre Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 08:50:05 -0000 On Jul 24, 2019, at 20:10, Eric Rescorla wrote: > This also seems like an edge case. The vast majority of clients do not have two independently controlled resolvers.. Some experiments by APNIC Labs demonstrate a significant population of stub resolvers that have google public DNS configured as one of multiple independently-operated resolvers. It was more common than I was expecting. I don't know of any experiments that test the general case (I don't *think* APNIC's experiment did, and maybe Google is special), but it may make sense to support your statement above with data if it turns out to be an important assumption. Joe From nobody Thu Jul 25 03:06:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 478921205E4 for ; Thu, 25 Jul 2019 03:06:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=gmx.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kJLXaJR0WsaF for ; Thu, 25 Jul 2019 03:06:08 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB38F1205D9 for ; Thu, 25 Jul 2019 03:06:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1564049008; bh=I0AKol2gFxDXDAtTT9YRIp73NFPwvFlTu3uvLO/n36o=; h=X-UI-Sender-Class:Subject:From:In-Reply-To:Date:Cc:References:To; b=MBCibJPiq72PXY24PubV3oIWOwkt9rQshhk09EWsp8pwza67ioCIkw9Vb4Z46n5Zd pBKju69i+jlBojwwE831fw8tBAkQ+J7lVNQFBxQUuY+12iVJNQNQXtT45jo1hlSe2U uvLSWWGnkc5wzGJeICbqAf+Kgo+wpOEU0OyPv5Xk= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from [192.168.1.171] ([80.159.240.8]) by mail.gmx.com (mrgmx003 [212.227.17.190]) with ESMTPSA (Nemesis) id 0LcShi-1iIjbS1S58-00jpum; Thu, 25 Jul 2019 12:03:28 +0200 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) From: Normen Kowalewski In-Reply-To: Date: Thu, 25 Jul 2019 12:03:20 +0200 Cc: Eric Rescorla , Jim Reid , "add@ietf.org" , Ted Lemon , Brian Dickson , Rob Sayre Content-Transfer-Encoding: quoted-printable Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <4FC4184E-E41D-420E-A594-60ECF3CD73F1@fugue.com> <7BE32238-2442-4954-B95E-1C089C8C86E7@fugue.com> To: Joe Abley , Paul Vixie X-Mailer: Apple Mail (2.3445.100.39) X-Provags-ID: V03:K1:jsrtuFO3qPIR1GnE3TBrdINh+l2Vwz8uvsY/2suOP9hlQKjS27m mQ+9LZ9gGiFZ+AId0hG9ykG81GQoPQm8Gl1LwFeYTjWDM0SakYnvh4n4xagm/5HfqPDiGe2 A6QqnYeB7jNbi1kRNOfiz3yB3bnMXF0qOiujRlOAT9OTRBqj9DlYLsXB4HlaqU3rF7Mp+Ns qto5PfYMQ5oyn/SaM/e8g== X-UI-Out-Filterresults: notjunk:1;V03:K0:HMqLPHKWWcY=:jbzzfnZMdJVAV3UO/QhAo9 dohymp87j3v+EQnSJUfgYGFhb6sNqVAo7Bmh/asX9W1DKTwD2ts87sXSNpPwzx0y4caNKqgtI ZfmXHeyyBBVa9tTgph+iujx1yMOsPcOmbvDPZw63vsG10ISmpv5671ck5wGWWr3E2M2Ox3ll2 tLBil3irz1tSPFXAbKc7WnBfXh0vxyUoaSsQbBEXfiYI12AsMQ/mXLnCVG/deB/C3Cb8HNj5Q oNBJmXEd93N0w5gnosNbBF+PY+ECZzUlQKtiZyR8YX18ljTQ4nXJOmm0J1JPu+lCPQljll+YW TmtsXIq4kw1ztGswFtSd6DqLvI24eLbYVcv0xPzcrY8FVLbacZOnnO/WGgLegE7xTebHcCaXc rjDjLmttq5leHX1lhcecn0qGAFvJSbh7i/V6+1MTbEJtQzrNT2tszqVrOsu70HZRvwBssIVL1 IOEfbl+Ly0N59sXMyHFFR7/0A1dtymhTKhREnijAUSqK4LY9RX21MWfsEns308pLJRuABhvCH N3AtUj0eq5SC5QEdylfQArrMSDUSwHgMthSHTlMEnIIOkQ3oKFBEr60xJSoerNJ7ennnav5bQ 7e/rMha5nrfsjEGpLAI7YpxWsVzxFH21ZVbAI5RXEicnj3irB2f1Lo5I6OQWuND3aqE3a6Lz6 7up7N9L5j8YW165Wls/NvZ7VF6Mw72nUTDHeilkJZ7+2VUUeGZ+17hp/lcmJDFRNnHCNC5Cqc Xj5/0wjX59XDU81Khfwv6rYEZmwPpJgT6ufj+nozJbXImbSqbdw0u6mhfSq1oZ5OuUaDUA3NH QR11rhSQyoL7eAlyZWUtlxU/SDwhlOmpNA0lnxEn27qwSYo1fEzrT9kmy2q2kaVbB5Nh/CHnt wJIYBFioSSquYXgwQw4w+oXI5yAGMCvP19ypY8m0S1ZTPAoh9cDPkWFw3p6AsQyxUHlTxrJPT 3HsH5Zl7M8UTAgHFkOjJUp4aOJ8pmpdPiTKsRc1DPdtWaS23OKTrsPI3Kwxz9i224t9er5yGc 8/M8opAIXoMijeic+gflnHgJUWZPePP4KcD0X6o4di5Lu/XRD6y6Oy8j+1obhKQ2p1OrlWX+V Lrpg7zCFIdwOPHVmkZPf35x3+MaLY4qzQ4s Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 10:06:10 -0000 Hi Joe, i am not surprised; I have seen many configs / resolv.conf contain dual = =E2=80=9Cown policy rDNS=E2=80=9D plus an extra one being public. Basically, own rDNS preferred, since its local and fastest especially if = the namespace i rather limited, and its hopefully also most secured from = admin perspective, but in case own is for some reason screwed, you will use public as the = second best choice.=20 So in this case, folks accept to relinquish local policies (and the = privacy aspect of terminating their queries on a server whose policy = they know and accept), in exchange for still being able to at least get = to the internet. I personally believe its wrong to blindly configure stuff like that, = because i that policy is in many cases pretty important, ah, well=E2=80=A6= . @Paul, can you possibly help me to understand some stats on this that = your likely quite familiar with: =20 i am looking at slide 6 of the IETF 104 presented measurement here: = https://datatracker.ietf.org/meeting/104/materials/slides-104-maprg-dns-ob= servatory-monitoring-global-dns-for-performance-and-security-pawel-foremsk= i-and-oliver-gasser-01=20 Is that that is all dns as a whole i guess (IIUC this is a mix of large = providers of Authoritative DNS, and large public rDNS) How would this diagram change if zooming in purely on customer rDNS use?=20= BR, Normen =20 > On 25. Jul 2019, at 10:49, Joe Abley wrote: >=20 > On Jul 24, 2019, at 20:10, Eric Rescorla wrote: >=20 >> This also seems like an edge case. The vast majority of clients do = not have two independently controlled resolvers.. >=20 > Some experiments by APNIC Labs demonstrate a significant population of > stub resolvers that have google public DNS configured as one of > multiple independently-operated resolvers. It was more common than I > was expecting. >=20 > I don't know of any experiments that test the general case (I don't > *think* APNIC's experiment did, and maybe Google is special), but it > may make sense to support your statement above with data if it turns > out to be an important assumption. >=20 >=20 > Joe >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Thu Jul 25 04:57:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C85BB12014B for ; Thu, 25 Jul 2019 04:57:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SriXBZ-9kuSY for ; Thu, 25 Jul 2019 04:57:48 -0700 (PDT) Received: from mail-lj1-x22c.google.com (mail-lj1-x22c.google.com [IPv6:2a00:1450:4864:20::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1ECC512013F for ; Thu, 25 Jul 2019 04:57:48 -0700 (PDT) Received: by mail-lj1-x22c.google.com with SMTP id v18so47680989ljh.6 for ; Thu, 25 Jul 2019 04:57:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=mkzcFn9kpvOjEwwsMt2Fb2NCLZ/4Cc89wbpllOTYzKs=; b=Fuv27Xj8CSD9OI7GHJWOXk/grQVfXYUXIEBMTKsEAHcnrg3+wWo0p8UV73Ow2lmh8b oshl3KAh5v08mHtKkm8EfW4m8CfvED4qYk5XnZZQg4cWA8XdRlpcfoYFwWCxBYZXiAIf vPP054FyF+0IqjkVXlxjWoAhleFDhQ+8IxYBI92NVR8nosHfsLhc6ZZpWFFvrvryYXyl crANkgpGZEnq7pvYfBg0Yodph9J0YaKuDnic6IvQufbeTcavmPz2mgDSjXmyHAhpbNtM Lych+GdJjwO3EWk3aOmGm2REOd3F3S982EXGpuSZrV1CsWbx5Ip8Hc8SZUmqDFUUbvFJ yQuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=mkzcFn9kpvOjEwwsMt2Fb2NCLZ/4Cc89wbpllOTYzKs=; b=bBcyNgDmAPN/KJhaSPCqvDyT/qV8RXL9ZG56ik8gx+VLe9uimRIrZnmG406PtNVrJo /h7+0gPK7lmAot9NS6QgGzBCI++f7uGXdhtC37QW8IuDvbFKmstbda06YmR/4TGUgeo/ tI6HcaR/PAuEFs6MxJHT3frbBGBokqCd3VOFGqeIo2GQeNoAsq1/xi8nSiHUPxhTjusS NG13zlxhBBNm9TaPylbNOaGzYe0Mf2yXEX6eFbG9FYAbW7EeUMJoUbdYz6ei1jLzQv4/ cRBtA+0MbV+o6newe5uU2VCz73UC50t1xeMaBY1c79q8DjBbn+XZjar6w3IfCRQzZvQq UJiQ== X-Gm-Message-State: APjAAAXYQ+WaCcRZZYVuPLI5TKpE2+b6DpZMb65qvEnpk9wZ5eSImqeb Q0UgEMmga5pPxf8usOPSHu5ZYCnCvHLHmdEuctU= X-Google-Smtp-Source: APXvYqxeFTRWgT1HnMc4uy+2vKiEWEnYt05riB1IWKta4hVTd0QMR+kFg1IXPq9f3QZcPpUsT5Wpy+WjIpds1nXkU4Q= X-Received: by 2002:a2e:890a:: with SMTP id d10mr46256493lji.145.1564055866259; Thu, 25 Jul 2019 04:57:46 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> <3a36e97f-7709-8e6d-bc61-61d8f5cf7b85@nic.cz> In-Reply-To: <3a36e97f-7709-8e6d-bc61-61d8f5cf7b85@nic.cz> From: Eric Rescorla Date: Thu, 25 Jul 2019 04:57:07 -0700 Message-ID: To: =?UTF-8?B?UGV0ciDFoHBhxI1law==?= Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000514c94058e8022e9" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 11:57:51 -0000 --000000000000514c94058e8022e9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 24, 2019 at 8:33 PM Petr =C5=A0pa=C4=8Dek = wrote: > > > On 24. 07. 19 13:14, Eric Rescorla wrote: > > > > > > On Wed, Jul 24, 2019 at 9:00 AM Jim Reid > > wrote: > > > > > > > > > On 24 Jul 2019, at 16:11, Eric Rescorla > > wrote: > > > > > > See my response to Ted. From the perspective of the client, actin= g > > accordingly looks basically identical to how you behave with a vali= d > > NXDOMAIN, and so DNSSEC doesn't change the situation very much. > > > > Not really. A validation failure is a fairly strong indication that > > the resolver is lying to you. > > > > > > Not really, no. Our current belief is that there is going to be quite a > > high rate of non-malicious validation failures. > > Could you please elaborate why you believe so? > > According to APNIC measurements, any site which has DNSSEC-related > problem will become unreachable for > 20 % of Internet users [0]. In my > coutry (CZ), more than 60 % of users are behind a DNSSEC-validating > resolver [1]. > > As far as I can tell, telco support lines are not ringing because of > DNSSEC. > > What data indicate some DNSSEC-related breakage? > The concern isn't misconfigured zones but rather middleboxes that strip RRSIGs or otherwise invalidate the DNSSEC signatures, so these measurements, which primarily measure whether the recursive resolver has a clear path, are not really that relevant. This hasn't been directly measured in some years, but here's AGL's post on this from 2015 https://www.imperialviolet.org/2015/01/17/notdane.html I'd certainly be interested in some evidence that this kind of problem has gone away, but it probably won't be us who takes it. -Ekr > Thank you. > > > [0] https://stats.labs.apnic.net/dnssec/XA > [1] https://stats.labs.apnic.net/dnssec/CZ > > Petr =C5=A0pa=C4=8Dek @ CZ.NIC > > > > > > > > Or should be. So a security-aware application would know the curren= t > > resolver can't be trusted (or is at the very least suspcious) and > > take suitable countermeasures. That's what I meant by "act > accordingly". > > > > > > What do you believe those countermeasures are? > > > > -Ekr > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000514c94058e8022e9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Wed, Jul 24, 2019 at 8:33 PM Petr = =C5=A0pa=C4=8Dek <petr.spacek@nic.= cz> wrote:
    jim@rfc1035.com
    > <mailto:jim@rf= c1035.com>> wrote:
    >
    >
    >
    >=C2=A0 =C2=A0 =C2=A0> On 24 Jul 2019, at 16:11, Eric Rescorla <ekr@rtfm.com
    >=C2=A0 =C2=A0 =C2=A0<mailto:ekr@rtfm..com>> wrote:
    >=C2=A0 =C2=A0 =C2=A0>
    >=C2=A0 =C2=A0 =C2=A0> See my response to Ted. From the perspective o= f the client, acting
    >=C2=A0 =C2=A0 =C2=A0accordingly looks basically identical to how you be= have with a valid
    >=C2=A0 =C2=A0 =C2=A0NXDOMAIN, and so DNSSEC doesn't change the situ= ation very much.
    >
    >=C2=A0 =C2=A0 =C2=A0Not really. A validation failure is a fairly strong= indication that
    >=C2=A0 =C2=A0 =C2=A0the resolver is lying to you.
    >
    >
    > Not really, no. Our current belief is that there is going to be quite = a
    > high rate of non-malicious validation failures.

    Could you please elaborate why you believe so?

    According to APNIC measurements, any site which has DNSSEC-related
    problem will become unreachable for > 20 % of Internet users [0]. In my<= br> coutry (CZ), more than 60 % of users are behind a DNSSEC-validating
    resolver [1].

    As far as I can tell, telco support lines are not ringing because of DNSSEC= .

    What data indicate some DNSSEC-related breakage?

    <= /div>
    The concern isn't misconfigured zones but rather middleboxes = that strip RRSIGs or otherwise
    invalidate the DNSSEC signatures, = so these measurements, which primarily measure whether
    the recurs= ive resolver has a clear path, are not really that relevant.

    =
    This hasn't been directly measured in some years, but here&#= 39;s AGL's post on this from 2015

    I'd certainly be inter= ested in some evidence that this kind of problem has gone away, but
    it probably won't be us who takes it.

    -Ekr<= /div>


    Thank you.


    [0] https://stats.labs.apnic.net/dnssec/XA
    [1] https://stats.labs.apnic.net/dnssec/CZ

    Petr =C5=A0pa=C4=8Dek=C2=A0 @=C2=A0 CZ.NIC


    >
    >
    >=C2=A0 =C2=A0 =C2=A0Or should be. So a security-aware application would= know the current
    >=C2=A0 =C2=A0 =C2=A0resolver can't be trusted (or is at the very le= ast suspcious) and
    >=C2=A0 =C2=A0 =C2=A0take suitable countermeasures. That's what I me= ant by "act accordingly".
    >
    > =C2=A0
    > What do you believe those countermeasures are?
    >
    > -Ekr

    --
    Add mailing list
    Add@ietf.org
    https://www.ietf.org/mailman/listinfo/add
    --000000000000514c94058e8022e9-- From nobody Thu Jul 25 06:18:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D1981120180 for ; Thu, 25 Jul 2019 06:18:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r40OaOkjRPAD for ; Thu, 25 Jul 2019 06:18:21 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A84BD120125 for ; Thu, 25 Jul 2019 06:18:21 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id 925B8374029C; Thu, 25 Jul 2019 06:18:20 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id C245815BB8F1; Thu, 25 Jul 2019 09:18:54 -0400 (EDT) Received: from dhcp-92b0.meeting.ietf.org (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id BCCCC15BB8F0; Thu, 25 Jul 2019 09:18:54 -0400 (EDT) From: Paul Ebersman To: Eric Rescorla cc: add@ietf.org In-reply-to: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> Comments: In-reply-to Eric Rescorla message dated "Wed, 24 Jul 2019 06:14:37 -0700." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <62257.1564060734.1@dhcp-92b0.meeting.ietf.org> Date: Thu, 25 Jul 2019 09:18:54 -0400 Message-Id: <20190725131854.C245815BB8F1@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 13:18:23 -0000 ekr> Well, this is true, but in the Web context, as we move towards 100% ekr> HTTPS, the importance of getting the right IP starts to decrease ekr> quite a bit: if you get the wrong IP address, then this turns into ekr> a connection failure. And the web is a significant use case/population, but DoT (and maybe DoH) and DNSSEC are useful for server to server, IoT, etc. (or should be used). And the trend is definitely to more connected devices that aren't human but that we don't want BOT'ed or lied to or spied on. Let's make sure that we're not conflating the web and the internet as the same thing. From nobody Thu Jul 25 06:23:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC0831200EC for ; Thu, 25 Jul 2019 06:23:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UVC9MTlx6ttk for ; Thu, 25 Jul 2019 06:23:28 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5ED22120073 for ; Thu, 25 Jul 2019 06:23:28 -0700 (PDT) Received: from dhcp-9fe5.meeting.ietf.org (dhcp-9fe5.meeting.ietf.org [31.133.159.229]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 9B16A242109D; Thu, 25 Jul 2019 13:23:26 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <20190725131854.C245815BB8F1@fafnir.remote.dragon.net> Date: Thu, 25 Jul 2019 14:23:23 +0100 Cc: add@ietf.org Content-Transfer-Encoding: 7bit Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <4DE9B8B1-36D5-4EB5-BE84-D61C182F7372@fugue.com> <20190725131854.C245815BB8F1@fafnir.remote.dragon.net> To: Paul Ebersman X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 13:23:30 -0000 > On 25 Jul 2019, at 14:18, Paul Ebersman wrote: > > Let's make sure that we're not conflating the web and the internet as > the same thing. +1 From nobody Thu Jul 25 06:53:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 818A7120043 for ; Thu, 25 Jul 2019 06:52:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.996 X-Spam-Level: X-Spam-Status: No, score=-6.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GAQB6py88ydg for ; Thu, 25 Jul 2019 06:52:56 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [217.31.204.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8FA4612001A for ; Thu, 25 Jul 2019 06:52:56 -0700 (PDT) Received: from pc-cznic19.fit.vutbr.cz (unknown [207.115.96.130]) by mail.nic.cz (Postfix) with ESMTPSA id 5862813FBF2; Thu, 25 Jul 2019 15:52:54 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1564062774; bh=Jgb3EpXJ9Lv3c1RGS+qM4qzT0UG8fS2ACtRTWXdLmZw=; h=To:From:Date; b=sWKGANudBjOJDpYFBxe8YvUqMhmmeo8NRw26hCvqBqcEq/RsJqKeCH5wK4W3FdL5E fx5IV17OzW1CXfh24ivebjZWTmY3tT82vUVSFvH2t8OZ8xDe0LTySCkQ9aYZuYfyrN AzlrQbzIrORHZwezyjlqEcqJjaUJDL+3aoCTfC3w= To: Eric Rescorla Cc: ADD Mailing list References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> <3a36e97f-7709-8e6d-bc61-61d8f5cf7b85@nic.cz> From: =?UTF-8?B?UGV0ciDFoHBhxI1law==?= Openpgp: preference=signencrypt Autocrypt: addr=petr.spacek@nic.cz; prefer-encrypt=mutual; keydata= mQINBFhri/0BEADByTMkvpHcvPYwyhy0IDQ1B2+uU6AWP0QJQB3upM/YqxoJBeMQ5SxpO+W6 BsU0hTIF90AKIgiiDtMH1oNhHnzRXqePKORIgL3BbH5OxGcbqCYk1fIKk43DliCN1RcbTyRV REnCRQGWMTUbRS/jQ3uyTAX4rT0NhPWhPy6TMLGEg6WJJz0IzhBEw3TitvAlq6XHbi5EZYwU AHqIcuqr3sS+qkWqlIBlahu1hqhTcmYGz7ihjnWkOFi1rjRfLfudAtgFpUSmsixh2tifdy+C d8OBQbtF2kM7V1X5dUzw/nUBXm1Qex2qohRmCspwqivu7nlDMrLoilmPaeoR5evr5hpIDdfP cJAPTJk4n56q6MTHFJWkGa0yq13AJHLANNjQ/dF+W6Dhw9w2KBpuw0iGZQBBf5G9SQ1xJ+tU 9filaldsTAX1gMkVso//kGEbuRIJnJr7Z8foE/zofFyoAv21VWy2vpgQ3CnEWOZMSmYH7/gZ qcM7nfkjk4zAijpjYA3qlXoWa44/nrkAGvt7sAMsxY1C2H7tr3h3/rwyfbBqQ9nMpNwYLXXa Dil7uzyqlpKDjwWCzYd3sH7ATyT4htrd0BY5+IFimSfHyLwixhakH8E14YYyV9tzkrB7fiWd g7+zDThLtZMvtrehtkjVDPT50xg8TMr68hd3GRWBUJHszMTnlQARAQABtCBQZXRyIFNwYWNl ayA8cGV0ci5zcGFjZWtAbmljLmN6PokCVAQTAQgAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIe AQIXgBYhBL4m67nL4FmzkQyjW86N1qGlCiHkBQJcEOXhBQkFp4LgAAoJEM6N1qGlCiHkxNwQ ALFyQ7Rrghf0rM9GN2+kgP92Qvot21h8/Je3bRTvoLyhYUXcAMRmODZQ/0EsjExFc+pRwn+E 0GD2TpiorDnRMpJYEmHqenYGIrZ5TE0lHwwu0fi/X3evDY4j68OFlim5Q6+7pHOlZWaRsSm5 T6blSwIaNDFYtBhI0X1ZXTGqbXIUBFuGxolo/xEgUkeDy+6D4R8yT17CTHkuGYYrfUYnoBTr j3xMVil/lNMievaklAL8kRNVl0It4M8VzHTyEdMq7pG0CJ0CfU8COizCsu4+zy8dsxMVE0Su hju05LSsClZ9X1csxSK9HjKq+TG1Hx2qciFHRB1qC2mNIvWTm10Gkj4tLTWcJp3k2Wyv+1K2 sLFxreGOwbx0uR7XtIIBTiiZAiVsjBH0D39qG2ZLz+bJkQvlTDZQuXzsMS51wROvTVxPYcXX p069hON2+/QqJasmpOHhOydGkB3uokA0crqvMOnK+EcueKQQspvdLGiFLefJPuM8VVyR9fFZ YjnX2vfGZbE+MxY8wG4mDbhgxsUORAEtNUH/G0dvTv66fzKpl5q9GIZs7el+1IU31w7KivgS 7fsWcOsdzq4KzZzNBRJtEDoxX4b9lQ8P6ttMlPi7PnQ+iN0OUxKSnAnKQiqKMFRO1zH22vn7 iiF4JMO32//0HcpsyV8oEdjDkSJsFRnDfLW2uQINBFhri/0BEADFp4ZfxSoKTAad0IkFK9CV oZ6XKywYLFNPPhzw++gbvHL2EX7QqhEsqbsWMYpH4jc/Kq55OYYU/lIcULuD0Y9oDR26XFQo u0FeSNnzRGb607U8OFOPQ+ei92Mm1YPQ33GPj8GqbQpkAp35sfjJ64TH/EQY38RN33jsHRkh wtWU/6yo+RZs7cFRuihuLl8FuoP0A5u/x+lNNeIBk8f27LVYrF81NSDDDYjnObCah+QLzGAw GDtjWkBVawpoHWwq58OQSx5piwyOCnFJeFONRcTRgOz239rsEA5LeYfmOGcnNwG6CHoJ5ZdW Jw5OV9BoA7UTHG95xVHV5QiEm6q6igI6wKV2RtFS7Roe0Wt8H7gC41JeqaKTUsGkz6uJraF8 mmKyS8E+mSh3djmqdJNHF1pJqKxAxPYA9Y0jPnYWeEH4fPeOR2YvBjztsye9nOv1AuKNu03d uzocyU95DfP/lwNJr5SH918Vf1t7WcJj9dg6J9Jc5LOwg13Qr31TuZijrMdqM7LJKC/0tOkS eXNoMlHJOIqbqm7N414I0HytbENf7AiyDxNA5TzJKkB0eBPLm2FMQCHLfasJHgbCrQut6nYw 3f3Gn3+PDzGEHI9sfQv/mYvO77oRSGw+3Hy1ToxIncIirAyRpa5KdPLklDpADvpfkXjuL6If ZZ0OIWKLSRa/DQARAQABiQI8BBgBCAAmAhsMFiEEvibrucvgWbORDKNbzo3WoaUKIeQFAlwQ 5fcFCQWngvoACgkQzo3WoaUKIeTg+w/9Gyp5EcB4AoR3vKVxP0SAh1zBher3bh9uGaKTAWt0 +0v8fyZYGEPqZr//9rkodPnXbQnr9ogzjJmZpsPvGPyRZikWjYIwkfM2Vb4BCyr5wQ9++9KB kob5zCQmUw2o7s/gISpFsCC5B0eYusArVDnrCyrroyaxbN6MpUb5lzVMEOCzYljtdrPRAXPL FKRm3ijLV0RcYPzJJVOPV5EzUfCtGsGTXXRI9Y9O/7lFaJ+iWnwygo/Xoi0IgBHvOAj9Gp3Q 0BY+sI6Rgzm9dbddm8gYJ4+FjfZivI7fbdfSubTWvrtFmFdHovIPJYLvXK7hUG22ww4CneIF D4oZSVy9xUoqJf0qQNruzEqTr7y7lbZIzxgPCSVmH0jpgJ1po6RLaJllNA+ZklOQ76fCMiaD 5yQuJluwD5w+acPWTbmZX6DijGHPZSjzeUkiMKctYSRqVUo6JmK0dgwwm3l1/Orb4D3YsLVP QDa4ZrCfSldrGC3zkEJ8iCVSYQwlc0JfIxyn8C3LLxToPYeFv/bQTeDYBjaV7a0SQ/xKUdpg RFzrGrxj7CM2WHcpxCLVK0agobuUO7YXoufHRM6y0rfMwT10baDjh+hLKMshxTqsP55lWvtM SleSGjheVTiZChb3jK0rUPCC4Rg3gDTEQsptC3TgN48PtLpmhsNc4JPm64zlrreInZQ= Organization: CZ.NIC Message-ID: <137fa1a4-8433-33ea-ecfc-27491d0e9fda@nic.cz> Date: Thu, 25 Jul 2019 09:54:25 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: cs Content-Transfer-Encoding: 8bit X-Virus-Scanned: clamav-milter 0.100.3 at mail.nic.cz X-Virus-Status: Clean Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 13:53:00 -0000 On 25. 07. 19 7:57, Eric Rescorla wrote: > > > On Wed, Jul 24, 2019 at 8:33 PM Petr Špaček > wrote: > > > > On 24. 07. 19 13:14, Eric Rescorla wrote: > > > > > > On Wed, Jul 24, 2019 at 9:00 AM Jim Reid > > >> wrote: > > > > > > > >     > On 24 Jul 2019, at 16:11, Eric Rescorla > >     .com>> wrote: > >     > > >     > See my response to Ted. From the perspective of the client, > acting > >     accordingly looks basically identical to how you behave with a > valid > >     NXDOMAIN, and so DNSSEC doesn't change the situation very much. > > > >     Not really. A validation failure is a fairly strong indication > that > >     the resolver is lying to you. > > > > > > Not really, no. Our current belief is that there is going to be > quite a > > high rate of non-malicious validation failures. > > Could you please elaborate why you believe so? > > According to APNIC measurements, any site which has DNSSEC-related > problem will become unreachable for > 20 % of Internet users [0]. In my > coutry (CZ), more than 60 % of users are behind a DNSSEC-validating > resolver [1]. > > As far as I can tell, telco support lines are not ringing because of > DNSSEC. > > What data indicate some DNSSEC-related breakage? > > > The concern isn't misconfigured zones but rather middleboxes that strip > RRSIGs or otherwise > invalidate the DNSSEC signatures, so these measurements, which primarily > measure whether > the recursive resolver has a clear path, are not really that relevant. > > This hasn't been directly measured in some years, but here's AGL's post > on this from 2015 > https://www.imperialviolet.org/2015/01/17/notdane.html > > I'd certainly be interested in some evidence that this kind of problem > has gone away, but > it probably won't be us who takes it. Understood, so it is worry about transport, which should be solved by DoH, right? What kind of non-clear path problem you are expecting in DoH channel from Firefox to a recursive of your choice? Petr Špaček @ CZ.NIC > > -Ekr > > > Thank you. > > > [0] https://stats.labs.apnic.net/dnssec/XA > [1] https://stats.labs.apnic.net/dnssec/CZ > > Petr Špaček  @  CZ.NIC > > > > > > > >     Or should be. So a security-aware application would know the > current > >     resolver can't be trusted (or is at the very least suspcious) and > >     take suitable countermeasures. That's what I meant by "act > accordingly". > > > >   > > What do you believe those countermeasures are? > > > > -Ekr > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Thu Jul 25 07:12:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 012C012023B for ; Thu, 25 Jul 2019 07:12:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z3uXdcxF8l9y for ; Thu, 25 Jul 2019 07:12:07 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C874D12022E for ; Thu, 25 Jul 2019 07:12:00 -0700 (PDT) Received: from Orochi.local ([196.52.21.215]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x6PEBrbg051059 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 25 Jul 2019 09:11:55 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1564063918; bh=T+TqmWIFNq/Oe0yp6wthCJUgjGJBYiSK5EUDyHeFnfA=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=CsfLYQGWWDatHlXJZGmfJgDgbDW0j7RIvNT3awz8EOHZWrbJOPon33DCGVGC4ZMkz wPDH8S0XQfV0tTpdBMwaFAeQxUUQtxcYJGzaTkEUjrjnGNN8pdHpHa7fHQ1sHh089i C2Zh+P6REMLAnfL3eGoBM4Zl2C91F2q8UHg/7Qlk= X-Authentication-Warning: raven.nostrum.com: Host [196.52.21.215] claimed to be Orochi.local To: Neil Cook , Stephane Bortzmeyer Cc: Jim Reid , add@ietf.org, Rob Sayre References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> From: Adam Roach Message-ID: Date: Thu, 25 Jul 2019 10:11:52 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 14:12:09 -0000 On 7/25/19 03:57, Neil Cook wrote: > But let’s say I decide to run my own non-public DoH  resolver on my > network at home. Firefox won’t have it on their list of TRRs, and if > as you suggest, the discovery drafts are pointless and so don’t > proceed, no application will ever find out about it, unless I > configure it manually on every single application and computer in my > house (not even mentioning those IoT devices that I can’t configure). > > It is also possible that we end up with a large number of public DoH > resolvers which mine your personal data for profit. Given the current > business model of the internet that is entirely possible. Since you mention Firefox's TRR list and then mention data mining (with an implied connection), I'd like to point out yet again that one of the key criteria for appearing on that list is an agreement to treat resolution data according to a strict set of privacy-protecting provisions. You can see, for example, Cloudflare's associated privacy policy at https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ I'm going to pre-reply to a frequent response that the lack of direct contractual relationship between users and Cloudflare is problematic. Even if you don't trust Mozilla's contractual agreement with Cloudflare to provide protection here, I would think that FTC v. Facebook (2019) [1] should serve as a pretty vivid illustration of what happens when a US company operates outside its published privacy policy. /a ____ [1] https://www.ftc.gov/news-events/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions From nobody Thu Jul 25 07:16:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9267E120071 for ; Thu, 25 Jul 2019 07:16:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c7mMOCFBqpbd for ; Thu, 25 Jul 2019 07:16:31 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36921120131 for ; Thu, 25 Jul 2019 07:16:23 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 3EC2B6A34B; Thu, 25 Jul 2019 16:16:18 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1564064178; bh=Tu9yg3XxPJ45Dm63BXNhaF5tC4wEDSzhUYUlw9I6w8M=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=Vv5yEeOLomCw45EXWeOvfWAY01zc2bMPTEYyfhdPCmXlxXPrs5jpMSGtm3wWDQSqZ IKR3Hj/kbmeu01Wp/goqTcophJr6FuMFucMTnJTlg4RONYZHXk3B+us4vUWC4+kwrW OHfANf4VWSvYg2HatuoGyb4fhoGjToCJkrWljb6YfiaTQDx8vzTud9e2XTn35BiNMO sIID6iXUV+RZF6Kd4dFlPn1gdzrDohj7Lf0Kc51D+YsO4QxLo49tXG7TZr/Jp3go3B Ht+OyNoTCUJOI4KpUHCUejebF3FZMS+zKEdfQnT8q3TVXDiJRkuKi0wlMsBSMGLeRO C6Zdm+7mTkeAw== Received: from [192.168.1.128] (host217-42-7-160.range217-42.btcentralplus.com [217.42.7.160]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id C44253C042B; Thu, 25 Jul 2019 16:16:17 +0200 (CEST) From: Neil Cook Message-Id: <5A359D3E-2272-4240-BD41-55646393BA9E@open-xchange.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_54557EAF-2599-477B-91F3-A9EB31A1A9D2" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 25 Jul 2019 15:16:16 +0100 In-Reply-To: Cc: Stephane Bortzmeyer , Jim Reid , add@ietf.org, Rob Sayre To: Adam Roach References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 14:16:34 -0000 --Apple-Mail=_54557EAF-2599-477B-91F3-A9EB31A1A9D2 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Adam, JFYI no connection was implied. I deliberately put the comment about = data mining in a separate paragraph, and said =E2=80=9Cit is also = possible=E2=80=9D. Neil > On 25 Jul 2019, at 15:11, Adam Roach wrote: >=20 > On 7/25/19 03:57, Neil Cook wrote: >> But let=E2=80=99s say I decide to run my own non-public DoH resolver = on my network at home. Firefox won=E2=80=99t have it on their list of = TRRs, and if as you suggest, the discovery drafts are pointless and so = don=E2=80=99t proceed, no application will ever find out about it, = unless I configure it manually on every single application and computer = in my house (not even mentioning those IoT devices that I can=E2=80=99t = configure). >>=20 >> It is also possible that we end up with a large number of public DoH = resolvers which mine your personal data for profit. Given the current = business model of the internet that is entirely possible. >=20 >=20 > Since you mention Firefox's TRR list and then mention data mining = (with an implied connection), I'd like to point out yet again that one = of the key criteria for appearing on that list is an agreement to treat = resolution data according to a strict set of privacy-protecting = provisions. You can see, for example, Cloudflare's associated privacy = policy at = https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-po= licy/firefox/ >=20 > I'm going to pre-reply to a frequent response that the lack of direct = contractual relationship between users and Cloudflare is problematic. = Even if you don't trust Mozilla's contractual agreement with Cloudflare = to provide protection here, I would think that FTC v. Facebook (2019) = [1] should serve as a pretty vivid illustration of what happens when a = US company operates outside its published privacy policy. >=20 > /a >=20 > ____ > [1] = https://www.ftc.gov/news-events/press-releases/2019/07/ftc-imposes-5-billi= on-penalty-sweeping-new-privacy-restrictions >=20 Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_54557EAF-2599-477B-91F3-A9EB31A1A9D2 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Adam,

    JFYI = no connection was implied. I deliberately put the comment about data = mining in a separate paragraph, and said =E2=80=9Cit is also = possible=E2=80=9D.

    Neil

    On 25 Jul 2019, at 15:11, Adam = Roach <adam@nostrum.com> wrote:

    On = 7/25/19 03:57, Neil Cook wrote:
    But let=E2=80=99s say I decide to run my own non-public DoH =  resolver on my network at home. Firefox won=E2=80=99t have it on = their list of TRRs, and if as you suggest, the discovery drafts are = pointless and so don=E2=80=99t proceed, no application will ever find = out about it, unless I configure it manually on every single application = and computer in my house (not even mentioning those IoT devices that I = can=E2=80=99t configure).

    It is also = possible that we end up with a large number of public DoH resolvers = which mine your personal data for profit. Given the current business = model of the internet that is entirely possible.


    Since you mention = Firefox's TRR list and then mention data mining (with an implied = connection), I'd like to point out yet again that one of the key = criteria for appearing on that list is an agreement to treat resolution = data according to a strict set of privacy-protecting provisions. You can = see, for example, Cloudflare's associated privacy policy at https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy= /privacy-policy/firefox/

    I'm going to = pre-reply to a frequent response that the lack of direct contractual = relationship between users and Cloudflare is problematic. Even if you = don't trust Mozilla's contractual agreement with Cloudflare to provide = protection here, I would think that FTC v. Facebook (2019) [1] should = serve as a pretty vivid illustration of what happens when a US company = operates outside its published privacy policy.

    /a

    ____
    [1] https://www.ftc.gov/news-events/press-releases/2019/07/ftc-impo= ses-5-billion-penalty-sweeping-new-privacy-restrictions



    Neil Cook
    neil.cook@open-xchange.com

    ---------------------------------------------------------------= ----------------------
    Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
    Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
    Chairman of = the Board: Richard Seibt

    European = Office: 
    Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
    Managing Director: Frank Hoberg
    US Office: 
    Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
    ---------------------------------------------------------------= ----------------------

    = --Apple-Mail=_54557EAF-2599-477B-91F3-A9EB31A1A9D2-- From nobody Thu Jul 25 07:21:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B307512006B for ; Thu, 25 Jul 2019 07:21:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NufH5NhYtmjY for ; Thu, 25 Jul 2019 07:21:00 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C9FB7120058 for ; Thu, 25 Jul 2019 07:21:00 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id B835B37401C0; Thu, 25 Jul 2019 07:20:59 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id 0FFA715BD17B; Thu, 25 Jul 2019 10:21:35 -0400 (EDT) Received: from dhcp-92b0.meeting.ietf.org (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 0950715BD17A; Thu, 25 Jul 2019 10:21:35 -0400 (EDT) From: Paul Ebersman To: Eric Rescorla cc: add@ietf.org In-reply-to: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> Comments: In-reply-to Eric Rescorla message dated "Wed, 24 Jul 2019 10:14:27 -0700." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <63890.1564064494.1@dhcp-92b0.meeting.ietf.org> Date: Thu, 25 Jul 2019 10:21:34 -0400 Message-Id: <20190725142135.0FFA715BD17B@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 14:21:02 -0000 jreid> Not really. A validation failure is a fairly strong indication jreid> that the resolver is lying to you. ekr> Not really, no. Our current belief is that there is going to be ekr> quite a high rate of non-malicious validation failures. What's the basis of this belief? When I was at comcast, query volumes on recursive were on order 500 billion q/day and hard/persistant DNSSEC failures were on order of dozens per month, so that seems like a pretty high success rate. From nobody Thu Jul 25 07:29:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C048E12014E for ; Thu, 25 Jul 2019 07:29:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FH7Ly-8DuAyc for ; Thu, 25 Jul 2019 07:29:45 -0700 (PDT) Received: from mail-lf1-x135.google.com (mail-lf1-x135.google.com [IPv6:2a00:1450:4864:20::135]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 083AC1200F4 for ; Thu, 25 Jul 2019 07:29:45 -0700 (PDT) Received: by mail-lf1-x135.google.com with SMTP id 62so29814592lfa.8 for ; Thu, 25 Jul 2019 07:29:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=AunX3UxeTlCcJBAidKB8KQdiNgy15iokkT27Cmtn5ks=; b=rkxjKnfqJOPoAUc/3GkN8jHWUMCMm7M+kOZlLPpsMqdZP7U8WomKlwJQwrCsVAyNP5 HUbQhdZYqF4AHmv9gzU/kYox1nSz2tUOT/LWhp2TsH/7sgxlo1pkxGRbFdFf2CfrVBdV 9m+CjtzfKYc35kkBrj6PzjbzvErlWAfnl2AcbHhxLLw1K751yn5IgylGVAVQTnAxa45f YMfEHhTfWL53xdqqnAWsf4iior7421NAdmRkpvkE4YBQjGgSCWcvhd88vc6rnvd3pLwf Y9NE94PoiFnNNo+C6ugGVI+pCTHF9fAmn9N4kmtKP1XcpmJrn0ADyk2nRBySN54Y3tWw yiLQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=AunX3UxeTlCcJBAidKB8KQdiNgy15iokkT27Cmtn5ks=; b=CEYV7VNX3QSq0OtKNwfFEEh3ET03D5wr84upof5WY/UqFchymIFQ/4fO039Lq3VVWg mb2AFFnwVlC+Fljbxsbq6ihBIzaTZXf12jd/z32RMnSPMWhbDbTzOcjkKWZAyG3NeVJ8 z6h1ZW+Aw/GR2IhsINBA/A9fhlT1jBJb7vKDdzWHe9G2z4QFEy6Z9BsWzNpzLAPK21rw J1t6rMb7uyyyf4e5CiWWcBXRxKxIEvCYcfUKZA66aiXrkDchzgu07yiV315wKURdIUqC npXY09Q5nXumhp48RLH9H+KrCNcGQeJa9L6t1+eowVpgIq5PG8MHn9EhsY3vgTT1W5g9 e7qQ== X-Gm-Message-State: APjAAAWu0qtqn2iMzF5jNoQp4pyka9QaIvd8GxHIX8eieXjLB8ef1o0a 3LFHzpzx9XsXQecMuY2LSyBnWrWHC8hS114Bzs7Z2g== X-Google-Smtp-Source: APXvYqxGSJj/x1aAR3PVJ6ApTx9p61RE7DmT4Iz8UioS9tyX9GZFlPVnkx2XEw0DTlGFOU31NwhYj3uMvNmg7SYqu3E= X-Received: by 2002:ac2:51a3:: with SMTP id f3mr13539764lfk.94.1564064983256; Thu, 25 Jul 2019 07:29:43 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> <20190725142135.0FFA715BD17B@fafnir.remote.dragon.net> In-Reply-To: <20190725142135.0FFA715BD17B@fafnir.remote.dragon.net> From: Eric Rescorla Date: Thu, 25 Jul 2019 07:29:05 -0700 Message-ID: To: Paul Ebersman Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000bba2d8058e824102" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 14:29:47 -0000 --000000000000bba2d8058e824102 Content-Type: text/plain; charset="UTF-8" On Thu, Jul 25, 2019 at 7:21 AM Paul Ebersman wrote: > > jreid> Not really. A validation failure is a fairly strong indication > jreid> that the resolver is lying to you. > > ekr> Not really, no. Our current belief is that there is going to be > ekr> quite a high rate of non-malicious validation failures. > > What's the basis of this belief? > > When I was at comcast, query volumes on recursive were on order 500 > billion q/day and hard/persistant DNSSEC failures were on order of > dozens per month, so that seems like a pretty high success rate. > See my previous message. This is about middleboxes interfering with the DNS queries, which would not be visible to you from the vantage point of comcast's recursive resolver. -Ekr --000000000000bba2d8058e824102 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Thu, Jul 25, 2019 at 7:21 AM Paul = Ebersman <list-add@dragon.net= > wrote:
    =C2= =A0 =C2=A0 =C2=A0
    jreid> Not really. A validation failure is a fairly strong indication jreid> that the resolver is lying to you.

    ekr> Not really, no. Our current belief is that there is going to be
    ekr> quite a high rate of non-malicious validation failures.

    What's the basis of this belief?

    When I was at comcast, query volumes on recursive were on order 500
    billion q/day and hard/persistant DNSSEC failures were on order of
    dozens per month, so that seems like a pretty high success rate.

    See my previous message. This is about middleboxe= s interfering with the DNS queries, which would not be visible to you from = the vantage point of comcast's recursive resolver.

    -Ekr

    --000000000000bba2d8058e824102-- From nobody Thu Jul 25 07:40:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FF921200EC for ; Thu, 25 Jul 2019 07:40:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aZp51Vn0grl1 for ; Thu, 25 Jul 2019 07:40:39 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC03D12004A for ; Thu, 25 Jul 2019 07:40:39 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id 9BEB937401C0; Thu, 25 Jul 2019 07:40:39 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id 0A57D15BD9C7; Thu, 25 Jul 2019 10:40:39 -0400 (EDT) Received: from fafnir.remote.dragon.net (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 04DFC15BD9C6; Thu, 25 Jul 2019 10:40:38 -0400 (EDT) From: Paul Ebersman To: Eric Rescorla cc: ADD Mailing list In-reply-to: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> <20190725142135.0FFA715BD17B@fafnir.remote.dragon.net> Comments: In-reply-to Eric Rescorla message dated "Thu, 25 Jul 2019 07:29:05 -0700." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <66113.1564065638.1@fafnir.remote.dragon.net> Date: Thu, 25 Jul 2019 10:40:38 -0400 Message-Id: <20190725144039.0A57D15BD9C7@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 14:40:41 -0000 ekr> Not really, no. Our current belief is that there is going to be ekr> quite a high rate of non-malicious validation failures. ebersman> What's the basis of this belief? ebersman> When I was at comcast, query volumes on recursive were on ebersman> order 500 billion q/day and hard/persistant DNSSEC failures ebersman> were on order of dozens per month, so that seems like a pretty ebersman> high success rate. ekr> See my previous message. This is about middleboxes interfering with ekr> the DNS queries, which would not be visible to you from the vantage ekr> point of comcast's recursive resolver. Sorry. Volume of list has been a bit poisonous and my mail reader threading is barely coping. ;) So your assertion is that there will be enough middleware boxes breaking DNSSEC and not handing a complete RRSET w/sigs, etc. that this will be the prevalent case? While I'd agree that many/most captive portal environments break DNSSEC (and pretty much everything else), most other recursive servers tend to honor the DO bit and send all records. I'm not so sure that most DNSSEC responses will be broken. While DNSSEC isn't a magic solution to everything, it is a useful solution to some of the problem space. When it works, it gives clearly secure answers. I do agree with you that if you do get some failure that isn't a DNSSEC validated success, just dropping the connecting is a reasonable action. But while it may be the expectations in browsers that ultimately, fast is more important than right, for non-web, right/secure is worth pursuing even at the cost of a bit of latency in the response. From nobody Thu Jul 25 07:48:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF0C4120294 for ; Thu, 25 Jul 2019 07:47:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x7khr6oWs4gs for ; Thu, 25 Jul 2019 07:47:56 -0700 (PDT) Received: from mail-lj1-x236.google.com (mail-lj1-x236.google.com [IPv6:2a00:1450:4864:20::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1EAB51202D1 for ; Thu, 25 Jul 2019 07:47:46 -0700 (PDT) Received: by mail-lj1-x236.google.com with SMTP id i21so48306149ljj.3 for ; Thu, 25 Jul 2019 07:47:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gJtHKXoRcuo4Gqj7AGRJ3PyxGiFueLaAMVZEjrqkxZI=; b=lXIEOUz+ddntWhywq13ENXE2dYoKmDFkYOTq21kBavOcp8u6skSVFxXdHQJ1GYeEh6 bPtGrjTfncOVVXd1k5NtfvTYxh26Dyc4ifuuumRZLqtnXPbk2zvlgdxne5F5Ae9RNLXb +bap8gjuuTFFQX5efzGy3h8eN9YDtkRnQc4Al+zSaDoU8m2Ued/ZLmPB67TjwBPNNdqR nJ8Lr/fPsRQfJZ6KsmkbuGrC7AkMjNyPVQY7utsYUzG7i7wFuPtss7mYQLdi0KaJZ/pb 8aWJdOL6kVBU/7sO6UzMAfkvBsi+OM3LFM3QgX/ruMd4QrcKJmYWWkV9hTIlbrXOTFyz xPsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gJtHKXoRcuo4Gqj7AGRJ3PyxGiFueLaAMVZEjrqkxZI=; b=nPxCVkIK47IOA8gCcsNcVM/pN8FlNB10GxkxIkbqiGRk03PWjmKBNoKln/HZZ1nGnN hlcFZ56pGwqelBrdnweKE5GqMlf8BgN7wMJQhyHLus0QmzgccLdcswwuP9hFlSpkOWlx OjYOSOxLZXKz04flNIIPVGL6itMa4gL2+nCT8F1RVdPnS/JPjkwr7lKYrWCxcA3bh97d K7uaxN33ZUQiYTWFgDjZr3b5yZaOGRVNlQTu641PGVeHVYvByOjIFUPkxSqpPRFE+7CV G9lTKdAoYC1DW/5JHpTdav5a71S2Sy24Vd/NRiQp4qTqAV8Wln2pkcHg01yRdaAsPC8Q s39Q== X-Gm-Message-State: APjAAAWlU00qlbXR9MtKNtQLbyLiyRX3a7HIS/t9rK1At9XulHOCXBiL eo2UYcK1DWybQJVLV3C+xaN/io04XRaY2rt6PDSeuw== X-Google-Smtp-Source: APXvYqxUgXz8WmS7mPsa/pEYZxCe27SlP3qmNB8I5SB5lZFU0XZEEg1EsY7MGems1+4l/HP172C6hyV1Zgb36knPWNA= X-Received: by 2002:a2e:9cd4:: with SMTP id g20mr23633568ljj.205.1564066064273; Thu, 25 Jul 2019 07:47:44 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> <20190725142135.0FFA715BD17B@fafnir.remote.dragon.net> <20190725144039.0A57D15BD9C7@fafnir.remote.dragon.net> In-Reply-To: <20190725144039.0A57D15BD9C7@fafnir.remote.dragon.net> From: Eric Rescorla Date: Thu, 25 Jul 2019 07:47:07 -0700 Message-ID: To: Paul Ebersman Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000002aa553058e828262" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 14:48:04 -0000 --0000000000002aa553058e828262 Content-Type: text/plain; charset="UTF-8" On Thu, Jul 25, 2019 at 7:40 AM Paul Ebersman wrote: > > ekr> Not really, no. Our current belief is that there is going to be > ekr> quite a high rate of non-malicious validation failures. > > ebersman> What's the basis of this belief? > > ebersman> When I was at comcast, query volumes on recursive were on > ebersman> order 500 billion q/day and hard/persistant DNSSEC failures > ebersman> were on order of dozens per month, so that seems like a pretty > ebersman> high success rate. > > ekr> See my previous message. This is about middleboxes interfering with > ekr> the DNS queries, which would not be visible to you from the vantage > ekr> point of comcast's recursive resolver. > > Sorry. Volume of list has been a bit poisonous and my mail reader > threading is barely coping. ;) > > So your assertion is that there will be enough middleware boxes breaking > DNSSEC and not handing a complete RRSET w/sigs, etc. that this will be > the prevalent case? > No. Rather that it will be sufficiently common that breakage is not a reliable indicator of attack and that therefore it is not viable for mass market end-user software to discard responses which are bogus according to DNSSEC. For context, our breakage budget here is very small: any change to clients which causes connection error rates to increase by more than fractions of a percent is not really something we can deploy. -Ekr --0000000000002aa553058e828262 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Thu, Jul 25, 2019 at 7:40 AM Paul = Ebersman <list-add@dragon.net= > wrote:
    =C2= =A0 =C2=A0 =C2=A0
    ekr> Not really, no. Our current belief is that there is going to be
    ekr> quite a high rate of non-malicious validation failures.

    ebersman> What's the basis of this belief?

    ebersman> When I was at comcast, query volumes on recursive were on
    ebersman> order 500 billion q/day and hard/persistant DNSSEC failures ebersman> were on order of dozens per month, so that seems like a pretty=
    ebersman> high success rate.

    ekr> See my previous message. This is about middleboxes interfering with=
    ekr> the DNS queries, which would not be visible to you from the vantage=
    ekr> point of comcast's recursive resolver.

    Sorry. Volume of list has been a bit poisonous and my mail reader
    threading is barely coping. ;)

    So your assertion is that there will be enough middleware boxes breaking DNSSEC and not handing a complete RRSET w/sigs, etc. that this will be
    the prevalent case?

    No. Rather that it = will be sufficiently common that breakage is not a reliable indicator of at= tack and that therefore it is not viable for mass market end-user software = to discard responses which are bogus according to DNSSEC.

    For context, our breakage budget here is very small: any change to = clients which causes connection error rates to increase by more than fracti= ons of a percent is not really something we can deploy.

    <= /div>
    -Ekr

    --0000000000002aa553058e828262-- From nobody Thu Jul 25 07:51:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B9641202F9 for ; Thu, 25 Jul 2019 07:51:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dqvvHdWxtAGi for ; Thu, 25 Jul 2019 07:51:20 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B94D12028B for ; Thu, 25 Jul 2019 07:51:20 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id DA34C6A290; Thu, 25 Jul 2019 16:51:18 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1564066278; bh=CBRP5pr439fukK4Vk3I+p5lvOAwbTl+QvQLGzOcBI6E=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=Vbz0CgpWaSzG0+hLxEycsSmxG720Cem4gWSrLUcHQJQLbThuDbssDRNGFGSdQoT36 LexFRNF9uD8ul+0U7c1QSo6j3IEzdoUyNQGR4+Z2my62XujOzd1ayoP7BiPF2jAr3L 4RGafLS+ORbXiUqbs1Detdrrt9//rlSZ5YJctdpaUAbOkxY6XqHgyZ824UmOnmV8Gk pW+GEN6xMMc6b8VT+ii2H92KFK0aiKgsjRB40VvrRnu9Wr/rbZ2qMshoOuDu0LvGQd 2MKAb5lQS3+Y+9ocOH4UyzjDU8EILnVScWAUzeuFW+gwmHM1uBbGnAsvCNPFGvOqA9 ZzLmZJqtqimuw== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id CE2873C042B; Thu, 25 Jul 2019 16:51:18 +0200 (CEST) Date: Thu, 25 Jul 2019 16:51:18 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Adam Roach Cc: add@ietf.org Message-ID: <2044195920.26849.1564066278788@appsuite-gw1.open-xchange.com> In-Reply-To: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev8 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 14:51:27 -0000 > Il 25 luglio 2019 16:11 Adam Roach ha scritto: > > I'm going to pre-reply to a frequent response that the lack of direct > contractual relationship between users and Cloudflare is problematic. > Even if you don't trust Mozilla's contractual agreement with Cloudflare > to provide protection here, I would think that FTC v. Facebook (2019) > [1] should serve as a pretty vivid illustration of what happens when a > US company operates outside its published privacy policy. However, privacy policies by private companies can be overridden by laws and other juridical instruments within the applicable jurisdiction, forcing the operator to give access to data to national law enforcement and security agencies (in the US, that is especially easy for non-US citizens). Same for other parts of your TRR clauses - you may commit not to block anything, but if President Trump shows up with an order that requires blocking DNS resolution for the domain name of a specific foreign company (a case that, honestly, does not seem so unlikely), you will be forced to implement it no matter what you think. This is not meant to challenge your commitment to privacy, but it's just how it is, and it is the reason why people in other parts of the world - even the privacy activists that dislike their local network and would love to get an alternative - are not too happy with your declared approach of redirecting queries by default to a different jurisdiction that, in their view, offers less privacy protection than their own. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Thu Jul 25 08:00:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A69F91202CB for ; Thu, 25 Jul 2019 08:00:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KPVn_UCl5nGj for ; Thu, 25 Jul 2019 08:00:03 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E76C120289 for ; Thu, 25 Jul 2019 08:00:00 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45vb3g0f6yzF0f for ; Thu, 25 Jul 2019 16:59:59 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1564066799; bh=p26iHxxuAPJKLl1UawB2eGo/NdAn/BQXgwaM8ZogadU=; h=Date:From:To:Subject:In-Reply-To:References; b=h3dLkN3PR5SkpAs4tQ1s08ULFfnnXPOofpVcA2ePkogUYKtwGQhAmCIVmejKB88+h NXqZTC1ZkJaquxiaxAlWZyasDtP83XqSjli0dA3ZdOORAbfho2ZylRw8G/7Op6RVsb itkLUi4YD5tdsmztAXoB/2USYKZ8he3Gr+5HD1RM= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id lw2HCYJPQi75 for ; Thu, 25 Jul 2019 16:59:57 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS for ; Thu, 25 Jul 2019 16:59:56 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id E40B9394973; Thu, 25 Jul 2019 10:59:55 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca E40B9394973 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id D9D8840A6FFE for ; Thu, 25 Jul 2019 10:59:55 -0400 (EDT) Date: Thu, 25 Jul 2019 10:59:55 -0400 (EDT) From: Paul Wouters To: add@ietf.org In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> <20190725142135.0FFA715BD17B@fafnir.remote.dragon.net> <20190725144039.0A57D15BD9C7@fafnir.remote.dragon.net> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 15:00:09 -0000 On Thu, 25 Jul 2019, Eric Rescorla wrote: > For context, our breakage budget here is very small: any change to clients which causes connection error > rates to increase by more than fractions of a percent is not really something we can deploy. What percentage of hijacked connections due to maliciously modified DNS is within your breakage budget? In other words, how do you balance security versus user convenience? A certificate that has expired only two hours ago seem to be fine to hard fail on. But a broken DNS transport is not? There is a bit of interaction here. People messing (or neglecting) their DNS of endusers might do this less if they get flagged in common browsers for doing so. Of course I symphatize with you that you do not want that to become your problem. But how long are we kicking this can down the road? Everything on the internet should be authenticated. We keep delaying this as a hard requirement for DNS only, for increasingly less convincing reasons. Paul From nobody Thu Jul 25 08:08:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 087D3120261 for ; Thu, 25 Jul 2019 08:07:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QMC44t-FzLnx for ; Thu, 25 Jul 2019 08:07:56 -0700 (PDT) Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCAB112009C for ; Thu, 25 Jul 2019 08:07:55 -0700 (PDT) Received: from dooku.sandelman.ca (unknown [IPv6:2001:67c:1232:144:6e88:14ff:fe34:93bc]) by relay.sandelman.ca (Postfix) with ESMTPS id C2CC81F44B; Thu, 25 Jul 2019 15:07:52 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id A06BC1D76; Thu, 25 Jul 2019 11:08:15 -0400 (EDT) From: Michael Richardson To: Paul Wouters , add@ietf.org In-reply-to: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> <20190725142135.0FFA715BD17B@fafnir.remote.dragon.net> <20190725144039.0A57D15BD9C7@fafnir.remote.dragon.net> Comments: In-reply-to Paul Wouters message dated "Thu, 25 Jul 2019 10:59:55 -0400." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Date: Thu, 25 Jul 2019 11:08:15 -0400 Message-ID: <16891.1564067295@dooku.sandelman.ca> Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 15:07:58 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Paul Wouters wrote: > What percentage of hijacked connections due to maliciously modified D= NS=20 > is within your breakage budget? In other words, how do you balance > security=20 > versus user convenience? A certificate that has expired only two hours > ago seem to be fine to hard fail on. But a broken DNS transport is no= t? I agree. I wish it was Applications Doing DNSSEC, and DNSSEC-over-HTTPS/TLS. It seems that once it's in the Application, that doing DNSSEC intelligently is much easier. =2D-=20 ] Never tell me the odds! | ipv6 mesh network= s [=20 ] Michael Richardson, Sandelman Software Works | network architect= [=20 ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [=20 =09 --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEERK+9HEcJHTJ9UqTMlUzhVv38QpAFAl05xd8ACgkQlUzhVv38 QpCPpgf/bDElZDxpkpoLhsYuVHcsBxVdMkeXMrDpr5pXx2Tu9624LU7iiHVWHjlU RkEUXFiwPVCob7748udcqqDEgwdt7g0gb314bvPXsy2e0YOptYsd+S4KMOg7/ccp nZRjgnke54NyskW9X/toiem2psBLcf+R7JMg51pu/ipNxrfE2r//sMTHx3bEIh4E /Fc7rDrRDDhlX2e4wkmKXfYyYwRYAJzazEzHXN9BJfMoGSV8/E/gBJSg7JRpfdox AzKkilATJfTX9ONAAQ6TdAjkWZtg/8yagzqToqPn8WobDAOJOysPyIDeH6tWrGWl 1E0zxWOMWdi+PR1EX01vlUVZjiRPoA== =dVMa -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Jul 25 08:16:39 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1788120073 for ; Thu, 25 Jul 2019 08:16:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lKk-iwFGOq8z for ; Thu, 25 Jul 2019 08:16:35 -0700 (PDT) Received: from mail-ua1-x92e.google.com (mail-ua1-x92e.google.com [IPv6:2607:f8b0:4864:20::92e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22D6D12006F for ; Thu, 25 Jul 2019 08:16:35 -0700 (PDT) Received: by mail-ua1-x92e.google.com with SMTP id c4so19982188uad.1 for ; Thu, 25 Jul 2019 08:16:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=XvPhNw6V6IG9JXT3OuME49JANd9nQiQmp4PWR+iO6c4=; b=YsVZ+TzjIZIHb/IrxuJDiOZdvYNTru8u37XtJAhVgR2Pi6HQggiKXm+NXYB0Cd3qAt xVRw7Fk1aGYtCo1jvvqpKYgD8Gks2fmCpUVKZgDVRVLlS/Fucb71ALFI42YJoNwPTsgx 5++CacVSciWzIBk4+ETVPJhEozxsBZfrIa/OaLSu4yvykBG4LBoEhsSMa88iElfgTDgk Bb3UZIu/6n+eBV2JZJ9XMGRdBUdww2VuerQHggktQ/s0A/G6GrIWkfzmbk7NFJmFpFOy Tjd3O8nlfSbw9ikXmWKTyAhrt1fwtn0viw3q9+dQZFQiJtdJtSxByhsEAYDaQZpxM7KL EAgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=XvPhNw6V6IG9JXT3OuME49JANd9nQiQmp4PWR+iO6c4=; b=m6YHzlVPNK7fiNs3QLx5tz14jhLCuLkYunBJTAtldlB1WeMaEP5/0BSGOmM7SdcPh5 brT/pXNA4MLVJVQR3bXnj3Rwo61ic8zksmmANPWrzxtSupTpS5PBM3GomdVgcW9WPvaC 7akhEQPDgJoVVJdTv/cTkLOZXNanV0pMF/zMoxfQ7xfWLgekKBKVXYNFiHiDVOXIxe2U ttv+/CE50lY+6llFZQJr0KvSm+2dMGbku9415Q4iYEWJKker/tUfJIu0CZJO1xEHtpRf AvE1bPc2VCxBGA20chUxcVzUEgwqqP3OpVOCH+sFprlaEGSgCJWyywHd5v9qLZAnRi1m DdwQ== X-Gm-Message-State: APjAAAWkllUzEE+kgn0H5xaRmEKT5bVZluDHTIHk76wyMyAhbShI+YWt tIqvf1O5XAq6F+vDX9i/mWi5WgIG/Re+fNbFGPI= X-Google-Smtp-Source: APXvYqzNo6Lw5SNsk2hVNwmo73AzvHqHtzNgCo+wx1oGqEe5/ubBuEiX9TrvwGOqkO2LyqSl6pEwLff+nKW416cRfNw= X-Received: by 2002:ab0:1c0c:: with SMTP id a12mr15202031uaj.75.1564067794246; Thu, 25 Jul 2019 08:16:34 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> <20190725142135.0FFA715BD17B@fafnir.remote.dragon.net> In-Reply-To: From: Brian Dickson Date: Thu, 25 Jul 2019 11:16:22 -0400 Message-ID: To: Eric Rescorla Cc: Paul Ebersman , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000047dfe3058e82e9e9" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 15:16:38 -0000 --00000000000047dfe3058e82e9e9 Content-Type: text/plain; charset="UTF-8" On Thu, Jul 25, 2019 at 10:29 AM Eric Rescorla wrote: > > > On Thu, Jul 25, 2019 at 7:21 AM Paul Ebersman wrote: > >> >> jreid> Not really. A validation failure is a fairly strong indication >> jreid> that the resolver is lying to you. >> >> ekr> Not really, no. Our current belief is that there is going to be >> ekr> quite a high rate of non-malicious validation failures. >> >> What's the basis of this belief? >> >> When I was at comcast, query volumes on recursive were on order 500 >> billion q/day and hard/persistant DNSSEC failures were on order of >> dozens per month, so that seems like a pretty high success rate. >> > > See my previous message. This is about middleboxes interfering with the > DNS queries, which would not be visible to you from the vantage point of > comcast's recursive resolver. > > -Ekr > I'm confused by this reference to middleboxes and DNS. The presumed use case is Do* (DoH/DoT), where the middleboxes only see TLS traffic, and absolutely have no ability to inspect or interfere with the contents of DNS packets within those connections. If we remove the middlebox from the equation, how then do you maintain the belief that "there is going to be quite a high rate of non-malicious validation failures"? The other messages in this thread indicate an extremely low rate of DNSSEC failures. Brian --00000000000047dfe3058e82e9e9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Thu, Jul 25, 2019 at 10:29 AM Eric= Rescorla <ekr@rtfm.com> wrote:




    --00000000000047dfe3058e82e9e9-- From nobody Thu Jul 25 08:17:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32A7812006F for ; Thu, 25 Jul 2019 08:17:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7SopZI9z1DuZ for ; Thu, 25 Jul 2019 08:17:27 -0700 (PDT) Received: from mail-lf1-x133.google.com (mail-lf1-x133.google.com [IPv6:2a00:1450:4864:20::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6D83112006D for ; Thu, 25 Jul 2019 08:17:27 -0700 (PDT) Received: by mail-lf1-x133.google.com with SMTP id s19so34807851lfb.9 for ; Thu, 25 Jul 2019 08:17:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Sn/I2yYRNVToTuE+n10FlDeQxsxx4rDVS+pDAgr4ZsQ=; b=laHI/LpU3XqptdBufEcsQESg5Bc7aRg3Jl143D3fVLVv/B9SopLBnwD3CIv0iFNe5q CL6sQeltJKvSsGImFco3GY7Jc+8pJ8dqN0/l/uN0wyS5/ZRqhxX+sR2U67OAq42ximG3 BtY6ew1g86xUfDI/2pVQ5PPxS0Z4/5DeAVHkLpIlclK4kQe9KThOOLickDqs38lcPUTH AgiN29z/j4h1dMCh2MLisSii7AE2iqTDa0pKOZEZeT2BtTyK8H96SZ/Q8+zEyMqtqLjX rowZ8Eok7Hxtla0g7O5gafatAG1Va3dN7JIoXOzUqzTED1LQuvQNrBGFzeowgFxI6Fb/ 5FYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Sn/I2yYRNVToTuE+n10FlDeQxsxx4rDVS+pDAgr4ZsQ=; b=QLugTyZkPruDd9vynmZhmOJZnm7gmZolJ9KZIHeIYUwlXl2CKd+0c/G6Tt5JuqNAXx J3U0BCrWEig8ru5xdKSNSoW1cYxckUlNDZeS/C/3YWs5PrlgzfIH8etzwaoQRIZxp0i6 xuTh4W6WwoQz23qsrIgZOR3JgyVjqLhb5//z007MTCput/fpnD2GVI8rHxzaROUKSRte dzdTqGByNDQ63yUul+PnVpk5vDvjWF1z/CVHg2aQK+pJNnCl531wgeDK5yiQ+KED4zOK WnjRH0BreavXXjRANEqHamVlXWEhCdsu+2mgrHMNgpMXmGfWI/x1zQ8seWJBJ4Z06May I3Gg== X-Gm-Message-State: APjAAAWqwmvDRh78bgEYAUJPxtlqvL9KyenBaVG369GK9PxUp+EUP00k vkJiSI2Ztz/0mqEKscMYzbtHFUI9bCOgacnKDJ5gWQ== X-Google-Smtp-Source: APXvYqxIpZHI6O0J5G/dGmlBS9lEZv1k553zyztzMSxiPUTNgYH7F1+oOfGlYd/3t6rT2V+R6kzwjf1W7J1ildzRcj8= X-Received: by 2002:ac2:51a3:: with SMTP id f3mr13652154lfk.94.1564067845708; Thu, 25 Jul 2019 08:17:25 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> <20190725142135.0FFA715BD17B@fafnir.remote.dragon.net> <20190725144039.0A57D15BD9C7@fafnir.remote.dragon.net> In-Reply-To: From: Eric Rescorla Date: Thu, 25 Jul 2019 08:16:48 -0700 Message-ID: To: Paul Wouters Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000593058058e82ec84" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 15:17:30 -0000 --000000000000593058058e82ec84 Content-Type: text/plain; charset="UTF-8" I think we're now entering territory that we've gone over before and that is largely off topic for this list. so I'm going to opt not to revisit it. -Ekr On Thu, Jul 25, 2019 at 8:00 AM Paul Wouters wrote: > On Thu, 25 Jul 2019, Eric Rescorla wrote: > > > For context, our breakage budget here is very small: any change to > clients which causes connection error > > rates to increase by more than fractions of a percent is not really > something we can deploy. > > What percentage of hijacked connections due to maliciously modified DNS > is within your breakage budget? In other words, how do you balance security > versus user convenience? A certificate that has expired only two hours > ago seem to be fine to hard fail on. But a broken DNS transport is not? > > There is a bit of interaction here. People messing (or neglecting) > their DNS of endusers might do this less if they get flagged in common > browsers for doing so. Of course I symphatize with you that you do not > want that to become your problem. But how long are we kicking this > can down the road? > > Everything on the internet should be authenticated. We keep delaying > this as a hard requirement for DNS only, for increasingly less convincing > reasons. > > Paul > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000593058058e82ec84 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    I think we're now entering territory that we'= ve gone over before and that is largely off topic for this list. so I'm= going to opt not to revisit it.

    -Ekr


    On Thu, Jul 25, 2019 at 8:00 AM Paul Wouters <paul@nohats.ca> wrote:
    On Thu, 25 Jul 2019, Eric Rescorla wrote:

    > For context, our breakage budget here is very small: any change to cli= ents which causes connection error
    > rates to increase by more than fractions of a percent is not really so= mething we can deploy.

    What percentage of hijacked connections due to maliciously modified DNS
    is within your breakage budget? In other words, how do you balance security=
    versus user convenience? A certificate that has expired only two hours
    ago seem to be fine to hard fail on. But a broken DNS transport is not?

    There is a bit of interaction here. People messing (or neglecting)
    their DNS of endusers might do this less if they get flagged in common
    browsers for doing so. Of course I symphatize with you that you do not
    want that to become your problem. But how long are we kicking this
    can down the road?

    Everything on the internet should be authenticated. We keep delaying
    this as a hard requirement for DNS only, for increasingly less convincing reasons.

    Paul

    --
    Add mailing list
    Add@ietf.org
    https://www.ietf.org/mailman/listinfo/add
    --000000000000593058058e82ec84-- From nobody Thu Jul 25 08:19:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31325120183 for ; Thu, 25 Jul 2019 08:19:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zWFfHLeuyZ0z for ; Thu, 25 Jul 2019 08:19:30 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110052.outbound.protection.outlook.com [40.107.11.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B39212014E for ; Thu, 25 Jul 2019 08:19:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=A6yPyatjhpVlMZem4Nbbw+npEgGcbmtsrplwkGtEO7cWK4Y7Ar4+s0bspp0tOfMHswaiUnTlhDNLn+4UUy51JXIobTcxwmyRc+tCIy1L3TJSj4Bz3s4aqc4qHuejvdE1nGta/dCn0qdW6heVKq5rKaff1++lu9G31OfYOCzp7ao4N+IPuRdjNDn4BzxKrbwnRoFmBp2PUYohz+AnlUmN6IP1lXTzB8on2XwDiJ4vPOoLzHMSryiGICULTLbuc/0uT6yiunyYO7OQ4VIiFTMPS3DgV+ss7XlKOWdX+ssjCO1oYhH/RO5MVXdiM9cZ5Ln8E3ZyKZ0cc336NmZM2HalPA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Q2v2Fo/ixz5hLjqSNUF8K7xBC9xY0y46o7PK8x3Eahk=; b=jKPRdM79y+dfltsYLcuycojga0dwDizT3U8gaJvM2Mvfu3jB+zw7fBu1dm+XWzzbz8dea2off3mTsFVS8SobvEHCVrC44gXxuSHLm9OEXRgMwDRUL0LQcgSqilKqpfkxMTIA46hmNbOiVvNyt2Xd42jfebCNH7NbCe8E7RskBy2wp9mpe0pF78ggPavEmytQEOam/uSRIGz4ATDL/5J2qNQMxC+N0SjY4ii+c7s86MiA3NeNBBA1lEaTNsCkoSu2CjEGqzBVCWHhXT79t5j6B2b4822ZDSzecFFyw6CZceFHOYCsKAy3IV4p0pE1GJFui4x2JnfiWq/yiaw9cpYZqA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Q2v2Fo/ixz5hLjqSNUF8K7xBC9xY0y46o7PK8x3Eahk=; b=TbrtFAXM/7t0dCIMC1AFCgydmlIpQ1VHqV/iRUyjUpfc5nL80WIQD2/97rPiD9DNMS1TPpMwlyU8y4v8cSx0+KrOFYQ1RA5H5WYH7dQRrKuoFM/VTHhzAGEofK6QBzVsLOvslW32SopOPaQQ0irbsgWrhB+Vo1lz3y+V3w5FYmQ= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1232.GBRP265.PROD.OUTLOOK.COM (20.176.142.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.17; Thu, 25 Jul 2019 15:19:27 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2094.013; Thu, 25 Jul 2019 15:19:27 +0000 From: Andrew Campling To: Adam Roach CC: "add@ietf.org" , "neil.cook@open-xchange.com" Thread-Topic: [Add] meeting hum: should the IETF take up this work? Thread-Index: AQHVQvQ3hyEXUjk430e+e4o5zbaPCqbbaiGg Date: Thu, 25 Jul 2019 15:19:27 +0000 Message-ID: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:4c4d:3a84:6d17:cecf] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 11343d39-6637-4ecb-88e4-08d711137bce x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1232; x-ms-traffictypediagnostic: LO2P265MB1232: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0109D382B0 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(34096005)(346002)(376002)(136003)(39830400003)(366004)(396003)(13464003)(189003)(199004)(51444003)(54906003)(966005)(74316002)(508600001)(6116002)(186003)(305945005)(33656002)(229853002)(66556008)(25786009)(11346002)(6916009)(316002)(446003)(14444005)(7696005)(256004)(64756008)(30864003)(6506007)(6246003)(53546011)(76176011)(66476007)(476003)(52536014)(5660300002)(76116006)(66446008)(102836004)(8936002)(81166006)(66946007)(81156014)(99286004)(4326008)(486006)(86362001)(68736007)(55016002)(6306002)(2906002)(14454004)(8676002)(71200400001)(46003)(44832011)(71190400001)(66574012)(53936002)(6436002)(9686003)(7736002)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1232; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: PfyHIfSRp6BOdVhGgM/GwL9ajoOZ727bor3uXuCkJNM6XHdASNdhgE45g+2Uc96Z0RC+d+o/vkYPWiLt8Q0ptw+R2/ASjfHIZ48gjVEAOI7YQxdBU6eYDQl54DiGhSBJMnl49vlIufWgiWnsr4nspyfjmcYiB0UfLneCgGMahVjvAJ5IgpYh/4W4VJEGKGmLZSvE+uzJ8/+e2jJcldhTh3yX8klG13cpldGg1Yzmwz/pC0004rp3LInPjRCvVWa5NozjCn6fZeV6z4n9pQuMAFzxFDPwMcErwDqz4w9g6Q9XAEMMrz84TnFSMAKby5a4FqH4xe0uT7Dxwa+6E1jsUuArhcIL8aowo9dyx5/PtJKQyZrl6g/r3xp1eJOhDLk2qQrIKYU81kn3gYFuRsjeQE+yW/2if0YBbVtzUDLEEJ4= Content-Type: multipart/alternative; boundary="_000_LO2P265MB13270867DB8A0F2614B46263C2C10LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 11343d39-6637-4ecb-88e4-08d711137bce X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jul 2019 15:19:27.3589 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1232 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 15:19:39 -0000 --_000_LO2P265MB13270867DB8A0F2614B46263C2C10LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QWRhbQ0KWW91IHJpZ2h0bHkgbWVudGlvbiB0aGUgcHJvdGVjdGlvbnMgb2ZmZXJlZCBieSB0aGUg Q2xvdWRmbGFyZSBwcml2YWN5IHBvbGljeSBhbmQgTW96aWxsYSdzIGNvbnRyYWN0IHdpdGggQ2xv dWRmbGFyZS4gIFRoZSB0b3BpY2FsIHJlZmVyZW5jZSB0byBGYWNlYm9vayBzaG91bGQgc2VydmUg YXMgYSB0aW1lbHkgcmVtaW5kZXIgYWJvdXQgdGhlIGdyb3dpbmcgaW1wb3J0YW5jZSBvZiBwcml2 YWN5IGFzIHdlbGwgYXMgYSB1c2VmdWwgaWxsdXN0cmF0aW9uIHRoYXQgd2VsbC1pbnRlbnRpb25l ZCBwcml2YWN5IHBvbGljaWVzIGNhbiBvZnRlbiBiZSBieS1wYXNzZWQgb3IgdW5kZXJtaW5lZC4N Cg0KR2l2ZW4geW91ciBjb21tZW50IHRvIE5laWwsIEkgdGhpbmsgdGhhdCBpdCB3b3VsZCBiZSBp bmNyZWRpYmx5IGhlbHBmdWwgdG8gaGF2ZSB5b3VyIHRob3VnaHRzIG9uIHRoZSBmb2xsb3dpbmcg cG9pbnRzOg0KDQrigKIgICAgICAgV2lsbCBhbGwgcmVzb2x2ZXJzIGFjY2Vzc2libGUgd2l0aGlu IE1vemlsbGEncyBUUlIgcG9saWN5IGhhdmUgYSBjb250cmFjdHVhbCByZWxhdGlvbnNoaXAgd2l0 aCB0aGUgY29tcGFueSB0byBwcm92aWRlIHRoaXMgYWRkaXRpb25hbCBsYXllciBvZiBwcm90ZWN0 aW9uPw0K4oCiICAgICAgIEluIEV1cm9wZSwgRE5TIGNvbnN0aXR1dGVzIHBlcnNvbmFsIGRhdGEg YW5kIHRoZXJlZm9yZSBuZWVkcyB0byBiZSBwcm9jZXNzZWQgaW4gY29tcGxpYW5jZSB3aXRoIEdE UFIgLSBJIGRpZG4ndCBub3RpY2UgYSBkaXJlY3QgcmVmZXJlbmNlIHRvIHRoaXMgaW4gdGhlIHBy aXZhY3kgcG9saWNpZXMsIGFwb2xvZ2llcyBpZiBJJ3ZlIG1pc3NlZCBpdDsNCuKAoiAgICAgICBG b3Igbm9uLVVTIGNpdGl6ZW5zICJyZWFzb25hYmx5IGJlbGlldmVkIHRvIGJlIG91dHNpZGUgdGhl IFVTIiwgRklTQSBTZWN0aW9uIDcwMiBvZiBjb3Vyc2Ugb3ZlcnJpZGVzIHRoZSBzdGF0ZWQgcHJp dmFjeSBwb2xpY2llcyBvZiBib3RoIE1vemlsbGEgYW5kIENsb3VkZmxhcmUgKHRoaXMgaXMgbm90 IGEgY3JpdGljaXNtLCBzaW1wbHkgYSBjbGFyaWZpY2F0aW9uKSwgaGFzIGdsb2JhbCByZWFjaCB3 aGVuIGNvbWJpbmVkIHdpdGggdGhlIENsb3VkIEFjdC4NCg0KSSB0aGluayB3ZSBzaG91bGQgYWxs IGJlYXIgaW4gbWluZCB0aGF0IERvSCBkb2VzIG9mIGNvdXJzZSBoYXZlIHRoZSBwb3RlbnRpYWwg dG8gcHJvdmlkZSBhIGNvbnRpZ3VvdXMsIGRldmljZSBsZXZlbCBmaW5nZXJwcmludCB0byB0aGUg RG9IIHJlc29sdmVyLCBpcyBhIGJhY2t3YXJkIHN0ZXAgZm9yIHByaXZhY3kgaW4gdGhhdCByZWdh cmQgdnMgYm90aCBEb1QgYW5kIEROUzUzLiAgSW4gbXkgdmlldyB0aGlzIGRvZXMgaGVscGZ1bGx5 IGlsbHVzdHJhdGUgdGhhdCBlbmNyeXB0aW9uIGFuZCBwcml2YWN5IGFyZSBub3Qgc3lub255bW91 cyDigJMgbm8gZG91YnQgb3RoZXJzIHdpbGwgaGF2ZSB0aGVpciBvd24gdmlld3MuDQoNCg0KQW5k cmV3DQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBBZGFtIFJvYWNoIDxhZGFt QG5vc3RydW0uY29tPg0KU2VudDogMjUgSnVseSAyMDE5IDE1OjEyDQpUbzogTmVpbCBDb29rIDxu ZWlsLmNvb2s9NDBvcGVuLXhjaGFuZ2UuY29tQGRtYXJjLmlldGYub3JnPjsgU3RlcGhhbmUgQm9y dHptZXllciA8Ym9ydHptZXllckBuaWMuZnI+DQpDYzogSmltIFJlaWQgPGppbUByZmMxMDM1LmNv bT47IGFkZEBpZXRmLm9yZzsgUm9iIFNheXJlIDxzYXlyZXJAZ21haWwuY29tPg0KU3ViamVjdDog UmU6IFtBZGRdIG1lZXRpbmcgaHVtOiBzaG91bGQgdGhlIElFVEYgdGFrZSB1cCB0aGlzIHdvcms/ DQoNCk9uIDcvMjUvMTkgMDM6NTcsIE5laWwgQ29vayB3cm90ZToNCj4gQnV0IGxldOKAmXMgc2F5 IEkgZGVjaWRlIHRvIHJ1biBteSBvd24gbm9uLXB1YmxpYyBEb0ggIHJlc29sdmVyIG9uIG15DQo+ IG5ldHdvcmsgYXQgaG9tZS4gRmlyZWZveCB3b27igJl0IGhhdmUgaXQgb24gdGhlaXIgbGlzdCBv ZiBUUlJzLCBhbmQgaWYNCj4gYXMgeW91IHN1Z2dlc3QsIHRoZSBkaXNjb3ZlcnkgZHJhZnRzIGFy ZSBwb2ludGxlc3MgYW5kIHNvIGRvbuKAmXQNCj4gcHJvY2VlZCwgbm8gYXBwbGljYXRpb24gd2ls bCBldmVyIGZpbmQgb3V0IGFib3V0IGl0LCB1bmxlc3MgSQ0KPiBjb25maWd1cmUgaXQgbWFudWFs bHkgb24gZXZlcnkgc2luZ2xlIGFwcGxpY2F0aW9uIGFuZCBjb21wdXRlciBpbiBteQ0KPiBob3Vz ZSAobm90IGV2ZW4gbWVudGlvbmluZyB0aG9zZSBJb1QgZGV2aWNlcyB0aGF0IEkgY2Fu4oCZdCBj b25maWd1cmUpLg0KPg0KPiBJdCBpcyBhbHNvIHBvc3NpYmxlIHRoYXQgd2UgZW5kIHVwIHdpdGgg YSBsYXJnZSBudW1iZXIgb2YgcHVibGljIERvSA0KPiByZXNvbHZlcnMgd2hpY2ggbWluZSB5b3Vy IHBlcnNvbmFsIGRhdGEgZm9yIHByb2ZpdC4gR2l2ZW4gdGhlIGN1cnJlbnQNCj4gYnVzaW5lc3Mg bW9kZWwgb2YgdGhlIGludGVybmV0IHRoYXQgaXMgZW50aXJlbHkgcG9zc2libGUuDQoNCg0KU2lu Y2UgeW91IG1lbnRpb24gRmlyZWZveCdzIFRSUiBsaXN0IGFuZCB0aGVuIG1lbnRpb24gZGF0YSBt aW5pbmcgKHdpdGggYW4gaW1wbGllZCBjb25uZWN0aW9uKSwgSSdkIGxpa2UgdG8gcG9pbnQgb3V0 IHlldCBhZ2FpbiB0aGF0IG9uZSBvZiB0aGUga2V5IGNyaXRlcmlhIGZvciBhcHBlYXJpbmcgb24g dGhhdCBsaXN0IGlzIGFuIGFncmVlbWVudCB0byB0cmVhdCByZXNvbHV0aW9uIGRhdGEgYWNjb3Jk aW5nIHRvIGEgc3RyaWN0IHNldCBvZiBwcml2YWN5LXByb3RlY3RpbmcgcHJvdmlzaW9ucy4gWW91 IGNhbiBzZWUsIGZvciBleGFtcGxlLCBDbG91ZGZsYXJlJ3MgYXNzb2NpYXRlZCBwcml2YWN5IHBv bGljeSBhdCBodHRwczovL2RldmVsb3BlcnMuY2xvdWRmbGFyZS5jb20vMS4xLjEuMS9jb21taXRt ZW50LXRvLXByaXZhY3kvcHJpdmFjeS1wb2xpY3kvZmlyZWZveC8NCg0KSSdtIGdvaW5nIHRvIHBy ZS1yZXBseSB0byBhIGZyZXF1ZW50IHJlc3BvbnNlIHRoYXQgdGhlIGxhY2sgb2YgZGlyZWN0IGNv bnRyYWN0dWFsIHJlbGF0aW9uc2hpcCBiZXR3ZWVuIHVzZXJzIGFuZCBDbG91ZGZsYXJlIGlzIHBy b2JsZW1hdGljLg0KRXZlbiBpZiB5b3UgZG9uJ3QgdHJ1c3QgTW96aWxsYSdzIGNvbnRyYWN0dWFs IGFncmVlbWVudCB3aXRoIENsb3VkZmxhcmUgdG8gcHJvdmlkZSBwcm90ZWN0aW9uIGhlcmUsIEkg d291bGQgdGhpbmsgdGhhdCBGVEMgdi4gRmFjZWJvb2sgKDIwMTkpIFsxXSBzaG91bGQgc2VydmUg YXMgYSBwcmV0dHkgdml2aWQgaWxsdXN0cmF0aW9uIG9mIHdoYXQgaGFwcGVucyB3aGVuIGEgVVMg Y29tcGFueSBvcGVyYXRlcyBvdXRzaWRlIGl0cyBwdWJsaXNoZWQgcHJpdmFjeSBwb2xpY3kuDQoN Ci9hDQoNCl9fX18NClsxXQ0KaHR0cHM6Ly93d3cuZnRjLmdvdi9uZXdzLWV2ZW50cy9wcmVzcy1y ZWxlYXNlcy8yMDE5LzA3L2Z0Yy1pbXBvc2VzLTUtYmlsbGlvbi1wZW5hbHR5LXN3ZWVwaW5nLW5l dy1wcml2YWN5LXJlc3RyaWN0aW9ucw0KDQoNCg0K --_000_LO2P265MB13270867DB8A0F2614B46263C2C10LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVu dD0iTWljcm9zb2Z0IEV4Y2hhbmdlIFNlcnZlciI+DQo8IS0tIGNvbnZlcnRlZCBmcm9tIHJ0ZiAt LT4NCjxzdHlsZT48IS0tIC5FbWFpbFF1b3RlIHsgbWFyZ2luLWxlZnQ6IDFwdDsgcGFkZGluZy1s ZWZ0OiA0cHQ7IGJvcmRlci1sZWZ0OiAjODAwMDAwIDJweCBzb2xpZDsgfSAtLT48L3N0eWxlPg0K PC9oZWFkPg0KPGJvZHk+DQo8Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iIHNpemU9IjMiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTJwdDsiPjxhIG5hbWU9Il9NYWlsRW5kQ29tcG9zZSI+PC9h Pg0KPGRpdj48Zm9udCBmYWNlPSJDYWxpYnJpIiBzaXplPSIzIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEycHQ7Ij48Yj5BZGFtPC9iPjwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxmb250IGZh Y2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTJwdDsiPllvdSBy aWdodGx5IG1lbnRpb24gdGhlIHByb3RlY3Rpb25zIG9mZmVyZWQgYnkgdGhlIENsb3VkZmxhcmUg cHJpdmFjeSBwb2xpY3kgYW5kIE1vemlsbGEncyBjb250cmFjdCB3aXRoIENsb3VkZmxhcmUuJm5i c3A7IFRoZSB0b3BpY2FsIHJlZmVyZW5jZSB0byBGYWNlYm9vayBzaG91bGQgc2VydmUgYXMgYSB0 aW1lbHkgcmVtaW5kZXIgYWJvdXQNCnRoZSBncm93aW5nIGltcG9ydGFuY2Ugb2YgcHJpdmFjeSBh cyB3ZWxsIGFzIGEgdXNlZnVsIGlsbHVzdHJhdGlvbiB0aGF0IHdlbGwtaW50ZW50aW9uZWQgcHJp dmFjeSBwb2xpY2llcyBjYW4gb2Z0ZW4gYmUgYnktcGFzc2VkIG9yIHVuZGVybWluZWQuJm5ic3A7 IDwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxmb250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTJwdDsiPiZuYnNwOzwvc3Bhbj48L2ZvbnQ+PC9kaXY+ DQo8ZGl2Pjxmb250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTJwdDsiPkdpdmVuIHlvdXIgY29tbWVudCB0byBOZWlsLCBJIHRoaW5rIHRoYXQgaXQgd291 bGQgYmUgaW5jcmVkaWJseSBoZWxwZnVsIHRvIGhhdmUgeW91ciB0aG91Z2h0cyBvbiB0aGUgZm9s bG93aW5nIHBvaW50czo8L3NwYW4+PC9mb250PjwvZGl2Pg0KPGRpdj48Zm9udCBmYWNlPSJDYWxp YnJpIiBzaXplPSIzIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEycHQ7Ij4mbmJzcDs8L3NwYW4+ PC9mb250PjwvZGl2Pg0KPHVsIHN0eWxlPSJtYXJnaW46MDtwYWRkaW5nLWxlZnQ6MThwdDsiPg0K PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0 OyI+DQo8bGk+V2lsbCBhbGwgcmVzb2x2ZXJzIGFjY2Vzc2libGUgd2l0aGluIE1vemlsbGEncyBU UlIgcG9saWN5IGhhdmUgYSBjb250cmFjdHVhbCByZWxhdGlvbnNoaXAgd2l0aCB0aGUgY29tcGFu eSB0byBwcm92aWRlIHRoaXMgYWRkaXRpb25hbCBsYXllciBvZiBwcm90ZWN0aW9uPzwvbGk+PGxp PkluIEV1cm9wZSwgRE5TIGNvbnN0aXR1dGVzIHBlcnNvbmFsIGRhdGEgYW5kIHRoZXJlZm9yZSBu ZWVkcyB0byBiZSBwcm9jZXNzZWQgaW4gY29tcGxpYW5jZSB3aXRoIEdEUFIgLSBJIGRpZG4ndCBu b3RpY2UgYSBkaXJlY3QgcmVmZXJlbmNlIHRvIHRoaXMgaW4gdGhlIHByaXZhY3kgcG9saWNpZXMs IGFwb2xvZ2llcyBpZiBJJ3ZlIG1pc3NlZCBpdDsmbmJzcDsgPC9saT48bGk+Rm9yIG5vbi1VUyBj aXRpemVucyAmcXVvdDtyZWFzb25hYmx5IGJlbGlldmVkIHRvIGJlIG91dHNpZGUgdGhlIFVTJnF1 b3Q7LCBGSVNBIFNlY3Rpb24gNzAyIG9mIGNvdXJzZSBvdmVycmlkZXMgdGhlIHN0YXRlZCBwcml2 YWN5IHBvbGljaWVzIG9mIGJvdGggTW96aWxsYSBhbmQgQ2xvdWRmbGFyZSAodGhpcyBpcyA8dT5u b3Q8L3U+IGEgY3JpdGljaXNtLCBzaW1wbHkgYSBjbGFyaWZpY2F0aW9uKSwgaGFzIGdsb2JhbCBy ZWFjaCB3aGVuIGNvbWJpbmVkIHdpdGgNCnRoZSBDbG91ZCBBY3QuPC9saT48L3NwYW4+PC9mb250 Pg0KPC91bD4NCjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMnB0OyI+Jm5ic3A7PC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQg ZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+SSB0 aGluayB3ZSBzaG91bGQgYWxsIGJlYXIgaW4gbWluZCB0aGF0IERvSCBkb2VzIG9mIGNvdXJzZSBo YXZlIHRoZSBwb3RlbnRpYWwgdG8gcHJvdmlkZSBhIGNvbnRpZ3VvdXMsIGRldmljZSBsZXZlbCBm aW5nZXJwcmludCB0byB0aGUgRG9IIHJlc29sdmVyLCBpcyBhIGJhY2t3YXJkIHN0ZXAgZm9yIHBy aXZhY3kgaW4gdGhhdCByZWdhcmQNCnZzIGJvdGggRG9UIGFuZCBETlM1My4mbmJzcDsgSW4gbXkg dmlldyB0aGlzIGRvZXMgaGVscGZ1bGx5IGlsbHVzdHJhdGUgdGhhdCBlbmNyeXB0aW9uIGFuZCBw cml2YWN5IGFyZSBub3Qgc3lub255bW91cyDigJMgbm8gZG91YnQgb3RoZXJzIHdpbGwgaGF2ZSB0 aGVpciBvd24gdmlld3MuJm5ic3A7Jm5ic3A7Jm5ic3A7IDwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8 ZGl2Pjxmb250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTJwdDsiPiZuYnNwOzwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxmb250IGZhY2U9IkNhbGli cmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTJwdDsiPiZuYnNwOzwvc3Bhbj48 L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxmb250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTJwdDsiPjxiPkFuZHJldyA8L2I+PC9zcGFuPjwvZm9udD48L2Rpdj4N CjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMnB0OyI+Jm5ic3A7PC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0iQ2Fs aWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+LS0tLS1PcmlnaW5h bCBNZXNzYWdlLS0tLS08YnI+DQoNCkZyb206IEFkYW0gUm9hY2ggJmx0O2FkYW1Abm9zdHJ1bS5j b20mZ3Q7IDxicj4NCg0KU2VudDogMjUgSnVseSAyMDE5IDE1OjEyPGJyPg0KDQpUbzogTmVpbCBD b29rICZsdDtuZWlsLmNvb2s9NDBvcGVuLXhjaGFuZ2UuY29tQGRtYXJjLmlldGYub3JnJmd0Ozsg U3RlcGhhbmUgQm9ydHptZXllciAmbHQ7Ym9ydHptZXllckBuaWMuZnImZ3Q7PGJyPg0KDQpDYzog SmltIFJlaWQgJmx0O2ppbUByZmMxMDM1LmNvbSZndDs7IGFkZEBpZXRmLm9yZzsgUm9iIFNheXJl ICZsdDtzYXlyZXJAZ21haWwuY29tJmd0Ozxicj4NCg0KU3ViamVjdDogUmU6IFtBZGRdIG1lZXRp bmcgaHVtOiBzaG91bGQgdGhlIElFVEYgdGFrZSB1cCB0aGlzIHdvcms/PC9zcGFuPjwvZm9udD48 L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMnB0OyI+Jm5ic3A7PC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFj ZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+T24gNy8y NS8xOSAwMzo1NywgTmVpbCBDb29rIHdyb3RlOjwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxm b250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTJwdDsi PiZndDsgQnV0IGxldOKAmXMgc2F5IEkgZGVjaWRlIHRvIHJ1biBteSBvd24gbm9uLXB1YmxpYyBE b0ggJm5ic3A7cmVzb2x2ZXIgb24gbXkgPC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQg ZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+Jmd0 OyBuZXR3b3JrIGF0IGhvbWUuIEZpcmVmb3ggd29u4oCZdCBoYXZlIGl0IG9uIHRoZWlyIGxpc3Qg b2YgVFJScywgYW5kIGlmIDwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxmb250IGZhY2U9IkNh bGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTJwdDsiPiZndDsgYXMgeW91 IHN1Z2dlc3QsIHRoZSBkaXNjb3ZlcnkgZHJhZnRzIGFyZSBwb2ludGxlc3MgYW5kIHNvIGRvbuKA mXQgPC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0i MyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+Jmd0OyBwcm9jZWVkLCBubyBhcHBsaWNh dGlvbiB3aWxsIGV2ZXIgZmluZCBvdXQgYWJvdXQgaXQsIHVubGVzcyBJIDwvc3Bhbj48L2ZvbnQ+ PC9kaXY+DQo8ZGl2Pjxmb250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTJwdDsiPiZndDsgY29uZmlndXJlIGl0IG1hbnVhbGx5IG9uIGV2ZXJ5IHNpbmds ZSBhcHBsaWNhdGlvbiBhbmQgY29tcHV0ZXIgaW4gbXkgPC9zcGFuPjwvZm9udD48L2Rpdj4NCjxk aXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MnB0OyI+Jmd0OyBob3VzZSAobm90IGV2ZW4gbWVudGlvbmluZyB0aG9zZSBJb1QgZGV2aWNlcyB0 aGF0IEkgY2Fu4oCZdCBjb25maWd1cmUpLjwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxmb250 IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTJwdDsiPiZn dDs8L3NwYW4+PC9mb250PjwvZGl2Pg0KPGRpdj48Zm9udCBmYWNlPSJDYWxpYnJpIiBzaXplPSIz Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEycHQ7Ij4mZ3Q7IEl0IGlzIGFsc28gcG9zc2libGUg dGhhdCB3ZSBlbmQgdXAgd2l0aCBhIGxhcmdlIG51bWJlciBvZiBwdWJsaWMgRG9IIDwvc3Bhbj48 L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxmb250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTJwdDsiPiZndDsgcmVzb2x2ZXJzIHdoaWNoIG1pbmUgeW91ciBwZXJz b25hbCBkYXRhIGZvciBwcm9maXQuIEdpdmVuIHRoZSBjdXJyZW50IDwvc3Bhbj48L2ZvbnQ+PC9k aXY+DQo8ZGl2Pjxmb250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTJwdDsiPiZndDsgYnVzaW5lc3MgbW9kZWwgb2YgdGhlIGludGVybmV0IHRoYXQgaXMg ZW50aXJlbHkgcG9zc2libGUuPC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0i Q2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+Jm5ic3A7PC9z cGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+Jm5ic3A7PC9zcGFuPjwvZm9udD48L2Rpdj4NCjxk aXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MnB0OyI+U2luY2UgeW91IG1lbnRpb24gRmlyZWZveCdzIFRSUiBsaXN0IGFuZCB0aGVuIG1lbnRp b24gZGF0YSBtaW5pbmcgKHdpdGggYW4gaW1wbGllZCBjb25uZWN0aW9uKSwgSSdkIGxpa2UgdG8g cG9pbnQgb3V0IHlldCBhZ2FpbiB0aGF0IG9uZSBvZiB0aGUga2V5IGNyaXRlcmlhIGZvciBhcHBl YXJpbmcgb24gdGhhdCBsaXN0IGlzIGFuIGFncmVlbWVudA0KdG8gdHJlYXQgcmVzb2x1dGlvbiBk YXRhIGFjY29yZGluZyB0byBhIHN0cmljdCBzZXQgb2YgcHJpdmFjeS1wcm90ZWN0aW5nIHByb3Zp c2lvbnMuIFlvdSBjYW4gc2VlLCBmb3IgZXhhbXBsZSwgQ2xvdWRmbGFyZSdzIGFzc29jaWF0ZWQg cHJpdmFjeSBwb2xpY3kgYXQgPGEgaHJlZj0iaHR0cHM6Ly9kZXZlbG9wZXJzLmNsb3VkZmxhcmUu Y29tLzEuMS4xLjEvY29tbWl0bWVudC10by1wcml2YWN5L3ByaXZhY3ktcG9saWN5L2ZpcmVmb3gv Ij5odHRwczovL2RldmVsb3BlcnMuY2xvdWRmbGFyZS5jb20vMS4xLjEuMS9jb21taXRtZW50LXRv LXByaXZhY3kvcHJpdmFjeS1wb2xpY3kvZmlyZWZveC88L2E+PC9zcGFuPjwvZm9udD48L2Rpdj4N CjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMnB0OyI+Jm5ic3A7PC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0iQ2Fs aWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+SSdtIGdvaW5nIHRv IHByZS1yZXBseSB0byBhIGZyZXF1ZW50IHJlc3BvbnNlIHRoYXQgdGhlIGxhY2sgb2YgZGlyZWN0 IGNvbnRyYWN0dWFsIHJlbGF0aW9uc2hpcCBiZXR3ZWVuIHVzZXJzIGFuZCBDbG91ZGZsYXJlIGlz IHByb2JsZW1hdGljLiA8L3NwYW4+PC9mb250PjwvZGl2Pg0KPGRpdj48Zm9udCBmYWNlPSJDYWxp YnJpIiBzaXplPSIzIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEycHQ7Ij5FdmVuIGlmIHlvdSBk b24ndCB0cnVzdCBNb3ppbGxhJ3MgY29udHJhY3R1YWwgYWdyZWVtZW50IHdpdGggQ2xvdWRmbGFy ZSB0byBwcm92aWRlIHByb3RlY3Rpb24gaGVyZSwgSSB3b3VsZCB0aGluayB0aGF0IEZUQyB2LiBG YWNlYm9vayAoMjAxOSkgWzFdIHNob3VsZCBzZXJ2ZSBhcyBhIHByZXR0eSB2aXZpZCBpbGx1c3Ry YXRpb24gb2YNCndoYXQgaGFwcGVucyB3aGVuIGEgVVMgY29tcGFueSBvcGVyYXRlcyBvdXRzaWRl IGl0cyBwdWJsaXNoZWQgcHJpdmFjeSBwb2xpY3kuPC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+ PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0 OyI+Jm5ic3A7PC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIg c2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+L2E8L3NwYW4+PC9mb250Pjwv ZGl2Pg0KPGRpdj48Zm9udCBmYWNlPSJDYWxpYnJpIiBzaXplPSIzIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEycHQ7Ij4mbmJzcDs8L3NwYW4+PC9mb250PjwvZGl2Pg0KPGRpdj48Zm9udCBmYWNl PSJDYWxpYnJpIiBzaXplPSIzIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEycHQ7Ij5fX19fPC9z cGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+WzFdPC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+ PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0 OyI+PGEgaHJlZj0iaHR0cHM6Ly93d3cuZnRjLmdvdi9uZXdzLWV2ZW50cy9wcmVzcy1yZWxlYXNl cy8yMDE5LzA3L2Z0Yy1pbXBvc2VzLTUtYmlsbGlvbi1wZW5hbHR5LXN3ZWVwaW5nLW5ldy1wcml2 YWN5LXJlc3RyaWN0aW9ucyI+aHR0cHM6Ly93d3cuZnRjLmdvdi9uZXdzLWV2ZW50cy9wcmVzcy1y ZWxlYXNlcy8yMDE5LzA3L2Z0Yy1pbXBvc2VzLTUtYmlsbGlvbi1wZW5hbHR5LXN3ZWVwaW5nLW5l dy1wcml2YWN5LXJlc3RyaWN0aW9uczwvYT48L3NwYW4+PC9mb250PjwvZGl2Pg0KPGRpdj48Zm9u dCBmYWNlPSJDYWxpYnJpIiBzaXplPSIzIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEycHQ7Ij4m bmJzcDs8L3NwYW4+PC9mb250PjwvZGl2Pg0KPGRpdj48Zm9udCBmYWNlPSJDYWxpYnJpIiBzaXpl PSIzIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEycHQ7Ij4mbmJzcDs8L3NwYW4+PC9mb250Pjwv ZGl2Pg0KPGRpdj48Zm9udCBmYWNlPSJDYWxpYnJpIiBzaXplPSIzIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEycHQ7Ij4mbmJzcDs8L3NwYW4+PC9mb250PjwvZGl2Pg0KPC9zcGFuPjwvZm9udD4N CjwvYm9keT4NCjwvaHRtbD4NCg== --_000_LO2P265MB13270867DB8A0F2614B46263C2C10LO2P265MB1327GBRP_-- From nobody Thu Jul 25 08:21:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EB9712021B for ; Thu, 25 Jul 2019 08:21:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jqEpRMhGaQ9G for ; Thu, 25 Jul 2019 08:21:19 -0700 (PDT) Received: from mail-lj1-x232.google.com (mail-lj1-x232.google.com [IPv6:2a00:1450:4864:20::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F3001200CC for ; Thu, 25 Jul 2019 08:21:10 -0700 (PDT) Received: by mail-lj1-x232.google.com with SMTP id y17so23829128ljk.10 for ; Thu, 25 Jul 2019 08:21:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=W8nYeABYxSQSGRTktg2Uqscy5Qei3h2eErCy15eACeE=; b=pCAO2ArIGC64+XibM3Uw1BaN/BS2YAvPb84H/intY5biJfW0IJVQr2OQJNwv3Eo/n2 FhFU91G84IZDsHYkiuOdeZ0FPU4cFRi72nAlC/WT7Kkye4NozMUTRmeVOYhR5WeyI31J DbYsb85yTHPXkIzl86GGNf3b2OIP9k3E02CvnruVv6/KR7qsVTFGHdqjZ4SWxsjui1TA Em5AphWNAb0bt4IpITnzTRaeX7uJXII4v7ZuEOewqcG1yBis6TbW0YJ1KqyBH/39mq6L 8TFqQaikUMxiJPCOLtFJcE1j6Xpki2DPI9LrksX6Tfw4GfN3Lr3WoO6/Kfp5SDMlnR0J ymFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=W8nYeABYxSQSGRTktg2Uqscy5Qei3h2eErCy15eACeE=; b=VYp/WJ1ewERXl6YuxwArNnGj0JbLbL6uxItho1uBTgzdnJ0wqp+DAbIyJBousDt+Oe ffmDgttIK4i2AMReVrS3RCWEwt/7IE40C9GtutMe3iHz+zGWqoiQecAvLPeWjdOcscEf 7XEWtP++hFhv9kMgR7yq9Q6fzEzmAx88azJFWbhj1lSCSNUDnAlcoxGlOEemqrY1fyVI be4NqxZFvKx3Ci6k9uVd/Ck/JqL9FRcbjPIRTvAqEoj66a24vqgUIzGS9Q/mhsbON+i+ /PzYPm8bMACxzHowCrmKqykvPk48gsZE2BN21QirgxQOnlTP69WtOCbPARiMsyoYIh6K y7eg== X-Gm-Message-State: APjAAAXY3Dk317SwS8P86dACcbaxtCyvZWJXnXI0Q7SHA3+7xBTGg7Zw WS3WEdtzwyWfv9l3uG8hDSt/G9Q/UCn8Y2GqnSA= X-Google-Smtp-Source: APXvYqyVrFI9VAQc3+KQKemVdv4liddaA7aF7rZRxDtLH+8RdAZ3yUAe1E0sS5chyZT0y0FIa7gIMXQ5sstSMROyMEU= X-Received: by 2002:a2e:890a:: with SMTP id d10mr46819835lji.145.1564068068657; Thu, 25 Jul 2019 08:21:08 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> <20190725142135.0FFA715BD17B@fafnir.remote.dragon.net> In-Reply-To: From: Eric Rescorla Date: Thu, 25 Jul 2019 08:20:32 -0700 Message-ID: To: Brian Dickson Cc: Paul Ebersman , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000a322b7058e82f9e4" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 15:21:25 -0000 --000000000000a322b7058e82f9e4 Content-Type: text/plain; charset="UTF-8" On Thu, Jul 25, 2019 at 8:16 AM Brian Dickson wrote: > > > On Thu, Jul 25, 2019 at 10:29 AM Eric Rescorla wrote: > >> >> >> On Thu, Jul 25, 2019 at 7:21 AM Paul Ebersman >> wrote: >> >>> >>> jreid> Not really. A validation failure is a fairly strong indication >>> jreid> that the resolver is lying to you. >>> >>> ekr> Not really, no. Our current belief is that there is going to be >>> ekr> quite a high rate of non-malicious validation failures. >>> >>> What's the basis of this belief? >>> >>> When I was at comcast, query volumes on recursive were on order 500 >>> billion q/day and hard/persistant DNSSEC failures were on order of >>> dozens per month, so that seems like a pretty high success rate. >>> >> >> See my previous message. This is about middleboxes interfering with the >> DNS queries, which would not be visible to you from the vantage point of >> comcast's recursive resolver. >> >> -Ekr >> > > I'm confused by this reference to middleboxes and DNS. > > The presumed use case is Do* (DoH/DoT), where the middleboxes only see TLS > traffic, and absolutely have no ability to inspect or interfere with the > contents of DNS packets within those connections. > > If we remove the middlebox from the equation, how then do you maintain the > belief that "there is going to be quite a high rate of non-malicious > validation failures"? > > The other messages in this thread indicate an extremely low rate of DNSSEC > failures. > This thread has gotten quite long and hard to track. I was talking about the case where DoH was not present, and my point was that DNSSEC is not a replacement for DoH in the settings I am concerned with. I agree that DoH potentially makes end-user software DNSSEC validation viable, and that's something that at some point we might look at. -Ekr > Brian > --000000000000a322b7058e82f9e4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable



    On Thu, Jul 25, 2019 at 8:16 AM Brian Dickson <brian.peter.dickson@gmail.= com> wrote:


    On Thu, Jul 25, 2019 at 10:29 AM E= ric Rescorla <ekr@rtfm= .com> wrote:


    On Thu, Jul 25, 2019 at 7:21 AM P= aul Ebersman <l= ist-add@dragon.net> wrote:
    =C2=A0 =C2=A0 =C2=A0
    jreid> Not really. A validation failure is a fairly strong indication jreid> that the resolver is lying to you.

    ekr> Not really, no. Our current belief is that there is going to be
    ekr> quite a high rate of non-malicious validation failures.

    What's the basis of this belief?

    When I was at comcast, query volumes on recursive were on order 500
    billion q/day and hard/persistant DNSSEC failures were on order of
    dozens per month, so that seems like a pretty high success rate.

    See my previous message. This is about middleboxe= s interfering with the DNS queries, which would not be visible to you from = the vantage point of comcast's recursive resolver.

    -Ekr

    I'm con= fused by this reference to middleboxes and DNS.

    Th= e presumed use case is Do* (DoH/DoT), where the middleboxes only see TLS tr= affic, and absolutely have no ability to inspect or interfere with the cont= ents of DNS packets within those connections.

    If w= e remove the middlebox from the equation, how then do you maintain the beli= ef that "there is going to be quite a high rate of non-malicious valid= ation failures"?=C2=A0

    The other messages in = this thread indicate an extremely low rate of DNSSEC failures.
    <= /div>

    This thread has gotten quite long and= hard to track. I was talking about the case where DoH was not present, and= my point was that DNSSEC is not a replacement for DoH in the settings I am= concerned with.

    I agree that DoH potentially = makes end-user software DNSSEC validation viable, and that's something = that at some point we might look at.

    -Ekr


    Brian
    --000000000000a322b7058e82f9e4-- From nobody Thu Jul 25 08:28:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72341120183 for ; Thu, 25 Jul 2019 08:28:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.968 X-Spam-Level: X-Spam-Status: No, score=-1.968 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, T_KAM_HTML_FONT_INVALID=0.01, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S5T6Fr2uMWae for ; Thu, 25 Jul 2019 08:28:20 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B19F1200EC for ; Thu, 25 Jul 2019 08:28:11 -0700 (PDT) Received: from Orochi.local ([196.52.21.215]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x6PFS7Jt063539 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 25 Jul 2019 10:28:09 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1564068490; bh=vpOcr++tmhleGWFhmourdgeA3dHRvqEH53hKLezSu9w=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=WipdPzJaLQMeyQ+l7caDuy6PZx3ochmCvIw8B7um3h50hC3nUuIGY4K0R6UNheHh+ tkmmy3l8abnI98kskgUa/itETMwEt68tA0rIoaEFT9Gnpd6oChUL6uapqj76AeH7KW grRZH1cmZv+jo3sRx76BakR031akJAe1Elr/FXLM= X-Authentication-Warning: raven.nostrum.com: Host [196.52.21.215] claimed to be Orochi.local To: Vittorio Bertola Cc: add@ietf.org References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <2044195920.26849.1564066278788@appsuite-gw1.open-xchange.com> From: Adam Roach Message-ID: <74f7939c-10c8-6e31-c6e8-cd00e58ee558@nostrum.com> Date: Thu, 25 Jul 2019 11:28:07 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <2044195920.26849.1564066278788@appsuite-gw1.open-xchange.com> Content-Type: multipart/alternative; boundary="------------644F36481A635CF5C0879584" Content-Language: en-US Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 15:28:25 -0000 This is a multi-part message in MIME format. --------------644F36481A635CF5C0879584 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On 7/25/19 10:51, Vittorio Bertola wrote: > >> Il 25 luglio 2019 16:11 Adam Roach ha scritto: >> >> I'm going to pre-reply to a frequent response that the lack of direct >> contractual relationship between users and Cloudflare is problematic. >> Even if you don't trust Mozilla's contractual agreement with Cloudflare >> to provide protection here, I would think that FTC v. Facebook (2019) >> [1] should serve as a pretty vivid illustration of what happens when a >> US company operates outside its published privacy policy. > However, privacy policies by private companies can be overridden by laws and other juridical instruments within the applicable jurisdiction, forcing the operator to give access to data to national law enforcement and security agencies (in the US, that is especially easy for non-US citizens). Same for other parts of your TRR clauses - you may commit not to block anything, but if President Trump shows up with an order that requires blocking DNS resolution for the domain name of a specific foreign company (a case that, honestly, does not seem so unlikely), you will be forced to implement it no matter what you think. > > This is not meant to challenge your commitment to privacy, but it's just how it is, and it is the reason why people in other parts of the world - even the privacy activists that dislike their local network and would love to get an alternative - are not too happy with your declared approach of redirecting queries by default to a different jurisdiction that, in their view, offers less privacy protection than their own. > Sure. That's a different objection than the surveillance capitalism concern that I was responding to, and I'm not sure there's *any* jurisdiction on the planet that is immune from such concerns [1] [2] [3] [4]. In terms of worries about queries from citizens of EU countries being sent to servers that are subject to US jurisdiction: we don't have immediate plans to implement DNS-over-HTTPS (DoH) in Firefox outside of North America. We are currently exploring potential DoH partners in Europe that would be employed for the benefit of European users. /a ____ [1] https://edri.org/italy-anti-terrorism-decree-strengthen-government-surveillance/ [2] https://www.thetrumpet.com/17338-germany-can-legally-spy-on-its-own-citizens [3] https://qz.com/92648/think-us-snooping-is-bad-try-italy-india-or-canada/ [4] https://www.justsecurity.org/36098/era-mass-surveillance-emerging-europe/ --------------644F36481A635CF5C0879584 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit
    On 7/25/19 10:51, Vittorio Bertola wrote:
    

    Il 25 luglio 2019 16:11 Adam Roach <adam@nostrum.com> ha scritto:

I'm going to pre-reply to a frequent response that the lack of direct 
contractual relationship between users and Cloudflare is problematic. 
Even if you don't trust Mozilla's contractual agreement with Cloudflare 
to provide protection here, I would think that FTC v. Facebook (2019) 
[1] should serve as a pretty vivid illustration of what happens when a 
US company operates outside its published privacy policy.

    However, privacy policies by private companies can be overridden by laws and other juridical instruments within the applicable jurisdiction, forcing the operator to give access to data to national law enforcement and security agencies (in the US, that is especially easy for non-US citizens). Same for other parts of your TRR clauses - you may commit not to block anything, but if President Trump shows up with an order that requires blocking DNS resolution for the domain name of a specific foreign company (a case that, honestly, does not seem so unlikely), you will be forced to implement it no matter what you think.

This is not meant to challenge your commitment to privacy, but it's just how it is, and it is the reason why people in other parts of the world - even the privacy activists that dislike their local network and would love to get an alternative - are not too happy with your declared approach of redirecting queries by default to a different jurisdiction that, in their view, offers less privacy protection than their own.

    Sure. That's a different objection than the surveillance capitalism concern that I was responding to, and I'm not sure there's *any* jurisdiction on the planet that is immune from such concerns [1] [2] [3] [4].

    In terms of worries about queries from citizens of EU countries being sent to servers that are subject to US jurisdiction: we don't have immediate plans to implement DNS-over-HTTPS (DoH) in Firefox outside of North America. We are currently exploring potential DoH partners in Europe that would be employed for the benefit of European users.

    /a ____ [1] https://edri.org/italy-anti-terrorism-decree-strengthen-government-surveillance/

    [2] https://www.thetrumpet.com/17338-germany-can-legally-spy-on-its-own-citizens

    [3] https://qz.com/92648/think-us-snooping-is-bad-try-italy-india-or-canada/

    [4] https://www.justsecurity.org/36098/era-mass-surveillance-emerging-europe/

    --------------644F36481A635CF5C0879584-- From nobody Thu Jul 25 08:28:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08018120180 for ; Thu, 25 Jul 2019 08:28:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b_ZaTyZnBibW for ; Thu, 25 Jul 2019 08:28:45 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B741120130 for ; Thu, 25 Jul 2019 08:28:45 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id BCABDBE79; Thu, 25 Jul 2019 16:28:43 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i7jMYe1t2RvQ; Thu, 25 Jul 2019 16:28:42 +0100 (IST) Received: from [31.133.133.0] (dhcp-8500.meeting.ietf.org [31.133.133.0]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id EF245BE74; Thu, 25 Jul 2019 16:28:41 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564068522; bh=jmTwW9rfwYruFeTuwDd8K6dFTPzwHlMnqW/7XGu5qj8=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=t2KKGegHeadD8Cv7a0J9Mhi/OBd6nr1OuzcCJDAlNaC21egi7Dw59Gy05SGHvTJZw i06Uqt+LmUxzSDBtzUors2iSuPwCXz5Q/tj536cwV9b/fdOc6E1rhfIjyKTBNovm73 QbxM9HVtiVBYV1aL3QyR3ZqZeCCjDiFVKNn4H2NY= To: Andrew Campling , Adam Roach Cc: "add@ietf.org" , "neil.cook@open-xchange.com" References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Thu, 25 Jul 2019 16:28:39 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="kwlYBIKQUZyuQx5c9WWTBgTw0v7CFRxXc" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 15:28:48 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --kwlYBIKQUZyuQx5c9WWTBgTw0v7CFRxXc Content-Type: multipart/mixed; boundary="5aQCFq2A1u61rzX7jyNourajlmx7Ju5Ka"; protected-headers="v1" From: Stephen Farrell To: Andrew Campling , Adam Roach Cc: "add@ietf.org" , "neil.cook@open-xchange.com" Message-ID: Subject: Re: [Add] meeting hum: should the IETF take up this work? References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> In-Reply-To: --5aQCFq2A1u61rzX7jyNourajlmx7Ju5Ka Content-Type: multipart/mixed; boundary="------------B931BDF09E45A540A4364ABB" Content-Language: en-GB This is a multi-part message in MIME format. --------------B931BDF09E45A540A4364ABB Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 25/07/2019 16:19, Andrew Campling wrote: > In Europe, DNS constitutes personal data and therefore needs to be=20 > processed in compliance with GDPR Sorry, it's not clear to me what you mean there. It's also not clear to me that the act of answering a DNS query is something where there's a specific way to comply with GDPR or not comply with GDPR. Can you provide a pointer to something with more detail as to GDPR requirements for DNS recursive resolvers? Thanks, S. --------------B931BDF09E45A540A4364ABB Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------B931BDF09E45A540A4364ABB-- --5aQCFq2A1u61rzX7jyNourajlmx7Ju5Ka-- --kwlYBIKQUZyuQx5c9WWTBgTw0v7CFRxXc Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl05yqcACgkQWrL68XsX K+pbBQ//TU16gtMyLxuaadBI6T1f+4+4uTpFJDNRt0VkQupBfXNL5CA41UAPAq1W VSJz5G90nIBQiGyAkl5KTQWqHROWQNjjvvMRhgC940WTOYipU8fTeN2xolniS/HM cZOOHOq0OfvaiQn4uKoQnh7XPcHnF9HdM055TxNYuWjQPLXaUySQ51xIRwkXEV3s vrmx09l88Vbo+POeJWI9fQGcmXapw1lHDNha6cTfWQpfn/CEl/RndIISWAhvHB1j +ZxGbyuk9xnFnofNL1xRjaNPCnqwvPBtslHZc+YFQvTIKs2N4LJSVJ5M7yJguOUs 7+cQ2zmabytzNeJ8HMvot2NZ6waZ9kmm1fr/+L7sp/4piNDgxWmz0Y9DyVK0ofYK UAF/tngy+nuomutWwjTWV1Vc28+jAxY5dLAYRsQrec+a/cy/giC3hF94pziWhUHw X3yUeEmTu02r3eB9k7JpwlNJN6FRDmzwis6uMKndHoD2m14Z5N0samA19cbXUhfg haTo00IEeDvDXwj4Q9JPtCPz0k8lKarFM4zTkuyzlaFbttk+lgQSo/WZhH9/WMGO dYNQxyryGZ7+PNCnABVu6GPNcjY0R2qOeuML5JHYZ+/ZuXnMsH3epL99ZGAEDkuM Tul/8cblfJvBy9W2CLU9YT5k6O+wB3WMclLY3MLFltxQmuXM5DI= =wi+X -----END PGP SIGNATURE----- --kwlYBIKQUZyuQx5c9WWTBgTw0v7CFRxXc-- From nobody Thu Jul 25 08:32:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD1351201F2 for ; Thu, 25 Jul 2019 08:32:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.678 X-Spam-Level: X-Spam-Status: No, score=-1.678 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sY2m5wYch5r2 for ; Thu, 25 Jul 2019 08:32:42 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BB96120265 for ; Thu, 25 Jul 2019 08:32:34 -0700 (PDT) Received: from Orochi.local ([196.52.21.215]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x6PFWQK3064259 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 25 Jul 2019 10:32:29 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1564068750; bh=xF7n+tIkAtRQbIsZQ443rHKC7Yrpqzjrs42umEBLhfE=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=tl5TOTn+4e6hfzfJPKjo1hmEghLfSX+T4e8M4JhIJv3eNUc13+F6vulsu8R5DcSrj x0sgB3dslrj/h1MMV/P0Yz4+Dp/f93fLHAjMjvuwIkJIld4dg732PkOvxFXS8xy+6Y lIPgLSNq4xFstwpDqQJ9DCybb8WHMYw/Ghf89kZ4= X-Authentication-Warning: raven.nostrum.com: Host [196.52.21.215] claimed to be Orochi.local To: Andrew Campling Cc: "add@ietf.org" , "neil.cook@open-xchange.com" References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> From: Adam Roach Message-ID: <64d4f80c-9d3c-278a-3629-2f5193303d83@nostrum.com> Date: Thu, 25 Jul 2019 11:32:26 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------0767A5CF1582F17527B696C5" Content-Language: en-US Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 15:32:44 -0000 This is a multi-part message in MIME format. --------------0767A5CF1582F17527B696C5 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit See my response to Vittorio, which I think addresses your points. /a On 7/25/19 11:19, Andrew Campling wrote: > *Adam* > You rightly mention the protections offered by the Cloudflare privacy > policy and Mozilla's contract with Cloudflare.  The topical reference > to Facebook should serve as a timely reminder about the growing > importance of privacy as well as a useful illustration that > well-intentioned privacy policies can often be by-passed or undermined. > Given your comment to Neil, I think that it would be incredibly > helpful to have your thoughts on the following points: > > * Will all resolvers accessible within Mozilla's TRR policy have a > contractual relationship with the company to provide this > additional layer of protection? > * In Europe, DNS constitutes personal data and therefore needs to be > processed in compliance with GDPR - I didn't notice a direct > reference to this in the privacy policies, apologies if I've > missed it; > * For non-US citizens "reasonably believed to be outside the US", > FISA Section 702 of course overrides the stated privacy policies > of both Mozilla and Cloudflare (this is _not_ a criticism, simply > a clarification), has global reach when combined with the Cloud Act. > > I think we should all bear in mind that DoH does of course have the > potential to provide a contiguous, device level fingerprint to the DoH > resolver, is a backward step for privacy in that regard vs both DoT > and DNS53.  In my view this does helpfully illustrate that encryption > and privacy are not synonymous – no doubt others will have their own > views. > *Andrew * > -----Original Message----- > From: Adam Roach > Sent: 25 July 2019 15:12 > To: Neil Cook ; Stephane > Bortzmeyer > Cc: Jim Reid ; add@ietf.org; Rob Sayre > Subject: Re: [Add] meeting hum: should the IETF take up this work? > On 7/25/19 03:57, Neil Cook wrote: > > But let’s say I decide to run my own non-public DoH  resolver on my > > network at home. Firefox won’t have it on their list of TRRs, and if > > as you suggest, the discovery drafts are pointless and so don’t > > proceed, no application will ever find out about it, unless I > > configure it manually on every single application and computer in my > > house (not even mentioning those IoT devices that I can’t configure). > > > > It is also possible that we end up with a large number of public DoH > > resolvers which mine your personal data for profit. Given the current > > business model of the internet that is entirely possible. > Since you mention Firefox's TRR list and then mention data mining > (with an implied connection), I'd like to point out yet again that one > of the key criteria for appearing on that list is an agreement to > treat resolution data according to a strict set of privacy-protecting > provisions. You can see, for example, Cloudflare's associated privacy > policy at > https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ > I'm going to pre-reply to a frequent response that the lack of direct > contractual relationship between users and Cloudflare is problematic. > Even if you don't trust Mozilla's contractual agreement with > Cloudflare to provide protection here, I would think that FTC v. > Facebook (2019) [1] should serve as a pretty vivid illustration of > what happens when a US company operates outside its published privacy > policy. > /a > ____ > [1] > https://www.ftc.gov/news-events/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions > --------------0767A5CF1582F17527B696C5 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
    See my response to Vittorio, which I think addresses your points.

    /a

    On 7/25/19 11:19, Andrew Campling wrote:
    Adam
    You rightly mention the protections offered by the Cloudflare privacy policy and Mozilla's contract with Cloudflare.  The topical reference to Facebook should serve as a timely reminder about the growing importance of privacy as well as a useful illustration that well-intentioned privacy policies can often be by-passed or undermined. 
     
    Given your comment to Neil, I think that it would be incredibly helpful to have your thoughts on the following points:
     
    • Will all resolvers accessible within Mozilla's TRR policy have a contractual relationship with the company to provide this additional layer of protection?
    • In Europe, DNS constitutes personal data and therefore needs to be processed in compliance with GDPR - I didn't notice a direct reference to this in the privacy policies, apologies if I've missed it; 
    • For non-US citizens "reasonably believed to be outside the US", FISA Section 702 of course overrides the stated privacy policies of both Mozilla and Cloudflare (this is not a criticism, simply a clarification), has global reach when combined with the Cloud Act.
      •
     
    I think we should all bear in mind that DoH does of course have the potential to provide a contiguous, device level fingerprint to the DoH resolver, is a backward step for privacy in that regard vs both DoT and DNS53.  In my view this does helpfully illustrate that encryption and privacy are not synonymous – no doubt others will have their own views.   
     
     
    Andrew
     
    -----Original Message-----
    From: Adam Roach <adam@nostrum.com>
    Sent: 25 July 2019 15:12
    To: Neil Cook <neil.cook=40open-xchange.com@dmarc.ietf.org>; Stephane Bortzmeyer <bortzmeyer@nic.fr>
    Cc: Jim Reid <jim@rfc1035.com>; add@ietf.org; Rob Sayre <sayrer@gmail.com>
    Subject: Re: [Add] meeting hum: should the IETF take up this work?
     
    On 7/25/19 03:57, Neil Cook wrote:
    > But let’s say I decide to run my own non-public DoH  resolver on my
    > network at home. Firefox won’t have it on their list of TRRs, and if
    > as you suggest, the discovery drafts are pointless and so don’t
    > proceed, no application will ever find out about it, unless I
    > configure it manually on every single application and computer in my
    > house (not even mentioning those IoT devices that I can’t configure).
    >
    > It is also possible that we end up with a large number of public DoH
    > resolvers which mine your personal data for profit. Given the current
    > business model of the internet that is entirely possible.
     
     
    Since you mention Firefox's TRR list and then mention data mining (with an implied connection), I'd like to point out yet again that one of the key criteria for appearing on that list is an agreement to treat resolution data according to a strict set of privacy-protecting provisions. You can see, for example, Cloudflare's associated privacy policy at https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/
     
    I'm going to pre-reply to a frequent response that the lack of direct contractual relationship between users and Cloudflare is problematic.
    Even if you don't trust Mozilla's contractual agreement with Cloudflare to provide protection here, I would think that FTC v. Facebook (2019) [1] should serve as a pretty vivid illustration of what happens when a US company operates outside its published privacy policy.
     
    /a
     
    ____
    [1]
     
     
     


    --------------0767A5CF1582F17527B696C5-- From nobody Thu Jul 25 08:39:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85B4A120240 for ; Thu, 25 Jul 2019 08:39:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r53Hpji2ma1s for ; Thu, 25 Jul 2019 08:39:33 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110079.outbound.protection.outlook.com [40.107.11.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26906120235 for ; Thu, 25 Jul 2019 08:39:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=LkesVHOAmawMWWtnS5seD/cbjpxJ2ieGsJoEXhesthPQKPmLt0PVUHBjjcMbPdkX+X2lQ0FBdmKPTJkAft4k/g5Au2xzX51nIETnTpdGuIqo4M4VK/V4PbqVrJvmwGjGtNzTQU9gDbB0b5M9M3s02qauSDKu1YURgs0ztcdrY/UfjxAKu6UpApSt60H9R8KV6pM9KaeBTnWQtkBWaKuHUwT68jdRSNFPx75WKHE/Bx09k9YaBvDbuZGrjsUM0e3hPOzICiJJU1mM295nHd/dabqdoCtQDyJ+hVFhW8bi98H+PDx6sxpFL+t0Luz/dW/uzsAqkvSKDAOeHGqqrnW33Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PUpP0gioJGI6TP5Vj+tYLS424GTcbHmPdO1suPQ64Qs=; b=GMJ76EE/peFUWIWTPbPlLXfzG0SWisivdw0cRRSvNHv1/l1FPgrGMjfc5skz0jZaPDFEsdR5htgiLdHIW3C4a8+NcuhbG0L+qMJ6pK+Zkgvu50gVvJNBGWq57fwsw96Sie0sNwT0UgdMwKNHt5n19dNoMBn0ua4Pswbqg23JWrraE1HbLMZm30X9JuiCjBrEo92Gwvp3aOwGXQed+5RQuJaNO01uxmEq8ZO96VOBBKFGwWMvQaJpcb3xX9548WeUgchX5JztjV1sIfknGkMw0axjmYBfJnp0g95HTCXOZNRHlzU13CRY4IhujncQiPHvxeCoROBgVkC6F5lRvIrL+g== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PUpP0gioJGI6TP5Vj+tYLS424GTcbHmPdO1suPQ64Qs=; b=pyYCBNBS5qyg1RbVQLkOCdbQCwCjB27W9aFjMfftVhgv0mCDqB2HCge3NRNSF78ejfquF2oq1D7FLKCtbCBbnOXylQL65N9ObnLDT/DstTV4eUXIy7VMRpmuNoGPdALazfDp1LKDkpBFf0eG3p4TCTxnSlytYDhXbpwtHKjimwM= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1133.GBRP265.PROD.OUTLOOK.COM (20.176.141.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Thu, 25 Jul 2019 15:39:30 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2094.013; Thu, 25 Jul 2019 15:39:30 +0000 From: Andrew Campling To: Eric Rescorla CC: "add@ietf.org" Thread-Topic: [Add] fixing coffee shop brokenness with DoH Thread-Index: AQHVQv2xaDaTq1BGZ0eqO2wXmgt3vqbbdjTQ Date: Thu, 25 Jul 2019 15:39:30 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> <20190725142135.0FFA715BD17B@fafnir.remote.dragon.net> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:4c4d:3a84:6d17:cecf] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3ee10cca-c9dc-450c-080b-08d711164904 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(2017052603328)(7193020); SRVR:LO2P265MB1133; x-ms-traffictypediagnostic: LO2P265MB1133: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 0109D382B0 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(34096005)(346002)(376002)(366004)(39830400003)(136003)(396003)(199004)(189003)(6116002)(316002)(99286004)(446003)(4744005)(186003)(33656002)(76176011)(7696005)(14444005)(256004)(71190400001)(44832011)(46003)(74316002)(790700001)(476003)(8936002)(81166006)(6916009)(81156014)(68736007)(486006)(8676002)(7736002)(6436002)(53546011)(102836004)(25786009)(6506007)(54896002)(86362001)(11346002)(236005)(508600001)(52536014)(53936002)(76116006)(66946007)(66476007)(66556008)(229853002)(9686003)(5660300002)(64756008)(66446008)(6246003)(14454004)(6306002)(4326008)(55016002)(2906002)(71200400001)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1133; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: BVllMPjD+6KHdUUVbpVv+QoDnRcqyr+GZtOzqzX3KdKVESGp75lU/XrFesgVICjtWICP1ZCXfbbLoF8FkR4F1nXSJeRiSLrpU/dGHogA61XxTgkAG1TloipHsiHrJtRoEVjBU6cEuZvjfmznKDK65cUD34IRCVjI1TZMG2XJFf6ITqqXaihEQB4tLaGrdvCDsrIQaIqDPgBKz2ZMcz5iAh/oaN0g3NwTIFs2/G43l/2s48ubhVMACxHSpDfQ1gsyMDABg9Rbznr/0r8jS1UxVIrU4mVGnmOi3dmlp1eWlqY3jIAP3u2h0LmsZcsgRPPWSfF2EyFY4mSNNzKXB1JHSrI5p2cIBPUUnIwyj3/RhImxN3/awKV0PXtkAQun9QXs9SpBDtSPJfsTC4eYoMKULXTM9eom0c6jTpz/L4GvAlU= Content-Type: multipart/alternative; boundary="_000_LO2P265MB1327A47EE98888D755633C66C2C10LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 3ee10cca-c9dc-450c-080b-08d711164904 X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jul 2019 15:39:30.6988 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1133 Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 15:39:36 -0000 --_000_LO2P265MB1327A47EE98888D755633C66C2C10LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gVGh1LCBKdWwgMjUsIDIwMTkgYXQgNDoyMSBQTSBFcmljIFJlc2NvcmxhIDxla3JAcnRmbS4u Y29tPG1haWx0bzpla3JAcnRmbS5jb20+PiB3cm90ZToNCg0KPiBUaGlzIHRocmVhZCBoYXMgZ290 dGVuIHF1aXRlIGxvbmcgYW5kIGhhcmQgdG8gdHJhY2suIEkgd2FzIHRhbGtpbmcgYWJvdXQgdGhl IGNhc2Ugd2hlcmUgRG9IIHdhcyBub3QgcHJlc2VudCwgYW5kIG15IHBvaW50IHdhcyB0aGF0IERO U1NFQyBpcyBub3QgYSByZXBsYWNlbWVudCBmb3IgRG9IIGluIHRoZSBzZXR0aW5ncyBJIGFtIGNv bmNlcm5lZCB3aXRoLg0KDQo+IEkgYWdyZWUgdGhhdCBEb0ggcG90ZW50aWFsbHkgbWFrZXMgZW5k LXVzZXIgc29mdHdhcmUgRE5TU0VDIHZhbGlkYXRpb24gdmlhYmxlLCBhbmQgdGhhdCdzIHNvbWV0 aGluZyB0aGF0IGF0IHNvbWUgcG9pbnQgd2UgbWlnaHQgbG9vayBhdC4NCg0KDQpQcmVzdW1hYmx5 IHRoaXMgYXBwbGllcyBkbyBib3RoIERvVCBhbmQgRG9IIEVyaWM/DQoNCkFzIHNvbWVvbmUgc2Fp ZCBkdXJpbmcgdGhlIERvSCBkaXNjdXNzaW9uIGF0IHRoZSBJQ0FOTiBjb25mZXJlbmNlIGluIE1h cnJha2VzaCBsYXN0IG1vbnRoLCDigJxEb1QgYW5kIERvSCBnaXZlIHlvdSBhIGhhcmRlbmVkIHBp cGUsIGRvbuKAmXQgc3RvcCB5b3UgZHJhd2luZyBwb2lzb25lZCB3YXRlciBmcm9tIHRoZSBsYWtl OyBETlNTRUMgcmVhc3N1cmVzIHlvdSB0aGF0IHRoZSB3YXRlciBpcyBzYWZl4oCdIChvciBzb21l dGhpbmcgdmVyeSBjbG9zZSB0byB0aGF0KS4gIEkgdGhvdWdodCB0aGF0IHdhcyBhIHVzZWZ1bCBh bmFsb2d5IHRvIGhpZ2hsaWdodCB3aHkgdGhlIGNvbWJpbmF0aW9uIG9mIERvVC9IIGFuZCBETlNT RUMgd2FzIGJlbmVmaWNpYWwuDQoNCg0KQW5kcmV3DQo= --_000_LO2P265MB1327A47EE98888D755633C66C2C10LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxp Lk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlv cml0eTozNDsNCgltYXJnaW4tdG9wOjBjbTsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1hcmdpbi1i b3R0b206MGNtOw0KCW1hcmdpbi1sZWZ0OjM2LjBwdDsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9 DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHls ZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmln aHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsN Cglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30N CnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQg NzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0 aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZh dWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwh LS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86 aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFb ZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGluaz0iYmx1ZSIgdmxpbms9 InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+T24gVGh1LCBKdWwgMjUsIDIwMTkgYXQgNDoyMSBQTSBFcmljIFJlc2NvcmxhICZsdDs8YSBo cmVmPSJtYWlsdG86ZWtyQHJ0Zm0uY29tIiB0YXJnZXQ9Il9ibGFuayI+ZWtyQHJ0Zm0uLmNvbTwv YT4mZ3Q7IHdyb3RlOg0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPiZndDsgVGhpcyB0aHJlYWQgaGFzIGdvdHRlbiBxdWl0ZSBsb25nIGFuZCBoYXJk IHRvIHRyYWNrLiBJIHdhcyB0YWxraW5nIGFib3V0IHRoZSBjYXNlIHdoZXJlIERvSCB3YXMgbm90 IHByZXNlbnQsIGFuZCBteSBwb2ludCB3YXMgdGhhdCBETlNTRUMgaXMgbm90IGEgcmVwbGFjZW1l bnQgZm9yIERvSCBpbiB0aGUgc2V0dGluZ3MgSSBhbSBjb25jZXJuZWQgd2l0aC48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+Jmd0OyBJIGFncmVlIHRoYXQgRG9IIHBvdGVudGlhbGx5IG1ha2VzIGVuZC11 c2VyIHNvZnR3YXJlIEROU1NFQyB2YWxpZGF0aW9uIHZpYWJsZSwgYW5kIHRoYXQncyBzb21ldGhp bmcgdGhhdCBhdCBzb21lIHBvaW50IHdlIG1pZ2h0IGxvb2sgYXQuPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQ7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5QcmVzdW1hYmx5IHRoaXMgYXBw bGllcyBkbyBib3RoIERvVCBhbmQgRG9IIEVyaWM/Jm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtt c28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7bXNvLWZh cmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkFzIHNvbWVvbmUgc2FpZCBkdXJpbmcgdGhlIERvSCBkaXNj dXNzaW9uIGF0IHRoZSBJQ0FOTiBjb25mZXJlbmNlIGluIE1hcnJha2VzaCBsYXN0IG1vbnRoLCDi gJxEb1QgYW5kIERvSCBnaXZlIHlvdSBhIGhhcmRlbmVkIHBpcGUsIGRvbuKAmXQgc3RvcCB5b3Ug ZHJhd2luZyBwb2lzb25lZCB3YXRlciBmcm9tIHRoZSBsYWtlOw0KIEROU1NFQyByZWFzc3VyZXMg eW91IHRoYXQgdGhlIHdhdGVyIGlzIHNhZmXigJ0gKG9yIHNvbWV0aGluZyB2ZXJ5IGNsb3NlIHRv IHRoYXQpLiZuYnNwOyBJIHRob3VnaHQgdGhhdCB3YXMgYSB1c2VmdWwgYW5hbG9neSB0byBoaWdo bGlnaHQgd2h5IHRoZSBjb21iaW5hdGlvbiBvZiBEb1QvSCBhbmQgRE5TU0VDIHdhcyBiZW5lZmlj aWFsLiZuYnNwOw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMi PkFuZHJldzxvOnA+PC9vOnA+PC9zcGFuPjwvYj48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRt bD4NCg== --_000_LO2P265MB1327A47EE98888D755633C66C2C10LO2P265MB1327GBRP_-- From nobody Thu Jul 25 08:41:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D975F120240 for ; Thu, 25 Jul 2019 08:41:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FEXk3Ijn3q3h for ; Thu, 25 Jul 2019 08:41:05 -0700 (PDT) Received: from mail-lf1-x12b.google.com (mail-lf1-x12b.google.com [IPv6:2a00:1450:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FC1C1202FE for ; Thu, 25 Jul 2019 08:41:05 -0700 (PDT) Received: by mail-lf1-x12b.google.com with SMTP id b29so27617373lfq.1 for ; Thu, 25 Jul 2019 08:41:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=eCUa55pSohz8Km1CTdiu/uLpzpGlXJRqF3uqe1ZbGLU=; b=BQsdoQXOXLjLdzz6BEYmh0ciyfcdADC2aW3eV3s25PuAe8rn4dcSpwq4Htj0A987vB xjDdzS8CarevAicdX+D47QKAb9A6asX4I0N953Qokm6R2Ih3L8hvARuPgQVQTHzXtyVQ FZgsblfABn2VG6/lixjaXXBzXexKIdqSenypRxmirdkMAX2UK9OdxFDkGagVDz2KiVr6 QJMb94hP01VB2R8asfGkCRDqoxW6eJ2vSRtlzhoYlUNssBtITssvBwBdEs2Nz+7rSgg1 TidjwzyVAtRiltpvAJuX6CgUhnNkLKiquTCrweNFFQTBYikimHPABkfWZbvZiKSOr85z IcOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=eCUa55pSohz8Km1CTdiu/uLpzpGlXJRqF3uqe1ZbGLU=; b=KfybNrZMR7QtlZU/IoQSWZXAN5hltZsGGQFe5HrZlzs/dT0lOP45KJhbR7ymVOJK5K XvwvIO0mt+aFkOmY/8QCPxDU2mUi/5At4etQVtB1cyGf7RrOI5+qothQrck1boyrbXSQ Awcnb6qssI0K0ZSAnfhAm9tEpwcLwlpLU7GHbkhp4RTEhIx2p78UfqSS38vXYmN4NTFC tXnyHAC/XReT39TKvM8zLu1ME1LQzJvDwwl2Dp2f0McmsUSmlQ3EET6ASvKRnqYH6lMg 6jrwP/VmmRK6wNVnVw6HZtlC6abe0lZvXHJf8A5HEUmfn3AHaE1rtSdTWrv7U87mmh6B PNtg== X-Gm-Message-State: APjAAAWDj6F9U6TCbE29BSvyOYBUVgqn9BYzKysAubTPAuucoigdapxP 8FOkMXYva7JrTp/KtWjFzRTceNoUCl5Tvl06qFGoEA== X-Google-Smtp-Source: APXvYqwAYMV9GZmG5S1O45RyJenQ54NgACVIwjWdJpVSTsE+k1sCfH46wdt1ubH3E9IXKP6NYSFsitSdpxZ7BbVr+7I= X-Received: by 2002:ac2:51a3:: with SMTP id f3mr13710117lfk.94.1564069263443; Thu, 25 Jul 2019 08:41:03 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <14DF8769-A817-4C06-9140-80198518244F@akamai.com> <1EFB37A3-23C6-44FF-B001-8F04B381EC04@rfc1035.com> <20190725142135.0FFA715BD17B@fafnir.remote.dragon.net> In-Reply-To: From: Eric Rescorla Date: Thu, 25 Jul 2019 08:40:25 -0700 Message-ID: To: Andrew Campling Cc: "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000da142c058e8340d3" Archived-At: Subject: Re: [Add] fixing coffee shop brokenness with DoH X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 15:41:08 -0000 --000000000000da142c058e8340d3 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Jul 25, 2019 at 8:39 AM Andrew Campling wrote: > On Thu, Jul 25, 2019 at 4:21 PM Eric Rescorla > wrote: > > > > > This thread has gotten quite long and hard to track. I was talking abou= t > the case where DoH was not present, and my point was that DNSSEC is not a > replacement for DoH in the settings I am concerned with. > > > > > I agree that DoH potentially makes end-user software DNSSEC validation > viable, and that's something that at some point we might look at. > > > > > > Presumably this applies do both DoT and DoH Eric? > Yes. -Ekr > > As someone said during the DoH discussion at the ICANN conference in > Marrakesh last month, =E2=80=9CDoT and DoH give you a hardened pipe, don= =E2=80=99t stop you > drawing poisoned water from the lake; DNSSEC reassures you that the water > is safe=E2=80=9D (or something very close to that). I thought that was a= useful > analogy to highlight why the combination of DoT/H and DNSSEC was > beneficial. > > > > > > *Andrew* > --000000000000da142c058e8340d3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Thu, Jul 25, 2019 at 8:39 AM Andre= w Campling <andrew.campling@419.consulting> wrote:

    On Thu, Jul 25, 2019 at 4:21 PM Eric Rescorla <ekr@rtfm..com> wrote= :

    =C2=A0

    > This thread has gott= en quite long and hard to track. I was talking about the case where DoH was= not present, and my point was that DNSSEC is not a replacement for DoH in = the settings I am concerned with.

    =C2=A0

    > I agree that DoH pot= entially makes end-user software DNSSEC validation viable, and that's s= omething that at some point we might look at.

    =C2=A0

    =C2=A0<= /span>

    Presumably this appli= es do both DoT and DoH Eric?=C2=A0


    Yes.
    =
    -Ekr

    =C2=A0<= /span>

    As someone said durin= g the DoH discussion at the ICANN conference in Marrakesh last month, =E2= =80=9CDoT and DoH give you a hardened pipe, don=E2=80=99t stop you drawing = poisoned water from the lake; DNSSEC reassures you that the water is safe=E2=80=9D (or something very cl= ose to that).=C2=A0 I thought that was a useful analogy to highlight why th= e combination of DoT/H and DNSSEC was beneficial.=C2=A0

    =C2=A0<= /span>

    =C2=A0

    Andrew

    --000000000000da142c058e8340d3-- From nobody Thu Jul 25 09:02:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BEC8412035C for ; Thu, 25 Jul 2019 09:02:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FE5zFxzx0bjJ for ; Thu, 25 Jul 2019 09:01:59 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110041.outbound.protection.outlook.com [40.107.11.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BCEF312036E for ; Thu, 25 Jul 2019 09:01:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eZBtn/vdXIuKD3MXj1WpLpSZOl0/8HIimY1pudFU/INdQWPnk3IWtUwdDbvRli6TjifYyHjdMB3mXiTlx9HbzzIelogilITiS//Fe41QaK9nOIwQyckUbwdEJjyqS1Di3PIfbATGoqR12g+z5bc1lb3+7Ln8rmzXnBT3Epr9HK0q1qHwICYBHS3qJtWWnur+3HFF3s5zv9LowQPjHmebT3jloanyzZ560rXKzoN3Jj0LkWCyAEz/SyS8/ZE31dnIU9M9ha+9TQ0yMPk36malteqzXz+y8OTDbCYzfJrx/pKADOI+qjnzYZoCkYQ8hac9ukycXCqThQ7Ff3f+8JJ88w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uarRvsAMqdOH9XC57GCVG8++80nTAd5q1EJVIw6mowM=; b=eYgIsWAc+FVdfAirYTrLprbW/0GrF2YrKevE631uRcZoi+dzFuzSI9H7t7mCLh+3chu/hNkYk4xrQvbzFRXl3oxT3trZdWpVmbPZ7VfcT/KuQUooS3xPFPHVlSJTKKVtxz4T+tnKE2EXkITj9BPZ8HTbkQnf9nr8soRfILGjKuhKeSu7f8HK2habFcd5CsCyQhFqgCmmyZAAGHRSciINywXNfvfrHeXN49l547BMlKUSsHS5Kg3L0YbpK50ofYgLYd2UKS6LvqBztpESvHmkdjKWT1wQYluQ23BncdZvrF9nHKr6aFEHltOLm7KxQ87QRtYXz2d6ddSVTPdDI5ON9Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uarRvsAMqdOH9XC57GCVG8++80nTAd5q1EJVIw6mowM=; b=r1k1KLBrvbFF9f4NFWRblnznNF9qMrgrCXwNyVFKilsfNPXnSG+IJZEClfq2Rvr/2lUXn+gSzc4UkEY287RBsMq44vqdC4/uEwCMx+3mokRH8gs9QSGHf6jRWQcGVdhGouCY4je/m4lOV4iqxhALrl3dn/MdTOUaep/oDs+e2jk= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1517.GBRP265.PROD.OUTLOOK.COM (20.176.145.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.16; Thu, 25 Jul 2019 16:01:55 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2094.013; Thu, 25 Jul 2019 16:01:55 +0000 From: Andrew Campling To: Stephen Farrell CC: "add@ietf.org" Thread-Topic: [Add] meeting hum: should the IETF take up this work? Thread-Index: AQHVQvQ3hyEXUjk430e+e4o5zbaPCqbbaiGggAALOoCAAAQbAA== Date: Thu, 25 Jul 2019 16:01:55 +0000 Message-ID: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:4c4d:3a84:6d17:cecf] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 12fbc1b2-93e0-46b4-13eb-08d711196a84 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1517; x-ms-traffictypediagnostic: LO2P265MB1517: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0109D382B0 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(346002)(366004)(39830400003)(136003)(376002)(34096005)(189003)(199004)(6506007)(6116002)(4326008)(186003)(6246003)(33656002)(30864003)(68736007)(66446008)(8936002)(316002)(71200400001)(486006)(64756008)(6306002)(5660300002)(71190400001)(102836004)(6436002)(52536014)(305945005)(74316002)(66476007)(66946007)(8676002)(76116006)(99286004)(66556008)(55016002)(9686003)(46003)(2906002)(476003)(7736002)(86362001)(81166006)(229853002)(25786009)(53546011)(81156014)(6916009)(508600001)(44832011)(11346002)(14454004)(256004)(966005)(7696005)(446003)(76176011)(14444005)(53936002)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1517; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 5f2X7E1m2zTKeMAb6hhsx5iElmdhAxz+v31Mz44I75zCC3bB3CjPlpTjYZcCOZNkbLSI01cXWDBG5GbVu948VlKcAi4o0cokvBHAmPl7TK00WrwLhim6X8MaU9zNlIqq7GriKXINvJkjQlny6ESZ2onPFvVm43HcpMYGjW9lZp8AqP3Iocd3UUjOvexZijGTawjVU6XwcwDIsfQrRWuCfR3e29R2Brsyw2qlBLLNJNxqjR8ip0UxsS0iGOyB+cSbFx5n8ktkc3q3K5YglNp/U9vjQ7lutx8KrpRU7wT3UCk9i1IfPjBpTCRWh/tKNnpj+QtY/YCbwFEaBYwSLDSPe56dhxYIoeiccFPdR8VE7HHzrN74jTpEDxMMu7qIyMdik4BAhjnCBiItrqDHUtJ7MMxCkmV2JOreD4DC3vqMltU= Content-Type: multipart/alternative; boundary="_000_LO2P265MB1327E54F6CE3C39EAF0C3BD1C2C10LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 12fbc1b2-93e0-46b4-13eb-08d711196a84 X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jul 2019 16:01:55.3380 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1517 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 16:02:07 -0000 --_000_LO2P265MB1327E54F6CE3C39EAF0C3BD1C2C10LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gMjUvMDcvMjAxOSAxNjoyOSwgU3RlcGhlbiBGYXJyZWxsIHdyb3RlOg0KDQo+IE9uIDI1LzA3 LzIwMTkgMTY6MTksIEFuZHJldyBDYW1wbGluZyB3cm90ZToNCiAgICAgID4+IEluIEV1cm9wZSwg RE5TIGNvbnN0aXR1dGVzIHBlcnNvbmFsIGRhdGEgYW5kIHRoZXJlZm9yZSBuZWVkcyB0byBiZQ0K ICAgICAgPj4gcHJvY2Vzc2VkIGluIGNvbXBsaWFuY2Ugd2l0aCBHRFBSDQoNCj4gU29ycnksIGl0 J3Mgbm90IGNsZWFyIHRvIG1lIHdoYXQgeW91IG1lYW4gdGhlcmUuDQoNCj4gSXQncyBhbHNvIG5v dCBjbGVhciB0byBtZSB0aGF0IHRoZSBhY3Qgb2YgYW5zd2VyaW5nIGEgRE5TIHF1ZXJ5IGlzIHNv bWV0aGluZyB3aGVyZSB0aGVyZSdzIGEgc3BlY2lmaWMgd2F5IHRvIGNvbXBseSB3aXRoIEdEUFIg b3Igbm90IGNvbXBseSB3aXRoIEdEUFIuDQoNCj4gQ2FuIHlvdSBwcm92aWRlIGEgcG9pbnRlciB0 byBzb21ldGhpbmcgd2l0aCBtb3JlIGRldGFpbCBhcyB0byBHRFBSIHJlcXVpcmVtZW50cyBmb3Ig RE5TIHJlY3Vyc2l2ZSByZXNvbHZlcnM/DQoNCg0KSW1wb3J0YW50IGhlYWx0aCB3YXJuaW5nLCBm b3Igc3BlY2lmaWMgZ3VpZGFuY2UgcGxlYXNlIGNoZWNrIHdpdGggYSBwcml2YWN5IGxhd3llciBh bmQvcmVndWxhdG9yLCBJJ20gbmVpdGhlciENCg0KSXQncyB0aGUgcHJvY2Vzc2luZyBvZiBETlMg KGRhdGEpIHRoYXQgbmVlZHMgdG8gYmUgaW4gY29tcGxpYW5jZSB3aXRoIEdEUFIsIHRoZXJlJ3Mg cGxlbnR5IG9mIGd1aWRhbmNlIG91dCB0aGVyZSByZWdhcmRpbmcgaG93IHBlcnNvbmFsIGRhdGEg c2hvdWxkIGJlIHByb2Nlc3NlZCBpbiBhIGNvbXBsaWFudCBtYW5uZXIuICBUaGUgcmVndWxhdG9y cyBoYXZlIGluZGljYXRlZCB0aGF0IHRoZXkgdmlldyBETlMgYXMgcGVyc29uYWwgZGF0YSwgc28g aW4gc2NvcGUgd2l0aCByZWdhcmRzIEdEUFIuDQoNCkZvciBndWlkYW5jZSByZWdhcmRpbmcgYSBz cGVjaWZpYyBpbXBsZW1lbnRhdGlvbiBvciBhcHBsaWNhdGlvbiBhbmQgaG93IHRvIGVuc3VyZSBH RFBSIGNvbXBsaWFuY2UsIEknZCBzdWdnZXN0IGFwcHJvYWNoaW5nIHRoZSByZWxldmFudCBuYXRp b25hbCByZWd1bGF0b3IgYXMgYW55IHN1Y2ggZ3VpZGFuY2Ugd2lsbCBiZSBjYXNlLXNwZWNpZmlj LiAgSW4gdGhlIFVLIHRoaXMgd291bGQgYmUgdGhlIEluZm9ybWF0aW9uIENvbW1pc3Npb25lcidz IE9mZmljZSAtIHNlZSBodHRwczovL2ljby5vcmcudWsvZm9yLW9yZ2FuaXNhdGlvbnMvZ3VpZGUt dG8tZGF0YS1wcm90ZWN0aW9uLyBhcyBhIGdvb2QgcGxhY2UgdG8gc3RhcnQgYW5kICBodHRwczov L2ljby5vcmcudWsvZ2xvYmFsL2NvbnRhY3QtdXMvIGZvciBjb250YWN0IGluZm9ybWF0aW9uLg0K DQoNCkFuZHJldw0KDQoNCg== --_000_LO2P265MB1327E54F6CE3C39EAF0C3BD1C2C10LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVu dD0iTWljcm9zb2Z0IEV4Y2hhbmdlIFNlcnZlciI+DQo8IS0tIGNvbnZlcnRlZCBmcm9tIHJ0ZiAt LT4NCjxzdHlsZT48IS0tIC5FbWFpbFF1b3RlIHsgbWFyZ2luLWxlZnQ6IDFwdDsgcGFkZGluZy1s ZWZ0OiA0cHQ7IGJvcmRlci1sZWZ0OiAjODAwMDAwIDJweCBzb2xpZDsgfSAtLT48L3N0eWxlPg0K PC9oZWFkPg0KPGJvZHk+DQo8Zm9udCBmYWNlPSJUaW1lcyBOZXcgUm9tYW4iIHNpemU9IjMiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTJwdDsiPjxhIG5hbWU9Il9NYWlsRW5kQ29tcG9zZSI+PC9h Pg0KPGRpdj48Zm9udCBmYWNlPSJDYWxpYnJpIiBzaXplPSIzIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEycHQ7Ij5PbiAyNS8wNy8yMDE5IDE2OjI5LCBTdGVwaGVuIEZhcnJlbGwgd3JvdGU6PC9z cGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+Jm5ic3A7PC9zcGFuPjwvZm9udD48L2Rpdj4NCjxk aXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MnB0OyI+Jmd0OyBPbiAyNS8wNy8yMDE5IDE2OjE5LCBBbmRyZXcgQ2FtcGxpbmcgd3JvdGU6PC9z cGFuPjwvZm9udD48L2Rpdj4NCjxkaXYgc3R5bGU9InBhZGRpbmctbGVmdDozNnB0OyI+PGZvbnQg ZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+Jmd0 OyZndDsgSW4gRXVyb3BlLCBETlMgY29uc3RpdHV0ZXMgcGVyc29uYWwgZGF0YSBhbmQgdGhlcmVm b3JlIG5lZWRzIHRvIGJlIDwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8ZGl2IHN0eWxlPSJwYWRkaW5n LWxlZnQ6MzZwdDsiPjxmb250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTJwdDsiPiZndDsmZ3Q7IHByb2Nlc3NlZCBpbiBjb21wbGlhbmNlIHdpdGggR0RQ Ujwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8ZGl2IHN0eWxlPSJwYWRkaW5nLWxlZnQ6MzZwdDsiPjxm b250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTJwdDsi PiZuYnNwOzwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxmb250IGZhY2U9IkNhbGlicmkiIHNp emU9IjMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTJwdDsiPiZndDsgU29ycnksIGl0J3Mgbm90 IGNsZWFyIHRvIG1lIHdoYXQgeW91IG1lYW4gdGhlcmUuPC9zcGFuPjwvZm9udD48L2Rpdj4NCjxk aXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MnB0OyI+Jm5ic3A7PC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJy aSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+Jmd0OyBJdCdzIGFsc28g bm90IGNsZWFyIHRvIG1lIHRoYXQgdGhlIGFjdCBvZiBhbnN3ZXJpbmcgYSBETlMgcXVlcnkgaXMg c29tZXRoaW5nIHdoZXJlIHRoZXJlJ3MgYSBzcGVjaWZpYyB3YXkgdG8gY29tcGx5IHdpdGggR0RQ UiBvciBub3QgY29tcGx5IHdpdGggR0RQUi48L3NwYW4+PC9mb250PjwvZGl2Pg0KPGRpdj48Zm9u dCBmYWNlPSJDYWxpYnJpIiBzaXplPSIzIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEycHQ7Ij4m bmJzcDs8L3NwYW4+PC9mb250PjwvZGl2Pg0KPGRpdj48Zm9udCBmYWNlPSJDYWxpYnJpIiBzaXpl PSIzIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEycHQ7Ij4mZ3Q7IENhbiB5b3UgcHJvdmlkZSBh IHBvaW50ZXIgdG8gc29tZXRoaW5nIHdpdGggbW9yZSBkZXRhaWwgYXMgdG8gR0RQUiByZXF1aXJl bWVudHMgZm9yIEROUyByZWN1cnNpdmUgcmVzb2x2ZXJzPzwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8 ZGl2Pjxmb250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTJwdDsiPiZuYnNwOzwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxmb250IGZhY2U9IkNhbGli cmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTJwdDsiPiZuYnNwOzwvc3Bhbj48 L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxmb250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTJwdDsiPjxiPkltcG9ydGFudCBoZWFsdGggd2FybmluZywgZm9yIHNw ZWNpZmljIGd1aWRhbmNlPC9iPjxiPiA8L2I+PGI+cGxlYXNlIDwvYj48Yj5jaGVjayB3aXRoIGEg cHJpdmFjeSBsYXd5ZXI8L2I+PGI+IGFuZC9yZWd1bGF0b3I8L2I+PGI+LCBJJ20gPC9iPjxiPm5l aXRoZXI8L2I+PGI+ISZuYnNwOyA8L2I+PC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQg ZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+Jm5i c3A7PC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0i MyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+SXQncyB0aGUgcHJvY2Vzc2luZyBvZiBE TlMgKGRhdGEpIHRoYXQgbmVlZHMgdG8gYmUgaW4gY29tcGxpYW5jZSB3aXRoIEdEUFIsIHRoZXJl J3MgcGxlbnR5IG9mIGd1aWRhbmNlIG91dCB0aGVyZSByZWdhcmRpbmcgaG93IHBlcnNvbmFsIGRh dGEgc2hvdWxkIGJlIHByb2Nlc3NlZCBpbiBhIGNvbXBsaWFudCBtYW5uZXIuJm5ic3A7IFRoZSBy ZWd1bGF0b3JzDQpoYXZlIGluZGljYXRlZCB0aGF0IHRoZXkgdmlldyBETlMgYXMgcGVyc29uYWwg ZGF0YSwgc28gaW4gc2NvcGUgd2l0aCByZWdhcmRzIEdEUFIuJm5ic3A7IDwvc3Bhbj48L2ZvbnQ+ PC9kaXY+DQo8ZGl2Pjxmb250IGZhY2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTJwdDsiPiZuYnNwOzwvc3Bhbj48L2ZvbnQ+PC9kaXY+DQo8ZGl2Pjxmb250IGZh Y2U9IkNhbGlicmkiIHNpemU9IjMiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTJwdDsiPkZvciBn dWlkYW5jZSByZWdhcmRpbmcgYSBzcGVjaWZpYyBpbXBsZW1lbnRhdGlvbiBvciBhcHBsaWNhdGlv biBhbmQgaG93IHRvIGVuc3VyZSBHRFBSIGNvbXBsaWFuY2UsIEknZCBzdWdnZXN0IGFwcHJvYWNo aW5nIHRoZSByZWxldmFudCBuYXRpb25hbCByZWd1bGF0b3IgYXMgYW55IHN1Y2ggZ3VpZGFuY2Ug d2lsbCBiZSBjYXNlLXNwZWNpZmljLiZuYnNwOw0KSW4gdGhlIFVLIHRoaXMgd291bGQgYmUgdGhl IEluZm9ybWF0aW9uIENvbW1pc3Npb25lcidzIE9mZmljZSAtIHNlZSA8YSBocmVmPSJodHRwczov L2ljby5vcmcudWsvZm9yLW9yZ2FuaXNhdGlvbnMvZ3VpZGUtdG8tZGF0YS1wcm90ZWN0aW9uLyI+ PGZvbnQgY29sb3I9IiMwNTYzQzEiPjx1Pmh0dHBzOi8vaWNvLm9yZy51ay9mb3Itb3JnYW5pc2F0 aW9ucy9ndWlkZS10by1kYXRhLXByb3RlY3Rpb24vPC91PjwvZm9udD48L2E+IGFzIGEgZ29vZCBw bGFjZQ0KdG8gc3RhcnQgYW5kICA8YSBocmVmPSJodHRwczovL2ljby5vcmcudWsvZ2xvYmFsL2Nv bnRhY3QtdXMvIj48Zm9udCBjb2xvcj0iIzA1NjNDMSI+PHU+aHR0cHM6Ly9pY28ub3JnLnVrL2ds b2JhbC9jb250YWN0LXVzLzwvdT48L2ZvbnQ+PC9hPiBmb3IgY29udGFjdCBpbmZvcm1hdGlvbi4m bmJzcDsgPC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6 ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+Jm5ic3A7PC9zcGFuPjwvZm9udD48 L2Rpdj4NCjxkaXY+PGZvbnQgZmFjZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMnB0OyI+Jm5ic3A7PC9zcGFuPjwvZm9udD48L2Rpdj4NCjxkaXY+PGZvbnQgZmFj ZT0iQ2FsaWJyaSIgc2l6ZT0iMyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMnB0OyI+PGI+QW5k cmV3IDwvYj48L3NwYW4+PC9mb250PjwvZGl2Pg0KPGRpdj48Zm9udCBmYWNlPSJDYWxpYnJpIiBz aXplPSIzIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEycHQ7Ij4mbmJzcDs8L3NwYW4+PC9mb250 PjwvZGl2Pg0KPGRpdj48Zm9udCBmYWNlPSJDYWxpYnJpIiBzaXplPSIzIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEycHQ7Ij4mbmJzcDs8L3NwYW4+PC9mb250PjwvZGl2Pg0KPC9zcGFuPjwvZm9u dD4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_LO2P265MB1327E54F6CE3C39EAF0C3BD1C2C10LO2P265MB1327GBRP_-- From nobody Thu Jul 25 09:26:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7214A120019 for ; Thu, 25 Jul 2019 09:26:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.188 X-Spam-Level: X-Spam-Status: No, score=-4.188 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xNC2L8giPa-w for ; Thu, 25 Jul 2019 09:26:22 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C05112000F for ; Thu, 25 Jul 2019 09:26:21 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 18BB76A34B; Thu, 25 Jul 2019 18:26:17 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1564071977; bh=YOCCP7SNazKLNRFcvUkPbqGtT8OXKsOeUf9a3tjiqX0=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=cn7azkv/gJyoirS5Y/FItWgS3G2yLLd5DsjAzUfF0Ktzb0XSUGKQQOXwmdgSgSnfM rDms1Fudz3S5kHWkrj/weIT66aixG6IysOXphnxEY7v8qxCBGlTp92fl5R5Nx9RpJv IJ5NYkRqYgN+KjH/FwUSGsuqO1ejK+FVgfb6RFdii9V4+twYlVLkFI9kbwiiOw8e0T sN0Y7mIK7Nhf3i1j3lEmPegUwaU1ouJ3zXDqfNjXqcdNcEdfnE/OscUrKywrfBxMJW 3m3Y5NB0ldBotohl9KC7HlLa9XflV4q/G9sfoOmuTaBY7GqEdCSF/Ew3FTJA6emNC3 Qy6DTs0m2T3wA== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 0CEF73C047B; Thu, 25 Jul 2019 18:26:17 +0200 (CEST) Date: Thu, 25 Jul 2019 18:26:16 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Adam Roach Cc: add@ietf.org Message-ID: <621882937.26997.1564071976996@appsuite-gw1.open-xchange.com> In-Reply-To: <74f7939c-10c8-6e31-c6e8-cd00e58ee558@nostrum.com> References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <2044195920.26849.1564066278788@appsuite-gw1.open-xchange.com> <74f7939c-10c8-6e31-c6e8-cd00e58ee558@nostrum.com> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev8 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 16:26:24 -0000

    Il 25 luglio 2019 17:28 Adam Roach <adam@nostrum.com> ha scritto:

    Sure. That's a different objection than the surveillance capitalism concern that I was responding to, and I'm not sure there's *any* jurisdiction on the planet that is immune from such concerns [1] [2] [3] [4].
    Sure, and that is why moving data across jurisdictions is not a reliable solution to the problem of providing more privacy or less censorship for everyone. But each of us generally (and excluding dictatorships) has better ways to defend him/herself in his/her own jurisdiction, than in a foreign one. At least, I know how to get a lawyer and go to court here, and I can vote for a different government and build a public opinion campaign against them.

    Moreover, when it comes to law enforcement, the commonly accepted balance between privacy and security is also highly cultural. I have no problem with my government tracking what people do online in my country, if they do it selectively under proper processes, only use the information for security and protect it properly; I actually prefer that to a scenario in which law enforcement is completely blind on online activities. However, in the U.S. the mindset seems to be really different. This is another reason why you might want not to mess up jurisdictions.

    But even if we come back to surveillance capitalism, I would prefer my DNS data to stay with companies that do not have surveillance capitalism as a business model, rather than with companies that have surveillance capitalism as a business model but commit to refrain from applying it to DNS data. While Mozilla does not belong to this latter category, many likely DoH operators do, and this explains a certain degree of skepticism on DoH's privacy properties outside the IETF community (see for example professor Bellovin's reply yesterday at the tech plenary, when asked about DoH).


    In terms of worries about queries from citizens of EU countries being sent to servers that are subject to US jurisdiction: we don't have immediate plans to implement DNS-over-HTTPS (DoH) in Firefox outside of North America. We are currently exploring potential DoH partners in Europe that would be employed for the benefit of European users.

    And that - as a Firefox user from Europe - will be much appreciated, as long as you do not change my resolver without my consent :-)

    As a DNS vendor, we are encouraging the resolver operators we are in touch with to deploy DoH, we are happy to support them in this, and we would be delighted to see those resolvers in your trusted list, as an option for users that choose not to use their local resolver. Still, we think that in Europe you should prioritize the local resolver.

    -- 

    Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
    vittorio.bertola@open-xchange.com 
    Office @ Via Treviso 12, 10144 Torino, Italy
    From nobody Thu Jul 25 15:59:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 332A31201BB for ; Thu, 25 Jul 2019 15:59:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L0KO0UwJaOeH for ; Thu, 25 Jul 2019 15:59:53 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [213.121.35.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC2AD1202ED for ; Thu, 25 Jul 2019 15:59:49 -0700 (PDT) Received: from tpw09926dag12e.domain1.systemhost.net (10.9.212.12) by BWP09926083.bt.com (10.36.82.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Thu, 25 Jul 2019 23:59:42 +0100 Received: from tpw09926dag11e.domain1.systemhost.net (10.9.212.11) by tpw09926dag12e.domain1.systemhost.net (10.9.212.12) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 25 Jul 2019 23:59:46 +0100 Received: from RDW083A012ED68.bt.com (10.187.98.38) by tpw09926dag11e.domain1.systemhost.net (10.9.212.11) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Thu, 25 Jul 2019 23:59:46 +0100 Received: from GBR01-CWL-obe.outbound.protection.outlook.com (104.47.20.54) by smtpe1.intersmtp.com (62.239.224.234) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 25 Jul 2019 23:59:07 +0100 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eNCmvGQkgqRjThaRj6VkRFd0wV9PLwvAsY5PDw3TPpfw/vdx7Bsu3jzmcGQlinbThdOBMEzQwJBHuoqXrmarD/cuI8eebrRkzWCMA/5mieAU4YVR2xZpYcvTgVsdxt1QANq4x1DnpaWEiZcUv0rKM+eawd/gLyamPYQqOXaTQjw+F/5THyQ1St4O1peqh41JPR1VFCT4xkCf9ySIyrZ7odrvWrMfLWys0Twu1cbBjJXATa4OYAcEcvcKt6IsiSiQlxd00W8v1zx6U1Bz2Ct4EYz3SAZ7gTL1xE26VgnreXTafPkqv5ogG2/+LN11hx0pLxjJ+l7LhLvDa5uotalHHw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BpM5RrYxNjhig0V9uMGUykzwsaxLoKtDbEYvd4mhjFA=; b=RMnZEw6esJDiEV5MrZMaXsSRa05Tku3fCUonHOvi91a+jq6klPjvWIDSqfAEF9GFk6eEgtZ5VkZpn4TVOEi0Ik0K1QVqUnvxJbUo9bwwmOiqaonZ46d9gN9ln+tbvZ5oi5ZURZJuBJ34sMoFETtaj8aG509poA/S1WN0plWvFGjr6TMA4l5EWoRcUxpr8vUo6nNj8fk5Barb/J7Yg4cWSqfiUrjPzXHfgqd6l3I8/JKZhI9HchMTLzrtTWSKXdDuKaa3CbqF42pTB5KG2QpW3Ai2IbO/o50/kliR6hzR834RR6h4l+ZqTpK36HylfLtjJXvSPjZ+qTNMbcfLqW0opg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=bt.com;dmarc=pass action=none header.from=bt.com;dkim=pass header.d=bt.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BpM5RrYxNjhig0V9uMGUykzwsaxLoKtDbEYvd4mhjFA=; b=VcnjNvfc0l9Hx7kOQEbl8GPpJNO11oimtTQ7kRfg+DGJfl6cSnyvXTaUlDAvauNMAbZ4m1rTmvby++qPq6ebLBBCMH3k1ifMfzEMutaHWf91i3ZCelPdH907HhZKETf92f598iLZvWZD4O9YAgqtIc22Xy8M5H9rHPA1QpNqK9M= Received: from LNXP123MB2251.GBRP123.PROD.OUTLOOK.COM (20.179.129.203) by LNXP123MB1819.GBRP123.PROD.OUTLOOK.COM (20.179.128.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.16; Thu, 25 Jul 2019 22:59:43 +0000 Received: from LNXP123MB2251.GBRP123.PROD.OUTLOOK.COM ([fe80::bd55:fd83:b21b:fe8]) by LNXP123MB2251.GBRP123.PROD.OUTLOOK.COM ([fe80::bd55:fd83:b21b:fe8%7]) with mapi id 15.20.2094.013; Thu, 25 Jul 2019 22:59:43 +0000 From: To: Thread-Topic: [Add] My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVQjN0tT3yle6xtE+bNqymiwuK46bb3Ohw Date: Thu, 25 Jul 2019 22:59:43 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=chris.box@bt.com; x-originating-ip: [31.133.151.116] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fa301b7f-de42-4a08-1e80-08d71153c87d x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LNXP123MB1819; x-ms-traffictypediagnostic: LNXP123MB1819: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-antispam-2: 1 x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0109D382B0 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(396003)(346002)(136003)(376002)(366004)(13464003)(52314003)(189003)(199004)(6506007)(52536014)(64756008)(66556008)(25786009)(66476007)(2501003)(76116006)(66946007)(14444005)(446003)(7736002)(966005)(5660300002)(71200400001)(66446008)(2906002)(256004)(71190400001)(66574012)(86362001)(74316002)(478600001)(99286004)(6436002)(55016002)(9686003)(2351001)(566174002)(66066001)(33656002)(476003)(8676002)(68736007)(6116002)(6916009)(316002)(11346002)(7696005)(8936002)(486006)(26005)(3846002)(6306002)(81166006)(81156014)(53546011)(5640700003)(53936002)(1730700003)(76176011)(14454004)(186003)(305945005)(102836004)(148743002); DIR:OUT; SFP:1101; SCL:1; SRVR:LNXP123MB1819; H:LNXP123MB2251.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: bt.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: rzth4QZQ9uHQ7fHqXxS6/o7CzYWR6vq0RuozUgOiA5QbEjj0/V0BvoCQFJB9vhHlsL+7qguQeQxBHvHYpva2TIZrmWOEaLZVb+NP+iiCFD6dCYTooEQFM7l2pFP8Icb264tXGImvAN8go2YydndkyyWDmQaYdFRSjpmygsq/mkHbRE6QXUHvDiMSM+ER6gYyA3o+mYAY6u1f1j/KRBq1ceMCiilQtSC9TLWBmx0H5+5pfluX1Ad3P8Cpfuuo1StK2oldJ3oZcXREcCk7IyEovQSxxt8hyJi3jjsB7fukRSe9CzMwivsahyAfF89FpRU7/pqB2wsws9f23AECAMDYw8erz71dKCT9BnnsBlcjjqXqw1/CvYyPRio8x4b41aY4HtLFOk2JeV34hSbFds0EA775VilDWhgnH6d6cilUQrg= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: fa301b7f-de42-4a08-1e80-08d71153c87d X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jul 2019 22:59:43.8066 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a7f35688-9c00-4d5e-ba41-29f146377ab0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: chris.box@bt.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: LNXP123MB1819 X-OriginatorOrg: bt.com Archived-At: Subject: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 22:59:56 -0000 Wes posted a set of 8 thought-provoking questions to the list yesterday. Be= low is my attempt at a response to each one. Also I fully agree that protoc= ols are not evil, and have never suggested that one is. It is the use of th= em that we are considering. Anyway, to the questions. 1. My goals are to add privacy and security to DNS while not breaking thing= s, still keeping a lid on malware, not astonishing end users, obtaining the= ir informed consent for any necessary data processing, and for the provider= of the access network (such as an ISP) to be able to offer support to user= s who are experiencing problems. The architecture described by Brian Dickso= n in https://mailarchive.ietf.org/arch/msg/add/HlKG81q7N-3WdAzIhsM0j-IEjuI = makes some first steps on this journey, by arranging for all compliant appl= ications to use the same route out of the users' device. 2. If browsers honor the DoH-Preference header described in draft-schinazi-= httpbis-doh-preference-hints, yes, this can split the global name space. If= google.com tells me to use chrisboxatbt.dns.google.com for all google.com = resolutions, then Google is at liberty to respond to my queries there in an= entirely different way than they would for their public authoritative zone= s. It also makes it trivially easy to identify me. 3. One ramification of the above is that it would not be possible for an en= terprise firewall to dynamically permit outbound access to an IP address be= cause it had seen the related DNS answer that provided the IP, and it's sat= isfied that the domain being connected to is ok. There will be many others. 4. Descriptions of many operational impacts of both encryption and centrali= zation can be found in draft-reid-doh-operator and draft-livingood-doh-impl= ementation-risks-issues. 5. I think we have an obligation to inform users which companies will be re= cording where they go on the internet. It can be argued that if users choos= e to purchase access from provider X, then they have consented to X handlin= g this in some way. Similar when users choose to go to website Y, they have= consented that Y will know about this. Beyond that, users will be surprise= d, and customer support will be at best difficult, at worst impossible. 6. If we were starting from scratch, obviously we would begin with the requ= irements, but these are still up for debate because we are talking about pr= ivacy and it's not yet clear who has the right to know about, and influence= , network access. I think we need rough consensus on the requirements befor= e design could begin. 7. It's clear to me that a ramification of fragmented DNS is a lower rate o= f caching, and higher latency. In an environment such as Uganda it can be h= ighly impacting: https://mailarchive.ietf.org/arch/msg/add/qkbGVukRPkh1wuiG= CHmPPn6TwOw 8. You ask for "localized, encrypted resolution that preserves user DNS res= olution privacy". In part this depends on the extent to which the user is h= appy with sharing data with the local network provider. If they trust BT as= an ISP, and are at home, using the BT network, then the answer is simple -= they could use BT's local DoH server for everything. In less straightforwa= rd cases, perhaps there needs to be access to both a local resolver and a m= ore central resolver that this user has chosen to trust. We could extend th= is with the resolvers owned by websites they are accessing, but this leads = to the tracking and split namespace issues described above. I do not know the optimal solution here; all I know is there are a set of p= roblems waiting to be solved. Chris -----Original Message----- From: Add On Behalf Of Wes Hardaker Sent: 24 July 2019 11:17 To: add@ietf.org Subject: [Add] My longer list of questions [from partial distribution at th= e MIC] Below is the longer list of thoughts at questions about ADD that I started = at the microphone. Thank you especially to those that encouraged me to wri= te these up. # Thoughts: ## Protocols themselves are not evil They're just bits on a wire. It's only misuse of the bits that is a proble= m. DNS is not a problem. DoH is not a problem. It's ONE solution to an u= nderlying problem: solving a privacy problem by encrypting DNS requests and= responses help to ensure user privacy, and DoH is one mechanism to attempt= to solve aspects of that problem. It does so by shifting who can see the = traffic, which is all encryption can ever easily do. We have multiple choi= ces in front of us, and I don't find any of them ideal with "no cons". ## Routing DNS requests Today, devices are already routing DNS requests to places different than th= e access point initially offered them. They do this sometimes by routing e= verything through a different network, such as when a VPN is in use. Split= -tunnel VPNs are a bit more tricky, as typically all DNS requests are route= d to the VPN's DNS server (for split-DNS "benefits") even though traffic se= nt to resolved addresses may not be. In both of these cases, users are typ= ically aware that they're operating in a special environment. The average = user does not, however, use a VPN. ADD technologies, which include DoH, DoT, global resolvers (e.g. google, cl= oudflare, quad9, opendns), and in-application full resolution required for = in-app DNSSEC validation, all have the potential to change where resolution= occurs at a much more granular level. DNS requests may be handled by comp= letely different services based on the application type (e.g. web browser v= s an email application displaying html) or even implementation (e.g. Firefo= x vs Opera). It is highly unlikely that the average user will be aware of = this DNS request distribution architecture, however. Users will have troubl= e selecting where to send trouble ticket requests when "some aspect" of the= Internet isn't working for them when "it's always the DNS". For example, = a newly emerging issue may be a website that may suddenly not work under Ch= rome when it does under Safari, with the underlying reason being solely whe= re DNS resolution happens. [Note: I'm not labeling this change as good or bad, just calling it out as = something worth consideration] ## User understanding becomes tricky # Questions outstanding in my mind: The above has led me to a series of questions, that I would love community = input and thought about. 1. Our primary goal in the IETF is standardization when interoperability ov= er individually different implementation is beneficial. As multiple applic= ation stacks are trending toward their own initial implementations of DNS r= esolution, what are the goals of promoting interoperability and (hopefully) interchangeability? What features and benefits are we architec= ting for? What can we make simpler? What is the right/best architecture f= or the problem? 2. Does splitting the DNS resolution paths into small pieces (possibly with= a potential side-effect of centralization if only a few resolution service= s are offered), have the potential to split the global name space (further)= ? If DNSSEC validation is only performed at the resolver, and never in the= application, then resolvers have the freedom to answer for names that may = not exist, or not answer for names that they are censoring by choice (spam,= malware protection) or by force (government mandate through jurisdictional= control). What concerns should we be focusing on in this area to ensure t= he continuation of a consistent global name space under the dual threat/ben= efit of possible centralization? 3. What other ramifications exist by promoting a per-protocol or per-applic= ation or per-vendor DNS resolution solution? 4. What operational impacts will there be from encrypting all DNS traffic, = both good and bad? Just like TLS in the data-center issues have made debug= ging user problems difficult (and expensive), DoH and similar technologies = may render ISP/access-point help desk's functionally unhelpful. 5. Do we and how do we inform users of this new architecture? Do users need= to know what the resolution default path's are for of each OS, service and= application? What are the ramifications of adding another service that ma= kes it harder for them to provide support desks with the necessary details = of issues they're observing. 6. If we were architecting this from scratch, what protocol would be select= today? Would it be DoH? Would it be DoT? Would it be DNSCurve? If we didn't have the deployment impediments that are getting in the way to= day (e.g. forced filtering), what would we select? Are we architecting sol= utions for impediments over good engineering because we must? Is there a b= etter middle ground? 7. Deployment optimization is always difficult, and with a distributed DNS = resolution system/fragmentation, architecting effective resolution caching = becomes even more challenging. What ramifications are likely to appear as = a result of having multiple caches with different contents on end-user devi= ces? What are the ramifications of such a system in a low-bandwidth, or hi= gh-loss environment? 8. How does application-centric resolution affect and get affected by local= ization efforts and constant mobility? Is centralization likely because a = global-scale, low-latency resolution is difficult for small-scale deploymen= ts? Can we achieve localized, encrypted resolution that preserves user DNS= resolution privacy without requiring centralization? [side thought this morning: I was imagining an airline attendant resetting = the entire plane's network because of multiple complaints by passengers hav= ing network trouble, when the reality was they were all using a web browser= pointing to a single (default?) DoH vendor and it had nothing to do with t= he local access point, but all passengers had to suffer the reset] -- Wes Hardaker USC/ISI -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add From nobody Thu Jul 25 22:52:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E85C41202CD for ; Thu, 25 Jul 2019 22:52:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OtWgynsX4vDI for ; Thu, 25 Jul 2019 22:52:13 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [IPv6:2a02:80:3ffe::176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB6891202FA for ; Thu, 25 Jul 2019 22:52:12 -0700 (PDT) Received: from [192.165.72.198] (unknown [IPv6:2a02:80:3ffc:0:3132:46dd:2768:5605]) by mail.frobbit.se (Postfix) with ESMTPSA id 0D3FF2994C; Fri, 26 Jul 2019 07:52:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1564120330; bh=GQx521YRfg+gz07nnojS71m2LWZ6qhY5OpUl0xMywZU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vp8OJkXLe2pfERxcs2hwOuDtVynR4645DkD82z4x5NOG6Tim4FseX10VzA52tw9Hd q1kOKrECWu8ytKNPKHQaDK/Nea+HfgikAAhIvzSFL9hgyCVpdenE3VSjXYrcSCwUMH Exy2qSXm91NyLl0EX9B7LaY2B5Jiqd1WFLRC3+/U= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Wes Hardaker" Cc: add@ietf.org Date: Fri, 26 Jul 2019 07:52:06 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: References: MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_B74C1157-9154-4EC6-8CE6-F0FDDD0B3C28_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 05:52:21 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_B74C1157-9154-4EC6-8CE6-F0FDDD0B3C28_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 24 Jul 2019, at 17:16, Wes Hardaker wrote: > 1. Our primary goal in the IETF is standardization when interoperabilit= y over individually different implementation is beneficial. As multiple = application stacks are trending toward their own initial implementations = of DNS resolution, what are the goals of promoting interoperability and (= hopefully) interchangeability? What features and benefits are we archite= cting for? What can we make simpler? What is the right/best architectur= e for the problem? The base architecture as defined by the IETF include two main things for = DNS from my point of view: - The routing of the DNS query (i.e. configuration of what is the full se= rvice resolver) is set by what I call "the operating system". All applica= tions use the same configuration. - The default configuration is set by the access provider that the end us= er have some kind of agreement with. Irrespectively if the end user is bu= ying Internet Access at home or is at an enterprise. The end user might d= o override of this by configuring a different end point (x.x.x.x - techno= logies) or by launching a VPN tunnel which I see as "layering access on t= op of access" which implies getting a new default configuration when the = tunnel is up. My view: Changing *any* of these two base assumptions is what I do not th= ink IETF should do. > 2. Does splitting the DNS resolution paths into small pieces (possibly = with a potential side-effect of centralization if only a few resolution s= ervices are offered), have the potential to split the global name space (= further)? Yes. > If DNSSEC validation is only performed at the resolver, and never in th= e application, then resolvers have the freedom to answer for names that m= ay not exist, or not answer for names that they are censoring by choice (= spam, malware protection) or by force (government mandate through jurisdi= ctional control). What concerns should we be focusing on in this area to= ensure the continuation of a consistent global name space under the dual= threat/benefit of possible > centralization? By not changing the two base assumptions above as I lay out as response t= o (1) we do not rock the boat regarding evolution of name resolution. If the above (...DNSSEC validation is only performed at the resolver...) = is a negative thing, which I can agree it is, then *that* should be fixed= , not breaking the two base assumptions I lay out above under (1). > 3. What other ramifications exist by promoting a per-protocol or per-ap= plication or per-vendor DNS resolution solution? The issues are mainly two: A. The ability to "understand what is going on" when "the access to inter= net is broken". Support cost is unknown. Changing responsibilities regard= ing DNS resolution will make it crystal clear end users can and will no l= onger get help with DNS resolution from their network provider regardless= of whether it is the enterprise or local ISP. This implies they will no = longer help with connection issues. I.e. operational nightmare. B. Legal responsibilities for DNS resolution is today tied to the respons= ibilities regarding routing and IP address allocation, i.e. with the acce= ss provider. If this is changed, the legal situation in the world will be= unknown, and the ramifications of that might break the network we know o= f today in ways we can not even dream of. Note: if the end user by making its own decision to override the DNS reso= lution path given by the access provider, she can do so by changing the d= efault configuration to something else (X.X.X.X), use a VPN, or by being = a customer of some managed device system/mechanism (like by the enterpris= e they work for). > 4. What operational impacts will there be from encrypting all DNS traff= ic, both good and bad? Just like TLS in the data-center issues have made= debugging user problems difficult (and expensive), DoH and similar techn= ologies may render ISP/access-point help desk's functionally unhelpful. Two issues here as well: A. Encrypting traffic is, which IETF have said already, a good thing. I a= gree with this. The downside will be that deep packet inspection will not= give information about the DNS traffic that passes the point of inspecti= on. I think that is a good thing, and exactly why we have encryption. B. Given encryption will protect the traffic, whoever have interest in in= specting the traffic anyways will have to say "no" in some way to the abi= lity to "hide". The only way to do so is to block specific traffic that i= s "no longer allowed", and when implementing such policy that should be a= s surgical as possible without secondary damages. To be able to minimize = secondary damages, it is important to separate "the bad traffic" from oth= er traffic. Conclusion: mixing encrypted DNS traffic with encrypted other= traffic and not having the ability to separate the two is *not* a good t= hing. Conclusion: This is where DoT and DoH and other technologies differ, and = while I think it is a good thing that DNS traffic end up being encrypted,= it must be possible to identify what is DNS-hidden-in-TLS traffic from o= ther-things-hidden-in-TLS, for example by using different port numbers. > 5. Do we and how do we inform users of this new architecture? I do not know what "this new architecure" is as the above have many open = ended questions. > Do users need to know what the resolution default path's are for of eac= h OS, service and application? What are the ramifications of adding anot= her service that makes it harder for them to provide support desks with t= he necessary details of issues they're observing. If there are changes in the form of: A. The end point of DNS routing is changing from access provider setting = to application setting OR B. There is no longer a default setting in the operating system for DNS r= outing but instead a per application setting OR C. DNS query resolution is impossible to separate from other protocols =2E..then IETF must inform not only end users, but also manufacturers and= legislators and inform them how these mechanisms are to be implemented g= iven the new architecture IETF has invented: A. How to do customer support and who is responsible for the end user abi= lity to use the Internet? B. How a legislator is to implement (and not) blocking access to certain = domain names? C. How an enterprise is implementing policies today implemented by manage= d device technologies and mix of flow inspection, dynamic IP tables and D= NS resolutions? > 6. If we were architecting this from scratch, what protocol would be se= lect today? Would it be DoH? Would it be DoT? Would it be DNSCurve? > If we didn't have the deployment impediments that are getting in the wa= y today (e.g. forced filtering), what would we select? Are we architecti= ng solutions for impediments over good engineering because we must? Is t= here a better middle ground? IETF is in the danger of just looking at one piece of of the puzzle and f= orgetting the architecture it is responsible for. The IETF is responsible for ensuring "Internet works", and this today imp= lies ability for not only end users to do their thing, but also enterpris= es, access providers and what not. Legislation in the world is in IETF only talked about in the form of "bad= States that require blocking" but we also have States that have requirem= ents on access providers that the Internet Access must work, with severe = penalties if it does not. If IETF by just looking at some local protocol = detail is changing this oversight ability from the State to ensure ISPs d= o the right thing (regarding Network Transparency, Open Internet Access a= nd what not) then IETF has the responsibility to not only explain this to= the legislators and States around the world and also if needed come up w= ith other protocol changes needed in the whole architecture that ensure f= uture functionality. That States or Enterprises want to block access to certain domain names i= s something that will not go away just because some individuals and indiv= idual companies active in the IETF have some cool ideas on how to do DNS.= It is time for IETF to grow up and be a real standard organization really= taking some real responsibilities. And for example for every proposed pr= otocol change regarding DNS resolution answer the questions and more: - Who is responsible for DNS resolution from the end users perspective? - How can legislation ensure this responsibility stays there? - How is an enterprise or network provider ensuring name resolution is ac= cording to its policies? - How is the end user given the above making a conscious choice and opt-o= ut of the mechanisms provided and run on her own? The danger is when a corner of the IETF say that every user of the intern= et is now opting out without that being known to anyone operationally inv= olved (including legally), and without IETF having tools in place to ensu= re responsibilities still exists and policies can be implemented. > 7. Deployment optimization is always difficult, and with a distributed = DNS resolution system/fragmentation, architecting effective resolution ca= ching becomes even more challenging. What ramifications are likely to ap= pear as a result of having multiple caches with different contents on end= -user devices? What are the ramifications of such a system in a low-band= width, or high-loss environment? Nothing prohibits the recursive resolver (which also might do validation)= on the local ::1 host route the DNS queries to a box which in turn use a= forwarder which might even be a X.X.X.X kind of service. I.e. caching ha= s to do with the RD flag more than the DNS routing. In high latency or low bandwidth environments, a local cache is good. In = higher bandwidth low latency, large centralized cache is good. I do not know how many locations in low latency scenarios I have helped b= y having them adding (as the network operator) a local full service resol= ver that accepts RD. Sure, slow before the cache is loaded, but earlier e= very query was slow. It is further bad to see TTL go down on RRSets as that also makes caches = in specifically difficult environments have issues if queries for the sam= e RRSet is sent more rarely than the TTL. Then the cache is cold in every= TTL cycle. > 8. How does application-centric resolution affect and get affected by l= ocalization efforts and constant mobility? Is centralization likely beca= use a global-scale, low-latency resolution is difficult for small-scale d= eployments? Can we achieve localized, encrypted resolution that preserve= s user DNS resolution privacy without requiring centralization? An access provider can already today choose to for example give their cus= tomers X.X.X.X as the end point of the DNS query routing. They can choose= to run the recursive resolver themselves. They can choose to do forwardi= ng to X.X.X.X in their recursive resolver. And with "access provider" I i= nclude not only "the ISP a user have at home" or "mobile operator" but al= so enterprise or for that matter the end user that buys a CPE and connect= s it to the ISP they get service from. Adding encryption to this is a piece of cake given a. we keep the DNS con= figuration architecture the same and b. we keep the protocol identifiable= and separable from other protocols. > [side thought this morning: I was imagining an airline attendant resett= ing the entire plane's network because of multiple complaints by passenge= rs having network trouble, when the reality was they were all using a web= browser pointing to a single (default?) DoH vendor and it had nothing to= do with the local access point, but all passengers had to suffer the res= et] Exactly. The Internet Architecture is built upon the idea that default configurati= on of DNS, IP address allocation and routing is the responsibility of who= ever provides Internet Access. Do not change that. Patrik --=_MailMate_B74C1157-9154-4EC6-8CE6-F0FDDD0B3C28_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXTqVBw8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI1835dQCdEo5Ji0Y3BFIs8QgJzxoN1WRv3s4An3Hs5HPj s/K4eIiw1uLNyp7/2lhU =jHIe -----END PGP SIGNATURE----- --=_MailMate_B74C1157-9154-4EC6-8CE6-F0FDDD0B3C28_=-- From nobody Thu Jul 25 23:08:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B6EF12029A for ; Thu, 25 Jul 2019 23:08:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F3P8M3uFFWYB for ; Thu, 25 Jul 2019 23:07:58 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BED71202AA for ; Thu, 25 Jul 2019 23:07:58 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id m24so102507842ioo.2 for ; Thu, 25 Jul 2019 23:07:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=kNXqwZ/IJNUFwjGfLZKvcfint9cnAPRGAS34Z68xYtc=; b=V9iqPf99CmiNav7yjpO2kqjanqltAde5UgwZKiuNfNIhjO/kds9gvkJnfBwLkXczI7 GeYMeQLDxIbMvv4IUcm+aGLJmtTlYs9Kjfk0meUJYS901eg0MMUTUt85yMIHu/30TsNL UFCWNoUR5pq+kdR8KJRlcFLlXBT/X2BtIuTXwVIBzgUQw0gcEJVkKVoaE6J0I42Hk/3y z7QrF9MQkI2hxpkyMdJLCvwFcX8cDE3u7Rv5x5NwSFsYqjaExlfwoZiflEbnGciuWmvI /YI2vfjzsrOxdB/oJOUWQgOuNcyMO99C2Qmr54/fyW/up26IRwC8Xy4uZmdcX+zDnR/9 vVsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=kNXqwZ/IJNUFwjGfLZKvcfint9cnAPRGAS34Z68xYtc=; b=eYMTJjK3pfXtNkTY7QhCiambIJ4c6LEDxmXV4ksW5rPDdkmCOwa0PCtocQVce+6/Nn +H7e8GeD/5WR2nqa9pYS3nQEUbJd94QTb2o4pJeNRY1DgzNaD2DNx6qeFN7VOn8/B9qW BzSho7bUCGJwhylBi1kLbIHJGe/sLvm/y3a0DdPuF/s8E7WeuWWcK0W5WTYoXcGVO9P8 mNDXk2Lkdsk2qDXvL1L2YBxsP2XjFYgtwWbFyPy/2AO5hi+ciSZYF7JXWyFdQUA6vrSm j5Taq069ngTL8wLQFeZLmjO58lmg1D/E56grq0hemrREXdhHFt2R+BMStqdDF15lvWc7 0zRQ== X-Gm-Message-State: APjAAAWz8mtIdeuG5WIlNpRGe714iu0/CxvBdojqFYGLhEcxZcB3mrYP QvwqlhIS7+9LCPF4g4FIMqdR3dhmGF+S6slHNno= X-Google-Smtp-Source: APXvYqxivAUjWCp+Ubtw7y7ksVE4/MaL0CBiScNtwX0qkn9VlRemdJJfFo6nebfi8HYvMYOg0I0O/sxkU5d60efwD5Q= X-Received: by 2002:a6b:b602:: with SMTP id g2mr84577176iof.54.1564121277756; Thu, 25 Jul 2019 23:07:57 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Thu, 25 Jul 2019 23:07:46 -0700 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Wes Hardaker , add@ietf.org Content-Type: multipart/alternative; boundary="000000000000257a00058e8f5da0" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 06:08:02 -0000 --000000000000257a00058e8f5da0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Jul 25, 2019 at 10:52 PM Patrik F=C3=A4ltstr=C3=B6m wrote: > > > [side thought this morning: I was imagining an airline attendant > resetting the entire plane's network because of multiple complaints by > passengers having network trouble, when the reality was they were all usi= ng > a web browser pointing to a single (default?) DoH vendor and it had nothi= ng > to do with the local access point, but all passengers had to suffer the > reset] > > Exactly. > One problem with this assertion is that it's usually the airline's DNS that fails first and frequently. Try it yourself: turn on a VPN or use DoH in Firefox next time you're on a plane, and enjoy a much better experience. I think they do a bunch of aggressive (and, let's note, ineffective) DNS filtering so people don't watch YouTube, and those servers don't seem to be very reliable. It would be better to just throttle each client's bandwidth. > > The Internet Architecture is built upon the idea that default > configuration of DNS, IP address allocation and routing is the > responsibility of whoever provides Internet Access. > I couldn't find a reference for this assertion. I looked at RFC 1958 < https://www.ietf.org/rfc/rfc1958.txt>. In fact, in section 6.2, it says: "Confidentiality and authentication are the responsibility of end users and must be implemented in the protocols used by the end users. Endpoints should not depend on the confidentiality or integrity of the carriers." thanks, Rob --000000000000257a00058e8f5da0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On Thu, Jul 25, 2019 at 10:52 PM Patrik F= =C3=A4ltstr=C3=B6m <paf=3D40frobbit.se@dmarc.ietf.org> wrote:

    > [side thought this morning: I was imagining an airline attendant reset= ting the entire plane's network because of multiple complaints by passe= ngers having network trouble, when the reality was they were all using a we= b browser pointing to a single (default?) DoH vendor and it had nothing to = do with the local access point, but all passengers had to suffer the reset]=

    Exactly.

    One problem with this assertio= n is that it's usually the airline's DNS that fails first and frequ= ently. Try it yourself: turn on a VPN or use DoH in Firefox next time you&#= 39;re on a plane, and enjoy a much better experience.

    <= div>I think they do a bunch of aggressive (and, let's note, ineffective= ) DNS filtering so people don't watch YouTube, and those servers don= 9;t seem to be very reliable. It would be better to just throttle each clie= nt's bandwidth.
    =C2=A0

    The Internet Architecture is built upon the idea that default configuration= of DNS, IP address allocation and routing is the responsibility of whoever= provides Internet Access.

    I couldn'= ;t find a reference for this assertion. I looked at RFC 1958 <https://www.ietf.org/rfc/rfc1958.txt= >.=C2=A0

    In fact, in section 6.2, it says:<= /div>"Confidentiality and authentication are the=C2=A0responsibility o= f end users and must be implemented in the protocols used by the end users.= Endpoints should not depend on the confidentiality or integrity of the car= riers."=C2=A0

    thanks,
    Rob
    --000000000000257a00058e8f5da0-- From nobody Thu Jul 25 23:14:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A51031202AF for ; Thu, 25 Jul 2019 23:14:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SR66qOgFUXzm for ; Thu, 25 Jul 2019 23:14:42 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [IPv6:2a02:80:3ffe::176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 82B2E1202AA for ; Thu, 25 Jul 2019 23:14:42 -0700 (PDT) Received: from [192.165.72.241] (unknown [IPv6:2a02:80:3ffc:0:3132:46dd:2768:5605]) by mail.frobbit.se (Postfix) with ESMTPSA id 1CE142981D; Fri, 26 Jul 2019 08:14:40 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1564121680; bh=sZ+da7gvmmQ9Y8eIrHbLI+tiG/G9QTFWJWmS+5C4WrM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VSOKtZ2vhHsewc+pHIMYCfnaPZPYonkY3JejD4su9JYyOhYSn/mg0/O7yS5YsadIV +E5KD4MvYYL6o2rjYafZ57XWu6j/a6dDvpj4QwtN1qsIHw6mvwzq6FWV+WrWK4XHmu BfTC7dpTkPtw9h8+ALzdrNWtTF45FzXGNe0gaMGs= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Rob Sayre" Cc: "Wes Hardaker" , add@ietf.org Date: Fri, 26 Jul 2019 08:14:38 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> In-Reply-To: References: MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_2FB0AF8A-67CC-4520-B46E-D69849C7CCE0_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 06:14:44 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_2FB0AF8A-67CC-4520-B46E-D69849C7CCE0_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 26 Jul 2019, at 8:07, Rob Sayre wrote: > One problem with this assertion is that it's usually the airline's DNS = that fails first and frequently. Try it yourself: turn on a VPN or use Do= H in Firefox next time you're on a plane, and enjoy a much better experie= nce. YMMV! The key here is what responsibility the airline as the network provider h= ave for a well functioning internet access? My point is that today the airline DO have that responsibility, while you= as a customer CAN make a choice like the one you explain. > I think they do a bunch of aggressive (and, let's note, ineffective) DN= S filtering so people don't watch YouTube, and those servers don't seem t= o be very reliable. It would be better to just throttle each client's ban= dwidth. No. They want to block access to certain things. They have decided to do so b= y blocking access to certain domain names. This in turn they police by fi= ltering DNS queries. >> The Internet Architecture is built upon the idea that default >> configuration of DNS, IP address allocation and routing is the >> responsibility of whoever provides Internet Access. > > I couldn't find a reference for this assertion. I looked at RFC 1958 < > https://www.ietf.org/rfc/rfc1958.txt>. > > In fact, in section 6.2, it says: > "Confidentiality and authentication are the responsibility of end users= and must be implemented in the protocols used by the end users. Endpoint= s should not depend on the confidentiality or integrity of the carriers."= Ehhh...what you say is that it is not the default situation on the Intern= et today that the access provider has this responsibility, and includes t= hat as part of their service? Can you point me to one access provider whi= ch do not include DNS end point information as part of the zeroconf they = use in their network? Patrik --=_MailMate_2FB0AF8A-67CC-4520-B46E-D69849C7CCE0_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXTqaTg8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI183JJwCfc5+nxOcgzxTSlyR50GzjX9WvenwAoI6IOFFL p3IJ0mVX7vNK1HLoykur =iTTr -----END PGP SIGNATURE----- --=_MailMate_2FB0AF8A-67CC-4520-B46E-D69849C7CCE0_=-- From nobody Thu Jul 25 23:23:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70CB51202B3 for ; Thu, 25 Jul 2019 23:23:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id roNKojkf6DYu for ; Thu, 25 Jul 2019 23:23:11 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6A3B21202AA for ; Thu, 25 Jul 2019 23:23:11 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id f4so102553671ioh.6 for ; Thu, 25 Jul 2019 23:23:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=duvJT/g53ZHqnWnQMVb3+FeKZlPxALE6tatLvBKpK14=; b=A6UnrUXITYfEoZMrftA0NnHhAD7JfILhI2ChGBKeFzu4+0mN3NInp6wokGYodDy8hM 9SYizk5wMrjPBtjMlpS0zdWFfjjf7o5C7YzMUPkjLRa1SasmxUIXRCKtv4qJoREAk5tW Hv2veZ1gtu1wHSsmcnTW48yVM9X6iWUqjmjf4TZrnugrN9mO2VbCNPpqsRT7391xKvjJ oV1kkUNnHXnGV1vRQw1ACfTTIeOLlfNB+wFnnKaF3cQ3aNlaIzKnjTYaSXvmm2C4+MKj Bkyc0a85ZGMfHwd8mVA0WQrNBk8VMvZsQobfYmZzmVmrIRHbsSGTPaM0J1e7jdWwcnOE y/QA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=duvJT/g53ZHqnWnQMVb3+FeKZlPxALE6tatLvBKpK14=; b=joO6IoLjyJT9Cn+YyGzOL2aL1dVZmW00hKvyzYA7Yk2tzSBqE/wBBYassDrH8PI+sn DL/cYlrpJWN6d0GwRFoDWWKX9O7qbadEctxLqE2q9jaPmTw6yKQTA8ArbXS0BriL0d+1 syTTcNMLBsZ9ygV0I90+0quO6CcTg7+v0eVPR9IYxt3+plwenNY0SoJoxJ3Sdpdvieyp l+O4nsl7mYOogMzBaL850NAUsvBalvapH0pKMKAOop+00h8J+K3rBAxNkZU0J0aqMj6n GRzeXkKbcizxMFkmUgWCt/EWtsnQYjRCEHvTB0kmcjybkdYO4obkkCspU8TdZZsGIFQ/ emSw== X-Gm-Message-State: APjAAAUWgirxUO2lmHFWhKsR8orqVaIjq4TY0072I0/Ydvj8msNXi2BY wIXl8inxwxEFwnDznDCYOMWQ3UQ3isXLPzo4EdRTB9vqN76Igw== X-Google-Smtp-Source: APXvYqwLTOEpDBWf4T31ANk9UlK20JaKh8XMzwB8bmXyrHBfq10T2uXktJqHhdih/DyCjCFAYtZyU/SPdpX3Ne8c3WU= X-Received: by 2002:a5e:9515:: with SMTP id r21mr52779746ioj.257.1564122190574; Thu, 25 Jul 2019 23:23:10 -0700 (PDT) MIME-Version: 1.0 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> In-Reply-To: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> From: Rob Sayre Date: Thu, 25 Jul 2019 23:22:59 -0700 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Wes Hardaker , add@ietf.org Content-Type: multipart/alternative; boundary="0000000000008dfbc9058e8f9341" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 06:23:13 -0000 --0000000000008dfbc9058e8f9341 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Jul 25, 2019 at 11:14 PM Patrik F=C3=A4ltstr=C3=B6m wrote: > They want to block access to certain things. They have decided to do so b= y > blocking access to certain domain names. This in turn they police by > filtering DNS queries. > They actually say what they want to do on the billing page: provide basic internet access for email and whatnot, but not streaming media. They do this, badly, by using DNS filtering to block YouTube and friends. So, I guess I disagree with the assertion that they are blocking access to certain domain names. They aren't blocked to anyone that can install a free-trial VPN app on their mobile phone. > > >> The Internet Architecture is built upon the idea ... > > Ehhh...what you say is that it is not the default situation on the > Internet today > Well, you wrote "The Internet Architecture" in all-caps. It seemed like that might refer to a document or standard of some kind. thanks, Rob --0000000000008dfbc9058e8f9341 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On Thu, Jul 25, 2019 at 11:14 PM Patrik F= =C3=A4ltstr=C3=B6m <paf@frobbit.se= > wrote:
    They want to block access to certain things. They have decided to do so by = blocking access to certain domain names. This in turn they police by filter= ing DNS queries.

    They actually say what= they want to do on the billing page: provide basic internet access for ema= il and whatnot, but not streaming media. They do this, badly, by using DNS = filtering to block YouTube and friends.

    So, I gues= s I disagree with the assertion that they are blocking access to certain do= main names. They aren't blocked to anyone that can install a free-trial= VPN app on their mobile phone.
    =C2=A0

    >> The Internet Architecture is built upon the idea ...

    Ehhh...what you say is that it is not the default situation on the Internet= today

    Well, you wrote "The Intern= et Architecture" in all-caps. It seemed like that might refer to a doc= ument or standard of some kind.

    thanks,
    = Rob
    --0000000000008dfbc9058e8f9341-- From nobody Thu Jul 25 23:30:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF4C61202FD for ; Thu, 25 Jul 2019 23:30:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qOYHQr9CUVcH for ; Thu, 25 Jul 2019 23:30:42 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.185]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F31D912030B for ; Thu, 25 Jul 2019 23:30:41 -0700 (PDT) Received: from [192.165.72.241] (unknown [IPv6:2a02:80:3ffc:0:7057:2d3:6ff3:9349]) by mail.frobbit.se (Postfix) with ESMTPSA id E463C29761; Fri, 26 Jul 2019 08:30:39 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1564122639; bh=8DqyqR7S2gI2YYXXq4TLhiGGZzCIXuzOfMbBdxEoJPo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ubi5aQNRHU4w01ndix1e90LBFapcFOA/El+7Ya8uUCuKUHM8iMNKGPIXpyD1w2Pn1 v71Sc0dTtAopZGyCDnI2gycT5MHUtCk/gPpIPAtfQdDh9RpHNwQ+fr1W/vEdU4WayD g6PSxNaCS9JZr/4Kv8mcIb/fI9s1zE8GSTuAqh08= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Rob Sayre" Cc: "Wes Hardaker" , add@ietf.org Date: Fri, 26 Jul 2019 08:30:38 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> In-Reply-To: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_9F77C90D-3F8C-4F7B-86F8-3F57F57F310C_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 06:30:47 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_9F77C90D-3F8C-4F7B-86F8-3F57F57F310C_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 26 Jul 2019, at 8:22, Rob Sayre wrote: > They actually say what they want to do on the billing page: provide bas= ic internet access for email and whatnot, but not streaming media. They d= o this, badly, by using DNS filtering to block YouTube and friends. Exactly. They have some goal, and implement it by filtering certain domai= n names, and in turn they implement that by hacking the recursive resolve= r they provide. > So, I guess I disagree with the assertion that they are blocking access= to certain domain names. They aren't blocked to anyone that can install = a free-trial VPN app on their mobile phone. Exactly my point. They like enterprises like governments do look at how s= uccessful the blocking mechanisms they have deployed is. As long as it is= successful enough, that is enough. When it is not successful enough anym= ore, they have to change method to reach the same goals. And my point is that if IETF is changing the model so that the success ra= te changes in implementing such policies, then IETF have a responsibility= to provide other tools that can be used by the same parties to implement= the same policies. And to answer THAT question, my view is that it would be silly for the IE= TF to change the overall model when just by changing the DNS protocol to = be encrypted, but not how to do DNS endpoint detection (for example) is s= o much easier. That way we get privacy, still have the ability for the en= d user to override the default setting and IETF do not have to really ans= wer questions by for example legislators, hardware- and software manufact= urers etc. >>>> The Internet Architecture is built upon the idea ... >> >> Ehhh...what you say is that it is not the default situation on the >> Internet today > > Well, you wrote "The Internet Architecture" in all-caps. It seemed like= that might refer to a document or standard of some kind. Ok, noted. My apologies. My intention with the caps was exactly the oppos= ite, it was to talk about what is in reality deployed out there. This while (as you point out) the end user have the ability to override t= hat by reconfiguring the operating system or use a VPN (or sign up to som= e managed device service). Patrik --=_MailMate_9F77C90D-3F8C-4F7B-86F8-3F57F57F310C_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXTqeDg8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI182U+gCfQQuuzCGqaXkfvjN2nhXR5KRrt94An2JYViwE X0iVxii+g70j9PlaCsC+ =gzTJ -----END PGP SIGNATURE----- --=_MailMate_9F77C90D-3F8C-4F7B-86F8-3F57F57F310C_=-- From nobody Thu Jul 25 23:44:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F29651202B4 for ; Thu, 25 Jul 2019 23:44:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DvbLjH2CR42e for ; Thu, 25 Jul 2019 23:44:53 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A9741202AA for ; Thu, 25 Jul 2019 23:44:53 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id s7so102497676iob.11 for ; Thu, 25 Jul 2019 23:44:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=KObnDjKtSoElBOEjl8XaoF19JOCa1TKM/GnlO6KimTQ=; b=Ysswx70J8tPJuHtADrz+ZVjIwhgbwLDrV/c34B0r78PJUGHCUmu3Npsv+rWOnNRt1g s2L3gSROKG52UFhjEPGigaa4yCkbOZiB2d7Rys5lVf07XnIpbIaT2hj6nqrygaJOC2dF 6uJa1+CKqkgCMfGt9MlwTOC9W+cS6TX4DZNOKt6Y6+HJ2cEcTBx5BP/QgagdNWXWqlNg vjOay6MSp6ps1UimrYsrEhtlXN2EzKgo57ItjZndalRsF91oD2gSX1Dtq4nI0DK21vhp IhRt/BzaftzHkUd+wGs+JGVDrotgnwf6LhB6Di0fbMJKMfyR4SnaxnvfsyUj3AvI6Lci ohYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=KObnDjKtSoElBOEjl8XaoF19JOCa1TKM/GnlO6KimTQ=; b=lW47tj0jGrTDRHmbxGFZi+8vU8sLZASjd884n5csQoLJ/X2kOJQIhPxwwSSYa3ip72 xw5RaXJNysGJQYyDi7mZhjU8Kx6Xep3vay3tuJGmDYYXPsGRTp0nXyB4ucTx4yu4oWuR 8HuCgAo3ukv0r2XQXWqKc3K5+nwf5wKj8NVijcADGNKBmwR87+cW3qamjGhg1kCm8TZD kjdpf1eGER4kyjX60Hch6yjYZoe+w/jzPR4A4xxyO2FGxCj/rXlR2IX2iXqLOenOE/PY b2jjeP6NihpuXx5Gu5pgNazorjsSXqxLtIS4e0xzpuVVCqPddV8rlRqsVwsIc3jPaSgt 9FiQ== X-Gm-Message-State: APjAAAUQxeVPq9fkXxJhWPiLtihYI00UyP1iaMURRMR9UrpUyWr1KUry 3X4t56+SjF39Qh6xg5hqt1bigvwHIz1RzQae40eErQNTDMw= X-Google-Smtp-Source: APXvYqzsff1f0noBIpIdHr0CC2aI8QluMOMNVP0PJoCoT/HoEN6hhGbNdJSEDM61O8EI+JXveDaA0eBM+tb3R5HuTHU= X-Received: by 2002:a6b:6d07:: with SMTP id a7mr21342856iod.254.1564123492413; Thu, 25 Jul 2019 23:44:52 -0700 (PDT) MIME-Version: 1.0 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> In-Reply-To: <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> From: Rob Sayre Date: Thu, 25 Jul 2019 23:44:41 -0700 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Wes Hardaker , add@ietf.org Content-Type: multipart/alternative; boundary="000000000000268da4058e8fe1be" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 06:44:55 -0000 --000000000000268da4058e8fe1be Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Jul 25, 2019 at 11:30 PM Patrik F=C3=A4ltstr=C3=B6m wrote: > > And my point is that if IETF is changing the model so that the success > rate changes in implementing such policies, then IETF have a responsibili= ty > to provide other tools that can be used by the same parties to implement > the same policies. > I don't agree with this part of your message, and I don't think you will find any IETF guideline supporting it (RFC 1958 seems against it, in fact). Someone at the ADD BoF mic mentioned that these arguments seem eerily-similar to those around HTTP/2 encryption, and I agree. thanks, Rob --000000000000268da4058e8fe1be Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On Thu, Jul 25, 2019 at 11:30 PM Patrik F= =C3=A4ltstr=C3=B6m <paf@frobbit.se= > wrote:

    And my point is that if IETF is changing the model so that the success rate= changes in implementing such policies, then IETF have a responsibility to = provide other tools that can be used by the same parties to implement the s= ame policies.

    I don't agree with th= is part of your message, and I don't think you will find any IETF guide= line supporting it (RFC 1958 seems against it, in fact). Someone at the ADD= BoF mic mentioned that these arguments seem eerily-similar to those around= HTTP/2 encryption, and I agree.

    thanks,
    Rob
    --000000000000268da4058e8fe1be-- From nobody Thu Jul 25 23:55:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46E131202AA for ; Thu, 25 Jul 2019 23:55:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DMez5JafyBpc for ; Thu, 25 Jul 2019 23:55:56 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [IPv6:2a02:80:3ffe::176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8B50120281 for ; Thu, 25 Jul 2019 23:55:55 -0700 (PDT) Received: from [192.165.72.241] (unknown [IPv6:2a02:80:3ffc:0:7057:2d3:6ff3:9349]) by mail.frobbit.se (Postfix) with ESMTPSA id F098F29865; Fri, 26 Jul 2019 08:55:53 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1564124154; bh=0dDHspQUQ1FCTEOHiDWwlFoW/Sih51OyMK/9NAPcNKE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cSh9X22pCX+TJCAeehCbe4nCmXDuv+jWBL6BarWE14in3VurFtWCrUDjUiIYkh7Pt TKzI8EGXaLL7O6azrwd93oPf7dJrG6z6nACIRZWf9WBaWUQhr1bbE51if58eQ/a++J D0v34b7XP7ngMos241D15jtsBkbjoyh8Iqq69X/4= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Rob Sayre" Cc: "Wes Hardaker" , add@ietf.org Date: Fri, 26 Jul 2019 08:55:52 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> In-Reply-To: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_30024C58-B2A8-4E19-824E-B3A5FAAD8CB7_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 06:55:58 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_30024C58-B2A8-4E19-824E-B3A5FAAD8CB7_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 26 Jul 2019, at 8:44, Rob Sayre wrote: > On Thu, Jul 25, 2019 at 11:30 PM Patrik F=C3=A4ltstr=C3=B6m wrote: > >> And my point is that if IETF is changing the model so that the success= >> rate changes in implementing such policies, then IETF have a responsib= ility >> to provide other tools that can be used by the same parties to impleme= nt >> the same policies. > > I don't agree with this part of your message, and I don't think you wil= l find any IETF guideline supporting it (RFC 1958 seems against it, in fa= ct). > Someone at the ADD BoF mic mentioned that these arguments seem eerily-s= imilar to those around HTTP/2 encryption, and I agree. First, the days are different now than before. Secondly, I claim IETF *di= d* explain to everyone why security as defined by SSL and TLS mechanisms = improved the user experience to the point that discussions between States= (for example) whether encryption in that way should be disallowed or not= =2E Those explanations and "enough friendly governments" makes it possibl= e to kill all international initiatives regarding forbidding those kind o= f encryption of flows. This is the result of the long term path that IETF have taken, very much = together with other standards organisations like W3C and others. But for = example, not so much with ENISA although the issues there regarding TLS1.= 3 seems to be under control thanks to hard work there. This is *exactly* my point. That *if* IETF do changes to "how the interne= t works" then IETF must take the same responsibility this time, and have = tools, ideas, arguments lined up regarding how the new architecture is to= o look like. And be prepared to get counter arguments from everyone that = do think it is necessary to (for example) a. identify DNS protocol flows = or b. block lookups of certain domain names. Not just say "this is the new tool in the toolbox" with the addition "by = using this new tool, no one today implementing their policy will be able = to do so in the future". The IETF have a responsibility here. Just like IETF had when HTTP with SS= L was introduced. Or maybe IETF do not view itself being the standards organisation that wa= nt to ensure Internet works for the general public? By being responsible and taking that responsibility it is included to als= o address these hard problems and answering them, and not only ignoring t= hem. Patrik --=_MailMate_30024C58-B2A8-4E19-824E-B3A5FAAD8CB7_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXTqj+A8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI180/hgCeJ8J4gAoAGMPlonR8VIdTInyJzLAAnR41Jj1V AQszU/KROr1A7N0AyJQU =doP6 -----END PGP SIGNATURE----- --=_MailMate_30024C58-B2A8-4E19-824E-B3A5FAAD8CB7_=-- From nobody Fri Jul 26 04:10:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53B4B1202F9 for ; Fri, 26 Jul 2019 04:10:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7jN06R_TrmTR for ; Fri, 26 Jul 2019 04:10:09 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B88111202FA for ; Fri, 26 Jul 2019 04:10:08 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id d79so38669844qke.11 for ; Fri, 26 Jul 2019 04:10:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=MblQJmcCNyzjFjXYYrnDM8NJuFIxC/SnJG1ZPoi97yU=; b=ch9PbnQIkhm4dli9G846kk/AkHOWZMsOykyfKzF/uIqZy/P8DZZk7+x1W1ny/UXKN9 peyZUNQzifuuN7go925cxEAzettauZCncE0mrw2Z0FkFYiva5yd6T162PyJ5FSKjMEa3 6h8cEBotU9d1Fo5IgWMdlhaVVlmubtFFwPdHOU61wUERzO/bbZnzu0YynJEzI66DlKLu FkEPQGZzm/aRYJEJZ4ZC33KQN75D5V/ZtG0rr2K1lXratW6nt6unxwMza5hnfZ2wHnA5 Ehk3JdilIpDMbizc/r3EBQ+dE/NvPaWa84QXMQKDxF4EPE2GqVRb7O+KtkZCz0KGHc69 a6Mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=MblQJmcCNyzjFjXYYrnDM8NJuFIxC/SnJG1ZPoi97yU=; b=qCsiARmIIdofrFnDKXjjxVpjRWyoI8LDF6jO/93RzMaxJQT0u45Nc6xkNLxJfzCwiE xrrMyMX4Bk0S+3cH+61w3K3sEbQ+pPoLWYk9CtcXlzakXjvIwzoEmWE7GO0FXhpwwnwT Rf/pBzsAqU6boK9kNJdxLRUb3hR9ijVTGBbI1Xr0Y3stpI8xQyBl5AzEeInSgmuQIkR+ c4LrDvQuERxXAh8ZZLU43QRbsQbedbhNVjAIlFyGzZUnHBpwqicF1lSusSrwbDypdEjQ OPuSGamfP2UqkdV9j9d5MNGbucgLsX9P0F9jgzWWJ0vOmElY61XjpyR/Yalk/Zf9CMct ZF0Q== X-Gm-Message-State: APjAAAXFrNyNZcSl7k8p2JjOFXtMLaP4n9S+f4F6hKCangzARXcSAbbc 2rtbtrpsr7dSrTSNhx24l4aHYIPWTlEV9A== X-Google-Smtp-Source: APXvYqw9ZiW+xdCzWghLzBoZR9IZLpmkzkn6NYHsZDfMQ1W05DMTwZ9a9iocc98/xFSkQQbRMrBhWw== X-Received: by 2002:a37:9a4a:: with SMTP id c71mr29671924qke.258.1564139407386; Fri, 26 Jul 2019 04:10:07 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:c49c:e3d4:5039:9e7? ([2001:67c:1232:144:c49c:e3d4:5039:9e7]) by smtp.gmail.com with ESMTPSA id h18sm20789758qkj.134.2019.07.26.04.10.06 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 26 Jul 2019 04:10:06 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-B31C37EA-89CA-4AF5-B956-241FA36266AA Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> Date: Fri, 26 Jul 2019 07:10:06 -0400 Cc: Rob Sayre , add@ietf.org, Wes Hardaker Content-Transfer-Encoding: 7bit Message-Id: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> To: =?utf-8?Q?Patrik_F=C3=A4ltstr=C3=B6m?= Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 11:10:12 -0000 --Apple-Mail-B31C37EA-89CA-4AF5-B956-241FA36266AA Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Patrik, regardless of whether the IETF has consensus to rule as you propose w= e do, we aren=E2=80=99t wizards. We do not have the power to stop apps from u= sing DoH without the operating system=E2=80=99s knowledge.=20 If you think this is a solvable problem, then rather than lecturing us on ho= w things should be if we were wizards, it might be better to explain how to a= ctually enforce the policy you think we should require operating systems to e= nforce.=20 Think it through. Do you really want to go there? Sent from my iPhone > On Jul 26, 2019, at 2:55 AM, Patrik F=C3=A4ltstr=C3=B6m wrote: >=20 >> On 26 Jul 2019, at 8:44, Rob Sayre wrote: >>=20 >>> On Thu, Jul 25, 2019 at 11:30 PM Patrik F=C3=A4ltstr=C3=B6m wrote: >>>=20 >>> And my point is that if IETF is changing the model so that the success >>> rate changes in implementing such policies, then IETF have a responsibil= ity >>> to provide other tools that can be used by the same parties to implement= >>> the same policies. >>=20 >> I don't agree with this part of your message, and I don't think you will f= ind any IETF guideline supporting it (RFC 1958 seems against it, in fact). >> Someone at the ADD BoF mic mentioned that these arguments seem eerily-sim= ilar to those around HTTP/2 encryption, and I agree. >=20 > First, the days are different now than before. Secondly, I claim IETF *did= * explain to everyone why security as defined by SSL and TLS mechanisms impr= oved the user experience to the point that discussions between States (for e= xample) whether encryption in that way should be disallowed or not. Those ex= planations and "enough friendly governments" makes it possible to kill all i= nternational initiatives regarding forbidding those kind of encryption of fl= ows. >=20 > This is the result of the long term path that IETF have taken, very much t= ogether with other standards organisations like W3C and others. But for exam= ple, not so much with ENISA although the issues there regarding TLS1.3 seems= to be under control thanks to hard work there. >=20 > This is *exactly* my point. That *if* IETF do changes to "how the internet= works" then IETF must take the same responsibility this time, and have tool= s, ideas, arguments lined up regarding how the new architecture is too look l= ike. And be prepared to get counter arguments from everyone that do think it= is necessary to (for example) a. identify DNS protocol flows or b. block lo= okups of certain domain names. >=20 > Not just say "this is the new tool in the toolbox" with the addition "by u= sing this new tool, no one today implementing their policy will be able to d= o so in the future". >=20 > The IETF have a responsibility here. Just like IETF had when HTTP with SSL= was introduced. >=20 > Or maybe IETF do not view itself being the standards organisation that wan= t to ensure Internet works for the general public? >=20 > By being responsible and taking that responsibility it is included to also= address these hard problems and answering them, and not only ignoring them.= >=20 > Patrik > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-B31C37EA-89CA-4AF5-B956-241FA36266AA Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Patrik, regardless of whether the IETF has c= onsensus to rule as you propose we do, we aren=E2=80=99t wizards. We do not h= ave the power to stop apps from using DoH without the operating system=E2=80= =99s knowledge. 

    If you think this is a solvable pro= blem, then rather than lecturing us on how things should be if we were wizar= ds, it might be better to explain how to actually enforce the policy you thi= nk we should require operating systems to enforce. 

    Think it through. Do you really want to go there?
    Sent from my iPhone

    On Jul 26, 2019, at 2:55 AM, Patrik F=C3=A4ltstr=C3=B6m <paf=3D40frobbit.se@dmarc.= ietf.org> wrote:

    On 26 Jul 2019, at 8:44, Rob Sayre wrote:
    <= br>
    On Thu, Jul 25, 2019 at 11:30 PM Patrik F=C3= =A4ltstr=C3=B6m <paf@frobbit.se>= wrote:

    And my p= oint is that if IETF is changing the model so that the success
    <= span>rate changes in implementing such policies, then IETF have a responsibi= lity
    to provide other tools that can be used by the same p= arties to implement
    the same policies.

    I don't agree with this part of your message, a= nd I don't think you will find any IETF guideline supporting it (RFC 1958 se= ems against it, in fact).
    <= span>Someone at the ADD BoF mic mentioned that these arguments seem eerily-s= imilar to those around HTTP/2 encryption, and I agree.

    First, the days are different now than before. Seco= ndly, I claim IETF *did* explain to everyone why security as defined by SSL a= nd TLS mechanisms improved the user experience to the point that discussions= between States (for example) whether encryption in that way should be disal= lowed or not. Those explanations and "enough friendly governments" makes it p= ossible to kill all international initiatives regarding forbidding those kin= d of encryption of flows.

    This is the resul= t of the long term path that IETF have taken, very much together with other s= tandards organisations like W3C and others. But for example, not so much wit= h ENISA although the issues there regarding TLS1.3 seems to be under control= thanks to hard work there.

    This is *exactl= y* my point. That *if* IETF do changes to "how the internet works" then IETF= must take the same responsibility this time, and have tools, ideas, argumen= ts lined up regarding how the new architecture is too look like. And be prep= ared to get counter arguments from everyone that do think it is necessary to= (for example) a. identify DNS protocol flows or b. block lookups of certain= domain names.

    Not just say "this is the ne= w tool in the toolbox" with the addition "by using this new tool, no one tod= ay implementing their policy will be able to do so in the future".
    The IETF have a responsibility here. Just like IETF h= ad when HTTP with SSL was introduced.

    Or ma= ybe IETF do not view itself being the standards organisation that want to en= sure Internet works for the general public?

    By being responsible and taking that responsibility it is included to also a= ddress these hard problems and answering them, and not only ignoring them.

      Patrik
    = --Apple-Mail-B31C37EA-89CA-4AF5-B956-241FA36266AA-- From nobody Fri Jul 26 07:51:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7203412004A for ; Fri, 26 Jul 2019 07:50:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kRTVKYddsn1S for ; Fri, 26 Jul 2019 07:50:56 -0700 (PDT) Received: from mail-ua1-x935.google.com (mail-ua1-x935.google.com [IPv6:2607:f8b0:4864:20::935]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E9F912003E for ; Fri, 26 Jul 2019 07:50:56 -0700 (PDT) Received: by mail-ua1-x935.google.com with SMTP id v20so21392548uao.3 for ; Fri, 26 Jul 2019 07:50:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=/HvSRmzdu1S5LGMP8aBvuc8hagXN2xeLwVCn1i7uc+U=; b=onh7M9wPvnOU0MWUEfdLHEc/BvWI7sq7MpMGSognDkpXRzw8ZXHQlPbUjleGkwqIs8 Q8Zu01Zu9zx8xr2HhaFKPp7TtBJk0k0MBh4SlaEbPbY/+2yK8V7fJJWeCIt4BJNHqiWn ylsLnnfiAFK3VP++A5iQreW9d+pFHIfXaYuWpzZm51NWsuS9cixT4U05e9ZBoT2z1jS7 Y7fX1jnywLK6h2+tdhAhTHPt6yqzQNRhRMoBFfefrx4dY8i+98oUnmwQJYcsix6POIp2 KdKR1/Yv/IWadDjKwR05uwO6D4OFU1ocY8Frqzx6LFaojucS5oHRDUcnv+I1Se26D8e/ yTng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/HvSRmzdu1S5LGMP8aBvuc8hagXN2xeLwVCn1i7uc+U=; b=Uu+PBSWVHaXNdyje+fZcJ07hCudyauOwE87dHDgz4pnCHmXwbrI9UyMZm9zBJGArE/ yV5fSOHIWm2O4A0X1134Tc7GVMDrJAxX59v0Go7Vwyz3u7Wial+aoYK5Zhsn2BCNIZxH mPofRmWebYOGSQ5VlJpMZQgfBNCrP/Oh6QBH3vKqnkmzY47ftVushhoBAikuDYZ2Ip/V tiNWwSJimgtDJecAbF6fWG9iMpmRQFwm48ZB4PmxYT9Ly7S2Ldh7b427bQpjLR1eXk1c J6cl88SMzSFJFy0FTjPHcIttN7ImmFvnydTcFygnEEgGSbX9saXfKrl8J5q31SSql86W +VvA== X-Gm-Message-State: APjAAAXP+vlQlS9GSANl/rKrupziYtMxvAcOdFSeKsPz9U6boe6jj4HZ VDef0rK7DBjOKAe4sZejodErfrHADBljsjyVYsg= X-Google-Smtp-Source: APXvYqzZ1mCnhHLVCCuBp/OQzcZleyauhQRAMFPxfGb+5UWMjwjaz/3yk67gisAMHJxCV/pcjWXPn+S1+Z6SawqM3Mg= X-Received: by 2002:ab0:2994:: with SMTP id u20mr29477086uap.114.1564152655572; Fri, 26 Jul 2019 07:50:55 -0700 (PDT) MIME-Version: 1.0 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> In-Reply-To: From: Brian Dickson Date: Fri, 26 Jul 2019 10:50:44 -0400 Message-ID: To: Ted Lemon Cc: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Wes Hardaker , ADD Mailing list , Rob Sayre Content-Type: multipart/alternative; boundary="00000000000068f4c6058e96ab59" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 14:50:59 -0000 --00000000000068f4c6058e96ab59 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Jul 26, 2019 at 7:10 AM Ted Lemon wrote: > Patrik, regardless of whether the IETF has consensus to rule as you > propose we do, we aren=E2=80=99t wizards. We do not have the power to sto= p apps > from using DoH without the operating system=E2=80=99s knowledge. > In retrospect, perhaps this should have been considered before DoH was published, particularly given the ways in which apps bypassing existing DNS controls (both DNS content and DNS server selection) impact the existing ecosystems and security for hosts and networks? > > If you think this is a solvable problem, then rather than lecturing us on > how things should be if we were wizards, it might be better to explain ho= w > to actually enforce the policy you think we should require operating > systems to enforce. > I'm not Patrick, but I do have some observations: - One risk of apps that do DoH is the ability of malware to hijack DoH-implementing apps. Doing so simplifies the coding needed by the malw= are itself. (This is bad) - With the exception of the "dissident" use case, all of the privacy features of DoH can be achieved using DoT - All of the public resolvers offering DoH also offer DoT. - I believe it is the case that DoT is implemented more broadly in DNS software than DoH. - One approach to enforcing the policy has a larger scope than the OS. It is to view DoH itself as the problem, and ask, how can we put the DoH genie (djinn) back in the bottle? The alternative approach to OS enforcement of such a policy, is much more problematic, with vastly more work required to implement: block applications from doing TLS themselves, and implement all of the TLS functionality at the OS level, with access to that via APIs and with additional controls. This would require substantial rewrites of all browsers, and would require standardization for the APIs themselves. Note that the latter could be partially done by the OSes themselves (at least the blocking part) without IETF participation. No matter what, the second option is exceedingly ugly, IMHO. It might have been a better original approach to TLS, but it isn't where we are today, and retrofitting that level of change into existing platforms (apps and OS) would be a daunting task. > > Think it through. Do you *really* want to go there? > I don't think "want" enters into it per se; it is a question of what is required in order to maintain all the existing functionality for things implemented in DNS today, and for preventing the problems created when applications use DoH to bypass OS-selected resolvers. The value of "required" may differ by environment, and that is a big part of the problem. The environments where DoH doesn't create problems, is very much a subset of environments into which DoH applications are already deployed (even without having DoH enabled). Brian > > Sent from my iPhone > > On Jul 26, 2019, at 2:55 AM, Patrik F=C3=A4ltstr=C3=B6m < > paf=3D40frobbit.se@dmarc.ietf.org> wrote: > > On 26 Jul 2019, at 8:44, Rob Sayre wrote: > > On Thu, Jul 25, 2019 at 11:30 PM Patrik F=C3=A4ltstr=C3=B6m wrote: > > > And my point is that if IETF is changing the model so that the success > > rate changes in implementing such policies, then IETF have a responsibili= ty > > to provide other tools that can be used by the same parties to implement > > the same policies. > > > I don't agree with this part of your message, and I don't think you will > find any IETF guideline supporting it (RFC 1958 seems against it, in fact= ). > > Someone at the ADD BoF mic mentioned that these arguments seem > eerily-similar to those around HTTP/2 encryption, and I agree. > > > First, the days are different now than before. Secondly, I claim IETF > *did* explain to everyone why security as defined by SSL and TLS mechanis= ms > improved the user experience to the point that discussions between States > (for example) whether encryption in that way should be disallowed or not. > Those explanations and "enough friendly governments" makes it possible to > kill all international initiatives regarding forbidding those kind of > encryption of flows. > > This is the result of the long term path that IETF have taken, very much > together with other standards organisations like W3C and others. But for > example, not so much with ENISA although the issues there regarding TLS1.= 3 > seems to be under control thanks to hard work there. > > This is *exactly* my point. That *if* IETF do changes to "how the interne= t > works" then IETF must take the same responsibility this time, and have > tools, ideas, arguments lined up regarding how the new architecture is to= o > look like. And be prepared to get counter arguments from everyone that do > think it is necessary to (for example) a. identify DNS protocol flows or = b. > block lookups of certain domain names. > > Not just say "this is the new tool in the toolbox" with the addition "by > using this new tool, no one today implementing their policy will be able = to > do so in the future". > > The IETF have a responsibility here. Just like IETF had when HTTP with SS= L > was introduced. > > Or maybe IETF do not view itself being the standards organisation that > want to ensure Internet works for the general public? > > By being responsible and taking that responsibility it is included to als= o > address these hard problems and answering them, and not only ignoring the= m. > > Patrik > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000068f4c6058e96ab59 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Fri, Jul 26, 2019 at 7:10 AM Ted L= emon <mellon@fugue.com> wrote= :
    Patrik, regardless of whether the IETF has consensus to rule as you pro= pose we do, we aren=E2=80=99t wizards. We do not have the power to stop app= s from using DoH without the operating system=E2=80=99s knowledge.=C2=A0

    In retrospect, perhaps this should have= been considered before DoH was published, particularly given the ways in w= hich apps bypassing existing DNS controls (both DNS content and DNS server = selection) impact the existing ecosystems and security for hosts and networ= ks?
    =C2=A0

    If you think this is a solvable prob= lem, then rather than lecturing us on how things should be if we were wizar= ds, it might be better to explain how to actually enforce the policy you th= ink we should require operating systems to enforce.=C2=A0

    I'm not Patrick, but I do have some observat= ions:
    • One risk of apps that do DoH is the ability of malw= are to hijack DoH-implementing apps. Doing so simplifies the coding needed = by the malware itself. (This is bad)
    • With the exception of the &quo= t;dissident" use case, all of the privacy features of DoH can be achie= ved using DoT
    • All of the public resolvers offering DoH also offer D= oT.
    • I believe it is the case that DoT is implemented more broadly i= n DNS software than DoH.
    • One approach to enforcing the policy has a= larger scope than the OS. It is to view DoH itself as the problem, and ask= , how can we put the DoH genie (djinn) back in the bottle?
    Th= e alternative approach to OS enforcement of such a policy, is much more pro= blematic, with vastly more work required to implement: block applications f= rom doing TLS themselves, and implement all of the TLS functionality at the= OS level, with access to that via APIs and with additional controls. This = would require substantial rewrites of all browsers, and would require stand= ardization for the APIs themselves.

    Note tha= t the latter could be partially done by the OSes themselves (at least the b= locking part) without IETF participation. No matter what, the second option= is exceedingly ugly, IMHO. It might have been a better original approach t= o TLS, but it isn't where we are today, and retrofitting that level of = change into existing platforms (apps and OS) would be a daunting task.
    =C2=A0

    Think it through. Do you really want to go there?

    I don&#= 39;t think "want" enters into it per se; it is a question of what= is required in order to maintain all the existing functionality for things= implemented in DNS today, and for preventing the problems created when app= lications use DoH to bypass OS-selected resolvers. The value of "requi= red" may differ by environment, and that is a big part of the problem.= The environments where DoH doesn't create problems, is very much a sub= set of environments into which DoH applications are already deployed (even = without having DoH enabled).

    Brian
    =C2= =A0

    Sent from my iPhone

    On Jul 26, 2019, at 2:5= 5 AM, Patrik F=C3=A4ltstr=C3=B6m <paf=3D40frobbit.se@dmarc.ietf.org> = wrote:

    On 26 = Jul 2019, at 8:44, Rob Sayre wrote:

    On Thu, Jul 25, 2019 at 11:30 PM Patrik F=C3=A4ltstr=C3= =B6m <paf@frobbit.se= > wrote:

    And my point is that if IETF is changing the model so that the success
    rate changes in implementing such policies, then IETF hav= e a responsibility
    to provide other tools that can be us= ed by the same parties to implement
    the same policies.
    <= br>
    I don't agree with this= part of your message, and I don't think you will find any IETF guideli= ne supporting it (RFC 1958 seems against it, in fact).
    Someone at the ADD BoF mic mentioned tha= t these arguments seem eerily-similar to those around HTTP/2 encryption, an= d I agree.

    First, the days ar= e different now than before. Secondly, I claim IETF *did* explain to everyo= ne why security as defined by SSL and TLS mechanisms improved the user expe= rience to the point that discussions between States (for example) whether e= ncryption in that way should be disallowed or not. Those explanations and &= quot;enough friendly governments" makes it possible to kill all intern= ational initiatives regarding forbidding those kind of encryption of flows.=

    This is the result of the long term path = that IETF have taken, very much together with other standards organisations= like W3C and others. But for example, not so much with ENISA although the = issues there regarding TLS1.3 seems to be under control thanks to hard work= there.

    This is *exactly* my point. That *= if* IETF do changes to "how the internet works" then IETF must ta= ke the same responsibility this time, and have tools, ideas, arguments line= d up regarding how the new architecture is too look like. And be prepared t= o get counter arguments from everyone that do think it is necessary to (for= example) a. identify DNS protocol flows or b. block lookups of certain dom= ain names.

    Not just say "this is the = new tool in the toolbox" with the addition "by using this new too= l, no one today implementing their policy will be able to do so in the futu= re".

    The IETF have a responsibility h= ere. Just like IETF had when HTTP with SSL was introduced.
    =
    Or maybe IETF do not view itself being the standards organ= isation that want to ensure Internet works for the general public?
    By being responsible and taking that responsibilit= y it is included to also address these hard problems and answering them, an= d not only ignoring them.

    =C2=A0=C2=A0Pat= rik
    --
    Add mailing list
    Add@ietf.org
    https://www.ietf.org/mailman/listinfo/add
    --00000000000068f4c6058e96ab59-- From nobody Fri Jul 26 08:06:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95E72120072 for ; Fri, 26 Jul 2019 08:06:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o0kXQ-fZMBsh for ; Fri, 26 Jul 2019 08:06:20 -0700 (PDT) Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95237120044 for ; Fri, 26 Jul 2019 08:06:20 -0700 (PDT) Received: by mail-qt1-x82a.google.com with SMTP id x22so47965138qtp.12 for ; Fri, 26 Jul 2019 08:06:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=yngOe4bVj7XMRCTJg1MRhmL4ypUMiXKNPGvMi1tjYF0=; b=PY4IOXX8w5CBXtWv6cUVy7Mdg17Lc9dvyHj7Ym5I7QRO8SS8JqWsn8od5aer2M1vtY TM6mtqrDG7bh7WJc9E0KMpGiTEND1ORv8c+QroSVSlokOhdkscmSw91aj58SSEs1vd8z jPHvf/utk86SBixFKiFJmtwDl+o9vzDk0gypwYwx/UOq8EI+OglWiVDFOmSBsTW+LxCq xrxmJjdgteXHuQuVTE6jntE3duhyVtAVQVNrhFhyGyWpd57wCvLXy3D8wdMj+xEZjIfj WIP9Ovm5JNbdPud+I9sWrw6aEv1qs1Tc1mvvqMXaFWWhgKDQ1Ys6JGzmeXCDKbn4b4yB MjDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=yngOe4bVj7XMRCTJg1MRhmL4ypUMiXKNPGvMi1tjYF0=; b=dk3UDhuDp3Z4M6skSNFvGe7qCaWqb5KjU0dkCoSFfYrdrnbzGcCC2x+VYmlNSS1qI+ lndGHNUXlC8G9+5WII0y+z2ddCPURS8fflcL9ucpK8y4ZGLSlsk0e2MtX8pNPV5sotUv CxZM5/Vjngzf7R8JXsp9U0cC/8Sq2fjJMH/lrZ71+ftHq+jZG9XE1vrwpHEPi7Jas9sD ZITa8PKTqTZFrkv8LdsuJJF9xbqMaNJjSdtg273LYuXj4UpRkmTwVE876apm4V3+hCy0 PpdLF1zRiyDyyL2lodPdvFIuPVl33mUO0jkJQ3w2IfawQv9kwHuiaFRjn1PmAgNgIE7K 2HgQ== X-Gm-Message-State: APjAAAXi+QPi62HcDRYcxQKBQzy+FQAoEYSLIkSH60Q5toW2x4H37y/s LNlWCGHuWf4V2HV3zLbydVzcuw== X-Google-Smtp-Source: APXvYqwMzDLBk7JzhOrJTw/KoVHDaRZbUKIDNXUNZXHW9/ClCgdBtNH7WV3zZqr8Eai+/8zOJADznA== X-Received: by 2002:ac8:689a:: with SMTP id m26mr66475892qtq.192.1564153579392; Fri, 26 Jul 2019 08:06:19 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:386e:b8f7:67a:f915? ([2001:67c:1232:144:386e:b8f7:67a:f915]) by smtp.gmail.com with ESMTPSA id c5sm24813217qkb.41.2019.07.26.08.06.18 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 26 Jul 2019 08:06:18 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-B77BA4D8-128B-4D49-AB1E-BFEDB628AAB0 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Fri, 26 Jul 2019 11:06:18 -0400 Cc: =?utf-8?Q?Patrik_F=C3=A4ltstr=C3=B6m?= , Wes Hardaker , ADD Mailing list , Rob Sayre Content-Transfer-Encoding: 7bit Message-Id: <45A7F1E2-B619-40C4-A4CD-F3DE246CD60C@fugue.com> References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> To: Brian Dickson Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 15:06:24 -0000 --Apple-Mail-B77BA4D8-128B-4D49-AB1E-BFEDB628AAB0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On Jul 26, 2019, at 10:50 AM, Brian Dickson w= rote: > One approach to enforcing the policy has a larger scope than the OS. It is= to view DoH itself as the problem, and ask, how can we put the DoH genie (d= jinn) back in the bottle? The djinn was never in the bottle in the first place. If this discussion is g= oing to continue to entertain the fantasy that malware isn=E2=80=99t already= doing this, it=E2=80=99s not likely to be very useful. I get that there is a wish that it could be possible to prevent tunneling ba= d things over TLS, but this is simply not an available option unless we outl= aw TLS, and it would appear that there is no consensus in the IETF to do thi= s. That being the case, all outlawing DoH will do is prevent us benefiting from= what is good about it. It will not prevent us suffering from what is bad ab= out it. Does this make sense to you, or do you think there=E2=80=99s actually some b= enefit to outlawing it? Do you think you could get consensus on outlawing i= t? If you succeeded, what problems would you have solved?= --Apple-Mail-B77BA4D8-128B-4D49-AB1E-BFEDB628AAB0 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

    On Jul 26, 2019, a= t 10:50 AM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
    • One a= pproach to enforcing the policy has a larger scope than the OS. It is to vie= w DoH itself as the problem, and ask, how can we put the DoH genie (djinn) b= ack in the bottle?
    The djinn was never in the bottle in the first place= . If this discussion is going to continue to entertain the fantasy that malw= are isn=E2=80=99t already doing this, it=E2=80=99s not likely to be very use= ful.

    I get that there is a wish that it could be po= ssible to prevent tunneling bad things over TLS, but this is simply not an a= vailable option unless we outlaw TLS, and it would appear that there is no c= onsensus in the IETF to do this.

    That being the cas= e, all outlawing DoH will do is prevent us benefiting from what is good abou= t it. It will not prevent us suffering from what is bad about it.
    =
    Does this make sense to you, or do you think there=E2=80=99s a= ctually some benefit to outlawing it?  Do you think you could get conse= nsus on outlawing it?  If you succeeded, what problems would you have s= olved?
    = --Apple-Mail-B77BA4D8-128B-4D49-AB1E-BFEDB628AAB0-- From nobody Fri Jul 26 08:34:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E65DB120161 for ; Fri, 26 Jul 2019 08:34:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PbTEj3lsYzWu for ; Fri, 26 Jul 2019 08:34:01 -0700 (PDT) Received: from mail-ua1-x934.google.com (mail-ua1-x934.google.com [IPv6:2607:f8b0:4864:20::934]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCBFF12015F for ; Fri, 26 Jul 2019 08:34:00 -0700 (PDT) Received: by mail-ua1-x934.google.com with SMTP id v18so21423035uad.12 for ; Fri, 26 Jul 2019 08:34:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=styyYDxZNKoGOplGb26i5BQPknqpeogFRMnbGOtb2fU=; b=cnHJLhJlkeIDtjYBWtnieffCrd/Jv4OCAzX/s8UMvSXchyjylzCghSjJyFqkGeAFX0 j87A/5XHPwvgiysCapR3Hn/BdG7lWoREwlGT2m3PslaICBcXJV58/8sCrnZg0E+tNqmS gS/bw7ZIZE3rRuCggz5bcl4OeJO5F2g9r61gR1u89l9r2eSQoMV5810wMMtipBFw3ca8 /39iqFv8YXT4ozEOUBKiYNQa034cCoWtpPp00AVV5eiL04FMOVOs8B5qqRGnyEJfTWtd 5II1vOYTukspA/7c/+aNhRU+IwR14fAq13d0WTOHbTuce5+tVzlYj8pUBx+GwzV0ds67 rUDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=styyYDxZNKoGOplGb26i5BQPknqpeogFRMnbGOtb2fU=; b=ITLlIGhBzdT31SEo0jk/lALBl4alVqf1G3LzHw6Esatlx4ALLjDWekbl3gittYOXWE tHG1ATXkZp/IJqAQ7Y9cPgkEqm2pw5BS1dZispOi9O+psZZChdz3s+pPR7nVx+xy/0tt OIm/sUwA8W3rPpZqjHnxInpXjuEYktQ62+q+YpAqyWXujsEMuWhTyMnp4GVPdG/rX+Nv 4uTkTkGqw1dJY2vjBUrAVmGfKQ/lEEJ+vmO6yLVzcmTyh4my5Md0qy0UeJCTjwBX7Rcx hYxrQgmMpQ9m1ab/lDg2DVjYZteBBkZVF2V2ITDiityHGrST4yPzZg0/Dbl4LFL9OB4w gCBA== X-Gm-Message-State: APjAAAX3/th2JZU+MHJAAmVRrbsNLtJMiojFjK73FTDYy9T2a3CcA+Qm Am7LIzF8acQCMSBWxIGTRH45aN/+xpdBVie47MM= X-Google-Smtp-Source: APXvYqxJbllkhH251UOymYx43RVfczcueT37zjfRnqgXn0CUFfFn9fhnhEvioXubuUdZRTmc149oohYinER/IL0qyrU= X-Received: by 2002:ab0:6390:: with SMTP id y16mr60681128uao.62.1564155240002; Fri, 26 Jul 2019 08:34:00 -0700 (PDT) MIME-Version: 1.0 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> <45A7F1E2-B619-40C4-A4CD-F3DE246CD60C@fugue.com> In-Reply-To: <45A7F1E2-B619-40C4-A4CD-F3DE246CD60C@fugue.com> From: Brian Dickson Date: Fri, 26 Jul 2019 11:33:48 -0400 Message-ID: To: Ted Lemon Cc: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Wes Hardaker , ADD Mailing list , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000743af1058e97458e" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 15:34:04 -0000 --000000000000743af1058e97458e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Jul 26, 2019 at 11:06 AM Ted Lemon wrote: > > > On Jul 26, 2019, at 10:50 AM, Brian Dickson > wrote: > > > - One approach to enforcing the policy has a larger scope than the OS. > It is to view DoH itself as the problem, and ask, how can we put the D= oH > genie (djinn) back in the bottle? > > The djinn was never in the bottle in the first place. If this discussion > is going to continue to entertain the fantasy that malware isn=E2=80=99t = already > doing this, it=E2=80=99s not likely to be very useful. > Malware was already communicating over TLS, but was not doing its DNS over new channels, until DoH was widely deployed. The community pushing DoH gave that new set of tools to the malware community. > > I get that there is a wish that it could be possible to prevent tunneling > bad things over TLS, but this is simply not an available option unless we > outlaw TLS, and it would appear that there is no consensus in the IETF to > do this. > This isn't about TLS itself, this is about port 443 (using TLS). The new problem is hiding DNS communications in a general-purpose port. It means that new DNS servers being used cannot be detected, and it means it is not possible to create a network-level enforcement scheme for which DNS resolvers can be used (by white-listing or black-listing specific IP addresses for DNS ports). DNS resolver choice enforcement is the current mechanism for several elements of enterprise networks, including preventing information leakage, preventing breakage of split DNS, and preventing exfiltration and payload acquisition by bad actors (humans and malware). DNS resolver detection is one of the most important mechanisms for malware detection, in particular discovery of new malware packages and/or strains. > > That being the case, all outlawing DoH will do is prevent us benefiting > from what is good about it. It will not prevent us suffering from what is > bad about it. > I fear you are conflating "DoH" with "all DNS over TLS things". The only thing that differentiates DoH from DoT is the port number, and inclusion of HTTP headers. And if you read my whole message, I definitely am not suggesting any change to the availability and use of DoT. It is precisely the port number used by DoH that is the problem. That's the only problem. If DoH were to decide to use a different port number, I would have zero objection to DoH, and I suspect everyone else raising objections to DoH would feel the same way. (There are other issues with applications doing DNS, in terms of exposing resolver choice to users rather than administrators, plus per-app resolver choice and non-shared DNS cache, but those are not as fundamental as the DoH port number issue.) > > Does this make sense to you, or do you think there=E2=80=99s actually som= e benefit > to outlawing it? Do you think you could get consensus on outlawing it? = If > you succeeded, what problems would you have solved? > Please, let us try to avoid using pronouns, as that inherently (and perhaps deliberately) sows confusion or conflates issues. "It" in your previous sentence could mean many things, everything from "DoH" to "TLS". I would like to answer the question you are asking, would you mind rephrasing your question without pronouns? Also, "you" is ambiguous, do you mean me personally, or the larger "you" of some particular community? If the latter, which community in particular, or just generally any larger community? Also, "outlawing" is definitely a loaded term, and not necessarily an accurate way of describing the method(s) that might be required to achieve the results. A better description of one possible approach would be deprecating/obsoleting/historicizing DoH-the-protocol, and encouraging implementers to remove DoH code from their apps, and to shut down DoH on public resolvers. That is a hypothetical approach, and not the only approach possible. It is an answer to your question of "how", not the questions on "whether", or "consensus". Those are separate discussions, and it is probably premature to start those conversations. Brian --000000000000743af1058e97458e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Fri, Jul 26, 2019 at 11:06 AM Ted = Lemon <mellon@fugue.com> wrot= e:


    On Jul 26, 2019, at 10:50 AM, Brian Dickson &= lt;brian= .peter.dickson@gmail.com> wrote:
    • One approa= ch to enforcing the policy has a larger scope than the OS. It is to view Do= H itself as the problem, and ask, how can we put the DoH genie (djinn) back= in the bottle?
    The djinn was never in the bottle in the first plac= e. If this discussion is going to continue to entertain the fantasy that ma= lware isn=E2=80=99t already doing this, it=E2=80=99s not likely to be very = useful.

    Malware was already com= municating over TLS, but was not doing its DNS over new channels, until DoH= was widely deployed. The community pushing DoH gave that new set of tools = to the malware community.
    =C2=A0

    I get that the= re is a wish that it could be possible to prevent tunneling bad things over= TLS, but this is simply not an available option unless we outlaw TLS, and = it would appear that there is no consensus in the IETF to do this.

    This isn't about TLS itself, this i= s about port 443 (using TLS).

    The new problem is h= iding DNS communications in a general-purpose port. It means that new DNS s= ervers being used cannot be detected, and it means it is not possible to cr= eate a network-level enforcement scheme for which DNS resolvers can be used= (by white-listing or black-listing specific IP addresses for DNS ports).

    DNS resolver choice enforcement is the current mech= anism for several elements of enterprise networks, including preventing inf= ormation leakage, preventing breakage of split DNS, and preventing exfiltra= tion and payload acquisition by bad actors (humans and malware).
    =
    DNS resolver detection is one of the most important mechanis= ms for malware detection, in particular discovery of new malware packages a= nd/or strains.
    =C2=A0

    That being the case, all = outlawing DoH will do is prevent us benefiting from what is good about it. = It will not prevent us suffering from what is bad about it.

    I fear you are conflating "DoH" with= "all DNS over TLS things".

    The only thi= ng that differentiates DoH from DoT is the port number, and inclusion of HT= TP headers.

    And if you read my whole message, I de= finitely am not suggesting any change to the availability and use of DoT.

    It is precisely the port number used by DoH that is= the problem. That's the only problem. If DoH were to decide to use a d= ifferent port number, I would have zero objection to DoH, and I suspect eve= ryone else raising objections to DoH would feel the same way.=C2=A0
    (There are other issues with applications doing DNS, in terms of exposin= g resolver choice to users rather than administrators, plus per-app resolve= r choice and non-shared DNS cache, but those are not as fundamental as the = DoH port number issue.)
    =C2=A0

    Does this make s= ense to you, or do you think there=E2=80=99s actually some benefit to outla= wing it?=C2=A0 Do you think you could get consensus on outlawing it?=C2=A0 = If you succeeded, what problems would you have solved?

    Please, let us try to avoid using pronouns, as that= inherently (and perhaps deliberately) sows confusion or conflates issues.<= /div>

    "It" in your previous sentence could mea= n many things, everything from "DoH" to "TLS". I would = like to answer the question you are asking, would you mind rephrasing your = question without pronouns?
    Also, "you" is ambiguous, do= you mean me personally, or the larger "you" of some particular c= ommunity? If the latter, which community in particular, or just generally a= ny larger community?

    Also, "outlawing" i= s definitely a loaded term, and not necessarily an accurate way of describi= ng the method(s) that might be required to achieve the results.
    <= br>
    A better description of one possible approach would be deprec= ating/obsoleting/historicizing DoH-the-protocol, and encouraging implemente= rs to remove DoH code from their apps, and to shut down DoH on public resol= vers.

    That is a hypothetical approach, and not the= only approach possible. It is an answer to your question of "how"= ;, not the questions on "whether", or "consensus". Thos= e are separate discussions, and it is probably premature to start those con= versations.

    Brian
    --000000000000743af1058e97458e-- From nobody Fri Jul 26 08:54:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FAAD120048 for ; Fri, 26 Jul 2019 08:54:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fN6PxB4icR3Y for ; Fri, 26 Jul 2019 08:53:57 -0700 (PDT) Received: from mail-vs1-xe32.google.com (mail-vs1-xe32.google.com [IPv6:2607:f8b0:4864:20::e32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A6D2120041 for ; Fri, 26 Jul 2019 08:53:57 -0700 (PDT) Received: by mail-vs1-xe32.google.com with SMTP id y16so36371774vsc.3 for ; Fri, 26 Jul 2019 08:53:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=xSMqXg/9x0rook37PBv5D3GFE7vlalICltUepMkIcMs=; b=Mpal88JaIQnf1H5CtEKafNbsapB5GXfWAwZpxciinvpvxP3iuicUWBNK/euCXqRIrh loNqRyVo4h3CB0414qLoj3qj2WWz1aRtpFdIS6Nj85mL3qOAmAs1HMMeqEV/4uW+bvlk xjluOJjdGFNRQb2D+/le67G7HHW5LjynpD7fzsy3K/Ig+JhaEekApBqIM2Gb34tTPq4/ giSUhCFtGvpVT/Jg5kBx1ot84Fp8tZaz5c55yZr8yjyM9oigrIH4mA/4T4yrqAmv9rMS QsvNVq7jiGnsdpYzw726ZRJO6XJ1UjYbt4E2hNp4YwHEdiLq3t5N4H14hoGnaAS9h7r3 taWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=xSMqXg/9x0rook37PBv5D3GFE7vlalICltUepMkIcMs=; b=P8IhNvdgZnUHOLwD6P60zT9qCpl8Z2AtRyMPLxVDtY0OUfnLaS4OzXX0JLxLD1TBlb aIUsf6UzaxJCvVi9Ypd07LCszdvCmx0p45bD4GFz/pfsnjiUf7uUSDGSeMbbsHubbB1g LLsXtuQ94Hhaw7qB+nX95mRYn4fmYPThoOew2SNObf2z4fjCqrH5FyGEYQXckmkExf6b cj/6EpjWwm8ncZparANNEt4P801dPTQ8keLsXWBaYfRPPRttwm0BsrVM5iHs2rqRIjTK Np/clNMBKryh9+LolIHVfbdQlTrLyDH+h86Syx3cPCTjSJOcuFUEYPGDrVgZZs6wQbDC S0JQ== X-Gm-Message-State: APjAAAXeTh0MQQhn+K+/IasyGSa98NR8YmlxR4d77SVJz89Z7+QFH2g8 c2fuYh2W9ULnYqONHxsCordqak/JOBx+ay+oAx8= X-Google-Smtp-Source: APXvYqzpI1132YKMV4E0Nl1ex+tQz72q0r5/s4pCCm++//kmCJoU0ZZ6H7WCYPDErYQUbz+QNleQNDiHaVPDrKHHW6o= X-Received: by 2002:a67:f043:: with SMTP id q3mr20389223vsm.219.1564156436632; Fri, 26 Jul 2019 08:53:56 -0700 (PDT) MIME-Version: 1.0 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> <45A7F1E2-B619-40C4-A4CD-F3DE246CD60C@fugue.com> In-Reply-To: <45A7F1E2-B619-40C4-A4CD-F3DE246CD60C@fugue.com> From: Brian Dickson Date: Fri, 26 Jul 2019 11:53:45 -0400 Message-ID: To: Ted Lemon Cc: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Wes Hardaker , ADD Mailing list , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000c75980058e978cfb" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 15:54:00 -0000 --000000000000c75980058e978cfb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Jul 26, 2019 at 11:06 AM Ted Lemon wrote: > > > On Jul 26, 2019, at 10:50 AM, Brian Dickson > wrote: > > > - One approach to enforcing the policy has a larger scope than the OS. > It is to view DoH itself as the problem, and ask, how can we put the D= oH > genie (djinn) back in the bottle? > > The djinn was never in the bottle in the first place. If this discussion > is going to continue to entertain the fantasy that malware isn=E2=80=99t = already > doing this, it=E2=80=99s not likely to be very useful. > One important distinction about malware "doing this": prior to the scenario where DoH (to an independently-operated resolver) was used, it was possible to detect this malware activity by correlation between DNS queries and TLS connections. In order to establish a TLS connection, the client app needs to do a DNS query to identify the IP address of the server to which it plans to connect= . A hypothetical anti-malware system with integration to the DNS query feed, would be aware of specific clients requesting specific DNS records, and the TTLs of the responses. Connections not conforming to tuples of (current time, client IP, server IP, TTL expiry time) would be detectable and alert-able. (Additional information on connections' SNI and servers' names allows much greater accuracy, but if/when ESNI happens, this signal goes away.) In an environment where DNS resolver choice cannot be detected or enforced, negates this model, particularly if all DNS query traffic becomes unobservable to the hypothetical anti-malware system. This is a change to the threat detection and blocking environment, and exists only when encrypted DNS is commingled with HTTPS traffic. Brian --000000000000c75980058e978cfb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Fri, Jul 26, 2019 at 11:06 AM Ted = Lemon <mellon@fugue.com> wrot= e:


    On Jul 26, 2019, at 10:50 AM, Brian Dickson &= lt;brian= .peter.dickson@gmail.com> wrote:
    • One approa= ch to enforcing the policy has a larger scope than the OS. It is to view Do= H itself as the problem, and ask, how can we put the DoH genie (djinn) back= in the bottle?
    The djinn was never in the bottle in the first plac= e. If this discussion is going to continue to entertain the fantasy that ma= lware isn=E2=80=99t already doing this, it=E2=80=99s not likely to be very = useful.

    One important disti= nction about malware "doing this": prior to the scenario where Do= H (to an independently-operated resolver) was used, it was possible to dete= ct this malware activity by correlation between DNS queries and TLS connect= ions.

    In order to establish a TLS connection, the = client app needs to do a DNS query to identify the IP address of the server= to which it plans to connect.

    A hypothetical anti= -malware system with integration to the DNS query feed, would be aware of s= pecific clients requesting specific DNS records, and the TTLs of the respon= ses.

    Connections not conforming to tuples of (curr= ent time, client IP, server IP, TTL expiry time) would be detectable and al= ert-able. (Additional information on connections' SNI and servers' = names allows much greater accuracy, but if/when ESNI happens, this signal g= oes away.)

    In an environment where DNS resolver ch= oice cannot be detected or enforced, negates this model, particularly if al= l DNS query traffic becomes unobservable to the hypothetical anti-malware s= ystem.

    This is a change to the threat detection an= d blocking environment, and exists only when encrypted DNS is commingled wi= th HTTPS traffic.

    Brian
    =C2=A0
    --000000000000c75980058e978cfb-- From nobody Fri Jul 26 09:26:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4CE0120041 for ; Fri, 26 Jul 2019 09:26:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TAvlUErDakjq for ; Fri, 26 Jul 2019 09:26:53 -0700 (PDT) Received: from mail-qt1-x82d.google.com (mail-qt1-x82d.google.com [IPv6:2607:f8b0:4864:20::82d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7CAD912003E for ; Fri, 26 Jul 2019 09:26:53 -0700 (PDT) Received: by mail-qt1-x82d.google.com with SMTP id n11so53140086qtl.5 for ; Fri, 26 Jul 2019 09:26:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=BD8cofvOcEkB63z49xHn5/8ZrWVr2bTUJSD2XJ0p4Mw=; b=XrVzsLbT0Puzym3G1Q4RULio1E+ntuoDgfJp66LeKbcGvwDt3Cv+A56goNRlqLjE2D 8AnK8IFIaUK6hhJjS5aP3L9vaC0jlmHoJBXVtVASZZyy0mCLn1ekGmV/cHGj/S+04qHY cQw+8RNxVitvSJ48uv6MwrBeOHOU/oSiBmPH80dtroD3iS0WPcXoyfZhEGgx1Qw30wKL fodNImpYlXXMR7qUI24qEVm9o4oRdBxz0q9k/mnyRzo24AsKDjePJ3WjpArwsKqbOtLb cKve5HBVuu35rwIVBRcxDa+56W//vA+iqHQGMvkiQp+wDjcsAhIvpkiREp4AD0/J8/hV jwGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=BD8cofvOcEkB63z49xHn5/8ZrWVr2bTUJSD2XJ0p4Mw=; b=onirtXIGc8E8UtzUnChSmGfQqJ2rWU2alkvxp3zhOTyI+3Ois6gO39FHtbrH13/MyA QKuO2O03IQYKUNYutyC4EWrNExZAG39WaIgdUK+OdiQyr0fyeoQKmlNFWOAYPJsHSlTz ldof2sPHpK2qDsVWmx01gdTVq8cDBlIGrkvqHhEBT4LczkjO0h3NVEjplVc6SpE7ioYf Nj0a6RKuN5aNX//bMWNabFCFwVb/fvsIoSf5LlCT2WgQwYNnYBCH/AwerOLqzBLLWmm5 HLi7P/BNQti1rSRP3+pFEeDzcyt+nuXxShYvT3PL3dWs1UbGIn2fB0ZqkyThCjmTRBHu 5HdQ== X-Gm-Message-State: APjAAAVd+7+nmOKba1Gn5KUytbv7LIGrFtwFIyJYwRUQVrUQNYQBhvv8 HkUpf/pC9nuvfdNm6QyED3LQ5w== X-Google-Smtp-Source: APXvYqzAbff+nOPDq8MKB54BeX8C8RVr9eYx4wEPhpm5VTdbWcawDr1Dc9tar+0zAP2zVSJ0+ggrEA== X-Received: by 2002:ad4:476f:: with SMTP id d15mr31718314qvx.29.1564158412592; Fri, 26 Jul 2019 09:26:52 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:386e:b8f7:67a:f915? ([2001:67c:1232:144:386e:b8f7:67a:f915]) by smtp.gmail.com with ESMTPSA id 39sm29364159qts.41.2019.07.26.09.26.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 26 Jul 2019 09:26:51 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-37921B2E-EE8F-45BA-AD8A-D7F17D5230C5 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Fri, 26 Jul 2019 12:26:50 -0400 Cc: =?utf-8?Q?Patrik_F=C3=A4ltstr=C3=B6m?= , Wes Hardaker , ADD Mailing list , Rob Sayre Content-Transfer-Encoding: 7bit Message-Id: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> <45A7F1E2-B619-40C4-A4CD-F3DE246CD60C@fugue.com> To: Brian Dickson Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 16:26:57 -0000 --Apple-Mail-37921B2E-EE8F-45BA-AD8A-D7F17D5230C5 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable What would be the good outcome that would result from the IETF deprecating D= oH? Who would follow our advice? =20 Sent from my iPhone > On Jul 26, 2019, at 11:53 AM, Brian Dickson wrote: >=20 >=20 >=20 >> On Fri, Jul 26, 2019 at 11:06 AM Ted Lemon wrote: >>=20 >>=20 >>> On Jul 26, 2019, at 10:50 AM, Brian Dickson wrote: >>> One approach to enforcing the policy has a larger scope than the OS. It i= s to view DoH itself as the problem, and ask, how can we put the DoH genie (= djinn) back in the bottle? >> The djinn was never in the bottle in the first place. If this discussion i= s going to continue to entertain the fantasy that malware isn=E2=80=99t alre= ady doing this, it=E2=80=99s not likely to be very useful. >=20 > One important distinction about malware "doing this": prior to the scenari= o where DoH (to an independently-operated resolver) was used, it was possibl= e to detect this malware activity by correlation between DNS queries and TLS= connections. >=20 > In order to establish a TLS connection, the client app needs to do a DNS q= uery to identify the IP address of the server to which it plans to connect. >=20 > A hypothetical anti-malware system with integration to the DNS query feed,= would be aware of specific clients requesting specific DNS records, and the= TTLs of the responses. >=20 > Connections not conforming to tuples of (current time, client IP, server I= P, TTL expiry time) would be detectable and alert-able. (Additional informat= ion on connections' SNI and servers' names allows much greater accuracy, but= if/when ESNI happens, this signal goes away.) >=20 > In an environment where DNS resolver choice cannot be detected or enforced= , negates this model, particularly if all DNS query traffic becomes unobserv= able to the hypothetical anti-malware system. >=20 > This is a change to the threat detection and blocking environment, and exi= sts only when encrypted DNS is commingled with HTTPS traffic. >=20 > Brian > =20 --Apple-Mail-37921B2E-EE8F-45BA-AD8A-D7F17D5230C5 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable What would be the good outcome that would r= esult from the IETF deprecating DoH?    Who would follow our advic= e?  

    Sent from my iP= hone

    On Jul 26, 2019, at 11:53 AM, Brian Dickson &= lt;brian.peter.dickson@gmai= l.com> wrote:



    =
    On Fri, Jul 26, 2019 at 11:06 AM Ted L= emon <mellon@fugue.com> wrote:=


    On Jul 26, 2019, at 10:50 AM, Brian Dickson <brian.peter= .dickson@gmail.com> wrote:
    • One approach to en= forcing the policy has a larger scope than the OS. It is to view DoH itself a= s the problem, and ask, how can we put the DoH genie (djinn) back in the bot= tle?
    The djinn was never in the bottle in the first place= . If this discussion is going to continue to entertain the fantasy that malw= are isn=E2=80=99t already doing this, it=E2=80=99s not likely to be very use= ful.

    One important distincti= on about malware "doing this": prior to the scenario where DoH (to an indepe= ndently-operated resolver) was used, it was possible to detect this malware a= ctivity by correlation between DNS queries and TLS connections.
    In order to establish a TLS connection, the client app needs to= do a DNS query to identify the IP address of the server to which it plans t= o connect.

    A hypothetical anti-malware system with i= ntegration to the DNS query feed, would be aware of specific clients request= ing specific DNS records, and the TTLs of the responses.

    Connections not conforming to tuples of (current time, client IP, serv= er IP, TTL expiry time) would be detectable and alert-able. (Additional info= rmation on connections' SNI and servers' names allows much greater accuracy,= but if/when ESNI happens, this signal goes away.)

    = In an environment where DNS resolver choice cannot be detected or enforced, n= egates this model, particularly if all DNS query traffic becomes unobservabl= e to the hypothetical anti-malware system.

    This is a= change to the threat detection and blocking environment, and exists only wh= en encrypted DNS is commingled with HTTPS traffic.

    = Brian
     
    = --Apple-Mail-37921B2E-EE8F-45BA-AD8A-D7F17D5230C5-- From nobody Fri Jul 26 09:59:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6F32120345 for ; Fri, 26 Jul 2019 09:59:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qUkhQhMTmAU6 for ; Fri, 26 Jul 2019 09:59:16 -0700 (PDT) Received: from mail-yw1-xc34.google.com (mail-yw1-xc34.google.com [IPv6:2607:f8b0:4864:20::c34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E3E531200C1 for ; Fri, 26 Jul 2019 09:59:15 -0700 (PDT) Received: by mail-yw1-xc34.google.com with SMTP id l124so20558879ywd.0 for ; Fri, 26 Jul 2019 09:59:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=BQiVBJENKvQXLK/qgVimD26itRg/Pa+OVo5jZGDThyo=; b=sATx8bxt52GQPRAE1MSyCSP8DrCIvbMVrkyEt9/+B9n99iHuy460sjnNSlZieZTr9U DMdpiqLUM2yKBbpJhAumhw6qwSPDin1wTHEPNRws+Rhzzb4EVDJjGVgdTGxoOPageEnx yeqUq6gJO9Ar+wHFaJSNKNDaWl/DITA/SlalurPnkzKark3nNJX01uwj1JQzxDc5SeN9 wIsPHTv2X7mpKVa+o7jEEdSue4SVHjvbuK0qRPSyaBa1XXM5xFYUh8gdnnMTfESQaM2B iL4AQmmiLaR5uW1E7LvRSimHuL+YOz/RcVuEnFTQzyC8tENzf6+wPAuuKcz2vuC2GNzR Aflg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=BQiVBJENKvQXLK/qgVimD26itRg/Pa+OVo5jZGDThyo=; b=k9J/Tz4Fr9DXI0/VDAL1i8n3EACHLEUY0sxY8on7IuZenVrPwb2gDJVzlQswrvp/2c PtbFWYSrubh3Y2aANMgMktQOziB+jwXM3l0DPKEiNK+AJxWrWhtKI6HcqPRuqqs6X+1y ktmFOq9WbDEt3rWRcqojzAi33HuyWtsiGCSw7L/HJXbneIwL6QdjiPkVivwCztrOwbt7 UKZqpTg1MyzvZbvllVnnpwnnG6E9ptqf8dESHh3s7l07YMwOUDA/GatyfsJl/zl0GmDd wvEuHKB/56iSQc5Wdl9ns8/3RKEFw8pPcy7n62MFZMThVGg9zMicI9WoDbo7RucK82hS Wg7A== X-Gm-Message-State: APjAAAWh9HjHAQL6Y0W193VUutfcDZL0qiZ7PajWgkV7wnS5HvroD6mS 3ynT/nOxqsOaXXHo1FsxnRXXzjtdKrjUO8UbmbI= X-Google-Smtp-Source: APXvYqz7NVx1AjbN3Jsi2QVEXL+sRSdAahviIfKDTMj7tUoVtWP0/HOl0pxVRBjcNELdD53f0tKU9g1D+fiLTXQOboE= X-Received: by 2002:a81:b249:: with SMTP id q70mr59932482ywh.350.1564160354866; Fri, 26 Jul 2019 09:59:14 -0700 (PDT) MIME-Version: 1.0 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> <45A7F1E2-B619-40C4-A4CD-F3DE246CD60C@fugue.com> In-Reply-To: From: Alec Muffett Date: Fri, 26 Jul 2019 17:59:04 +0100 Message-ID: To: Brian Dickson Cc: Ted Lemon , =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , ADD Mailing list , Rob Sayre , Wes Hardaker Content-Type: multipart/alternative; boundary="00000000000052dd75058e987637" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 16:59:18 -0000 --00000000000052dd75058e987637 Content-Type: text/plain; charset="UTF-8" On Fri, 26 Jul 2019, 16:54 Brian Dickson, wrote: > One important distinction about malware "doing this": prior to the > scenario where DoH (to an independently-operated resolver) was used, it was > possible to detect this malware activity by correlation between DNS queries > and TLS connections. > Unless the malware was using (eg) Tor, like in this article from 5 years ago (and the world hasn't ended yet) https://blog.trendmicro.com/trendlabs-security-intelligence/defending-against-tor-using-malware-part-1/ At best you might have detected Tor, in such circumstances, rather than malware; and Tor is literally designed to bypass such filters. - alec --00000000000052dd75058e987637 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    On Fri, 26 Jul 2019, 16:54 Brian Dickson, <= ;brian.peter.dickson@gmail= .com> wrote:
    One important distinction about malware "= ;doing this": prior to the scenario where DoH (to an independently-ope= rated resolver) was used, it was possible to detect this malware activity b= y correlation between DNS queries and TLS connections.

    Unless the ma= lware was using (eg) Tor, like in this article from 5 years ago (and the wo= rld hasn't ended yet)


    At best you might h= ave detected Tor, in such circumstances, rather than malware; and Tor is li= terally designed to bypass such filters.

    <= div dir=3D"auto">- alec

    =
    --00000000000052dd75058e987637-- From nobody Fri Jul 26 10:27:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D046F1203B9 for ; Fri, 26 Jul 2019 10:27:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DozqvcJ-92XZ for ; Fri, 26 Jul 2019 10:27:00 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B12331203B3 for ; Fri, 26 Jul 2019 10:26:59 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 8CF026A355; Fri, 26 Jul 2019 19:26:57 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1564162017; bh=zMmO/TNCkPzjwyqL7mTxl3le602ED6UhHcC3phFrn/k=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=j+w+NDFP4KsFuNR6EGatD1srX7sfKOEcYyyhx7wXOb/B2vP190BSDSLwsqRBsKpRc 3x0ka7olwkN2tKbIqXmNgyPWwdk6tj9ctLJ40du+Z+1Xw7K95MhO7RUv+0G07JpzwV rmjWS6ZCBSVyIIxCfUeDpv0o0CshsvDOuw3Hy/xUi6q+pVtS+eriGu3KDWdku/N45c 56wk+TrPtROnDCLITcUeOGFyOTfxcj1NpUeBGxgUTSBCq2Fux4RikCzBUKhI86t/jU UwcaIjU23w6SIJCHhw7zWsJBI7bWyeHfDKwXt00yAfssTHBPUPhv8YaJS+sjgUBZkO 8hVlyvdOdjh/w== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 7FDDD3C015E; Fri, 26 Jul 2019 19:26:57 +0200 (CEST) Date: Fri, 26 Jul 2019 19:26:57 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Ted Lemon Cc: add@ietf.org Message-ID: <607995672.381.1564162017469@appsuite-gw1.open-xchange.com> In-Reply-To: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev9 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 17:27:02 -0000 =20 =20

    Il 26 luglio 2019 13:10 Ted Lemon <mellon@fugue.com> ha scritto:


    Patrik, regardless of whether the IETF has consensus to rule as yo= u propose we do, we aren=E2=80=99t wizards. We do not have the power to sto= p apps from using DoH without the operating system=E2=80=99s knowledge.&nbs= p;
    This is true, but the IETF also does not have the power to stop apps fro= m doing things differently from the standards it publishes, yet it still pu= blishes standards. So I do not see what would be wrong if we could come to = consensus (assuming that we ever could, something that I don't know) that c= ertain ways of deploying DoH are "best practices" while others are not reco= mmended unless for some specific use cases, or even not recommended at all,= because they create worse problems than they solve. This would still not p= revent any application from doing the non-recommended things, but at least = it would make it clear that this is not how the community thinks that the t= echnology should be used, and make the IETF look a little more friendly to = the needs of other Internet stakeholders.

    This could also be important since among the unhappy stakeholders there = are governments, which could resort to invasive regulatory countermeasures = that would have much broader impacts over the Internet's usability and glob= al interoperability, unless the IETF can offer them a better way to exert t= heir sovereignty over the Internet to a reasonable extent.

    -- 

    Vittorio Bertola | Head of Policy & Innovation, Open=
-Xchange
    vittorio.b=
ertola@open-xchange.com | +39 348 7015022
    Office @ Via Treviso 12, 1=
0144 Torino, Italy
    =20 From nobody Fri Jul 26 10:31:49 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FA05120075 for ; Fri, 26 Jul 2019 10:31:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C8pHZNlwqsMv for ; Fri, 26 Jul 2019 10:31:45 -0700 (PDT) Received: from mail-ot1-x334.google.com (mail-ot1-x334.google.com [IPv6:2607:f8b0:4864:20::334]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C2FF120041 for ; Fri, 26 Jul 2019 10:31:14 -0700 (PDT) Received: by mail-ot1-x334.google.com with SMTP id r21so50074064otq.6 for ; Fri, 26 Jul 2019 10:31:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4yCmRgRcMylqfqtRiBtJtJ8rTfw+6xKgi4jZdhHaI0s=; b=PUy6ZVfHu77Bxr/3gtkpB9UdSVc+8Z0npANmHsfTaZtUQyiXADi5S2tgS8r4hkBLlZ PY47qc9UfgRZUrNL8SKUDGF/MYvfhXuR5jLNLfr/u2KBcYkjY9qhX0Rg7pwNpfqj7cBQ 9tC26wLhdvRGb2aReznvbs1S8AgNSJUrQ7KFC2Yfk7lTIpGDk0N+lz4oTJU1kQP9paDW xWSwtNuvc84pWy8rJizeDMZzRH8F8MWSJnH3I8qTivgmqaS9PHYqQ7Y0r1OYkH2ux64O oY2d1TmZv97dSMBJe2SHgB6nsxsdP51HooaLTkJDiCeisr9dJr0mcDbk3APnn1p+SdKs SznQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4yCmRgRcMylqfqtRiBtJtJ8rTfw+6xKgi4jZdhHaI0s=; b=pi1GvlRgVDUgeoVnml46KlTNILcNnMbF8oJC7/lg5CEprjDQH2nll7TFgXU2S431lI szpBDCR1N4fy6tc1/mAmr1MU89gWMoXDn3jMiyrSIELmYqZxtyoJ0SH5NcP87/ZPKyrT +huO1SQpy0aC7VStuj0ujgNxlLYEYDfKeNkmhog61KxWp1E0P8hUUGy7GDkvGqXeqCub 0seezJuMIvBaBVoSoW5o+75y7tZbQkyzXkQ0VvINv62LfeN9XCrk0/t5/Z3/SHbIhySX OIZwFuFqjZ8vDDuZfP0wZ+hKTO+mACdRt5HNTQk0PUNrqgVrEMN7uVo1egVDVPT9V8f3 ie3A== X-Gm-Message-State: APjAAAURtsTaf3UahONO3RZ80zsO+eTocwsljFwmfS2bWgvoaKVGuOuX 6EJRS4mNMZcBayLpIXvRaopc4vNV3uxB4w== X-Google-Smtp-Source: APXvYqxbaLuosmiADvRyxlSip8Kx98DuSJch85yH51Fd8fAxpsXk0J6ubA4qTJOa9l2+hscaCnhSKg== X-Received: by 2002:a05:6830:13c3:: with SMTP id e3mr70384772otq.253.1564162273860; Fri, 26 Jul 2019 10:31:13 -0700 (PDT) Received: from [26.53.223.213] ([208.54.86.159]) by smtp.gmail.com with ESMTPSA id b23sm17414257otl.75.2019.07.26.10.31.12 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 26 Jul 2019 10:31:13 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-1B295315-0B4F-4AC1-B955-9351FB21B975 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16F203) In-Reply-To: Date: Fri, 26 Jul 2019 13:31:11 -0400 Cc: =?utf-8?Q?Patrik_F=C3=A4ltstr=C3=B6m?= , Wes Hardaker , ADD Mailing list , Rob Sayre Content-Transfer-Encoding: 7bit Message-Id: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> <45A7F1E2-B619-40C4-A4CD-F3DE246CD60C@fugue.com> To: Ted Lemon Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 17:31:48 -0000 --Apple-Mail-1B295315-0B4F-4AC1-B955-9351FB21B975 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Jul 26, 2019, at 12:26 PM, Ted Lemon wrote: >=20 > What would be the good outcome that would result from the IETF deprecating= DoH? Who would follow our advice? =20 I think for the answer to that question, it might be necessary to compare wi= th such deprecation activity such as MD5, TLS versions below 1.3, and other s= imilar situations. The Internet is a big place with a lot of diverse parties with their own spe= cific approaches to things like this, and it is difficult to predict how any= of them would respond, let alone all of them. A significant factor in any similar situation has been deployment prior to d= eprecation, and available deployment of successors or alternatives. I humbly acknowledge that it could get messy, particularly depending on how v= arious groups and entities respond. The deployment impact is one reason I think this should be addressed widely a= nd soon, so that either way, the impact can be minimized. Examples of groups that may not all share the same view on the issues at han= d, include browser vendors, security vendors, industry groups like CA/B, res= olver operators, ISP trade associations, ISPs, national governments, consume= r protection entities, enterprises, DNS software vendors, OS maintainers, ho= sting companies, DPI equipment vendors, IoT vendors, open source router firm= ware groups, to list just a few off the top of my head. And the degree to which those same groups have similar or dissimilar views o= f DoT is a relevant question in the context of =E2=80=9Calternatives or succ= essors=E2=80=9D. Brian >=20 > Sent from my iPhone >=20 >> On Jul 26, 2019, at 11:53 AM, Brian Dickson wrote: >>=20 >>=20 >>=20 >>> On Fri, Jul 26, 2019 at 11:06 AM Ted Lemon wrote: >>>=20 >>>=20 >>>> On Jul 26, 2019, at 10:50 AM, Brian Dickson wrote: >>>> One approach to enforcing the policy has a larger scope than the OS. It= is to view DoH itself as the problem, and ask, how can we put the DoH genie= (djinn) back in the bottle? >>> The djinn was never in the bottle in the first place. If this discussion= is going to continue to entertain the fantasy that malware isn=E2=80=99t al= ready doing this, it=E2=80=99s not likely to be very useful. >>=20 >> One important distinction about malware "doing this": prior to the scenar= io where DoH (to an independently-operated resolver) was used, it was possib= le to detect this malware activity by correlation between DNS queries and TL= S connections. >>=20 >> In order to establish a TLS connection, the client app needs to do a DNS q= uery to identify the IP address of the server to which it plans to connect. >>=20 >> A hypothetical anti-malware system with integration to the DNS query feed= , would be aware of specific clients requesting specific DNS records, and th= e TTLs of the responses. >>=20 >> Connections not conforming to tuples of (current time, client IP, server I= P, TTL expiry time) would be detectable and alert-able. (Additional informat= ion on connections' SNI and servers' names allows much greater accuracy, but= if/when ESNI happens, this signal goes away.) >>=20 >> In an environment where DNS resolver choice cannot be detected or enforce= d, negates this model, particularly if all DNS query traffic becomes unobser= vable to the hypothetical anti-malware system. >>=20 >> This is a change to the threat detection and blocking environment, and ex= ists only when encrypted DNS is commingled with HTTPS traffic. >>=20 >> Brian >> =20 --Apple-Mail-1B295315-0B4F-4AC1-B955-9351FB21B975 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

    Sent from my iPhone

    On Jul 26, 2019, at 12:2= 6 PM, Ted Lemon <mellon@fugue.com= > wrote:

    What would b= e the good outcome that would result from the IETF deprecating DoH?   &= nbsp;Who would follow our advice?  

    I think for the answer to that question, it might be necessary to compare= with such deprecation activity such as MD5, TLS versions below 1.3, and oth= er similar situations.

    The Internet is a big place w= ith a lot of diverse parties with their own specific approaches to things li= ke this, and it is difficult to predict how any of them would respond, let a= lone all of them.

    A significant factor in any simil= ar situation has been deployment prior to deprecation, and available deploym= ent of successors or alternatives.

    I humbly acknowl= edge that it could get messy, particularly depending on how various groups a= nd entities respond.

    The deployment impact is one r= eason I think this should be addressed widely and soon, so that either way, t= he impact can be minimized.

    Examples of groups that= may not all share the same view on the issues at hand, include browser vend= ors, security vendors, industry groups like CA/B, resolver operators, ISP tr= ade associations, ISPs, national governments, consumer protection entities, e= nterprises, DNS software vendors, OS maintainers, hosting companies, DPI equ= ipment vendors, IoT vendors, open source router firmware groups, to list jus= t a few off the top of my head.

    And the degree to w= hich those same groups have similar or dissimilar views of DoT is a relevant= question in the context of =E2=80=9Calternatives or successors=E2=80=9D.

    Brian


    Sent from my iPhone=

    On Jul 26, 2019, at 11:53 AM, Brian Dickson <<= a href=3D"mailto:brian.peter.dickson@gmail.com">brian.peter.dickson@gmail.co= m> wrote:



    On Fri, Jul 26, 2019 at 11:06 AM Ted Lemon= <mellon@fugue.com> wrote:
    =

    On Jul 26, 2019, at 10:50 AM, Brian Dickson <brian.peter.dic= kson@gmail.com> wrote:
    • One approach to enforc= ing the policy has a larger scope than the OS. It is to view DoH itself as t= he problem, and ask, how can we put the DoH genie (djinn) back in the bottle= ?
    The djinn was never in the bottle in the first place= . If this discussion is going to continue to entertain the fantasy that malw= are isn=E2=80=99t already doing this, it=E2=80=99s not likely to be very use= ful.

    One important distincti= on about malware "doing this": prior to the scenario where DoH (to an indepe= ndently-operated resolver) was used, it was possible to detect this malware a= ctivity by correlation between DNS queries and TLS connections.
    In order to establish a TLS connection, the client app needs to= do a DNS query to identify the IP address of the server to which it plans t= o connect.

    A hypothetical anti-malware system with i= ntegration to the DNS query feed, would be aware of specific clients request= ing specific DNS records, and the TTLs of the responses.

    Connections not conforming to tuples of (current time, client IP, serv= er IP, TTL expiry time) would be detectable and alert-able. (Additional info= rmation on connections' SNI and servers' names allows much greater accuracy,= but if/when ESNI happens, this signal goes away.)

    = In an environment where DNS resolver choice cannot be detected or enforced, n= egates this model, particularly if all DNS query traffic becomes unobservabl= e to the hypothetical anti-malware system.

    This is a= change to the threat detection and blocking environment, and exists only wh= en encrypted DNS is commingled with HTTPS traffic.

    = Brian
     
    = --Apple-Mail-1B295315-0B4F-4AC1-B955-9351FB21B975-- From nobody Fri Jul 26 11:07:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B889120368 for ; Fri, 26 Jul 2019 11:07:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WEyr8t2EXMVh for ; Fri, 26 Jul 2019 11:07:30 -0700 (PDT) Received: from NAM05-CO1-obe.outbound.protection.outlook.com (mail-eopbgr720102.outbound.protection.outlook.com [40.107.72.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69124120331 for ; Fri, 26 Jul 2019 11:07:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=nb1zXVzgNwzt/YrmBBOwve0JxDfHl89nVpUG97ar4V28+g7pCUlK5W2Oc6UljFXl/kEJxqHRLxqJ8x8ZuHE4VUBJfAKxLSKXAOnTtwQajpkxnz4cmhzp4c2rXPL3w2+HVQVlSDKvWN2UJIHK7lm1r5bNLH81fT3F77h7MHcZW5ubNDYbMXxNc8YmiLySQ4zNwVKu3IyST0SwXcoBfyZK2aGiRtSJu98OWXDIHuxv6aRuRhRhJJF38ZyANAMuRY8pPcpQ8iy2cc0E7mR46pgHX/ov08VSpTD79L8aoBhhRyMJv5gbiZHs2XP7Psu3D9vhBk9+PsXRkEpeF61GpGBPYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7IOUUNQLvpwp5a9wfz4tAisEJnJDvUlOPbcu8oBDCjI=; b=k5ZsJjvagPj4WgJSluGgrUn2c3WIiwHzo7xpxki439jAxDYDJ4rrSagxLr3zBlwFDr7i4hjYMuHCGKnJZeT4ubU+viMnOL5BsjQLNHQad3+L63XvuUk9GrsTU9Sf5oka7JZtg1A54y/skzcK9wupX5ADO/TZ3PChm/t90I0Qv3Imxhp8fr1d1nT+sfAMMjG+iqNWjuFpIMcQczhVFCWDYKnAkaIbB3UbxylcvboBM9KMVS1NiP1BsnrD6C3LX/9nKPox7TOqu/448WFxG7HUiLMjwMBFpj1CmRYSjMYfJT2B9AkeKe4TbIPYu0hks7DhMUNFn+883QrBYLWaLPUXxw== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7IOUUNQLvpwp5a9wfz4tAisEJnJDvUlOPbcu8oBDCjI=; b=KmUl9mrAfYalyext4S5rNd3uO5euswusyqm+Glhzw0dUz8H/eg3FYKSCdIWItHqQv6YYuwKtQDTje2F6FCDiRlt8YLPsOlUvvxKrYac31pfH6crAf6BlAx5rgvzfPD9Jdea0S7wVJl+vbG5LcvV6oiGYgoLXLCO3uTFxHYsOeRc= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (20.179.20.141) by MN2PR21MB1279.namprd21.prod.outlook.com (20.179.21.91) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.1; Fri, 26 Jul 2019 18:07:28 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde%9]) with mapi id 15.20.2136.000; Fri, 26 Jul 2019 18:07:28 +0000 From: Tommy Jensen To: Brian Dickson , Ted Lemon CC: =?Windows-1252?Q?Patrik_F=E4ltstr=F6m?= , ADD Mailing list , Rob Sayre , Wes Hardaker Thread-Topic: [Add] My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVQjLR+0y/7ln6YE2p2KAXgMVqt6bcaB0AgAAEYACAAAHrAIAAAlaAgAACIwCAAAPtgIAAAyAAgABHCACAAD2lAIAABFkAgAANQoCAAAk+AIAAEfuAgAAB+yc= Date: Fri, 26 Jul 2019 18:07:28 +0000 Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> <45A7F1E2-B619-40C4-A4CD-F3DE246CD60C@fugue.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [131.107.160.49] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 958ee22b-5c7e-4e21-afde-08d711f41ee2 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:MN2PR21MB1279; x-ms-traffictypediagnostic: MN2PR21MB1279: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 01106E96F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(376002)(39860400002)(136003)(346002)(366004)(396003)(199004)(189003)(52314003)(54896002)(26005)(68736007)(53546011)(7736002)(102836004)(186003)(81166006)(76176011)(6506007)(8676002)(86362001)(66556008)(66574012)(7696005)(14454004)(52536014)(561944003)(71190400001)(22452003)(74316002)(110136005)(256004)(316002)(19627405001)(14444005)(3846002)(2906002)(54906003)(6116002)(236005)(53936002)(10090500001)(66476007)(25786009)(33656002)(8936002)(486006)(8990500004)(66066001)(6436002)(11346002)(476003)(446003)(105004)(64756008)(6246003)(71200400001)(4326008)(5660300002)(55016002)(478600001)(66946007)(76116006)(81156014)(91956017)(229853002)(10290500003)(9686003)(99286004)(66446008)(148743002); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1279; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: uLkA8V40LwoEvjaQD6jthr56Kl+vZDsnrBR6e9Llx8LuHN1Gawkptd8+yj9oPMDh3PfvVc2gUZpPX/8SOW4LMUMSMi04EQB+H2oVkFPXFO7wsmNuIpHvpV6jJqa8wTGaZftBZEYem1Lc+1hBiAvp2aVd635Wc2E/kl7Gm3PBTeyGL7go7fd+eltuV3W+jFJU+oe+mgc+1O/KFe65cq5esQV5BFOwaTDFk4lNKUzWS2pp0p2LralvW83n0I+AW5sNoAHyRLDA6lNHrRhHcBdihxp6LUBrfzbbTGeHyxnAhK5b0PACnlKJ7iwGmRl8vclmT0dJBRQMyvPy+2NejqdYqpzdmCU/l5QJqBqqAyIdAMNnfyihwhsXc9eFBt3vt+ldMaiRkBUaRID2nCdMZigquQNvAlXWyKxHB5iI9ezuRBA= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR21MB1213C0E4CFFAF3BD1AB449ACFAC00MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 958ee22b-5c7e-4e21-afde-08d711f41ee2 X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Jul 2019 18:07:28.2840 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tojens@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1279 Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 18:07:35 -0000 --_000_MN2PR21MB1213C0E4CFFAF3BD1AB449ACFAC00MN2PR21MB1213namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I think for the WG to entertain the idea of deprecating or otherwise stop r= ecommending DoH is a bad idea. The comparison with MD5 and outdated TLS ver= sions has a fundamental flaw: those algorithms have suffered from some kind= of breakage or weakness against moden infra that made using them insecure.= DoH doesn't share that weakness; its effectiveness is actually a root caus= e of all the WG's debate. I don't think we gain anything from discovering a= nd sharing a useful tool then telling people not to use that tool. And even= if we wanted to, they're going to anyway, cat's out of the bag. > I don't think "want" enters into it per se; it is a question of what is r= equired in order to maintain all the existing functionality for things impl= emented in DNS today, and for preventing the problems created when applicat= ions use DoH to bypass OS-selected resolvers. The value of "required" may d= iffer by environment, and that is a big part of the problem. I think this is a constructive approach. I don't think we maintain the func= tionality we have today in the 53U world by finding ways to let middle boxe= s get access (visibility in any format) to the traffic. A major reason for = encrypting DNS or any other traffic is to prevent exactly that. I think we = need to focus on making recommendations that will maximize the cases where = encrypted DNS traffic is going to RRs the user trusts to do traffic manipul= ation (parental controls, internal resolution routing, malware blocking, or= whatever else that manipulation may be). The platform can be the source of signal well-behaved apps need to get that= kind of insight. For example, without reference to specific APIs, any give= n platform should know whether its configured DNS servers came from DHCP (a= nd possibly whether the network that recommended them is "user trusted" or = not in the context of being a home or work or public network) or were manua= lly set by the user. This information can be used to help sort available RR= s by how much the user has expressed trust in them already. If DNS-capable = apps (DoH or otherwise) wanted to play nicely in the ecosystem, they could = ask the platform about the currently configured system DNS and weigh that a= gainst their configuration. My proposal is this sorting would prefer user involvement over anything els= e, and admin involvement over non-admin involvement. Meaning, where Firefox= is on a platform where an admin has configured the platform's DNS servers = manually, it would defer to the system resolver until it can promote its ow= n RR recommendation directly to an admin authority (or to a non-admin user = if that's all the system is using). OTOH, if the platform indicates its cur= rent DNS servers all came from a less trusted network, the app could then f= eel justified in deferring to its own recommendation without violating user= trust. Thoughts? Thanks, Tommy ________________________________ From: Add on behalf of Brian Dickson Sent: Friday, July 26, 2019 10:31 AM To: Ted Lemon Cc: Patrik F=E4ltstr=F6m ; ADD Mailing l= ist ; Rob Sayre ; Wes Hardaker Subject: Re: [Add] My longer list of questions [from partial distribution a= t the MIC] Sent from my iPhone On Jul 26, 2019, at 12:26 PM, Ted Lemon > wrote: What would be the good outcome that would result from the IETF deprecating = DoH? Who would follow our advice? I think for the answer to that question, it might be necessary to compare w= ith such deprecation activity such as MD5, TLS versions below 1.3, and othe= r similar situations. The Internet is a big place with a lot of diverse parties with their own sp= ecific approaches to things like this, and it is difficult to predict how a= ny of them would respond, let alone all of them. A significant factor in any similar situation has been deployment prior to = deprecation, and available deployment of successors or alternatives. I humbly acknowledge that it could get messy, particularly depending on how= various groups and entities respond. The deployment impact is one reason I think this should be addressed widely= and soon, so that either way, the impact can be minimized. Examples of groups that may not all share the same view on the issues at ha= nd, include browser vendors, security vendors, industry groups like CA/B, r= esolver operators, ISP trade associations, ISPs, national governments, cons= umer protection entities, enterprises, DNS software vendors, OS maintainers= , hosting companies, DPI equipment vendors, IoT vendors, open source router= firmware groups, to list just a few off the top of my head. And the degree to which those same groups have similar or dissimilar views = of DoT is a relevant question in the context of =93alternatives or successo= rs=94. Brian Sent from my iPhone On Jul 26, 2019, at 11:53 AM, Brian Dickson > wrote: On Fri, Jul 26, 2019 at 11:06 AM Ted Lemon > wrote: On Jul 26, 2019, at 10:50 AM, Brian Dickson > wrote: * One approach to enforcing the policy has a larger scope than the OS. = It is to view DoH itself as the problem, and ask, how can we put the DoH ge= nie (djinn) back in the bottle? The djinn was never in the bottle in the first place.. If this discussion i= s going to continue to entertain the fantasy that malware isn=92t already d= oing this, it=92s not likely to be very useful. One important distinction about malware "doing this": prior to the scenario= where DoH (to an independently-operated resolver) was used, it was possibl= e to detect this malware activity by correlation between DNS queries and TL= S connections. In order to establish a TLS connection, the client app needs to do a DNS qu= ery to identify the IP address of the server to which it plans to connect. A hypothetical anti-malware system with integration to the DNS query feed, = would be aware of specific clients requesting specific DNS records, and the= TTLs of the responses. Connections not conforming to tuples of (current time, client IP, server IP= , TTL expiry time) would be detectable and alert-able. (Additional informat= ion on connections' SNI and servers' names allows much greater accuracy, bu= t if/when ESNI happens, this signal goes away.) In an environment where DNS resolver choice cannot be detected or enforced,= negates this model, particularly if all DNS query traffic becomes unobserv= able to the hypothetical anti-malware system. This is a change to the threat detection and blocking environment, and exis= ts only when encrypted DNS is commingled with HTTPS traffic. Brian --_000_MN2PR21MB1213C0E4CFFAF3BD1AB449ACFAC00MN2PR21MB1213namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
    I think for the WG to entertain the idea of deprecating or otherwise stop r= ecommending DoH is a bad idea. The comparison with MD5 and outdated TLS ver= sions has a fundamental flaw: those algorithms have suffered from some kind= of breakage or weakness against moden infra that made using them insecure. DoH doesn't share that weakness= ; its effectiveness is actually a root cause of all the WG's debate. I don'= t think we gain anything from discovering and sharing a useful tool then te= lling people not to use that tool. And even if we wanted to, they're going to anyway, cat's out of the bag.

    > I don't think "want" enters into it per se; it is a question of wh= at is required in order to maintain all the existing functionality for thin= gs implemented in DNS today, and for preventing the problems created when a= pplications use DoH to bypass OS-selected resolvers. The value of "required" may differ by environment, an= d that is a big part of the problem.
    The platform can be the source of signal well-behaved apps need to get that= kind of insight. For example, without reference to specific APIs, any give= n platform should know whether its configured DNS servers came from DHCP (a= nd possibly whether the network that recommended them is "user trusted" or not in the context of= being a home or work or public network) or were manually set by the user. = This information can be used to help sort available RRs by how much the use= r has expressed trust in them already. If DNS-capable apps (DoH or otherwise) wanted to play nicely in the ecosystem= , they could ask the platform about the currently configured system DNS and= weigh that against their configuration.

    My proposal is this sorting would prefer user involvement over anything els= e, and admin involvement over non-admin involvement. Meaning, where Firefox= is on a platform where an admin has configured the platform's DNS servers = manually, it would defer to the system resolver until it can promote its own RR recommendation directly to= an admin authority (or to a non-admin user if that's all the system is usi= ng). OTOH, if the platform indicates its current DNS servers all came from = a less trusted network, the app could then feel justified in deferring to its own recommendation without v= iolating user trust.

    Thoughts? 

    Thanks,
    Tommy

    From: Add <add-bounces@i= etf.org> on behalf of Brian Dickson <brian.peter.dickson@gmail.com>= ;
    Sent: Friday, July 26, 2019 10:31 AM
    To: Ted Lemon <mellon@fugue.com>
    Cc: Patrik F=E4ltstr=F6m <paf=3D40frobbit.se@dmarc.ietf.org>; = ADD Mailing list <add@ietf.org>; Rob Sayre <sayrer@gmail.com>; = Wes Hardaker <wjhns1@hardakers.net>
    Subject: Re: [Add] My longer list of questions [from partial distrib= ution at the MIC]
     


    Sent from my iPhone

    On Jul 26, 2019, at 12:26 PM, Ted Lemon <mellon@fugue.com> wrote:

    What would be the good outcome that would result from the = IETF deprecating DoH?    Who would follow our advice?  

    I think for the answer to that question, it might be necessary to comp= are with such deprecation activity such as MD5, TLS versions below 1.3, and= other similar situations.

    The Internet is a big place with a lot of diverse parties with their o= wn specific approaches to things like this, and it is difficult to predict = how any of them would respond, let alone all of them.

    A significant factor in any similar situation has been deployment prio= r to deprecation, and available deployment of successors or alternatives.

    I humbly acknowledge that it could get messy, particularly depending o= n how various groups and entities respond.

    The deployment impact is one reason I think this should be addressed w= idely and soon, so that either way, the impact can be minimized.

    Examples of groups that may not all share the same view on the issues = at hand, include browser vendors, security vendors, industry groups like CA= /B, resolver operators, ISP trade associations, ISPs, national governments,= consumer protection entities, enterprises, DNS software vendors, OS maintainers, hosting companies, DPI equipment ven= dors, IoT vendors, open source router firmware groups, to list just a few o= ff the top of my head.

    And the degree to which those same groups have similar or dissimilar v= iews of DoT is a relevant question in the context of =93alternatives or suc= cessors=94.

    Brian


    Sent from my iPhone

    On Jul 26, 2019, at 11:53 AM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:



    On Fri, Jul 26, 2019 at 11:06 AM Te= d Lemon <mellon@fugue.com> wr= ote:


    On Jul 26, 2019, at 10:50 AM, Brian Dickson <brian.peter.dickso= n@gmail.com> wrote:
    • One approach to enforcing the policy has a larger scope than the OS. It= is to view DoH itself as the problem, and ask, how can we put the DoH geni= e (djinn) back in the bottle?
    The djinn was never in the bottle in the first place.. If this discuss= ion is going to continue to entertain the fantasy that malware isn=92t alre= ady doing this, it=92s not likely to be very useful.

    One important distinction about malware "doing this": prior = to the scenario where DoH (to an independently-operated resolver) was used,= it was possible to detect this malware activity by correlation between DNS= queries and TLS connections.

    In order to establish a TLS connection, the client app needs to do a D= NS query to identify the IP address of the server to which it plans to conn= ect.

    A hypothetical anti-malware system with integration to the DNS query f= eed, would be aware of specific clients requesting specific DNS records, an= d the TTLs of the responses.

    Connections not conforming to tuples of (current time, client IP, serv= er IP, TTL expiry time) would be detectable and alert-able. (Additional inf= ormation on connections' SNI and servers' names allows much greater accurac= y, but if/when ESNI happens, this signal goes away.)

    In an environment where DNS resolver choice cannot be detected or enfo= rced, negates this model, particularly if all DNS query traffic becomes uno= bservable to the hypothetical anti-malware system.

    This is a change to the threat detection and blocking environment, and= exists only when encrypted DNS is commingled with HTTPS traffic.

    Brian
     
    --_000_MN2PR21MB1213C0E4CFFAF3BD1AB449ACFAC00MN2PR21MB1213namp_-- From nobody Fri Jul 26 11:09:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B11E812033C for ; Fri, 26 Jul 2019 11:09:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b5odgLm4keii for ; Fri, 26 Jul 2019 11:09:40 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [IPv6:2a02:80:3ffe::176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F9BA120331 for ; Fri, 26 Jul 2019 11:09:40 -0700 (PDT) Received: from [192.165.72.241] (unknown [IPv6:2a02:80:3ffc:0:7057:2d3:6ff3:9349]) by mail.frobbit.se (Postfix) with ESMTPSA id 7A6FF29BEE; Fri, 26 Jul 2019 20:09:38 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1564164578; bh=V8rWjnfUsH6qru+g3YAiWqgP2RizJPrRd1XqNr/zAmA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=k5Tp5XG99tPRoH670jDULnxqen0eMbG9rGRxIx3L19AK0Tl4xEcjt8qA2Ri6tDL+u i0SrrnZ9SmPx+3cQe+xnC/ypLKpvXZSvnP55THW0uThnLIHL1CiJ9Xj9DnPANs6dKY GQyiClno1rC8iATwNhyTiWrEXx2wC5rj+pcVO9Lk= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Brian Dickson" Cc: "Ted Lemon" , "Wes Hardaker" , "ADD Mailing list" , "Rob Sayre" Date: Fri, 26 Jul 2019 20:09:37 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <4B44D5E6-81D6-418D-99C6-61484AB23BA2@frobbit.se> In-Reply-To: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> <45A7F1E2-B619-40C4-A4CD-F3DE246CD60C@fugue.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_DD6EBDB6-EB64-4586-B467-DC33043AFA1A_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 18:09:43 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_DD6EBDB6-EB64-4586-B467-DC33043AFA1A_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable First: Ted, you are correct, there is no protocol police and definitely I= ETF is not the one. Thats not the point. People do listen to IETF or anyone else that comes up with "good words". = There is a competition between standards and material that can be referen= ced. If IETF is not saying good things, then some other standard organiza= tion will be referenced. This is not about telling people what to NOT do. This is about telling pe= ople what they SHOULD do. On 26 Jul 2019, at 19:31, Brian Dickson wrote: > The deployment impact is one reason I think this should be addressed wi= dely and soon, so that either way, the impact can be minimized. > > Examples of groups that may not all share the same view on the issues a= t hand, include browser vendors, security vendors, industry groups like C= A/B, resolver operators, ISP trade associations, ISPs, national governmen= ts, consumer protection entities, enterprises, DNS software vendors, OS m= aintainers, hosting companies, DPI equipment vendors, IoT vendors, open s= ource router firmware groups, to list just a few off the top of my head. Plus other Standard Organizations. > And the degree to which those same groups have similar or dissimilar vi= ews of DoT is a relevant question in the context of =E2=80=9Calternatives= or successors=E2=80=9D. There are so many players that sets the policy for how IP packets can be = sent and used today, and if nothing else legal tools used (including lice= nsing, oversight over peering, traffic exchange etc), that unless IETF (w= ith the help of ISOC and cooperation with other SDOs) do take all of thes= e things into account and CONTINUE TO EXPLAIN how a good balance is betwe= en the various interests that exists, IETF can quite quickly be non-inter= esting and loose its voice. Patrik --=_MailMate_DD6EBDB6-EB64-4586-B467-DC33043AFA1A_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXTtB4Q8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI182I2gCfUGkXezvri+PFsaIQX5twcYPw2RMAn2yfg+yC pPJdSOSzmnMSx9CjYf79 =Z0HT -----END PGP SIGNATURE----- --=_MailMate_DD6EBDB6-EB64-4586-B467-DC33043AFA1A_=-- From nobody Fri Jul 26 11:30:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A32A1201E5 for ; Fri, 26 Jul 2019 11:30:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7oTMZu7_ykPs for ; Fri, 26 Jul 2019 11:30:06 -0700 (PDT) Received: from mail-ot1-x32f.google.com (mail-ot1-x32f.google.com [IPv6:2607:f8b0:4864:20::32f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 749D012008C for ; Fri, 26 Jul 2019 11:30:06 -0700 (PDT) Received: by mail-ot1-x32f.google.com with SMTP id x21so17821379otq.12 for ; Fri, 26 Jul 2019 11:30:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Y7ky7Eom3WBsAdd3le6kYJnspVY/Jch9tsSnyyvJrcI=; b=vCQhjIBY+uC5obIvUXz0fLbZVTgK/5Rqwar0pSmtddq6dAFFuOP3e7CzdC8vn8BdKP i+kR0152nCoDeEwFP+3W5ihMN1tLzqj6j4ELLAPPNiYFrDjjTJ7c7in51DCYDn2gto8R oPk2k84FrvaJMXfES/Ig1IK1PfOFz+xn9N9zOJNmsgvIQ7eW7sGuebHq9nUDpIdZ6U5i B7tfXm/6l7nMKqUou4pOqs84Zb4LjY/bNWQ7oV7puVHRFN65jQZS9GOjLyf1yx9Z0URY yW8c9RX26YoPzKdNgQ74vVehmy4Iq4ZMi8O5JcS4mvSZxpqEQJ0T3J0RtqrZId0mUNIR X5bg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Y7ky7Eom3WBsAdd3le6kYJnspVY/Jch9tsSnyyvJrcI=; b=KHN+gthnNiI/iuMgDWZhK2MfLaLMqAIRKVte1PQAVlV9uMD4WhpgJxmplJg1NIVvRb arLMu9DqihriJjJZO2+eEcKdEmC1pg9VVQU8/SJsvYsqn0FpBV6ADD50jQFLadUc8KQU vSUCvQWLavJ0HxQlFo0plmWaUNGZCHMv15L5nUegyJxHOYI29dAv0RnQhgJAt17QsVGm 8KWDiB77Ads/FKyct2/DM97Odtun/FxUGDaNIiIRFim7SF05KaWDQbxvGxedCvlSBGGj YJdWZrOaNXYthIP0XXmH+BIuSiFznrpHlF7yvSctvymmMMprjrLDD3WH7+2R9Q+yK+4M i7zg== X-Gm-Message-State: APjAAAUwJ5BMYVSdkXLSuKVPGM3v9smzUnP10ye15Od2YWca7Do4+nIY vcqJcZyiMvwV7Zj1+UxTQdkHPw== X-Google-Smtp-Source: APXvYqwDGhpMC1T3zb8rxHejKGlUnOtDfMkLDg5NfRK+RTdBsyfQLJ8OgOZlRqrvmGC8ZVwzrMI2YQ== X-Received: by 2002:a9d:6853:: with SMTP id c19mr15170111oto.213.1564165805682; Fri, 26 Jul 2019 11:30:05 -0700 (PDT) Received: from [10.123.196.186] (mobile-107-92-58-127.mycingular.net. [107.92.58.127]) by smtp.gmail.com with ESMTPSA id 138sm18137791oii.8.2019.07.26.11.30.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 26 Jul 2019 11:30:04 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Fri, 26 Jul 2019 14:30:03 -0400 Cc: Brian Dickson , =?utf-8?Q?Patrik_F=C3=A4ltstr=C3=B6m?= , ADD Mailing list , Rob Sayre , Wes Hardaker Content-Transfer-Encoding: quoted-printable Message-Id: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> <45A7F1E2-B619-40C4-A4CD-F3DE246CD60C@fugue.com> To: Tommy Jensen Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 18:30:08 -0000 I don=E2=80=99t think it=E2=80=99s a bad idea to talk about how well behaved= apps and stacks ought to behave. Indeed I think it=E2=80=99s important work= . I just want to make sure that we are careful not to imagine that we have p= owers we don=E2=80=99t actually have as we think about what the right advice= may be.=20 From nobody Fri Jul 26 11:55:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B88E81200C1 for ; Fri, 26 Jul 2019 11:55:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TqGrHcP5pxO2 for ; Fri, 26 Jul 2019 11:54:59 -0700 (PDT) Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2B746120071 for ; Fri, 26 Jul 2019 11:54:59 -0700 (PDT) Received: by mail-io1-xd2e.google.com with SMTP id s7so106748427iob.11 for ; Fri, 26 Jul 2019 11:54:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=a1UxyXXQQKTNJHm1e43e+NdQG2YFtJCMUkwWBlQMrnE=; b=ac/qdHKXpUB7uBSu6zFKUxeXuZ6AEsIKQeYFu+8pdYHAj9lYabbHJZ02roRDcJM6DJ uUiegXm/ULB1n4EtmT66OmSPnyU+RS2riKNwECXR9cRQeI/10rvEgUFfnVotGHH57DJB jb+Q8k1J8nKDjXQI/SgAERkEnfqK9inCJCqubnZXVEoTUHd+qI7xJA1ULlzSkPuPd5Xy xCOb7EfCNUOeTk7U+Uh+UsEgkBYoRZZrpT4S/wm0MxWHbFhhjBu7lXNYO9Xb5n7GbKrO /W0bZFnNAQ58y/c0+KVj556RRgFlKCmlpqz5hoacIprEASrtTXFN9OLrW6OJcbhPxAcd jU9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=a1UxyXXQQKTNJHm1e43e+NdQG2YFtJCMUkwWBlQMrnE=; b=A3Q2ljcw/d9wJbPVd/eh/ce+nEk8uDmUVaeEySC0PJM7abXyoguUhzFDnC+wiSFIRd J4HB3dtZE/3QazoHgVUrOL00ey7gEY0k8JHdwtSGG7evxjY4B3udZe5clGLewnxP395B yAok7uY1CZi1uovTYiNuOjIseuH+agOkyDGFOwS7twHnOTM6FwlNxFaxeMdw3IdZJ4Qi oqSD8li4gbHgV0CJct2FW8sEPsvyZwOUIwndkjTDRlKKo9WlQHoNPd+cZiGUUITn/ZBm CkW2rhJDg7HabFfyTRRVdK0VbWdmXC/pBlevazeFJXfHFOC/VZJvBheldWjps3b/8C5M BCoQ== X-Gm-Message-State: APjAAAW6wCFwWJZ7XRPKbwAhPoKtKaMRGbscVrg2MK7Zog+WbJIaBM/K 0zJSmFvQwfOMIfIyWAS0DQw= X-Google-Smtp-Source: APXvYqzRpjzFsUWwYTCIEvGcKkn140qMgfeTNLMmnSPxwgOTkupTIlvzJ8uoTYYfy3j/sysYt84Xpw== X-Received: by 2002:a5d:9618:: with SMTP id w24mr24439018iol.279.1564167298450; Fri, 26 Jul 2019 11:54:58 -0700 (PDT) Received: from [10.255.255.51] ([207.164.22.11]) by smtp.gmail.com with ESMTPSA id r7sm39194060ioa.71.2019.07.26.11.54.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 26 Jul 2019 11:54:57 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-3BC50F59-BE40-4865-A4D2-B98DCE31C296 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16F203) In-Reply-To: Date: Fri, 26 Jul 2019 14:54:55 -0400 Cc: Ted Lemon , =?utf-8?Q?Patrik_F=C3=A4ltstr=C3=B6m?= , ADD Mailing list , Rob Sayre , Wes Hardaker Content-Transfer-Encoding: 7bit Message-Id: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> <45A7F1E2-B619-40C4-A4CD-F3DE246CD60C@fugue.com> To: Tommy Jensen Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 18:55:03 -0000 --Apple-Mail-3BC50F59-BE40-4865-A4D2-B98DCE31C296 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Jul 26, 2019, at 2:07 PM, Tommy Jensen wr= ote: >=20 > I think for the WG to entertain the idea of deprecating or otherwise stop r= ecommending DoH is a bad idea. The comparison with MD5 and outdated TLS vers= ions has a fundamental flaw: those algorithms have suffered from some kind o= f breakage or weakness against moden infra that made using them insecure. Do= H doesn't share that weakness; its effectiveness is actually a root cause of= all the WG's debate. I don't think we gain anything from discovering and sh= aring a useful tool then telling people not to use that tool. And even if we= wanted to, they're going to anyway, cat's out of the bag. >=20 > > I don't think "want" enters into it per se; it is a question of what is r= equired in order to maintain all the existing functionality for things imple= mented in DNS today, and for preventing the problems created when applicatio= ns use DoH to bypass OS-selected resolvers. The value of "required" may diff= er by environment, and that is a big part of the problem. >=20 > I think this is a constructive approach. I don't think we maintain the fun= ctionality we have today in the 53U world by finding ways to let middle boxe= s get access (visibility in any format) to the traffic. A major reason for e= ncrypting DNS or any other traffic is to prevent exactly that. I think we ne= ed to focus on making recommendations that will maximize the cases where enc= rypted DNS traffic is going to RRs the user trusts to do traffic manipulatio= n (parental controls, internal resolution routing, malware blocking, or what= ever else that manipulation may be). >=20 So, this is where I am in favor of deployment and use of DoT, with only the R= R having the necessary visibility and control to accomplish the desired resu= lts. The reason for DoT rather than DoH, is to enable detection and/or blocking o= f DoT connections at the network layer. The network layer is critical for the ability to enforce policies for all de= vices on a network, regardless of ownership or status. EG BYOD, environments= without active device management, compromised devices, apps with defects, u= napproved apps, etc. DoT is effectively an upgrade, without significant changes to network contro= l capabilities or any new requirements for host level controls. > The platform can be the source of signal well-behaved apps need to get tha= t kind of insight. For example, without reference to specific APIs, any give= n platform should know whether its configured DNS servers came from DHCP (an= d possibly whether the network that recommended them is "user trusted" or no= t in the context of being a home or work or public network) or were manually= set by the user. This information can be used to help sort available RRs by= how much the user has expressed trust in them already. If DNS-capable apps (= DoH or otherwise) wanted to play nicely in the ecosystem, they could ask the= platform about the currently configured system DNS and weigh that against t= heir configuration. >=20 > My proposal is this sorting would prefer user involvement over anything el= se, and admin involvement over non-admin involvement. Meaning, where Firefox= is on a platform where an admin has configured the platform's DNS servers m= anually, it would defer to the system resolver until it can promote its own R= R recommendation directly to an admin authority (or to a non-admin user if t= hat's all the system is using). OTOH, if the platform indicates its current D= NS servers all came from a less trusted network, the app could then feel jus= tified in deferring to its own recommendation without violating user trust. >=20 > Thoughts?=20 It is an excellent set of ideas for cases where there is no requirement for n= etwork level enforcement, or where only untrusted or insecure networks are u= sed. These are a potential part of a larger and improved network ecosystem. H= owever, I believe the network level stuff will always be a necessary aspect f= or several use cases. It might be the case where some mutual trust and disco= very of posture and capability, from a not-yet-selected WG with TBD semantic= s. A lot boils down to the concept of =E2=80=9Cmutual=E2=80=9D, or of network-c= entric controls. One possibility needs to be that the client has enough information to decide= whether to connect to a given network. Multi homes devices (eg smartphones)= may have alternative networks they can use. Brian >=20 > From: Add on behalf of Brian Dickson > Sent: Friday, July 26, 2019 10:31 AM > To: Ted Lemon > Cc: Patrik F=C3=A4ltstr=C3=B6m ; ADD Ma= iling list ; Rob Sayre ; Wes Hardaker > Subject: Re: [Add] My longer list of questions [from partial distribution a= t the MIC] > =20 >=20 >=20 > Sent from my iPhone >=20 > On Jul 26, 2019, at 12:26 PM, Ted Lemon wrote: >=20 >> What would be the good outcome that would result from the IETF deprecatin= g DoH? Who would follow our advice? =20 >=20 > I think for the answer to that question, it might be necessary to compare w= ith such deprecation activity such as MD5, TLS versions below 1.3, and other= similar situations. >=20 > The Internet is a big place with a lot of diverse parties with their own s= pecific approaches to things like this, and it is difficult to predict how a= ny of them would respond, let alone all of them. >=20 > A significant factor in any similar situation has been deployment prior to= deprecation, and available deployment of successors or alternatives. >=20 > I humbly acknowledge that it could get messy, particularly depending on ho= w various groups and entities respond. >=20 > The deployment impact is one reason I think this should be addressed widel= y and soon, so that either way, the impact can be minimized. >=20 > Examples of groups that may not all share the same view on the issues at h= and, include browser vendors, security vendors, industry groups like CA/B, r= esolver operators, ISP trade associations, ISPs, national governments, consu= mer protection entities, enterprises, DNS software vendors, OS maintainers, h= osting companies, DPI equipment vendors, IoT vendors, open source router fir= mware groups, to list just a few off the top of my head. >=20 > And the degree to which those same groups have similar or dissimilar views= of DoT is a relevant question in the context of =E2=80=9Calternatives or su= ccessors=E2=80=9D. >=20 > Brian >=20 >>=20 >> Sent from my iPhone >>=20 >> On Jul 26, 2019, at 11:53 AM, Brian Dickson wrote: >>=20 >>>=20 >>>=20 >>> On Fri, Jul 26, 2019 at 11:06 AM Ted Lemon wrote: >>>=20 >>>=20 >>>> On Jul 26, 2019, at 10:50 AM, Brian Dickson wrote: >>>> One approach to enforcing the policy has a larger scope than the OS. It= is to view DoH itself as the problem, and ask, how can we put the DoH genie= (djinn) back in the bottle? >>> The djinn was never in the bottle in the first place.. If this discussio= n is going to continue to entertain the fantasy that malware isn=E2=80=99t a= lready doing this, it=E2=80=99s not likely to be very useful. >>>=20 >>> One important distinction about malware "doing this": prior to the scena= rio where DoH (to an independently-operated resolver) was used, it was possi= ble to detect this malware activity by correlation between DNS queries and T= LS connections. >>>=20 >>> In order to establish a TLS connection, the client app needs to do a DNS= query to identify the IP address of the server to which it plans to connect= . >>>=20 >>> A hypothetical anti-malware system with integration to the DNS query fee= d, would be aware of specific clients requesting specific DNS records, and t= he TTLs of the responses. >>>=20 >>> Connections not conforming to tuples of (current time, client IP, server= IP, TTL expiry time) would be detectable and alert-able. (Additional inform= ation on connections' SNI and servers' names allows much greater accuracy, b= ut if/when ESNI happens, this signal goes away.) >>>=20 >>> In an environment where DNS resolver choice cannot be detected or enforc= ed, negates this model, particularly if all DNS query traffic becomes unobse= rvable to the hypothetical anti-malware system. >>>=20 >>> This is a change to the threat detection and blocking environment, and e= xists only when encrypted DNS is commingled with HTTPS traffic. >>>=20 >>> Brian >>> =20 --Apple-Mail-3BC50F59-BE40-4865-A4D2-B98DCE31C296 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

    Sent from my iPhone

    On Jul 26, 2019, at 2:07= PM, Tommy Jensen <Jensen.= Thomas@microsoft.com> wrote:

    <= div dir=3D"ltr">
    I think for the WG to entertain the idea of deprecating or otherwise stop re= commending DoH is a bad idea. The comparison with MD5 and outdated TLS versi= ons has a fundamental flaw: those algorithms have suffered from some kind of= breakage or weakness against moden infra that made using them insecure. DoH doesn't share that weakness;= its effectiveness is actually a root cause of all the WG's debate. I don't t= hink we gain anything from discovering and sharing a useful tool then tellin= g people not to use that tool. And even if we wanted to, they're going to anyway, cat's out of the bag.

    > I don't think "want" enters into it per se; it is a question of what is requi= red in order to maintain all the existing functionality for things implement= ed in DNS today, and for preventing the problems created when applications u= se DoH to bypass OS-selected resolvers. The value of "required" may differ by environment, and that is a= big part of the problem.
    I think this is a constructive approach. I don't think we maintain the functi= onality we have today in the 53U world by finding ways to let middle boxes g= et access (visibility in any format) to the traffic. A major reason for encr= ypting DNS or any other traffic is to prevent exactly that. I think we need to focus on making recommendati= ons that will maximize the cases where encrypted DNS traffic is going to RRs= the user trusts to do traffic manipulation (parental controls, internal res= olution routing, malware blocking, or whatever else that manipulation may be).

    So, this is where I am= in favor of deployment and use of DoT, with only the RR having the necessar= y visibility and control to accomplish the desired results.

    The reason for DoT rather than DoH, is to enable detection and/or b= locking of DoT connections at the network layer.

    Th= e network layer is critical for the ability to enforce policies for all devi= ces on a network, regardless of ownership or status. EG BYOD, environments w= ithout active device management, compromised devices, apps with defects, una= pproved apps, etc.

    DoT is effectively an upgrade, w= ithout significant changes to network control capabilities or any new requir= ements for host level controls.


    The platform can be the source of signal well-behaved apps need to get that k= ind of insight. For example, without reference to specific APIs, any given p= latform should know whether its configured DNS servers came from DHCP (and p= ossibly whether the network that recommended them is "user trusted" or not in the context of being a ho= me or work or public network) or were manually set by the user. This informa= tion can be used to help sort available RRs by how much the user has express= ed trust in them already. If DNS-capable apps (DoH or otherwise) wanted to play nicely in the ecosystem,= they could ask the platform about the currently configured system DNS and w= eigh that against their configuration.

    My proposal is this sorting would prefer user involvement over anything else= , and admin involvement over non-admin involvement. Meaning, where Firefox i= s on a platform where an admin has configured the platform's DNS servers man= ually, it would defer to the system resolver until it can promote its own RR recommendation directly to a= n admin authority (or to a non-admin user if that's all the system is using)= . OTOH, if the platform indicates its current DNS servers all came from a le= ss trusted network, the app could then feel justified in deferring to its own recommendation without vi= olating user trust.

    Thoughts? 

    It is an excelle= nt set of ideas for cases where there is no requirement for network level en= forcement, or where only untrusted or insecure networks are used. These are a= potential part of a larger and improved network ecosystem. However, I belie= ve the network level stuff will always be a necessary aspect for several use= cases. It might be the case where some mutual trust and discovery of postur= e and capability, from a not-yet-selected WG with TBD semantics.
    <= br>
    A lot boils down to the concept of =E2=80=9Cmutual=E2=80=9D, o= r of network-centric controls.

    One possibility need= s to be that the client has enough information to decide whether to connect t= o a given network. Multi homes devices (eg smartphones) may have alternative= networks they can use.

    Brian

    <= blockquote type=3D"cite">

    From: Add <add-bounces@ietf.org> on behalf of Brian Dic= kson <brian.peter.dickso= n@gmail.com>
    Sent: Friday, July 26, 2019 10:31 AM
    To: Ted Lemon <mellon@fugue.co= m>
    Cc: Patrik F=C3=A4ltstr=C3=B6m <paf=3D40frobbit.se@dmarc.ietf.org>; ADD Mailing li= st <add@ietf.org>; Rob Sayre <<= a href=3D"mailto:sayrer@gmail.com">sayrer@gmail.com>; Wes Hardaker &l= t;wjhns1@hardakers.net>
    Subject: Re: [Add] My longer list of questions [from partial distribu= tion at the MIC]
     


    Sent from my iPhone

    On Jul 26, 2019, at 12:26 PM, Ted Lemon <mellon@fugue.com> wrote:

    What would be the good outcome that would result from the I= ETF deprecating DoH?    Who would follow our advice?  

    I think for the answer to that question, it might be necessary to compa= re with such deprecation activity such as MD5, TLS versions below 1.3, and o= ther similar situations.

    The Internet is a big place with a lot of diverse parties with their ow= n specific approaches to things like this, and it is difficult to predict ho= w any of them would respond, let alone all of them.

    A significant factor in any similar situation has been deployment prior= to deprecation, and available deployment of successors or alternatives.

    I humbly acknowledge that it could get messy, particularly depending on= how various groups and entities respond.

    The deployment impact is one reason I think this should be addressed wi= dely and soon, so that either way, the impact can be minimized.

    Examples of groups that may not all share the same view on the issues a= t hand, include browser vendors, security vendors, industry groups like CA/B= , resolver operators, ISP trade associations, ISPs, national governments, co= nsumer protection entities, enterprises, DNS software vendors, OS maintainers, hosting companies, DPI equipment vend= ors, IoT vendors, open source router firmware groups, to list just a few off= the top of my head.

    And the degree to which those same groups have similar or dissimilar vi= ews of DoT is a relevant question in the context of =E2=80=9Calternatives or= successors=E2=80=9D.

    Brian


    Sent from my iPhone

    On Jul 26, 2019, at 11:53 AM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:



    On Fri, Jul 26, 2019 at 11:06 AM Ted= Lemon <mellon@fugue.com> wrot= e:


    On Jul 26, 2019, at 10:50 AM, Brian Dickson <brian.peter.dickson@= gmail.com> wrote:
    • One approach to enforcing the policy has a larger scope than the OS. It i= s to view DoH itself as the problem, and ask, how can we put the DoH genie (= djinn) back in the bottle?
    The djinn was never in the bottle in the first place.. If this discussi= on is going to continue to entertain the fantasy that malware isn=E2=80=99t a= lready doing this, it=E2=80=99s not likely to be very useful.

    One important distinction about malware "doing this": prior to the scen= ario where DoH (to an independently-operated resolver) was used, it was poss= ible to detect this malware activity by correlation between DNS queries and T= LS connections.

    In order to establish a TLS connection, the client app needs to do a DN= S query to identify the IP address of the server to which it plans to connec= t.

    A hypothetical anti-malware system with integration to the DNS query fe= ed, would be aware of specific clients requesting specific DNS records, and t= he TTLs of the responses.

    Connections not conforming to tuples of (current time, client IP, serve= r IP, TTL expiry time) would be detectable and alert-able. (Additional infor= mation on connections' SNI and servers' names allows much greater accuracy, b= ut if/when ESNI happens, this signal goes away.)

    In an environment where DNS resolver choice cannot be detected or enfor= ced, negates this model, particularly if all DNS query traffic becomes unobs= ervable to the hypothetical anti-malware system.

    This is a change to the threat detection and blocking environment, and e= xists only when encrypted DNS is commingled with HTTPS traffic.

    Brian
     
    = --Apple-Mail-3BC50F59-BE40-4865-A4D2-B98DCE31C296-- From nobody Fri Jul 26 12:23:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EA6C1201CC for ; Fri, 26 Jul 2019 12:23:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Uh5YogLScrh9 for ; Fri, 26 Jul 2019 12:23:45 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D4C22120437 for ; Fri, 26 Jul 2019 12:23:31 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45wJsF4XQgzKx6 for ; Fri, 26 Jul 2019 21:23:29 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1564169009; bh=P6jH1o8lDtyJtRwt1YSN1Vz6h24Ngjogqad4bSegS+Q=; h=Date:From:To:Subject:In-Reply-To:References; b=otEAi0Q3DSOh+hBPumlYEiW5DsdZZU55Bs6EPaOS4fDu5iuTrP1icGIHvx5qdutWv TbOvNag5MMwZtTScZ9Lo+7F8+xvjAs46HG6ALPm3C9gLYDcKDxcnt2IMozXuX/yujm 8Lb3E58o9/8P2MkmFyfrsESYrb51uDlJPhEdX8tI= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id 2EfMQmQF0X5t for ; Fri, 26 Jul 2019 21:23:28 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS for ; Fri, 26 Jul 2019 21:23:27 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 4388061CEE; Fri, 26 Jul 2019 15:23:26 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 4388061CEE Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 3AFE140A6FFE for ; Fri, 26 Jul 2019 15:23:26 -0400 (EDT) Date: Fri, 26 Jul 2019 15:23:26 -0400 (EDT) From: Paul Wouters To: add@ietf.org In-Reply-To: <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=ISO-8859-15 Content-Transfer-Encoding: 8BIT Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 19:23:47 -0000 On Fri, 26 Jul 2019, Patrik Fltstrm wrote: > And my point is that if IETF is changing the model so that the success rate changes in implementing such policies, then IETF have a responsibility to provide other tools that can be used by the same parties to implement the same policies. How dare you make such a good bike lock! I think RFC 7258 still stands. > And to answer THAT question, my view is that it would be silly for the IETF to change the overall model when just by changing the DNS protocol to be encrypted, but not how to do DNS endpoint detection (for example) is so much easier. That way we get privacy, still have the ability for the end user to override the default setting and IETF do not have to really answer questions by for example legislators, hardware- and software manufacturers etc. There is DoT, DoH and VPNs. The problem is not that the IETF is doing nothing. It is that is doing little to help the enterprise people mess with DNS "for the user". Mostly because the IETF cannot help with distinguishing the good people from the bad people. I think the general enduser philosophy is that they trust a few big centralized companies more than most network operators of the many unknown networks they join. The centralization makes me sad, but the additional security makes me happy. The privacy impact greatly concerns me. Paul From nobody Fri Jul 26 14:43:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87C9912006E for ; Fri, 26 Jul 2019 14:43:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lastpresslabel-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W8mwSyi7wQhm for ; Fri, 26 Jul 2019 14:43:09 -0700 (PDT) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8789B120047 for ; Fri, 26 Jul 2019 14:43:09 -0700 (PDT) Received: by mail-qt1-x833.google.com with SMTP id n11so54056476qtl.5 for ; Fri, 26 Jul 2019 14:43:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lastpresslabel-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=yfOylrwwqZN2Wcs7G0c1kyi1tKx7FOPkukcmTNi/1gQ=; b=M6lO8me6KuHeVAVLn6YmwFP52Ey1Ovo34B10KGgcfzTGaWAmy5gPpZqfHPjAwKaxfr L1MxlJZdzvpJ0AFHOHPMaox47pnvU6p0eG5hKCFe6UCsR045jDmjU9tbmfDShJRS8yK+ 24S1mDHPnyK+cOwTRM2jELnbO8j3a82l1dImjDEGIrIBHu0BdtXwF8Wi1cc0ofk0Ot5E iFBcztJoLDdZw7AUvLSfymUupk0RMRkCWND5uHw6lJicjEQS4dQU86Hah49uHdhv2dSD hZZ1G6ZG3jh+eZY3fnvq3pIDkTnzzheXXnpWbCpWg/XhfmUEd0WJncDqYsLEmKcBfdWR U6PQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=yfOylrwwqZN2Wcs7G0c1kyi1tKx7FOPkukcmTNi/1gQ=; b=VL28vE7IrMl4EvM1bdChB4YxuYVYhl78TRVPazNm9plRinls6yhXsKnD59beXhtGdw RlJpmqDp1lqpZreY5JU93rav3f7k2bAJjBUumXwusy7x/fqtX4h0R4dIHxEcEYiL6CLh 2Gabb4DOQ/YguwjoMNYld1yPZ7rzqmWMC6moKs4jEbzVcCWsdDHpxdSRzzVMhf3NP77C wSXSl6PQpLf0j1FckxWLDulKRXl5B5rtaPwR/11twybobA5bPCOUbCrC68w3ZvxKRdgw 6JIgCkY7gqPUP0yaZLNPeQTyM5byPs2QvvT+Bv7wnhXEdHkiGUsu/IINItNj59h219pV VlYQ== X-Gm-Message-State: APjAAAVBpqFT9xoDJFeb3urr53o7jHvenU7ISibx2yiwqRhKtZ+Lw1qY +5fKBBHlfbnX38+voxCpCsNDjz8UlDQ= X-Google-Smtp-Source: APXvYqyrUzI68gu5As9MRl6bfGLSZSSTGCeC6c6xb4hZcbA/Ku8T2545026YIX+Pj2wAvhxyLDX0CQ== X-Received: by 2002:ac8:1c42:: with SMTP id j2mr67960789qtk.68.1564177388369; Fri, 26 Jul 2019 14:43:08 -0700 (PDT) Received: from [172.20.19.232] ([45.61.14.174]) by smtp.gmail.com with ESMTPSA id l123sm23383094qkc.9.2019.07.26.14.43.07 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 26 Jul 2019 14:43:07 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Dominique Lazanski X-Mailer: iPhone Mail (16F203) In-Reply-To: Date: Fri, 26 Jul 2019 17:43:07 -0400 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <82464B8C-D634-41B5-8EBB-A15A39CA9162@lastpresslabel.com> References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> To: Paul Wouters Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 21:43:12 -0000 >> On 26 Jul 2019, at 15:23, Paul Wouters wrote: >>=20 >> On Fri, 26 Jul 2019, Patrik F=C3=A4ltstr=C3=B6m wrote: >>=20 >> And my point is that if IETF is changing the model so that the success ra= te changes in implementing such policies, then IETF have a responsibility to= provide other tools that can be used by the same parties to implement the s= ame policies. >=20 > How dare you make such a good bike lock! >=20 > I think RFC 7258 still stands. >=20 >> And to answer THAT question, my view is that it would be silly for the IE= TF to change the overall model when just by changing the DNS protocol to be e= ncrypted, but not how to do DNS endpoint detection (for example) is so much e= asier. That way we get privacy, still have the ability for the end user to o= verride the default setting and IETF do not have to really answer questions b= y for example legislators, hardware- and software manufacturers etc. >=20 > There is DoT, DoH and VPNs. The problem is not that the IETF is doing > nothing. It is that is doing little to help the enterprise people > mess with DNS "for the user". Mostly because the IETF cannot help with > distinguishing the good people from the bad people. That=E2=80=99s not the issue.=20 >=20 > I think the general enduser philosophy is that they trust a few big > centralized companies more than most network operators of the many > unknown networks they join. Um no. Depends on the country, the regulatory environment and the users. I t= rust the operator I use more than one of those big companies.=20 > The centralization makes me sad, Me too.=20 > but > the additional security makes me happy. You mean additional encryption. For some users, this is a downgrade in secur= ity.=20 > The privacy impact greatly > concerns me. Me too.=20 >=20 > Paul Dominique=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Fri Jul 26 15:13:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96DF7120181 for ; Fri, 26 Jul 2019 15:13:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iW4zyRtW0rnw for ; Fri, 26 Jul 2019 15:13:51 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3562120173 for ; Fri, 26 Jul 2019 15:13:50 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 3BF2A6A35E; Sat, 27 Jul 2019 00:13:48 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1564179228; bh=9qVdiqZyEtVsIBtHAx6ZqYwL12jZKAxQnPabVUVeXVI=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From; b=Uiv9CHACWCta/xhRfpsOukiZvgrhr0JISHWkAlZZcHZhvfSyYgez48jsWKSPjaa9G U53eUthffbHanDOI8p6mqzOCne+RgalDt/baOckNgvQKNbepx/W2VxEc3fEdzfX9Qq 1Gx9LcHLEyDHyEYnopb1uv2qibbyaAuscAuhwwQUyGAdR5r2M4KNRZxwB7ueGigU55 bDqiCY7E8mCAyXVc5rtW72dzAbB0SgyNmldh3Szl8S321CTVA/q5GPEZniRlSok3Hv 7FN+hiGtyUuGOzcq6RGi6Z8yLgfsyzCBZRxP8EdzOzf/WM9bOSzn52+s42FmxWLM8w mxV5GhKZ0AUAg== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 2FCB73C015E; Sat, 27 Jul 2019 00:13:48 +0200 (CEST) Date: Sat, 27 Jul 2019 00:13:48 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Paul Wouters , add@ietf.org Message-ID: <1888798146.520.1564179228138@appsuite-gw1.open-xchange.com> In-Reply-To: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev9 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 22:13:53 -0000 > Il 26 luglio 2019 21:23 Paul Wouters ha scritto: > > I think the general enduser philosophy is that they trust a few big > centralized companies more than most network operators of the many > unknown networks they join. This is what you think, but is this assumption supported by data? I've never seen any. Moreover, this seems to be highly variable depending on context (location, user type, use case, level of tech-savviness etc). Different people see different contexts and generalize their perception to the entire Intenet. This is also why, in the end, users need to be allowed to make this choice for themselves, though "I delegate this choice to ..." is also an acceptable user choice. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Fri Jul 26 15:49:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF75712019F for ; Fri, 26 Jul 2019 15:49:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZZxMBLMxXU6W for ; Fri, 26 Jul 2019 15:49:34 -0700 (PDT) Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0BAE1120191 for ; Fri, 26 Jul 2019 15:49:33 -0700 (PDT) Received: from dooku.sandelman.ca (unknown [75.98.19.134]) by relay.sandelman.ca (Postfix) with ESMTPS id 3D9EA1F44B; Fri, 26 Jul 2019 22:49:32 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id 69D2C1A97; Fri, 26 Jul 2019 18:49:39 -0400 (EDT) From: Michael Richardson To: Adam Roach , add@ietf.org In-reply-to: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> Comments: In-reply-to Adam Roach message dated "Thu, 25 Jul 2019 10:11:52 -0400." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Date: Fri, 26 Jul 2019 18:49:39 -0400 Message-ID: <25583.1564181379@dooku.sandelman.ca> Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 22:49:36 -0000 --=-=-= Content-Type: text/plain Adam Roach wrote: > Since you mention Firefox's TRR list and then mention data mining (with an > implied connection), I'd like to point out yet again that one of the key > criteria for appearing on that list is an agreement to treat resolution > data according to a strict set of privacy-protecting provisions. You > can see, for > example, Cloudflare's associated privacy policy at > https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ Does Mozilla have a policy/proceedure to vet the privacy policy of DoT/DoH providers? Maybe Mozilla is considering this? Would it be appropriate for this to go into a certificate extension (perhaps signed by a Mozilla CA)? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEERK+9HEcJHTJ9UqTMlUzhVv38QpAFAl07g4IACgkQlUzhVv38 QpCYNQf9FFmK6f3he4UEHvlIXhjXM90NnGZQJ1WKlJVqogTmvI2xMUYVuhqnQtif iYsYSuMqTkqfoz9+ifK3uuSvYu0v/JBjpuqVBFk0O9QHRj6z6aEO38rIWTr+rPYE zm9wPTK8nC8yltNl+upZr4YTtKbP+CZYHvUjXzHUReD3UeKenCXlsz1O/W0t860V egljmSeTRrpr0RrtpD38E6he0k4a+YBeUmxsRwBlcPbMEEafz6lH9ryTxUVoibcf m1YzI81YRtb/8aJYyHdhQvqOoNmeE/at+q5svrot7C1D2ff5xVuqJBK2ZTRqCObS EkbKWlhQw6ZnSiiIm7QAApEat7L9Yw== =XLGV -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Jul 26 15:57:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28E9D120181 for ; Fri, 26 Jul 2019 15:57:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vlhDwZZMD4yo for ; Fri, 26 Jul 2019 15:57:35 -0700 (PDT) Received: from mail-qk1-x731.google.com (mail-qk1-x731.google.com [IPv6:2607:f8b0:4864:20::731]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFEE1120191 for ; Fri, 26 Jul 2019 15:57:34 -0700 (PDT) Received: by mail-qk1-x731.google.com with SMTP id d15so40236999qkl.4 for ; Fri, 26 Jul 2019 15:57:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=hweH/hF+BnitaInwaqHXzn3A3hMAIfjPspcNW/dU234=; b=Xf5Z1ncjiYS+rajODeF/HYJzfke1NN3w7F8Vh1SZvp/1seBKOcqIsQBEBWmA4sL0Eu 813LYLC4DPd+PQeHSlT1D4KSg7HFPdC11fsTd3u8/eqTwElHuaKjg/a+cTHiunDx/aQN LmR0VJs3KoiCbVqGRQNrtdfGF911UwuRhhuCIUODyFekBadphWVQ73JNf1EMqvR3RKrd HQMSnCgJtwAyiBZpdrugTu/hMDmWoKTbO6yno97NmQPq3ZgoRGSWH9BVbd3Yxv9hhwYA y9JPEKvUy2Snni0ntrvdQLXJN1uYzRp+lT61nybj0vxyBJeAaebNAlvmmcWD8V97+3Ku /SIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=hweH/hF+BnitaInwaqHXzn3A3hMAIfjPspcNW/dU234=; b=lKg4e8GgG8pKqUbPKuxW3zN6fp6/ggLXejsv53YOD9iZrjYPJx+JEW9yFxbxNo9h4g 6HIwH9GIv9/J79uw27TxUuIYpIBnRclURVtBqs8laTqBWOqj1018RESfp/xKyVYLFItF K9TWqZf6m+B2CmEDRwIhyQ5tA0MWelBz3RahFT6X2WdoM063GJzXAryU5392DaM8JfA5 BWX/lEqQKavGVpjiKfKEv28BuGX4nVH403cNC3QenIqoosV/DLlDNms5oTBO3iATsuUk twe1/FmG3bPYqXLIISXmcw7iSRM7yWKA0lAcSO/hjQ+CD2ShtwSZtStWgAF+R0bnZIz7 JI/g== X-Gm-Message-State: APjAAAUhjtIWZB5mCrQZOOB6ce2/cObI4TC/7dEEHt/7GFQhpjqp+RcH s+sDTkvVKHeKy96tia9vvTGYdLaWABo9pJmd X-Google-Smtp-Source: APXvYqzqdUlFRpfm+lGM/gSJ2WmzHiZy21yi4YWhr7xPzOfsZR+pwrsRXsX5TcWAKnNs4PND8oUnwQ== X-Received: by 2002:a37:4ad7:: with SMTP id x206mr66807906qka.85.1564181854046; Fri, 26 Jul 2019 15:57:34 -0700 (PDT) Received: from [10.0.30.16] (c-73-186-137-119.hsd1.ma.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id g35sm30152940qtg.92.2019.07.26.15.57.33 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 26 Jul 2019 15:57:33 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_975DB4FF-A2DB-47BC-9471-806F9FEB50E3" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Ted Lemon X-Priority: 3 In-Reply-To: <1888798146.520.1564179228138@appsuite-gw1.open-xchange.com> Date: Fri, 26 Jul 2019 18:57:31 -0400 Cc: Paul Wouters , add@ietf.org Message-Id: <52FC9A3D-4983-4009-87E0-6A0F7ADCEF96@fugue.com> References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <1888798146.520.1564179228138@appsuite-gw1.open-xchange.com> To: Vittorio Bertola X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 22:57:37 -0000 --Apple-Mail=_975DB4FF-A2DB-47BC-9471-806F9FEB50E3 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 26, 2019, at 6:13 PM, Vittorio Bertola = wrote: > This is what you think, but is this assumption supported by data? I've = never seen any.=20 The main evidence for this is that the businesses that use the =E2=80=9Cwe= sell your eyeballs=E2=80=9D business model have many orders of = magnitude (at least four) more eyeballs total than the companies that = don=E2=80=99t have customers. E.g., facebook and google. This may = change over time, but that=E2=80=99s the status quo, and it does us no = good to pretend otherwise. Also, by the way, if you run Ubuntu linux, you are trusting Canonical = just as much as you are trusting Mozilla or Google. At least Canonical = seems willing to let us pay, but it=E2=80=99s important to pay attention = to all the orgs we are trusting, and not just the charismatic megafauna. --Apple-Mail=_975DB4FF-A2DB-47BC-9471-806F9FEB50E3 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 26, 2019, at 6:13 PM, Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> = wrote:
    This is what = you think, but is this assumption supported by data? I've never seen = any. 

    The main evidence for this is that the = businesses that use the =E2=80=9Cwe sell your eyeballs=E2=80=9D business = model have many orders of magnitude (at least four) more eyeballs total = than the companies that don=E2=80=99t have customers.   E.g., = facebook and google.  This may change over time, but that=E2=80=99s = the status quo, and it does us no good to pretend otherwise.

    Also, by the way, if you = run Ubuntu linux, you are trusting Canonical just as much as you are = trusting Mozilla or Google.  At least Canonical seems willing to = let us pay, but it=E2=80=99s important to pay attention to all the= orgs we are trusting, and not just the charismatic = megafauna.

    = --Apple-Mail=_975DB4FF-A2DB-47BC-9471-806F9FEB50E3-- From nobody Fri Jul 26 16:27:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DED8120181 for ; Fri, 26 Jul 2019 16:27:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g97euu5UJ0kt for ; Fri, 26 Jul 2019 16:27:05 -0700 (PDT) Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32EFC1201CF for ; Fri, 26 Jul 2019 16:27:04 -0700 (PDT) Received: from dooku.sandelman.ca (unknown [75.98.19.134]) by relay.sandelman.ca (Postfix) with ESMTPS id 7674E1F44B for ; Fri, 26 Jul 2019 23:27:02 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id 566371A97; Fri, 26 Jul 2019 19:27:03 -0400 (EDT) From: Michael Richardson To: add@ietf.org In-reply-to: References: Comments: In-reply-to Patrik =?us-ascii?Q?=3D=3Futf-8=3Fb=3FRsOkbHRzdHLDtm?= =?us-ascii?Q?0=3D=3F=3D?= message dated "Fri, 26 Jul 2019 07:52:06 +0200." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Date: Fri, 26 Jul 2019 19:27:03 -0400 Message-ID: <27369.1564183623@dooku.sandelman.ca> Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 23:27:08 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Patrik F=C3=A4ltstr=C3=B6m wrote: > My view: Changing *any* of these two base assumptions is what I do not > think IETF should do. I like the way you stated this. >> If DNSSEC validation is only performed at the resolver, and never in >> the application, then resolvers have the freedom to answer for names >> that may not exist, or not answer for names that they are censoring = by >> choice (spam, malware protection) or by force (government mandate >> through jurisdictional control). What concerns should we be focusin= g on >> in this area to ensure the continuation of a consistent global name >> space under the dual threat/benefit of possible >> centralization? > By not changing the two base assumptions above as I lay out as respon= se > to (1) we do not rock the boat regarding evolution of name resolution. > If the above (...DNSSEC validation is only performed at the > resolver...) is a negative thing, which I can agree it is, then *that* > should be fixed, not breaking the two base assumptions I lay out above > under (1). I wonder if we should define a new return other than NXDOMAIN that a resolver that is censoring by choice (spam, malware), such that an Application Doing DNSSEC could recognize as being intentional? The NSEC3 would otherwise prove that the QNAME ought to exist. > A. The ability to "understand what is going on" when "the access to > internet is broken". Support cost is unknown. Changing responsibiliti= es > regarding DNS resolution will make it crystal clear end users can and > will no longer get help with DNS resolution from their network provid= er > regardless of whether it is the enterprise or local ISP. This implies > they will no longer help with connection issues. This is certainly a valid concern. Up to now, ad-hoc help (neighboring teenager, etc.) would typically override DNS server to 8.8.8.8, etc. before calling the ISP. > The IETF is responsible for ensuring "Internet works", and this today > implies ability for not only end users to do their thing, but also > enterprises, access providers and what not. I like to say the IETF is responsible for Internet and also internet. I +1 the rest of your comments, thank you Patrik. =2D- ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | network architect= [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [ =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEERK+9HEcJHTJ9UqTMlUzhVv38QpAFAl07jEYACgkQlUzhVv38 QpCp/wgAo1ZmryEebg5OVxzomM3DNEz0ClEGxtP9EdzeA4skmMt9miXj4lCDvy4c 4ZJF0ayqiWeFCKfd008c49+eamK8nJjkaG8pkYG+XOKoRwbhdT4ZzeO2voPcPlvo sl5ZnNJseNYU26ROyP4kSlIiGDQS+UlA84LRGsmCMhiAOj3kYEdatQGV/tjvkD7l 4RpYXx8+UlvHdVPxc6896ygtcbOZCW1fK88X6MMqcLpycTrwhJrk1PtsM6a6OWsv EDuHkb+0gQ/UKR4059SRsfBRg9OKNu7fYhkrRlBqbyo62iYbVm9uGAYOWWtBlUgf Ksf6GGmAH3RdFMj+EWhbjyvD51a6cw== =39tx -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Jul 26 16:35:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 727E41201CF for ; Fri, 26 Jul 2019 16:35:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=uniregistry.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GIejHeQsHhFD for ; Fri, 26 Jul 2019 16:35:10 -0700 (PDT) Received: from a-mx.uniregistry.com (a.mx.uniregistry.net [64.96.177.8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C5EF120181 for ; Fri, 26 Jul 2019 16:35:10 -0700 (PDT) Abuse: Forward to abuse@uniregistry.com with full headers X-Virus-Scanned: Content filter at a-mx.uniregistry.com Powered-By: https://www.uniregistry.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniregistry.com; s=bravo; t=1564184109; bh=HtRNeiwyaUPWBmlsD7GevlGR116nTV7/kFY7gsMgYbw=; h=Subject:To:References:From:Date:In-Reply-To; b=n1As1nXu70PAffokbSHAG8ozHkfHf1CEQ0UfN9E01oInzdI9MoYxY9nxxXZJpHWwR aOfhb2Eh13ksVM7g5+N8Npo+1Q4f0A6UGARPK8FyWSZjZnhMtUZrqVZW9OaFGI+fa6 a1mcmfdUX8yQkH64uAcPK/Gbau3W6qBtWDJ3Aha4Xbv84s/ttq6rRZ3nacPZwTgG6W G2V89xkk3sDnzX2deRmsIgDHdbDL/BjIvWKki2F2I+BnBpS1ZpOc2gTXaaSEwf4ZFy uD7k4Wike6VNiFv1wcEp4Vs3C0NBVGeOR591SBWXFwZbxbMcZkFGWEVb3ORZKumAIt T9UMi1Wn5YkNg== Received: from PatrickM.local ([66.54.123.66]) (authenticated bits=0) by a-mx.uniregistry.com (8.15.2/8.15.2/Debian-8) with ESMTPSA id x6QNZ86d017104 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Fri, 26 Jul 2019 23:35:09 GMT To: add@ietf.org References: <27369.1564183623@dooku.sandelman.ca> From: Patrick Mevzek Organization: Uniregistry Message-ID: <7cfa79af-3130-2c64-f8fd-f2ce7b9be585@uniregistry.com> Date: Fri, 26 Jul 2019 18:35:06 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <27369.1564183623@dooku.sandelman.ca> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 23:35:12 -0000 On 2019-07-26 18:27 -0500, Michael Richardson wrote:> > If the above (...DNSSEC validation is only performed at the > > resolver...) is a negative thing, which I can agree it is, then *that* > > should be fixed, not breaking the two base assumptions I lay out above > > under (1). > > I wonder if we should define a new return other than NXDOMAIN that a > resolver that is censoring by choice (spam, malware), such that an > Application Doing DNSSEC could recognize as being intentional? Not a new return code, but an extension will provide that: Extended DNS Errors draft-ietf-dnsop-extended-error-06 For example: 4.6.1. NXDOMAIN Extended DNS Error Code 2 - Censored The resolver attempted to perfom a DNS query but the domain was blacklisted by a security policy imposed upon the server being talked to. Note that how the imposed policy is applied is irrelevant (in- band DNS somehow, court order, etc). The R flag should be set. The main problem remaining probably on how to give that information back to the application requesting DNS resolution. -- Patrick Mevzek From nobody Fri Jul 26 17:20:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B7C71201D1 for ; Fri, 26 Jul 2019 17:20:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3L6o8qPsQESh for ; Fri, 26 Jul 2019 17:20:00 -0700 (PDT) Received: from mail-io1-xd36.google.com (mail-io1-xd36.google.com [IPv6:2607:f8b0:4864:20::d36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A0E7120181 for ; Fri, 26 Jul 2019 17:20:00 -0700 (PDT) Received: by mail-io1-xd36.google.com with SMTP id k20so108253617ios.10 for ; Fri, 26 Jul 2019 17:20:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gs5B9whDT9CG0dtGL2rtj/ftfpImdGKnSoL/tEfhqgM=; b=nv0rafRreu9u5PnPf1PY/Nh/jIdmHjBqVCZb0jwAsGeN1Kb3qMgZZmmTx8/kwjYiQr T+IWQ+qHgmCeRfEoYTJxIJE2YznoVw1p/GqCrchpet+gWpUIZ5IS4CyOdb34BQ0TDA8V cRrAaTYVbDcuQPO0ipWYpzYtmZPnt9IsJxVXa+7tLaO61d58Ahticbj2F2QEOjEpzQre RDs7+NqY2HnUqEdTsDp338Rkub0164QRJdL+8ONd2TTODNcdHFIdE4hUy637ECRo+0Ty 9eIxvsIcvCzoSW1LYb3C4Ii6Rc7CAYNOTwzEpFBO+JpgaVa3Jp7saIf8C0zMvzUdHpA7 VysQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gs5B9whDT9CG0dtGL2rtj/ftfpImdGKnSoL/tEfhqgM=; b=Vc+1FZOnV4k4ncnBC3yESlKL+M9KKR8ztJ4JzLo4OG4NmNvjmfqYqufoIr21efqrQX OE0mAwFLS4rKkMGU2nXw1vwMSVT8e6erGBUacpljwznCgf/bevgkugegq4xbOsydEDvq znHogNTj4Wwkdrc6KtiUhC/C/wvrjthQDBGevAaoYRpXCGrkmU3etFjDNQPFQcV9ZHrQ +MGEft101NBWrPvmlhS67l9ymM3f7kJT0aBF6OAXK1tp6ZkoFogkgOIAubQokkCnSM36 XL5eTQtxegk6O79jrORD5FtHgZVnOOguWWDOiv1ph/TrexlQl6seZdR1SgVJiWBU1375 vMhw== X-Gm-Message-State: APjAAAWt6lm+v3QgBMp8GgOfDI2OMzkdBp3RsPH41HCEhliAoV0NZSj3 tvS0lay3BQLzaTWEwBESVbw/RoEUscDPqZRcQM4+HQ== X-Google-Smtp-Source: APXvYqzfLyDfnv+vD3wSXLgS1VHZ82TThRJVZgh4GG9OT6XdChrR5gtKPnJ7mHqix1GNy7g3nyHAeAad+AKBLe5HNmg= X-Received: by 2002:a6b:ed09:: with SMTP id n9mr19937851iog.153.1564186799360; Fri, 26 Jul 2019 17:19:59 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> In-Reply-To: <25583.1564181379@dooku.sandelman.ca> From: Ben Schwartz Date: Fri, 26 Jul 2019 20:19:47 -0400 Message-ID: To: Michael Richardson Cc: Adam Roach , add@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000924465058e9e9e6c" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 00:20:03 -0000 --000000000000924465058e9e9e6c Content-Type: multipart/alternative; boundary="0000000000008a59e9058e9e9e2b" --0000000000008a59e9058e9e9e2b Content-Type: text/plain; charset="UTF-8" On Fri, Jul 26, 2019 at 6:49 PM Michael Richardson wrote: > > Adam Roach wrote: > > Since you mention Firefox's TRR list and then mention data mining > (with an > > implied connection), I'd like to point out yet again that one of the > key > > criteria for appearing on that list is an agreement to treat > resolution > > data according to a strict set of privacy-protecting provisions. You > > can see, for > > example, Cloudflare's associated privacy policy at > > > https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ > > Does Mozilla have a policy/proceedure to vet the privacy policy > of DoT/DoH providers? Maybe Mozilla is considering this? > Yes, they've published their minimum criteria here: https://wiki.mozilla.org/Security/DOH-resolver-policy#Privacy_Requirements Would it be appropriate for this to go into > a certificate extension (perhaps signed by a Mozilla CA)? > > -- > Michael Richardson , Sandelman Software Works > -= IPv6 IoT consulting =- > > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000008a59e9058e9e9e2b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Fri, Jul 26, 2019 at 6:49 PM Micha= el Richardson <mcr+ietf@sande= lman.ca> wrote:

    Adam Roach <adam@n= ostrum.com> wrote:
    =C2=A0 =C2=A0 > Since you mention Firefox's TRR list and then mentio= n data mining (with an
    =C2=A0 =C2=A0 > implied connection), I'd like to point out yet again= that one of the key
    =C2=A0 =C2=A0 > criteria for appearing on that list is an agreement to t= reat resolution
    =C2=A0 =C2=A0 > data according to a strict set of privacy-protecting pro= visions. You
    =C2=A0 =C2=A0 > can see, for
    =C2=A0 =C2=A0 > example, Cloudflare's associated privacy policy at =C2=A0 =C2=A0 > https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/priva= cy-policy/firefox/

    Does Mozilla have a policy/proceedure to vet the privacy policy
    of DoT/DoH providers?=C2=A0 Maybe Mozilla is considering this?

    Yes, they've published their minimum criteria h= ere:=C2=A0https://wiki.mozilla.org/Security/DOH-resolver-policy= #Privacy_Requirements

    Would it be appropriate for this to go into
    a certificate extension (perhaps signed by a Mozilla CA)?

    --
    Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
    =C2=A0-=3D IPv6 IoT consulting =3D-



    --
    Add mailing list
    Add@ietf.org
    https://www.ietf.org/mailman/listinfo/add
    --0000000000008a59e9058e9e9e2b-- --000000000000924465058e9e9e6c Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCDSlvdHELzX2hmnDbSPWQk9 pFZIXkfnq0FnEtDzHmrCyDAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA3MjcwMDE5NTlaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAcUuNLdIwjL9tq/783Vx337OpnIMrdG8QTjeHIw+2 P6yoqaOvsttXz2Nx+PlXRR6r0t9IXx30/rBK346WndSbNILVJPtj7CJe/7Roav4UEkfPjkeTXmoB nK5ci/JkPChzeRBTKwEpLipCfvKHSmgbdqMbslZ8rkVcmyfLsfnUdWY8asHqvMqHhFZ+YA2xL0pN wzZ4OdWn/Ty9qb8raAReFkr+T1Dbtpct3zKdOqChV/7mrtXa7BrNM1+bZGBjzo+q4efNNXqd6Pak EfyOynn6UmtkC22igHRhrVPfhMs8FfKkhGnFJZ1DOr554Hz85Qyg6bcpqUegDR3H5I1D+VJGEQ== --000000000000924465058e9e9e6c-- From nobody Fri Jul 26 17:37:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F10CD120288 for ; Fri, 26 Jul 2019 17:37:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bXsxvDaEzeoU for ; Fri, 26 Jul 2019 17:37:20 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 46A7712027B for ; Fri, 26 Jul 2019 17:37:20 -0700 (PDT) Received: from pps.filterd (m0048276.ppops.net [127.0.0.1]) by m0048276.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x6R0XVfJ013079 for ; Fri, 26 Jul 2019 20:37:19 -0400 Received: from usaoamgip001.mail.tfayd.com ([173.213.212.135]) by m0048276.ppops.net-00176a04. with ESMTP id 2u04x86kc3-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Fri, 26 Jul 2019 20:37:18 -0400 Received: from unknown (HELO potemwp00048.mail.tfayd.com) ([10.40.78.204]) by usaoamgip001.mail.tfayd.com with ESMTP; 26 Jul 2019 20:35:34 -0400 Received: from potemwp00032.mail.tfayd.com (100.124.56.56) by potemwp00009.mail.tfayd.com (100.124.56.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Fri, 26 Jul 2019 18:37:16 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00032.mail.tfayd.com (100.124.56.56) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Fri, 26 Jul 2019 18:37:15 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Fri, 26 Jul 2019 18:37:15 -0600 From: "Deen, Glenn (NBCUniversal)" To: Paul Wouters CC: "add@ietf.org" Thread-Topic: [EXTERNAL] Re: [Add] My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVQ3ZZclhQDNpxb0CwfHz20SgVb6bczosAgAAB7ACAAAJVgIAAAiMAgADX6wD///MZWg== Date: Sat, 27 Jul 2019 00:37:15 +0000 Message-ID: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-27_01:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907270005 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 00:37:33 -0000 > On Jul 26, 2019, at 2:23 PM, Paul Wouters wrote: >=20 > think the general enduser philosophy is that they trust a few big > centralized companies more than most network operators of the many > unknown networks they join. I=92m not sure that=92s a supportable statement. Anecdotally I see lots of= people joining WiFi in hotels and coffee shops pretty freely and without c= oncern.=20 Certainly there is a class of user who does take extra steps to use things = like VPNs, but they are the exception and not the rule. The global reports= on internet traffic from Sandvine and Cisco show that the general user is = not taking such action as a vpn or using a DNS service from big centralized= companies. Yes some are, but the traffic volumes in multiple reports sho= w that the general user is not.=20 The general user is using their networks suggested choices for DNS and they= seem quite ok with that. I say this because they can change it in most net= works (Corp networks often being the exception) to one of the centralized s= ervices that have been available for some time. Yet they have not made that= choice as shown by public global reports which show that dns traffic to th= ose other services is working hard to break 10% of total dns traffic.=20 So according to the available data, it=92s not true that general end user = philosophy is to trust a few big companies more than most Network operators= . Glenn = From nobody Fri Jul 26 19:05:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 905941201FA for ; Fri, 26 Jul 2019 19:05:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y4LM4G1iRzaR for ; Fri, 26 Jul 2019 19:05:39 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7CE11201D9 for ; Fri, 26 Jul 2019 19:05:38 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id s7so108468946iob.11 for ; Fri, 26 Jul 2019 19:05:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=N2sog6SkjlBxiJNljV9osBZaxwnQ+I8RqhVBBIWw3Dg=; b=LXJvV+quPblHkKERI4NLeFZJ1Z8l6scFP8dKyiGt74xQ9vqKIWvpeotb1kvW3HyGJ3 al2TjMx4J4bQA64ddvy7OJLdCiWOa3r7OtFtm8TvcyToq5Hj0fPaR2OFc0re9T5DpKfc fHZ1RIpLj4EjYSMQmLggE8/ZBT7MSoD8+wTj/0FOYPgrbEqc38sjRuZ78qmuM/jtIO02 Lk5CQc7oGBRm9apFn1czdaTQbzdCBFUOmdrUoNC05ab3mvATmjBPtELhbUTtpsUDS167 1MIRqRLlNI73h36r/M2A4369fh89jymvM6i3zPbmD1Dh/RpZdMtfK/D1Gh5s7Ypj9J6I nT9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=N2sog6SkjlBxiJNljV9osBZaxwnQ+I8RqhVBBIWw3Dg=; b=awGvcWqDOkocg0bHO0wJzZm205BoC4M5i32SMvZa/92GzjOqKRRgfOTee2LYaPXwft ZXKYsjG+qa6ooeUyAx6ICRHrLbEoPtbxxpF4QmKPGNHiJrzJrv5jMZBPvbUnuDxWt8wS iRcgi5b4S7mM3niMg2V/UxmCSx5V3/0Jb7q4bIo9Qo9uihAXOsFw06VnuuszIzMtWFeS 013qLk1FDN8YC9bRyykfUK8pX3Zv8r+qe4yTw9Iy/x3CmYmzt9dOdNRBCL+ecU1MIqlK u07XJ+njhdKm5EYN2g/sajNpqfLmzuRd5J1V65rxotU3wwLHMSO1aegY40YrvfSfh/C7 pmVw== X-Gm-Message-State: APjAAAUe4bJTW12p4H4zPOn8neGGYMFPfT/xIBCPleUVTMYXOS6KJg3G x6oJqWb66GqJsGi7ShANa+OGXE0wgRYTlEWBhYE= X-Google-Smtp-Source: APXvYqzYUWI7Vly6V2bvtSicqdTueghAdCMqGJTlhtaznMmAivh66UUuCiN2vN+HEAi/FCGp9sc5valDXGe1jWH1Qa4= X-Received: by 2002:a05:6602:98:: with SMTP id h24mr27644508iob.49.1564193138149; Fri, 26 Jul 2019 19:05:38 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> In-Reply-To: From: Rob Sayre Date: Fri, 26 Jul 2019 19:05:26 -0700 Message-ID: To: Ben Schwartz Cc: Michael Richardson , add@ietf.org, Adam Roach Content-Type: multipart/alternative; boundary="0000000000005c0d2d058ea01878" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 02:05:42 -0000 --0000000000005c0d2d058ea01878 Content-Type: text/plain; charset="UTF-8" On Fri, Jul 26, 2019 at 5:20 PM Ben Schwartz wrote: > On Fri, Jul 26, 2019 at 6:49 PM Michael Richardson > wrote: > >> Does Mozilla have a policy/proceedure to vet the privacy policy >> of DoT/DoH providers? Maybe Mozilla is considering this? >> > > Yes, they've published their minimum criteria here: > https://wiki.mozilla.org/Security/DOH-resolver-policy#Privacy_Requirements > Without getting into specifics, many ISPs use their DNS traffic as fuel for an ad network and/or sell the data on, and thus wouldn't meet those requirements. Whether that's a good or bad thing is probably outside the already-vague scope of this mailing list. That's one reason I don't think the IETF should get involved at the moment, and why terms like "policy" or "operational requirements" can be problematic. thanks, Rob --0000000000005c0d2d058ea01878 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On Fri, Jul 26, 2019 at 5:20 PM Ben Schwa= rtz <bemasc=3D40google.co= m@dmarc.ietf.org> wrote:
    On Fri, Jul 26, 2019 at 6= :49 PM Michael Richardson <mcr+ietf@sandelman.ca> wrote:
    Does Mozilla have a policy/proceedure to vet the privacy policy
    of DoT/DoH providers?=C2=A0 Maybe Mozilla is considering this?

    Yes, they've published their minimum criteria h= ere:=C2=A0https://wiki.mozilla.org/Security/D= OH-resolver-policy#Privacy_Requirements
    <= div>
    Without getting into specifics, many ISPs use their DNS = traffic as fuel for an ad network and/or sell the data on, and thus wouldn&= #39;t meet those requirements. Whether that's a good or bad thing is pr= obably outside the already-vague scope of this mailing list.

    =
    That's one reason I don't think the IETF should get invo= lved at the moment, and why terms like "policy" or "operatio= nal requirements" can be problematic.=C2=A0

    t= hanks,
    Rob
    --0000000000005c0d2d058ea01878-- From nobody Sat Jul 27 06:09:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3C4A12027A for ; Sat, 27 Jul 2019 06:09:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X2e3nHRCiWwC for ; Sat, 27 Jul 2019 06:09:23 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56C72120140 for ; Sat, 27 Jul 2019 06:09:23 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id v24so54196087ljg.13 for ; Sat, 27 Jul 2019 06:09:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=OrHHFY7ZwAbtTPseyXUea2lyBvZ7vHDz0l4vVCzYggQ=; b=0yXTuKPYCOTwJP2vRmjE80QrBLMg4GG2sJa7H/kRrfBzXjIj6PqxTFcA9HB0mfW4l4 03YTgUnhMKXgae1Ih0FVGWtxG0SFQdCFq+aavbZZKrQM7Rb9bv0XSsD6ViR31nrpS+QJ mR94/0B7TRvltknZoOc+IQG0UzDEDasybo2/oCv9b+YXYoiawUoDizjiAYCHVD5bFUDY iOr8ZDT0v0wyT2O/KFLR1fknAehVLwZG3frqVI5zzgh4xsG+3KNUoIyFk2SQ3apylm+J EB16Fb8NJljuKPaC3xq9zCMMGoQt1aHSwbIyV9FIRI0PMTctwQq5BKuvFI8pYs3fvLWA RYnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=OrHHFY7ZwAbtTPseyXUea2lyBvZ7vHDz0l4vVCzYggQ=; b=c6zxF6MCp+Bf8ooeT4k3rTy1Bi6Zcoa6l1DfY3IP4t5MpKVvnoXI3v3cfYOg4dktGw +z4nAzu+UWshv8A4iyLDzFHf3BaZ20VMDarjG4yxWVDGS4RcM0zvHkolAupcyZDHp34m Dkspix+vsiMGII0dFeq4G88AaX93MKVa2CPESfASOE0aiLzkqpEbSUso2uphMPrzfuUZ 0wDlrqmfmyBruf5tQzVYF7tGktkGjTLpancUFt0DVRtwwODsnO6smZ4ObHB3PfWPEsOO nfyJu4cV2T6lH71qX/tQo5NCmIZPqP++tuZ6MQB/QMeNTR0KYTNVbTUp56/bIiOtc1Ih LKiA== X-Gm-Message-State: APjAAAXvLDUL1Ih5D+tdvmTvTPtF8kcA1cb8HiVkXcZ3Mb0HsJjiXJvl ysUUY6HUq3WbBH/SPmFgNSITh8KpMSGgFI1O5d0= X-Google-Smtp-Source: APXvYqxmI28vPsJimk2sztVVkYVQA7mGK95TksthcX2yrxjWM3csDwFcf5KWaTvBcOL6Ufr1qJU/EGGXbnnycPn+hzY= X-Received: by 2002:a2e:3008:: with SMTP id w8mr53470039ljw.13.1564232961420; Sat, 27 Jul 2019 06:09:21 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> In-Reply-To: <25583.1564181379@dooku.sandelman.ca> From: Eric Rescorla Date: Sat, 27 Jul 2019 06:08:44 -0700 Message-ID: To: Michael Richardson Cc: Adam Roach , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000002ffbf058ea95eb0" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 13:09:26 -0000 --00000000000002ffbf058ea95eb0 Content-Type: text/plain; charset="UTF-8" On Fri, Jul 26, 2019 at 3:49 PM Michael Richardson wrote: > > Adam Roach wrote: > > Since you mention Firefox's TRR list and then mention data mining > (with an > > implied connection), I'd like to point out yet again that one of the > key > > criteria for appearing on that list is an agreement to treat > resolution > > data according to a strict set of privacy-protecting provisions. You > > can see, for > > example, Cloudflare's associated privacy policy at > > > https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ > > Does Mozilla have a policy/proceedure to vet the privacy policy > of DoT/DoH providers? Maybe Mozilla is considering this? > Yes: https://wiki.mozilla.org/Security/DOH-resolver-policy Would it be appropriate for this to go into > a certificate extension (perhaps signed by a Mozilla CA)? > I'm not sure what this would buy us over just having a list. -Ekr > -- > Michael Richardson , Sandelman Software Works > -= IPv6 IoT consulting =- > > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000002ffbf058ea95eb0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Fri, Jul 26, 2019 at 3:49 PM Micha= el Richardson <mcr+ietf@sande= lman.ca> wrote:

    Adam Roach <adam@n= ostrum.com> wrote:
    =C2=A0 =C2=A0 > Since you mention Firefox's TRR list and then mentio= n data mining (with an
    =C2=A0 =C2=A0 > implied connection), I'd like to point out yet again= that one of the key
    =C2=A0 =C2=A0 > criteria for appearing on that list is an agreement to t= reat resolution
    =C2=A0 =C2=A0 > data according to a strict set of privacy-protecting pro= visions. You
    =C2=A0 =C2=A0 > can see, for
    =C2=A0 =C2=A0 > example, Cloudflare's associated privacy policy at =C2=A0 =C2=A0 > https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/priva= cy-policy/firefox/

    Does Mozilla have a policy/proceedure to vet the privacy policy
    of DoT/DoH providers?=C2=A0 Maybe Mozilla is considering this?

    Yes:


    Would it be appropriate for this to go into
    a certificate extension (perhaps signed by a Mozilla CA)?
    <= div>
    I'm not sure what this would buy us over just having= a list.

    -Ekr


    --
    Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
    =C2=A0-=3D IPv6 IoT consulting =3D-



    --
    Add mailing list
    Add@ietf.org
    https://www.ietf.org/mailman/listinfo/add
    --00000000000002ffbf058ea95eb0-- From nobody Sat Jul 27 07:49:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 884BB120018 for ; Sat, 27 Jul 2019 07:49:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hr30yDSe1dk4 for ; Sat, 27 Jul 2019 07:49:04 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D30E12000E for ; Sat, 27 Jul 2019 07:49:04 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id B1D833818D for ; Sat, 27 Jul 2019 10:48:42 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 3F4A25D3 for ; Sat, 27 Jul 2019 10:49:02 -0400 (EDT) From: Michael Richardson To: add@ietf.org In-Reply-To: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 14:49:07 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Rob Sayre wrote: >> On Fri, Jul 26, 2019 at 6:49 PM Michael Richardson >> wrote: >>=20 >>> Does Mozilla have a policy/proceedure to vet the privacy policy >>> of DoT/DoH providers? Maybe Mozilla is considering this? >>>=20 >>=20 >> Yes, they've published their minimum criteria here: >> https://wiki.mozilla.org/Security/DOH-resolver-policy#Privacy_Requir= ements Does this result in an explicit pinning/listing of the TRR into a list, or does it result in a certificate being issued? > Without getting into specifics, many ISPs use their DNS traffic as fu= el for > an ad network and/or sell the data on, and thus wouldn't meet those > requirements. Whether that's a good or bad thing is probably outside = the > already-vague scope of this mailing list. Agreed, but if the enterprises and others have reasons (malware) to want their own anchors, the question becomes what do they need to get on the approved list. > That's one reason I don't think the IETF should get involved at the m= oment, > and why terms like "policy" or "operational requirements" can be > problematic. In my mind, the IETF can have a standard way to express the policies of a given DoH server is, without actually endorsing any specific policy. =2D-=20 ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | IoT architect = [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [ --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl08ZF0ACgkQgItw+93Q 3WX3eQf/RsfE/8LKeCM8deYoBvpXjilf8I4X1oKuak7f3f6FLHGYV2XEqtxNRPUE keRk4FhpfsjMSsz5bGaxwkLxppPU3q0gPck5uD324DZGjqsff15R/YKf6AFITryE +PI8/twKp76RP5X7cPTLtuyYk5ZqWWk4ij8+v+kq0P6dUcdPaNH6qBzQ+ej/ipaW BI5xGe+4Ru1n+lwbypiCf2sTJWA+7819HIVORJinkpGtTceB//wKlvyhspc0P+Iz 9u/Tam3gDfGtosUEQSyKsl5Tbhkk2NLFl9oHP7PyQNGVdVXR/R5vy1a1f9mj/ktB /+PkcFmj63a2XuxmPKUVd9QOY3GALA== =vHCT -----END PGP SIGNATURE----- --=-=-=-- From nobody Sat Jul 27 07:52:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0B8812000E for ; Sat, 27 Jul 2019 07:52:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tDwls0uNbOhE for ; Sat, 27 Jul 2019 07:52:31 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7789B120018 for ; Sat, 27 Jul 2019 07:52:31 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 93B653818D for ; Sat, 27 Jul 2019 10:52:10 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 30DF95D3 for ; Sat, 27 Jul 2019 10:52:30 -0400 (EDT) From: Michael Richardson To: ADD Mailing list In-Reply-To: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 14:52:34 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable mcr> Does Mozilla have a policy/proceedure to vet the privacy policy of mcr> DoT/DoH providers? Maybe Mozilla is considering this? ekr> Yes: https://wiki.mozilla.org/Security/DOH-resolver-policy mcr> Would it be appropriate for this to go into mcr> a certificate extension (perhaps signed by a Mozilla CA)? > I'm not sure what this would buy us over just having a list. I guess it buys Mozilla nothing. But others could rely on the list in a distributed fashion. If the extension said what the privacy was, rather than just that Mozilla h= ad vetted it, then perhaps there could be other levels of privacy. =2D-=20 ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | IoT architect = [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [ --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl08ZS0ACgkQgItw+93Q 3WWTaggAoOwr36gaB26N0TKTSGEvlfgfjb/4eCWZiRVMALQ2IGGS6D4vBR1vfs8a bK+2SbVRNkipuUCjSLYeTGFxkt4uy5MTnE+Ad2XwoHUh+8SNWdUXhGA/VWHAceW0 O9pzNEmHYi7W6WzyD77GXYzwPUMPf4/61it6Vlcrd8Axlbi2tfaCUh21J8mdDdr9 CfxB+aOEwJKYgsz4Qw6XpHVkJNNrCm4mQpGVghp4cSCMEwo0OG2SE3yVQ7nHri3f 8qjxENrKQ7GfK/7RV5tyAvcHJW/VBoUwm1x+G/rsymGHCjoxEXOd6XWpyEIle/UV f15nTWj6M4yrLVkd40khVJYO8ODbww== =o465 -----END PGP SIGNATURE----- --=-=-=-- From nobody Sat Jul 27 08:30:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF6A4120024 for ; Sat, 27 Jul 2019 08:30:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O9khrlUx95uJ for ; Sat, 27 Jul 2019 08:30:30 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D00012000E for ; Sat, 27 Jul 2019 08:30:30 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 0A939BE2E; Sat, 27 Jul 2019 16:30:28 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lWpbfqQhXQOL; Sat, 27 Jul 2019 16:30:26 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 6F431BE24; Sat, 27 Jul 2019 16:30:26 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564241426; bh=AquaPJgCvhQMH21x5VPkrBb9fw1RAZI2+W4Wl+Hls/E=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=20OloI0j/dPM1CtH4yNZBEELHTfOxMLFGpUWu2PuGY/SeneqStuPFJU7wNT12hoxh 0ncMr24cRIVlgke4ytM255E4Pb50wELlUpbUs/JCTW+XOrBcRmqzQ/VennOHYaoU1S I9TXKtwLcDSJA3cKA32DVmIB4hc9TpLnw6q0nf2Y= To: "Deen, Glenn (NBCUniversal)" , Paul Wouters Cc: "add@ietf.org" References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> Date: Sat, 27 Jul 2019 16:30:24 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="8XTKGj5m1mpzsF5wVew6GieCHf7qSUX9K" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 15:30:33 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --8XTKGj5m1mpzsF5wVew6GieCHf7qSUX9K Content-Type: multipart/mixed; boundary="pxdIthIKzvP9fnxrjpY4KWd7kBEChd4vF"; protected-headers="v1" From: Stephen Farrell To: "Deen, Glenn (NBCUniversal)" , Paul Wouters Cc: "add@ietf.org" Message-ID: <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> In-Reply-To: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> --pxdIthIKzvP9fnxrjpY4KWd7kBEChd4vF Content-Type: multipart/mixed; boundary="------------EFADF14676E6E5CC89A477BC" Content-Language: en-GB This is a multi-part message in MIME format. --------------EFADF14676E6E5CC89A477BC Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable > On Jul 26, 2019, at 2:23 PM, Paul Wouters wrote: > > think the general enduser philosophy is that they trust a few big > centralized companies more than most network operators of the many > unknown networks they join. On 27/07/2019 01:37, Deen, Glenn (NBCUniversal) wrote: > So according to the available data, it=E2=80=99s not true that general= end > user philosophy is to trust a few big companies more than most > Network operators. So I think you're both wrong in that you left out the "for what" that really is necessary when discussing who trusts whom for what. And since the "for what" in this case is "DNS recursive resolver selection" and my bet is that few people know what that is, it is moot to discuss whom a random person might trust more for that. S. --------------EFADF14676E6E5CC89A477BC Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------EFADF14676E6E5CC89A477BC-- --pxdIthIKzvP9fnxrjpY4KWd7kBEChd4vF-- --8XTKGj5m1mpzsF5wVew6GieCHf7qSUX9K Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl08bhAACgkQWrL68XsX K+rCFBAArwFL0lUEO7XqgC1V0uSdmt7Chnc/7lJpDAUcIdMvMWv8H+gK7W8WrjH9 ldsRKp7/b2Hs5HxiZHnRRBhaVzkXAxBmIWp5eic/c+lXP0QWKju5x3Exoe4x/TWO gWbfG50u0I7Sui8MkxaymZcONGjgQW42reW+eiyXinCCHpeIP477KUPk0LmAS6ou DUD7VmsnsroQy9IWzQlnL9yVx6erx5FzVDgodOwVYWpF5aN+pkL4sTonOgencVDO 06RI9QLZ4PoahS4Dsf/77FkQQmX8ee7se3U19B2RqqvKetm1bqVYyO0oUxc8JnY7 VWzs699nbLMIRAah+xdSRQIrjysxEVSSuQR2g/BFKs7kOvsSSvri4vhRJLVOAiTY dDHU8u1agyWVVWGrFSHBkCj+raT0CyFr+S7NKkRTD1IvtAEN6jlyQqFQWJKZSl96 qqzh4PhQjQDpTSGSjz/arYNQJt4gZonz3w0k+VsRb82vixmJcVv8NW9J4rV536z/ dku+8wOIivJYPfzEN82QItxXpb9n9RH16cCCfQR/7i1Afr4HHFS/ikfjA9uNzix5 iQqe5RGbiGKjLsdZSk29NZfRbO2SZSiK91ErV1DjcCE4vMZGiPgoi9oj6CYutC4w X8Qwo8auASnn6BXwtEEDb/Zfjc/kk2UbyaHbSHtVhvQnJodYQyI= =6F5C -----END PGP SIGNATURE----- --8XTKGj5m1mpzsF5wVew6GieCHf7qSUX9K-- From nobody Sat Jul 27 08:32:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5EBC12001A for ; Sat, 27 Jul 2019 08:32:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GnRn32iETr2e for ; Sat, 27 Jul 2019 08:32:47 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9173312000E for ; Sat, 27 Jul 2019 08:32:47 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 46260BE24; Sat, 27 Jul 2019 16:32:46 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 762HGmSEkR9M; Sat, 27 Jul 2019 16:32:45 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id BA713BE3E; Sat, 27 Jul 2019 16:32:44 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564241564; bh=xhofeAM0SCrM/kVOYW/0GKx0+nt0h6TwiK1LPzJL/jc=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=cqs7q2yMM/Irua4Mpm6821Tte6jE6ZIIDTXaSHddIRTetiOv33v8yCGrT/1bpSLch dLSQCMnHe7f3pt+iqalLAVZBB8nNqa1dnFsEZy+OIMCkjxGSvDk6Z7aMTmbFQhx7+N eQDig11ePp+8/x7txqTA9jfy7P918gDm4ffTfRDI= To: Rob Sayre , Ben Schwartz Cc: Michael Richardson , add@ietf.org, Adam Roach References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Sat, 27 Jul 2019 16:32:43 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="IYsGsDwyvOvIuuzQ9dImKl87I0UA9RRvL" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 15:32:50 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --IYsGsDwyvOvIuuzQ9dImKl87I0UA9RRvL Content-Type: multipart/mixed; boundary="k1vEDMbqYeLSqrTfPIuo1BfvzHb7z6NH1"; protected-headers="v1" From: Stephen Farrell To: Rob Sayre , Ben Schwartz Cc: Michael Richardson , add@ietf.org, Adam Roach Message-ID: Subject: Re: [Add] meeting hum: should the IETF take up this work? References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> In-Reply-To: --k1vEDMbqYeLSqrTfPIuo1BfvzHb7z6NH1 Content-Type: multipart/mixed; boundary="------------58C8443286FC2DEA6FF7BFAE" Content-Language: en-GB This is a multi-part message in MIME format. --------------58C8443286FC2DEA6FF7BFAE Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 27/07/2019 03:05, Rob Sayre wrote: > Without getting into specifics, many ISPs use their DNS traffic as fuel= for > an ad network and/or sell the data on, I think we would need some specific evidence of that before we ought factor it into the discussion. Is there evidence of this happening? Thanks, S. --------------58C8443286FC2DEA6FF7BFAE Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------58C8443286FC2DEA6FF7BFAE-- --k1vEDMbqYeLSqrTfPIuo1BfvzHb7z6NH1-- --IYsGsDwyvOvIuuzQ9dImKl87I0UA9RRvL Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl08bpsACgkQWrL68XsX K+oDxQ//dYZOVDLY3M7Itc04ofPrC+Ce92u/Br8/JSkm7TvZAX08cILap3BYtfvZ znrSC5Yipn7L98oGBopN78GYrxPpKkMdK/xTs5kQSLEYrj/NYvgXNrMo7299pE5E bb6ZafBColX+p3QERExzrKEWGpUWfWgYjiHRBmfnfKAJtXxvnXx+K1fD6Mbl5hhI OGUdpe0jJqjdGCcv9MmP9R/UJ+E1xFPgz4NuupzL3cevUVcFSnPLlIUSp87CVFDq yoB4pOBd/vb6ntbx+zPSwhczrEtZQyPs2qnOZkZZVTeE6AxhNz8r9pHn2wtsO/MP EvfYcOu6TRcoURDJ5IHhCtFp7YsIxetdn32TcL2MvbSiEAMCnNDvY6faFavGwLe/ MIei0d0Ub0gQ4b3RcQHbnphBy34vMo7cXrbGMYv4hrzmmtqiq1qutXLDkeE4/68P gGDX9HP83vCHsN5Zve4YpeMQ17DA+eyF0fkbobljaG80VBAy6jb6kTZKz4eUJC3K DAHZJRntHJNxY7hvM+HKu+8EGPHNQIYjViqL1HFHGZ+TZ860XUwb9fXeFO1pNYuD 8QbGnk3GfGelkUtS1XAv8N9bGa8et88xl/Mtli/HnoaYPskj3vl0/+bOhhBeu0VD vSOsUn/wLHVWxrGSB9oYKOnRaVrFzrjXbReFUTQm+gAgSdYg+Jk= =t3WV -----END PGP SIGNATURE----- --IYsGsDwyvOvIuuzQ9dImKl87I0UA9RRvL-- From nobody Sat Jul 27 08:56:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B29B120024 for ; Sat, 27 Jul 2019 08:56:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FWBKABoFIpWG for ; Sat, 27 Jul 2019 08:56:10 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E23EC12000E for ; Sat, 27 Jul 2019 08:56:09 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id d24so54316017ljg.8 for ; Sat, 27 Jul 2019 08:56:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ivVA7GiZVvr0Bpo2BPXzXTAIIl0uzaQzqyZayqgWPew=; b=saIeF1kvzSH2oAEMZpMc6y/CUOQBgQoHIoiUihL2LJiJDKpbRWEEbgWijPGG5J26Nr LldhmnZyzlrrSqpqwsI51FThlHv89edhsn7qRaAoeY/+BSdtkHoo4MGRNEpzkgYFk3ek K4q5XRQDkvvPEDX+DlK/DV4F0N148z453w/1McLIfrBed8txkMK6k1Ma0znlCbqyCiYH 8tux98UKSs9+55/Z3B52bGRJtvSEK7uy26wVaBjGY7IK/Y3ESZdmkhV+MwQIIbBQBNL6 iALdxua8zy7Ae6SSd75hokc6mJ2qgi4nPjO4mo1I1LJSyw82rCWPw06YAy+bPdSZ73yT JcDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ivVA7GiZVvr0Bpo2BPXzXTAIIl0uzaQzqyZayqgWPew=; b=syfQ2rkIKuvQ2qG74JUMtXq7CFtxZNOcODbD/mZFLhfLnbrMcRtUm4e5iJHF8/DC3G 74POIhxst9O0TOAe3N7naIVFETPbKGUgpbU0ENzdMNFjthlJzLy/Epog2jkUbty5Pkzd zgiik32VJIkeFdnJuF5WpHgi8uGDZCeWAwcgA8BqxFuxLSr7PpIRzx+DlA9V7IRfMlqD WY9ji7esA3Qyc7MtZWPRdXi+N1VxKdFlm62ZfHcM0oFrlXR02qF0yFam4mSEySNh2FV2 0ubmzTwbwPbX/DkLVW46lnpNGUYEFqtAaGLE91fzGRCMowuDfq2hvioUrHwNt7V2coXa 8ZQA== X-Gm-Message-State: APjAAAWSQ0oOQ4UarcawJY/HirIBBAWRLeBQRIclUrWPfb0GszRb33pi K7lBl7eT+uWIGi9yzj4E6bq9wAOfejJA3B4m3iM= X-Google-Smtp-Source: APXvYqy2U4hveCKN5vSp2hUTTkq/xa4Mdaglwxc2GZXXzLMUe8KULmlJI6lqj4FSe7zseL7r7J+5Xnq7oT6//agGQ8Y= X-Received: by 2002:a2e:96d0:: with SMTP id d16mr39580167ljj.14.1564242968160; Sat, 27 Jul 2019 08:56:08 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> <1856.1564239150@localhost> In-Reply-To: <1856.1564239150@localhost> From: Eric Rescorla Date: Sat, 27 Jul 2019 08:55:31 -0700 Message-ID: To: Michael Richardson Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000075bc92058eabb2a2" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 15:56:13 -0000 --00000000000075bc92058eabb2a2 Content-Type: text/plain; charset="UTF-8" On Sat, Jul 27, 2019 at 7:52 AM Michael Richardson wrote: > > mcr> Does Mozilla have a policy/proceedure to vet the privacy policy of > mcr> DoT/DoH providers? Maybe Mozilla is considering this? > > ekr> Yes: https://wiki.mozilla.org/Security/DOH-resolver-policy > > > mcr> Would it be appropriate for this to go into > mcr> a certificate extension (perhaps signed by a Mozilla CA)? > > > I'm not sure what this would buy us over just having a list. > > I guess it buys Mozilla nothing. > But others could rely on the list in a distributed fashion. > Well, we already have a worked example of a similar system, which is Root Programs, and in that case we've found that having a list of trust anchors that someone could download was adequate. Unless this list were to get very large, this seems far simpler than creating a certificate extension. If the extension said what the privacy was, rather than just that Mozilla > had > vetted it, then perhaps there could be other levels of privacy. > It's not quite clear to me what you have in mind here, but one thing I would like to emphasize is that the Mozilla TRR program is more than just a self-assertion about privacy policy, in that we actively manage the list, rather than just trusting people's self-assertions. If people were interested in some other set of privacy policies, then it's not clear to me who would be responsible for running such a program. -Ekr --00000000000075bc92058eabb2a2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Sat, Jul 27, 2019 at 7:52 AM Micha= el Richardson <mcr+ietf@sande= lman.ca> wrote:

    =C2=A0 =C2=A0 mcr> Does Mozilla have a policy/proceedure to vet the priv= acy policy of
    =C2=A0 =C2=A0 mcr> DoT/DoH providers?=C2=A0 Maybe Mozilla is considering= this?

    =C2=A0 =C2=A0 ekr> Yes: https://wiki.mozilla= .org/Security/DOH-resolver-policy


    =C2=A0 =C2=A0 mcr> Would it be appropriate for this to go into
    =C2=A0 =C2=A0 mcr> a certificate extension (perhaps signed by a Mozilla = CA)?

    =C2=A0 =C2=A0 > I'm not sure what this would buy us over just having= a list.

    I guess it buys Mozilla nothing.
    But others could rely on the list in a distributed fashion.

    Well, we already have a worked example of a similar sy= stem, which is=20 Root Programs, and in that case we've found that having a list of trust= =20 anchors that someone could download was adequate. Unless this list were to = get very large, this seems far simpler than creating a certificate extensio= n.


    If the extension said what the privacy was, rather than just that Mozilla h= ad
    vetted it, then perhaps there could be other levels of privacy.

    It's not quite clear to me what you have in mi= nd here, but one thing I would like to emphasize is that the Mozilla TRR pr= ogram is more than just a self-assertion about privacy policy, in that we a= ctively manage the list, rather than just trusting people's self-assert= ions. If people were interested in some other set of privacy policies, then= it's not clear to me who would be responsible for running such a progr= am.

    -Ekr



    --00000000000075bc92058eabb2a2-- From nobody Sat Jul 27 09:23:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56086120091 for ; Sat, 27 Jul 2019 09:23:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jeiGAnCxjXZL for ; Sat, 27 Jul 2019 09:23:55 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 822F612008D for ; Sat, 27 Jul 2019 09:23:55 -0700 (PDT) Received: from pps.filterd (m0048207.ppops.net [127.0.0.1]) by m0048207.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x6RGNKmt022375 for ; Sat, 27 Jul 2019 12:23:53 -0400 Received: from usushmgip002.mail.tfayd.com ([216.178.109.236]) by m0048207.ppops.net-00176a04. with ESMTP id 2u0hv9mj8x-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Sat, 27 Jul 2019 12:23:53 -0400 Received: from unknown (HELO potemwp00043.mail.tfayd.com) ([10.40.33.204]) by usushmgip002.mail.tfayd.com with ESMTP; 27 Jul 2019 09:23:52 -0700 Received: from potemwp00030.mail.tfayd.com (100.124.56.54) by potemwp00009.mail.tfayd.com (100.124.56.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Sat, 27 Jul 2019 10:23:51 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00030.mail.tfayd.com (100.124.56.54) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Sat, 27 Jul 2019 10:23:50 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Sat, 27 Jul 2019 10:23:50 -0600 From: "Deen, Glenn (NBCUniversal)" To: Stephen Farrell CC: Paul Wouters , "add@ietf.org" Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4 Date: Sat, 27 Jul 2019 16:23:50 +0000 Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com>, <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> In-Reply-To: <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-27_13:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=959 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907270206 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 16:23:57 -0000 On Jul 27, 2019, at 8:30 AM, Stephen Farrell wr= ote: >> On Jul 26, 2019, at 2:23 PM, Paul Wouters wrote: >>=20 >> think the general enduser philosophy is that they trust a few big >> centralized companies more than most network operators of the many >> unknown networks they join. >=20 >=20 >> On 27/07/2019 01:37, Deen, Glenn (NBCUniversal) wrote: >> So according to the available data, it=92s not true that general end >> user philosophy is to trust a few big companies more than most >> Network operators. > So I think you're both wrong in that you left out the "for what" > that really is necessary when discussing who trusts whom for what. >=20 > And since the "for what" in this case is "DNS recursive resolver > selection" and my bet is that few people know what that is, it is > moot to discuss whom a random person might trust more for that. >=20 As you would say ... =93fair enough=94. My key point was that there is no= t data support for the assertion that general users trust a few big compani= es more. Glenn = From nobody Sat Jul 27 09:51:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C4BB312016A for ; Sat, 27 Jul 2019 09:51:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MTqjt6-Wwf21 for ; Sat, 27 Jul 2019 09:51:28 -0700 (PDT) Received: from mail-qk1-x72d.google.com (mail-qk1-x72d.google.com [IPv6:2607:f8b0:4864:20::72d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D39FB120165 for ; Sat, 27 Jul 2019 09:51:27 -0700 (PDT) Received: by mail-qk1-x72d.google.com with SMTP id m14so15676383qka.10 for ; Sat, 27 Jul 2019 09:51:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=TOQp4HlrNHzX2JhhxoMN22n/Bwik6CvCBsFplGyWIrw=; b=IKmKds9Eb7CL0IL1qDWKxmfkaWVoKMaqEgvXk8OS6xdKeicVdeQTJk6anT6fbbZqiN /sSNWLw6urdoPsvl8SmUKI+s9pZEXZi2/XB13uqQHLJZeUiH63A2g0rshns8OMB65EiF V2JbqHGAFVVIuZa6uedc6LxsnZeVrj2Uu4HMTjewhgiIY7S8Ou/RyiJTIvcN5vlp6Asb mF8WKMFIJvyt59LeZk2AemXy2xGf/eadxc2K2zCjtU06WhbWm7X64HqXvrN7CtFKZgfd /+u7vAQolim9TbMhqrIDe86UhrGEIeISuqbifV2hTMfb/Uicns6558CyC7M1dYxXW+wC RmeQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=TOQp4HlrNHzX2JhhxoMN22n/Bwik6CvCBsFplGyWIrw=; b=qCmEYeR8UIN4Tfsy1lho1mLS9jccnQa1lI6j2RGsTES4gRGLuQ7CZOwNZQLYBV9+qN +PkUKLP5K/ZL48VYvGqXtoPQ6Zuf0afCMkg5I3c4PHUy7gCbMNQYu0jRpuSKjpTiJAq3 Qf5hvkKG6FcWJLHOJJZgDHrSt1pu5TvQKapTLIaaDbjGgmUffHG/aDt3ruathzk3nMOY +yIEYVTJD0Yf66DgZJYWtBpiDmYgN36lAEPv+KX5WsinjjDmwFwkNExxFbgxhXgNoQ7/ WMzsmGdQVx21Z/W9bXOytTmLCffsjF+HfVPgaQHVeLOqjS6vfxJSFR7H0jPRfBoXxfNY 5+CA== X-Gm-Message-State: APjAAAXYt2Zkfk59CjZV9HCuWYf1CXCQfk4k0tLV0oIlWTDSrXlu7eI9 yajiW0W+b63d5ZLtaTpG9bSbJw== X-Google-Smtp-Source: APXvYqx9OUlpgsHkf9cETjtLbEmItjQEy17mtS7pWOWGWi7Gx4sGkUPn9jXgB9GORDp32sW5pmWNdw== X-Received: by 2002:a37:7cc5:: with SMTP id x188mr65678240qkc.456.1564246286832; Sat, 27 Jul 2019 09:51:26 -0700 (PDT) Received: from [10.0.30.16] (c-73-186-137-119.hsd1.ma.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id y42sm36986354qtc.66.2019.07.27.09.51.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 27 Jul 2019 09:51:26 -0700 (PDT) From: Ted Lemon Message-Id: <47F10041-6E3E-49D0-AE83-7EB0BE1FD91F@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F47948F6-8EE0-4292-8749-1B56A6C1FD51" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Sat, 27 Jul 2019 12:51:24 -0400 In-Reply-To: Cc: Stephen Farrell , Paul Wouters , "add@ietf.org" To: "Deen, Glenn (NBCUniversal)" References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 16:51:31 -0000 --Apple-Mail=_F47948F6-8EE0-4292-8749-1B56A6C1FD51 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 27, 2019, at 12:23 PM, Deen, Glenn (NBCUniversal) = wrote: > My key point was that there is not data support for the assertion = that general users trust a few big companies more. This is a really puzzling observation. I guess it depends on what you = mean by trust. You could mean =E2=80=9Cput their trust in=E2=80=9D = (operational trust) or you could mean =E2=80=9Cfeel that they are = trustworthy=E2=80=9D (emotional trust). Or possibly some third thing I = didn=E2=80=99t think of! :) So if you mean =E2=80=9Cfeel that they are trustworthy,=E2=80=9D I think = this is true=E2=80=94there=E2=80=99s plenty of evidence that people do = not think that various large corporations are trustworthy in that sense. However, what we mean by =E2=80=9Ctrust=E2=80=9D when we are talking = about protocols is operational trust: that they actually make a choice = to trust the corporation regardless of how they feel about the = corporation=E2=80=99s trustworthiness. We do this all the time, and I = suspect everyone here is familiar with the feeling of reluctantly = allowing a corporation to be =E2=80=9Ctrusted=E2=80=9D when we feel = fairly certain they are not worthy of that trust, simply because we have = no choice. In that sense, there is a tremendous amount of data to support the = conjecture that users trust a few big companies more. It=E2=80=99s not = because they trust them in the sense of considering them trustworthy, = but because they have no choice but to trust them: the small company = that might actually be more trustworthy (or might not) is not an option = for them. The service that the end-user wants is not available from = that small company. In this sense, then, we can see that in fact users do trust various = large companies. When they use the resolver offered by their ISP, they = are trusting their ISP. When they use the resolver in the coffee shop, = they are trusting the coffee shop. When they choose to use 8.8.8.8., = they are trusting Google, and they are also trusting their ISP not to = intercept their connection to Google, if they are using Do53. If they = use 1.1.1.1, the same is true. If they use 8.8.8.8 with DoT, they are = trusting Google, and if their ISP wants to intercept the connection, = they will know that this is happening. But it=E2=80=99s pretty easy = for the ISP to do this. If they want to use 8.8.8.8, and either they know their ISP is not = trustworthy, or know that they will sometimes be using ISPs that = aren=E2=80=99t trustworthy (the coffee shop use case), then they have no = choice but to use DoH, because it=E2=80=99s not really something that a = coffee shop would be able to intercept or block, even if they wanted to. In most cases, I think it=E2=80=99s safe to say that the users just take = the default behavior. So if they have a smartphone, they just trust = the vendor to act in their best interests (whether they actually believe = the vendor will do this or not). If they are running Firefox or = Chrome, they will trust Mozilla or Google to act in their interest, = which may mean using DoH, whether either of these orgs is actually = acting in their interest or not. And if they are using the operating system resolver, they may = legitimately hope that what they are buying is an O.S. that doesn=E2=80=99= t betray their trust by sending personally-identifying information down = the DoH channel. It might even be possible for a small company to make = money offering this as a service, to those people who want it. So I hope this clarifies the distinction between emotional trust, for = which I believe there is plenty of data that actually supports your = assertion, and operational trust, for which there is data that pretty = definitively contradicts it. --Apple-Mail=_F47948F6-8EE0-4292-8749-1B56A6C1FD51 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 27, 2019, at 12:23 PM, Deen, Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:
     My key point was that there is not data support for the = assertion that general users trust a few big companies = more.

    This = is a really puzzling observation.  I guess it depends on what you = mean by trust.   You could mean =E2=80=9Cput their trust in=E2=80=9D = (operational trust) or you could mean =E2=80=9Cfeel that they are = trustworthy=E2=80=9D (emotional trust).  Or possibly some third = thing I didn=E2=80=99t think of! :)

    So if you mean =E2=80=9Cfeel that they = are trustworthy,=E2=80=9D I think this is true=E2=80=94there=E2=80=99s = plenty of evidence that people do not think that various large = corporations are trustworthy in that sense.

    However, what we mean by =E2=80=9Ctrust=E2= =80=9D when we are talking about protocols is operational trust: that = they actually make a choice to trust the corporation regardless of how = they feel about the corporation=E2=80=99s = trustworthiness.   We do this all the time, and I suspect everyone = here is familiar with the feeling of reluctantly allowing a corporation = to be =E2=80=9Ctrusted=E2=80=9D when we feel fairly certain they are not = worthy of that trust, simply because we have no choice.

    In that sense, there is = a tremendous amount of data to support the conjecture that users trust a = few big companies more.  It=E2=80=99s not because they trust them = in the sense of considering them trustworthy, but because they have no = choice but to trust them: the small company that might actually be more= trustworthy (or might not) is not an option for them.   The = service that the end-user wants is not available from that small = company.

    In this sense, = then, we can see that in fact users do trust various large companies. =   When they use the resolver offered by their ISP, they are = trusting their ISP.   When they use the resolver in the coffee = shop, they are trusting the coffee shop.   When they choose to use = 8.8.8.8., they are trusting Google, and they are also trusting their ISP = not to intercept their connection to Google, if they are using Do53. =   If they use 1.1.1.1, the same is true.   If they use 8.8.8.8 = with DoT, they are trusting Google, and if their ISP wants to intercept = the connection, they will know that this is happening.   But it=E2=80= =99s pretty easy for the ISP to do this.

    If they want to use 8.8.8.8, and either = they know their ISP is not trustworthy, or know that they will sometimes = be using ISPs that aren=E2=80=99t trustworthy (the coffee shop use = case), then they have no choice but to use DoH, because it=E2=80=99s not = really something that a coffee shop would be able to intercept or block, = even if they wanted to.

    In most cases, I think it=E2=80=99s safe to say that the = users just take the default behavior.   So if they have a = smartphone, they just trust the vendor to act in their best interests = (whether they actually believe the vendor will do this or not).   = If they are running Firefox or Chrome, they will trust Mozilla or Google = to act in their interest, which may mean using DoH, whether either of = these orgs is actually acting in their interest or not.

    And if they are using = the operating system resolver, they may legitimately hope that what they = are buying is an O.S. that doesn=E2=80=99t betray their trust by sending = personally-identifying information down the DoH channel.   It might = even be possible for a small company to make money offering this as a = service, to those people who want it.

    So I hope this clarifies the = distinction between emotional trust, for which I believe there is plenty = of data that actually supports your assertion, and = operational trust, for which there is data that pretty definitively = contradicts it.

    = --Apple-Mail=_F47948F6-8EE0-4292-8749-1B56A6C1FD51-- From nobody Sat Jul 27 10:56:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8973F120044 for ; Sat, 27 Jul 2019 10:56:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Edxdjq6TDxZ for ; Sat, 27 Jul 2019 10:56:31 -0700 (PDT) Received: from mail-io1-xd43.google.com (mail-io1-xd43.google.com [IPv6:2607:f8b0:4864:20::d43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91095120018 for ; Sat, 27 Jul 2019 10:56:31 -0700 (PDT) Received: by mail-io1-xd43.google.com with SMTP id g20so111415503ioc.12 for ; Sat, 27 Jul 2019 10:56:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=GqPcmWEeDcK8olSQ2neVFzUeE8LvfyzzW5IwNP+TQ8k=; b=N+HVVQWTjZTvp4og66U3ASt1eBOcVb60MYsiez7yDAJOFuwTUs6xiP94pAs/g6acsY XvMNlZnDJU1BLJzMP6u7lgEZSEVtNV3eG4OUCdGYNo9FJmSQvmhjLO+TtkOsRSAMSBe2 I+ijzfcxhKjFly9NSWTr1IugWgU3Ne84tPCwpm6NImvAYWodX/Bn0QzJlvwrrZh8jtvj SvVB2CZVrJq80ULGJrieBLY2C2R5P+See0HbyUAF4p+xYtFFBwYULAg7OqaaZp341Y9S 7dSHeKw/0/TZuFazWAh9RiCB7OO2/1WzIUC7lSByVfJmmU4fg2I9AMwccewr4CDERKIX VY3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=GqPcmWEeDcK8olSQ2neVFzUeE8LvfyzzW5IwNP+TQ8k=; b=DYoGoL3kWbiwVZADHiMC9LvEFjvcKrmbThqS+14Ob1mbbRa0IAvMKf1NsyE+0RCPcY W2Z+P6e2kgeG9VKu0q5ByNLFER4J0Yi1VXQD20l2rGl5Z10ajOPh3QQmPvmDLIr+c4+5 OVJc74mazG3MNw92V21XF9EGQiN4VJxCV1PjE/3VJMGsDxf88S2QiWn0Se0dSaTCEmJD E0u8JyrF9ktJHlp3facqsh6WSPVDPmLelQP9IejNajkkkBaVQ8+XieGBK9qAb/W1N8NW 22y/D2IwGXI8Sw1sycYLp0lwP6davA/UbZs/KQJuOxe69YUL2uD3UfofcRvMHORL5u+R E6LQ== X-Gm-Message-State: APjAAAUmVf7N54h5wtAI5oZpPNJ8ioSKr+aVLs9ErdHRRUx/i9rWkood bBRQjLqHFDlxHtXP688SMr3f+MDsb8AHHwCDLmw= X-Google-Smtp-Source: APXvYqzrQPMTz0FRgy5Q2qYF4w9VS6HQcfwJMAXnoVbPsO+PxokgkCOGvvfRale1lZuVZZpDA8PdQFwLLhUovYeEUqQ= X-Received: by 2002:a6b:b602:: with SMTP id g2mr91928293iof.54.1564250190641; Sat, 27 Jul 2019 10:56:30 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> In-Reply-To: From: Rob Sayre Date: Sat, 27 Jul 2019 10:56:19 -0700 Message-ID: To: Stephen Farrell Cc: Ben Schwartz , Michael Richardson , add@ietf.org, Adam Roach Content-Type: multipart/alternative; boundary="000000000000f400a0058ead60e9" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 17:56:34 -0000 --000000000000f400a0058ead60e9 Content-Type: text/plain; charset="UTF-8" On Sat, Jul 27, 2019 at 8:32 AM Stephen Farrell wrote: > > I think we would need some specific evidence of that before > we ought factor it into the discussion. Is there evidence of > this happening? > https://arstechnica.com/tech-policy/2017/03/senate-votes-to-let-isps-sell-your-web-browsing-history-to-advertisers/ thanks, Rob --000000000000f400a0058ead60e9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On Sat, Jul 27, 2019 at 8:32 AM Stephen F= arrell <stephen.farrell@cs.= tcd.ie> wrote:

    I think we would need some specific evidence of that before
    we ought factor it into the discussion. Is there evidence of
    this happening?

    =
    --000000000000f400a0058ead60e9-- From nobody Sat Jul 27 11:28:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00D4A120041 for ; Sat, 27 Jul 2019 11:28:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jMz0OZxpvKXQ for ; Sat, 27 Jul 2019 11:28:04 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C5E5120018 for ; Sat, 27 Jul 2019 11:28:04 -0700 (PDT) Received: from xse460.mail2web.com ([66.113.197.206] helo=xse.mail2web.com) by mx65.antispamcloud.com with esmtp (Exim 4.89) (envelope-from ) id 1hrRQI-0001fv-8w for add@ietf.org; Sat, 27 Jul 2019 20:28:02 +0200 Received: from xsmtp22.mail2web.com (unknown [10.100.68.61]) by xse.mail2web.com (Postfix) with ESMTPS id 45wvNX2JPyz1wWf for ; Sat, 27 Jul 2019 11:19:08 -0700 (PDT) Received: from [10.5.2.17] (helo=xmail07.myhosting.com) by xsmtp22.mail2web.com with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from ) id 1hrRHg-0000aX-76 for add@ietf.org; Sat, 27 Jul 2019 11:19:08 -0700 Received: (qmail 5734 invoked from network); 27 Jul 2019 18:19:07 -0000 Received: from unknown (HELO [192.168.1.101]) (Authenticated-user:_huitema@huitema.net@[172.56.38.170]) (envelope-sender ) by xmail07.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 27 Jul 2019 18:19:07 -0000 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Christian Huitema X-Mailer: iPhone Mail (16F203) In-Reply-To: Date: Sat, 27 Jul 2019 11:19:06 -0700 Cc: Stephen Farrell , Paul Wouters , "add@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> To: "Deen, Glenn (NBCUniversal)" X-Originating-IP: 66.113.197.206 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 66.113.197.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=66.113.197.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.13) X-Recommended-Action: accept X-Filter-ID: Mvzo4OR0dZXEDF/gcnlw0STiPCilqAig5bem4hJMKBmpSDasLI4SayDByyq9LIhVeehxjF+fQ2Ck Tn4fBfSrAkTNWdUk1Ol2OGx3IfrIJKywOmJyM1qr8uRnWBrbSAGDNzOpszOkW3faMySFwG163+fH zJ6mVE7ewsipSVIfs4bj21Rqa748DyOs5C0jDZaNgyWFxOA5dILPypvKxNVhWQwOVcNrdpWfEYrY fLBY3+cqR/Azv01OJhPK4SsoJkVNmdySlZou9qHIGOZDEEo7O2nS6C1mWTD2n8BB0gTSSfDtw+Ut ziY+nbU7qa50sEXj8hEv6ylbrSataIASdByf+qyWDcKgIew/Pqmv8CiR0A+Ffy7fEg460Hn2xYnW avStyzAiWbbj13U46jbWFIz21cHX/YzWyFk7762whX3QQ+5uhkPm88V7ziklAaTl19sU919xeAvO xjeQEcL5lNmXdGd9U9Oojh2QY0MMPWjRsTVhMmX9VvKuj6psZloQqgYBwH0r+197ykuYmDR9wbL2 DBEuqNMl4E+tMKMsv/A3u4xFRxF9LSHNsZFl22lrRRn/H0knlMgOQTVp+x1fo2EPm5KHzmP2+HxV ijKKPtqDwZd7wJgR9gN8n34hQyCWBa3zq4MhqHT770a7vPEpZry5KpMMSX8cP3T4zT/djFuzBcN8 g2fGU86cSswil+kDetUfttbLHdNhiUq2jBEvMVLlZ4GThCScvU0cCIiHSQbmcVKe6JvDqaPfQft3 SIG8hrREIPeg9WrzDXOtahmLPdT6/A6cVZdgJUIY+b6RxjrE7W6Pe+7BpRefWhDzYLH0mpP9XPWl FdaGOH191uXjgjQN/RTaYTLUj/RFhcnr3QktcdgYAyOTYUb9LBW3W43GoB2s1vEjHyvS2QZiR+AZ YvfxEvZFKu+ZM2mB1CpThxyaBpbeNHk15VolAGHS5rCXQKDyCQUljhSWDhWh87HBSLhNUo4qiB0X MVQG2R7iUfOzATaF5R3hQJk8CwyURYKQ0Ye0iR3bHfnMCIEU+nrglojKwJanfcoq9IsR6l/OZb9V MEM= X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 18:28:07 -0000 =20 > On Jul 27, 2019, at 9:23 AM, Deen, Glenn (NBCUniversal) wrote: >=20 > As you would say ... =E2=80=9Cfair enough=E2=80=9D. My key point was tha= t there is not data support for the assertion that general users trust a few= big companies more. The data that I have in mind is Gmail's market share. That seems like big en= ough fact. It is not unreasonable to believe that moving DNS to a web servic= e would result in the same kind of evolution. Unless of course we do somethi= ng, but then the question is what. -- Christian Huitema=20= From nobody Sat Jul 27 11:30:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0EC67120048 for ; Sat, 27 Jul 2019 11:30:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W2tboypFqfiv for ; Sat, 27 Jul 2019 11:30:36 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53298120018 for ; Sat, 27 Jul 2019 11:30:36 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 7FF80BE4D; Sat, 27 Jul 2019 19:30:34 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IfSKyTCHNLDV; Sat, 27 Jul 2019 19:30:32 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id A2C06BE47; Sat, 27 Jul 2019 19:30:32 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564252232; bh=2Aqq+BAGwt1UhGeq3djVLtGb1bT6p9P7y9c6dIdX08g=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=1J2Gs7/0JluU2+4GuLtSVQ3YhHntVs891WKX6aECC8UX4OR1HQa7GcyAlK3xsiaFW wbsFXDxLwJB0BhRjYpp0GnLx9p3goqVu4ZvZhPtXSwLMIVBmN3Aefo2GvMxiUJDlxe FeJP5Iht5q4qTeozT3kYJePe0lj3wSPtHr/7o+fI= To: Rob Sayre Cc: Ben Schwartz , add@ietf.org, Adam Roach , Michael Richardson References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Sat, 27 Jul 2019 19:30:31 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="J7C2fnFib1ynm3AMhTSHHsWA8gt87hp05" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 18:30:39 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --J7C2fnFib1ynm3AMhTSHHsWA8gt87hp05 Content-Type: multipart/mixed; boundary="oWty01TNEEs9dNdEFTz2X5ijrTaJWtlx5"; protected-headers="v1" From: Stephen Farrell To: Rob Sayre Cc: Ben Schwartz , add@ietf.org, Adam Roach , Michael Richardson Message-ID: Subject: Re: [Add] meeting hum: should the IETF take up this work? References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> In-Reply-To: --oWty01TNEEs9dNdEFTz2X5ijrTaJWtlx5 Content-Type: multipart/mixed; boundary="------------073150AACA79C0CDC82C8616" Content-Language: en-GB This is a multi-part message in MIME format. --------------073150AACA79C0CDC82C8616 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 27/07/2019 18:56, Rob Sayre wrote: > On Sat, Jul 27, 2019 at 8:32 AM Stephen Farrell > wrote: >=20 >>=20 >> I think we would need some specific evidence of that before we >> ought factor it into the discussion. Is there evidence of this >> happening? >>=20 >=20 > https://arstechnica.com/tech-policy/2017/03/senate-votes-to-let-isps-se= ll-your-web-browsing-history-to-advertisers/ Assuming that regulation/law came into force, I read that as saying that an ISP could sell DNS-access data legally in the US, but it's always been the case that a network provider could do that. Evidence that it is really happening would be more interesting as part of this discussion, as, should that be the case, it'd I think provide a strong argument for the kind of TRR setup that mozilla seem keen on. Cheers, S. > > thanks, Rob >=20 >=20 --------------073150AACA79C0CDC82C8616 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------073150AACA79C0CDC82C8616-- --oWty01TNEEs9dNdEFTz2X5ijrTaJWtlx5-- --J7C2fnFib1ynm3AMhTSHHsWA8gt87hp05 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl08mEcACgkQWrL68XsX K+pq1g//aG7zscRk7kTYGzOMt/c3kdEPjCyR4iQbqJeIWKI89p5CI27N2H6JNjDR vaCfdTSCmlM8J9BO1ZOMHG3LpkD9dvoBHSpbO2e4J0AAR5xr0VYtb2zwuZz0zrLC S7EhC4UyQzOtk9xoV06jL02En7gdh9grhVDkUmIqDl05d5HVreRLx+299jLUXVCR bg6XX9CYIxpAGLEFsgudnwSU3t00tILWHn73EEqlIpaHRuFEw3P8lpFlIolpHNsg JRDbK++5Ib9fiAPM0+0aOVJr17NUPL3g1Vy5JTR2A3NoID1lP18sAnEa2vpy6xzh CreKty0lZF36InwdoFmJyeONuuxwaeWAopoRO5NFmmb5v0a+X3oY+gGB2VkB8hbn sWTwU/Gef8SD2krxKOM6jRDvCYD2u7ATgM2GFPL95sTsNRJxOGMzuC2uGJHIMVDz XgKyq75VBJe0bi7POd3ztMq/yKkkakSApoo3YqvtwJK7Q+gTw2x2k272qiRE06Nf Hu+k1MaGsMY+kHoTnGpHB4cb7Lhl6gj7zQ8J+G/nfCUlBF4OKAUAc8fXEs/4hujQ 8Qnq6BX4dNA6QK2N+80fwpZWG9HcztjxG2VJhcU72P8NiRtx2dxTXSJWr//ovnHP g5xAet4XHCqfs5eRSN+3RusVYlt219i3zr5AaMc1WYHv5KM7p00= =QL42 -----END PGP SIGNATURE----- --J7C2fnFib1ynm3AMhTSHHsWA8gt87hp05-- From nobody Sat Jul 27 12:05:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C199F12004F for ; Sat, 27 Jul 2019 12:04:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5n9gYdmENLr9 for ; Sat, 27 Jul 2019 12:04:56 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC726120018 for ; Sat, 27 Jul 2019 12:04:56 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id g20so111618366ioc.12 for ; Sat, 27 Jul 2019 12:04:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Z7fC/1ntKSsZt4qzUlGvcz8PRePjrV1d+kj1QL8Hxdw=; b=HIzrk7D3DmAeTpsNL/Qip1cmfgNrg++qlpeMFT8VbrkQllwsODFL8oQOJbI0KauYHD H3cjygoyCnTGNcQdS4IpLkl6fDbiBqF85oFc5jg64a8ZXRfgnbpR4oylv31XrB6WrYvG 6oYetqgumJLYAlbWVRtjyE3svctzVrK1h/Rn8JaVEGkOsvLArmLwwpAGcP2MIPrFkoRq IKU4azdXF0FM2zSlk7EEpSSlY9RsB9Sh0WWF/0vVu3BhQU/i/zEeA2fA56mKQr/xJqLV iQ5Fqgpxn4F16tmyTZfra+ULHNSVEUWumc6+KqjdT39zaZKoAAFKeFUgUg8vSG4g+Xro 8GpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Z7fC/1ntKSsZt4qzUlGvcz8PRePjrV1d+kj1QL8Hxdw=; b=SN53XFAXcDSDWS8agQ579HNRUF9a5sdQWSjSnReapLTmF9TyiHwqzcNvX/797ZSHhh jSEewxqD9SwLBJggIab+GUsNjgLfs40sm34KU64Fvx3l5Or7lfrK7sLdZte5LLU/5YG8 RAvkUoumMHURnU2HXfowYbPpJG5PFuXsKrxs8Ezm2pjXZm0D+2O+/576EmZUYhdRgxxo Ydd6etSFiYFckZVfJiFbj3XDUxtN20OwPtjBq2GnAg4tyE8g1njA9nGjnmRxshe+4Zte /dRVPlDLhr9q+kmjCF0JeShsG0iQBAWx8yrwnLFf2goNr4CyUU5IndLjekJijye2DEeJ Jr5Q== X-Gm-Message-State: APjAAAVLK2ej7T45HlfaMNfHdFB1jiM2Ly9ke/8iBL1AbPYu/z6C/WZa hveP5iqJJ8cIKefnLoA5dn+7r5dpztCIbi4vbjABSxyJ5slj+k8F X-Google-Smtp-Source: APXvYqz6QC6PHOIORd28QBrTzNwUirS7eyF29w36ewi0pvBkTbwaNYVt2Hft386jUvJsJ5izvVu+L6FIPi/suCO4jmo= X-Received: by 2002:a02:5a02:: with SMTP id v2mr101336319jaa.124.1564254295809; Sat, 27 Jul 2019 12:04:55 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> In-Reply-To: From: Rob Sayre Date: Sat, 27 Jul 2019 12:04:44 -0700 Message-ID: To: Stephen Farrell Cc: Ben Schwartz , add@ietf.org, Adam Roach , Michael Richardson Content-Type: multipart/alternative; boundary="000000000000a3e604058eae5552" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 19:04:59 -0000 --000000000000a3e604058eae5552 Content-Type: text/plain; charset="UTF-8" On Sat, Jul 27, 2019 at 11:30 AM Stephen Farrell wrote: > > Evidence that it is really happening would be more interesting > as part of this discussion, as, should that be the case, it'd I > think provide a strong argument for the kind of TRR setup that > mozilla seem keen on. https://arstechnica.com/information-technology/2015/03/atts-plan-to-watch-your-web-browsing-and-what-you-can-do-about-it/ There's plenty of evidence that ISPs use DNS traffic to fuel their own ad networks (again, no judgement). I also found some research that shows DNS information being at least "shared": https://blog.benjojo.co.uk/post/ISPs-sharing-DNS-query-data In that context, I don't think a WG is going to be productive. thanks, Rob --000000000000a3e604058eae5552 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On Sat, Jul 27, 2019 at 11:30 AM Stephen = Farrell <stephen.farrell@cs= .tcd.ie> wrote:

    Evidence that it is really happening would be more interesting
    as part of this discussion, as, should that be the case, it'd I
    think provide a strong argument for the kind of TRR setup that
    mozilla seem keen on.



    In that context, I don't = think a WG is going to be productive.

    thanks,
    Rob
    =C2=A0
    --000000000000a3e604058eae5552-- From nobody Sat Jul 27 14:52:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85B1312007A for ; Sat, 27 Jul 2019 14:52:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uO_sgCfkeUqN for ; Sat, 27 Jul 2019 14:52:44 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 522C3120052 for ; Sat, 27 Jul 2019 14:52:44 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 427143818C; Sat, 27 Jul 2019 17:52:22 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 460DB5D3; Sat, 27 Jul 2019 17:52:42 -0400 (EDT) From: Michael Richardson To: Eric Rescorla cc: ADD Mailing list In-Reply-To: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> <1856.1564239150@localhost> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 21:52:47 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Eric Rescorla wrote: > If the extension said what the privacy was, rather than just that > Mozilla > had vetted it, then perhaps there could be other levels of privacy. > It's not quite clear to me what you have in mind here, but one thing I > would like to emphasize is that the Mozilla TRR program is more than > just a self-assertion about privacy policy, in that we actively manage > the list, rather than just trusting people's self-assertions. If peop= le > were interested in some other set of privacy policies, then it's not > clear to me who would be responsible for running such a program. I'm not clear either at this point, because we don't have any feedback from any other entities. There seems to be significant interest in having TRRs running internal to enterprises, for the benefit for BOYDs, which would do = as much as possible in that environment. It might be that some TRR's are unable for local legal reasons to comply to the exact same criteria as Mozilla would like for a TRR to be used by the general public. For instance, enterprises might be required by some other local law to retain detailed data for 24 hours or something like that, but not disclose it without judicial review.=20 The fact that Mozilla is not just depending upon self-assertions is part of what is of interest to end users, I think. While a policy OID might work f= or some things, I agree that it is probably a self-assertion. It could be more complex: The CA signing might actively investigating before signing such a policy OID, or a third party might be providing a separately signed assertion that goes into a (new?) extension. I will drop this here, as I think you've answered my query as to the degree of interest Mozilla has. =2D-=20 Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl08x6oACgkQgItw+93Q 3WV8IAf/UHIh3+9qwYtML4fgpIofP61JduMWOY6op0qM3W/+QuweDZafEFS0gEJK lW06U7ttoKvkdQrahAgNbM/ofCAo9EwdCzU4x3kI3Ps4KlPIDwbnEOqRJ5MBVDwa i1yrrQ3tbFW4YgmS957XLTcDD7hf8CAjYo4fybiVCJr5BEaSJPHTstoNMjAGCY+9 BQz+jT/gdhboWuwc4jQ2u05azdX6Bre8tbQ7xSowiFj8qp8c1SH0sRyedmcNxn0z 3pFyziuyf1fLq9gAZDzPBCkfWmNWXynKRJJI+URjch0hDFu+oT6NcIYk0ssyLjKN g0G/jVFRGPR0ZgRHIdBezxToHvd73w== =P8vO -----END PGP SIGNATURE----- --=-=-=-- From nobody Sat Jul 27 19:50:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2DCB1200DF for ; Sat, 27 Jul 2019 19:50:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vBcvoBi2ed6W for ; Sat, 27 Jul 2019 19:50:11 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B0AE1200D7 for ; Sat, 27 Jul 2019 19:50:10 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 95E646A30C; Sun, 28 Jul 2019 04:50:07 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1564282207; bh=os0N1Kp1bmfhhAGx+g41ks48hGQcVd+hdRRDoedMZPs=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=n8CQmAdWZVuK3MrL9pD7lEe+Jn02W7ngOUgQx2lXaX9zRTXluxqggGA4E7eZz2x78 lDptF0tpRnxQsB4T0wNB/cy7kRneseaJ/qsovhTss6zaHWnv+GCpySA/SWipfIohIq njNkJmsKLwP2/BphvfmalLf73dTBTA8u7GMk7vcViz3XhQ/8XIJt5uRS2Xx3qPIHwn vxI0NwU/6sxx42hhtQpwYAl4CD+7zZvpQ6fgXUnCL5npKdlCnlXiiegFOD/5sCfIBk ACQ3BiWYcq1X57d0N0pY0tLWB3d5hZoY+/AexHqCf4dTVT9g5/hIGPAXv44HCx7uyz g8BqZMedp9usA== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 7C7213C0063; Sun, 28 Jul 2019 04:50:07 +0200 (CEST) Date: Sun, 28 Jul 2019 04:50:07 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Eric Rescorla Cc: ADD Mailing list Message-ID: <1938073477.1358.1564282207426@appsuite-gw2.open-xchange.com> In-Reply-To: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> <1856.1564239150@localhost> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev9 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jul 2019 02:50:13 -0000

    Il 27 luglio 2019 17:55 Eric Rescorla <ekr@rtfm.com> ha scritto:




    On Sat, Jul 27, 2019 at 7:52 AM Michael Richardson < mcr+ietf@sandelman.ca> wrote:

    If the extension said what the privacy was, rather than just that Mozilla had
    vetted it, then perhaps there could be other levels of privacy.

    It's not quite clear to me what you have in mind here, but one thing I would like to emphasize is that the Mozilla TRR program is more than just a self-assertion about privacy policy, in that we actively manage the list, rather than just trusting people's self-assertions. If people were interested in some other set of privacy policies, then it's not clear to me who would be responsible for running such a program.
    I understand your viewpoint, but from the opposite one - the resolver operator's one - having to apply for membership to multiple lists of trusted resolvers, possibly with different or even contrasting requirements, just to be usable on any browser and any application, looks like a nightmare. Also, this would definitely be a push towards a smaller number of bigger and more centralized resolver operators, as smaller operators would have a harder time managing multiple accreditations.

    So there would be merit in thinking of a joint industry program to evaluate and accredit resolvers, which could even foresee different levels of accreditation or different policies, so that applications could still pick different requirements, but at least the resolver could apply once and, if meeting all the requirements, be validated for all clients. All in all, it would not be too different from the CA machinery.

    But your point on who would run it, and "is there actually anyone willing to work on this?", is also valid; and also, even the simplest resolver certification program would still be more restrictive, and thus more prone to centralization, than the current situation in which people can just deploy a DNS resolver without having to ask for permission and it becomes immediately available to everyone.

    -- 

    Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
    vittorio.bertola@open-xchange.com 
    Office @ Via Treviso 12, 10144 Torino, Italy
    From nobody Sun Jul 28 02:05:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D1F421200E7 for ; Sun, 28 Jul 2019 02:05:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JWMZD_ifD5o5 for ; Sun, 28 Jul 2019 02:05:25 -0700 (PDT) Received: from mail-io1-xd44.google.com (mail-io1-xd44.google.com [IPv6:2607:f8b0:4864:20::d44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CBB1F1200E6 for ; Sun, 28 Jul 2019 02:05:24 -0700 (PDT) Received: by mail-io1-xd44.google.com with SMTP id f4so113682906ioh.6 for ; Sun, 28 Jul 2019 02:05:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NVKbJp+wkgmQCbR9t6iwfnbziMZUYkIa8YUukNBG56I=; b=dALdsW4Wfz3j0b/YtAfzsxzPoi7/nVWWCkU2SfFHQTMwKybZ93n9qRitO8eMA9jyvC QEsAz87x/l2BrQ/BmPtCseMoPyy/CpGHaKTKqCCPb8gpGcfzn84YhAXQlFa45TTWvQHs OWQa7uDWEx2fcofueat9D1sI8YyPVq/i1RXNcxTD+0KpC6gKbC2EBGk28wSb3Rr/8Jcq wZmqbb2kxYHzNUQmzDCHi7Cf5pW8Nrm6C/oL35KSWnzsSAbWSCA4jXUazKTiNEep36C3 ZetYAQabm5ZvJ9/T73UJ35IyJ1UbrtDHd0VDshnGqQY7NKV6q1OsitNfLGEwdkp3S8Ns zJ0w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NVKbJp+wkgmQCbR9t6iwfnbziMZUYkIa8YUukNBG56I=; b=jjPDiAkuDhTEZ81ZqZfwoJp5juvaMmew+curZnO7Li/GVgfCmcHFLVToyHnoBTwfoW bvvdHxvGc1C847JeEh7vXsVoe3RG9dqJNP3NhD6ux6FZ33Vat+ULZFSK/BSRxoJzrZDp itnoSnO6w3+JLgC0NfrVzQel2QaCKbRSCVmqVg62n1lKv+/f343F5lizfuH0AYmiQkk8 hKPLWxQYPpackRaXQopI37EuRrmZ+MNbivHb/ifXkqVMXrvwshYCqTdjPRRWJRPjQ+6V g+6NFUXWQLorecwG4zzv+dsFlhsx8+XO4FhWJXW8Ygj0ew9HZALTCmDoFV+wusyVv7Be kLOQ== X-Gm-Message-State: APjAAAW3L3WGtcgUwlXg5v0DdQckfLPKEHILp23I4gkub+hMKHAjjpSc iXUOJE8cDmVJ0cKNzUQhnUYhcCUmYkm3YZUrOFPh+t6/ X-Google-Smtp-Source: APXvYqy0vwpeVEk5DyMJ6JkmnfBNkpFrbiLFtulwTRNZ8Dix6nyr1CgHg5DQlxJtLEEE+Itz5CsR1ym+tpbXMC9Mitc= X-Received: by 2002:a02:b883:: with SMTP id p3mr34328623jam.79.1564304723909; Sun, 28 Jul 2019 02:05:23 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> <1856.1564239150@localhost> <1938073477.1358.1564282207426@appsuite-gw2.open-xchange.com> In-Reply-To: <1938073477.1358.1564282207426@appsuite-gw2.open-xchange.com> From: Valentin Gosu Date: Sun, 28 Jul 2019 11:05:03 +0200 Message-ID: To: Vittorio Bertola Cc: Eric Rescorla , add@ietf.org Content-Type: multipart/alternative; boundary="00000000000063a31f058eba1319" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jul 2019 09:05:27 -0000 --00000000000063a31f058eba1319 Content-Type: text/plain; charset="UTF-8" On Sun, Jul 28, 2019, 04:50 Vittorio Bertola wrote: > > Il 27 luglio 2019 17:55 Eric Rescorla ha scritto: > > > > > On Sat, Jul 27, 2019 at 7:52 AM Michael Richardson < mcr+ietf@sandelman.ca> > wrote: > > If the extension said what the privacy was, rather than just that Mozilla > had > vetted it, then perhaps there could be other levels of privacy. > > > It's not quite clear to me what you have in mind here, but one thing I > would like to emphasize is that the Mozilla TRR program is more than just a > self-assertion about privacy policy, in that we actively manage the list, > rather than just trusting people's self-assertions. If people were > interested in some other set of privacy policies, then it's not clear to me > who would be responsible for running such a program. > > I understand your viewpoint, but from the opposite one - the resolver > operator's one - having to apply for membership to multiple lists of > trusted resolvers, possibly with different or even contrasting > requirements, just to be usable on any browser and any application, looks > like a nightmare. Also, this would definitely be a push towards a smaller > number of bigger and more centralized resolver operators, as smaller > operators would have a harder time managing multiple accreditations. > > So there would be merit in thinking of a joint industry program to > evaluate and accredit resolvers, which could even foresee different levels > of accreditation or different policies, so that applications could still > pick different requirements, but at least the resolver could apply once > and, if meeting all the requirements, be validated for all clients. All in > all, it would not be too different from the CA machinery. > > But your point on who would run it, and "is there actually anyone willing > to work on this?", is also valid; and also, even the simplest resolver > certification program would still be more restrictive, and thus more prone > to centralization, than the current situation in which > people can just deploy a DNS resolver without having to ask for permission > and it becomes immediately available to everyone. > It seems to me that for both DNS resolvers and DoH servers people still need to go through the trouble of pointing their systems to it. You can easily set up your DoH server, and share it with your friends... Who then need to configure their browsers/stub resolvers to use it. The question is which DoH servers are trustworthy enough to be a default - which is where Mozilla's policies become important. The problem with centralization also exists today with the bigger DNS resolvers... I suspect quad8, quad1 and quad9 get the majority of traffic (from people who switched the default DNS service, or ISPs that forward such traffic) - which makes sense since they provide a globally available reliable service. > -- > > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com > Office @ Via Treviso 12, 10144 Torino, Italy > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000063a31f058eba1319 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On Sun, Jul 28, 2019, 04:50 Vittorio Bertola <vittorio.bert= ola=3D40open-xchange.c= om@dmarc.ietf.org> wrote:
    =20 =20 =20

    Il 27 luglio 2019 17:55 Eric Rescorla <ekr@rtfm.com> ha scritto:




    On Sat, Jul 27, 2019 at 7:52 AM Michael Richardson < mcr+ietf@sandelman.ca> wrote:

    If the extension said what the privacy was, rather than just that Moz= illa had
    vetted it, then perhaps there could be other levels of privacy.

    It's not quite clear to me what you have in mind here, but one th= ing I would like to emphasize is that the Mozilla TRR program is more than = just a self-assertion about privacy policy, in that we actively manage the = list, rather than just trusting people's self-assertions. If people wer= e interested in some other set of privacy policies, then it's not clear= to me who would be responsible for running such a program.
    I understand your viewpoint, but from the opposite one - the resolver op= erator's one - having to apply for membership to multiple lists of trus= ted resolvers, possibly with different or even contrasting requirements, ju= st to be usable on any browser and any application, looks like a nightmare.= Also, this would definitely be a push towards a smaller number of bigger a= nd more centralized resolver operators, as smaller operators would have a h= arder time managing multiple accreditations.

    So there would be merit in thinking of a joint industry program to evalu= ate and accredit resolvers, which could even foresee different levels of ac= creditation or different policies, so that applications could still pick di= fferent requirements, but at least the resolver could apply once and, if me= eting all the requirements, be validated for all clients. All in all, it wo= uld not be too different from the CA machinery.

    But your point on who would run it, and "is there actually anyone w= illing to work on this?", is also valid; and also, even the simplest r= esolver certification program would still be more restrictive, and thus mor= e prone to centralization, than the current situation in which
    =


    =
    people can just deploy a DNS resolver without having to as= k for permission and it becomes immediately available to everyone.

    It seems to me that for both DNS resolvers and DoH servers people= still need to go through the trouble of pointing their systems to it.

    You can easily set up your D= oH server, and share it with your friends... Who then need to configure the= ir browsers/stub resolvers to use it.

    The question is which DoH servers are trustworthy enough to b= e a default - which is where Mozilla's policies become important.
    =

    The problem with centralizati= on also exists today with the bigger DNS resolvers... I suspect quad8, quad= 1 and quad9 get the majority of traffic (from people who switched the defau= lt DNS service, or ISPs that forward such traffic) - which makes sense sinc= e they provide a globally available reliable service.


    -- 

    Vittorio Bertola | Head of Policy & Innovation, Open-Xchangevittorio.bertola@open-xchange.com 
    Office @ Via Trev=
iso 12, 10144 Torino, Italy
    =20
    --
    Add mailing list
    Add@ie= tf.org
    https://www.ietf.org/mailman/listinfo/add
    --00000000000063a31f058eba1319-- From nobody Sun Jul 28 02:57:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3753912012B for ; Sun, 28 Jul 2019 02:57:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F1KDjjKu_6CM for ; Sun, 28 Jul 2019 02:57:01 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.185]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 68458120127 for ; Sun, 28 Jul 2019 02:57:00 -0700 (PDT) Received: from [172.16.5.85] (vpn01-stb.sth.netnod.se [192.71.80.86]) by mail.frobbit.se (Postfix) with ESMTPSA id 68F652B1CB; Sun, 28 Jul 2019 11:56:57 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1564307817; bh=4gAtPEvaldi+rDy3r0LlYFn33uAo5v4g80AoCH/3FQQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U/Agtnpdia5T9kUuh1ivgSMtfZbfCSaB55Ktevjbl3xWy5ohaL9Q6u8vV4V1tLLLe FKv9rOTq1fVr3DdapJvBqDaRabm5MIni0YlHGMklHUUTHgrtuT4iJrPSvnYGktH55+ kEXuwBD3EGXPf481goqC9iC+3rHFe0CoK3lGf8dM= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Christian Huitema" Cc: "Deen, Glenn" , "Paul Wouters" , add@ietf.org, "Stephen Farrell" Date: Sun, 28 Jul 2019 11:56:56 +0200 X-Mailer: MailMate (2.0BETAr6137) Message-ID: In-Reply-To: <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_708059FF-8D38-4FEC-A5D3-FE9C25AAED42_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jul 2019 09:57:03 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_708059FF-8D38-4FEC-A5D3-FE9C25AAED42_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 27 Jul 2019, at 20:19, Christian Huitema wrote: > The data that I have in mind is Gmail's market share. That seems like b= ig enough fact. It is not unreasonable to believe that moving DNS to a we= b service would result in the same kind of evolution. Unless of course we= do something, but then the question is what. It is not IETF that have decided everyone should use a centralised mail s= ervice like Gmail. IETF still give the end user a choice on what to do. I want IETF to have the same view on DNS. Patrik --=_MailMate_708059FF-8D38-4FEC-A5D3-FE9C25AAED42_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXT1xaA8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI180x/ACdFc7ffwhDqbsgelYpmcwPdiImevsAn1D8qtI9 HWr12K71GcG+8RuJ3wbz =4fxM -----END PGP SIGNATURE----- --=_MailMate_708059FF-8D38-4FEC-A5D3-FE9C25AAED42_=-- From nobody Sun Jul 28 04:38:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 674C012013A for ; Sun, 28 Jul 2019 04:37:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2OWgkCesJhmD for ; Sun, 28 Jul 2019 04:37:56 -0700 (PDT) Received: from mail-qt1-x82d.google.com (mail-qt1-x82d.google.com [IPv6:2607:f8b0:4864:20::82d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4EB3C1200E7 for ; Sun, 28 Jul 2019 04:37:56 -0700 (PDT) Received: by mail-qt1-x82d.google.com with SMTP id h21so56929258qtn.13 for ; Sun, 28 Jul 2019 04:37:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=r5UsFJyi9fdeT8snrq8wy1Qc45JNaAFNASVQyTlMnGg=; b=XVrGufgf3h55HDFoQ5kRp3AteUVd7MD5y91j4vJekrRvhyw5Otp+F379qxD3E5nfSF 4jGRfHZczJ5moXtL4Ni4oyQsXNdDPgrPGPtBRKbHyRaMVDRedCt0SDRj8707Ltli2xo1 w+2IJ6rgEp/UzqtzBFb0jOQm8n9XLV02/l662uQyr1StFDNbzoQPVSoioHQFoN/ma7Dd oPTsHkMs4ykLVIHWB9sbjjIeJGYpIeEd6KFuhJzn4hlGB2W7JhhC2U1OzRwaCX+nGHTq A8eyiiL5kVQe0apQb0vwhaVEDiG8rECQvhUkHn8ugxiAZoW5Ovedg6triSqqZVejfNnm Y1JA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=r5UsFJyi9fdeT8snrq8wy1Qc45JNaAFNASVQyTlMnGg=; b=YBGVRdxVvy9jhqGLH1sFUoWUdSOLgrunJeZAEjG7zXEoMMnKKi7ckMJFeQDgESuy3j Po5kh+PjAbC8qcgiOp1DQlCQ16YtJNMVtIGlSghoZ41y/bg0WWhLhoQZmjavQEZJ0gE7 kZ8kg0K2RpXdIQVeQf8YRR5umPdjfr1OR4ZdDTS2tBmCPFs79HCNyjl36ZUijcURDaYm yR8SMZUE2j8TtBVCtCBrjHejiB3CLjcuw9UEI5Ixz6wyvbhUIGUza1ZxMTUVGp3XQykW 92ll02pc4vwNtM8SQydheAKbDt4EKQmD3S0rRmdOlZtzZVR5fAXpfwBaTrrjgwKxwJHv iZ2Q== X-Gm-Message-State: APjAAAWtnOPdnY1JW2xTfKQIqehsL/JZUJfHAYep6bPsf2BWjWlWoyC7 9Ws1kxf8f2oYnQ1wKg+Jv3Ft5A== X-Google-Smtp-Source: APXvYqxT/VQ6xyJaFcm8D/Rit68GgxuPImmzAcyTxHMFDUmJobdbrHnZyz5whErloX0xoBwOvUUlIQ== X-Received: by 2002:ac8:5289:: with SMTP id s9mr72431867qtn.64.1564313875076; Sun, 28 Jul 2019 04:37:55 -0700 (PDT) Received: from [10.0.30.11] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id 47sm34862287qtw.90.2019.07.28.04.37.54 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 28 Jul 2019 04:37:54 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Sun, 28 Jul 2019 07:37:53 -0400 Cc: Christian Huitema , Stephen Farrell , Paul Wouters , add@ietf.org, "Deen, Glenn" Content-Transfer-Encoding: quoted-printable Message-Id: <2197AA50-C266-4490-9E84-DB9EBC428EAE@fugue.com> References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> To: =?utf-8?Q?Patrik_F=C3=A4ltstr=C3=B6m?= Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jul 2019 11:37:59 -0000 Sure, but isn=E2=80=99t the conclusion to draw from this that there is at pr= esent a natural tendency toward consolidation that exists because we haven=E2= =80=99t offered a better alternative? Isn=E2=80=99t the right answer then t= o figure out that alternative, rather than to complain about the choices peo= ple make in its absence? Sent from my iPhone > On Jul 28, 2019, at 5:56 AM, Patrik F=C3=A4ltstr=C3=B6m wrote: >=20 >> On 27 Jul 2019, at 20:19, Christian Huitema wrote: >>=20 >> The data that I have in mind is Gmail's market share. That seems like big= enough fact. It is not unreasonable to believe that moving DNS to a web ser= vice would result in the same kind of evolution. Unless of course we do some= thing, but then the question is what. >=20 > It is not IETF that have decided everyone should use a centralised mail se= rvice like Gmail. IETF still give the end user a choice on what to do. >=20 > I want IETF to have the same view on DNS. >=20 > Patrik > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Sun Jul 28 05:53:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D934212010C for ; Sun, 28 Jul 2019 05:53:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fAF4t0Av1sxL for ; Sun, 28 Jul 2019 05:53:51 -0700 (PDT) Received: from mail-lf1-x134.google.com (mail-lf1-x134.google.com [IPv6:2a00:1450:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CBCB6120144 for ; Sun, 28 Jul 2019 05:53:49 -0700 (PDT) Received: by mail-lf1-x134.google.com with SMTP id b17so40136191lff.7 for ; Sun, 28 Jul 2019 05:53:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cKW/aK+mwDSGvWHoGyJbBnCLHim+zO8YAf2Bjfd5DRM=; b=t8DZtL/AAClv0QSy5hgJW2D1WYVLVABWUS3qN9oi0Mh4ZOm1goPdLtShETQ6TV2QLm DIWytlBGcjW7/cBxMBnWsVhzGJXCmdODbjRW2Qc/u3lUnCB9VgMM9mmD8qNba0W3j5N/ MCWXF4u8JyXj2LPh4os0+adj1UF6jwiFQ98XIpq/qp8KrE/B3mo+rnrzB5m6UkHYyKxZ Ls6VJyo5ynBNRi8gktNY3xuvkX4HTK+pUc+TP6nZv4FeGEqmRjDVXdAuUThBBcTFE8/z B3JHGksb8IUz50zmiBChAyajWRwCV8x8bGMgzdMAN2W6PCBx9qxNhO3DvaLaFEu/NjVL bBlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cKW/aK+mwDSGvWHoGyJbBnCLHim+zO8YAf2Bjfd5DRM=; b=L6H+zWRQaajZ1a0N0xhFP+kuaCePpl3gEoEmphi7p3I0jzq5ei3TmMRQWbwOqxV2F1 TdtjHvamGM7tPKi558T3SepdS9sQmkGNIXY8taeUWXIfdn9zLqYQQQXjv8+YkRnp56fq 6RUd0+n2SbJo4cLI+H9X9qDBDMouUI+cERz5uiju+rrxId0weLdvOXoU4eRoPTOYNkfu MsEw5uks5OPTUWGIi7ugyuFBSP+EMLpLwQfG8q4XoO3RmkVGeLnQ/RadnR/JmjdE+Ifk e/Jt4f+m676IWD5hBTZquzB5+DX3MG5GzJFxq9aDf1Ufxgihxx+55+tNEfU06kevC4/H D1mg== X-Gm-Message-State: APjAAAV50Fgec7GNmXxBXgqeD4vGLBt+9uwMQFjEismgv/Dp/tMG0bP+ +kv5zpoDlkgPakNVfVnc+aLor+ygChevQeGTtihurCes X-Google-Smtp-Source: APXvYqypf7NaaD7hYlyedl9/e6njF4nBHlZjQB1rTsj2WlUrtK0uqmGpy2l9iEDYmBZGYCiIq6Vxz3k0PXfgmTgQqRc= X-Received: by 2002:a05:6512:1da:: with SMTP id f26mr48357258lfp.129.1564318427945; Sun, 28 Jul 2019 05:53:47 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <25583.1564181379@dooku.sandelman.ca> <1856.1564239150@localhost> <1938073477.1358.1564282207426@appsuite-gw2.open-xchange.com> In-Reply-To: <1938073477.1358.1564282207426@appsuite-gw2.open-xchange.com> From: Eric Rescorla Date: Sun, 28 Jul 2019 05:53:10 -0700 Message-ID: To: Vittorio Bertola Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000036acae058ebd449f" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jul 2019 12:53:54 -0000 --00000000000036acae058ebd449f Content-Type: text/plain; charset="UTF-8" On Sat, Jul 27, 2019 at 7:50 PM Vittorio Bertola < vittorio.bertola@open-xchange.com> wrote: > > Il 27 luglio 2019 17:55 Eric Rescorla ha scritto: > > > > > On Sat, Jul 27, 2019 at 7:52 AM Michael Richardson < mcr+ietf@sandelman.ca> > wrote: > > If the extension said what the privacy was, rather than just that Mozilla > had > vetted it, then perhaps there could be other levels of privacy. > > > It's not quite clear to me what you have in mind here, but one thing I > would like to emphasize is that the Mozilla TRR program is more than just a > self-assertion about privacy policy, in that we actively manage the list, > rather than just trusting people's self-assertions. If people were > interested in some other set of privacy policies, then it's not clear to me > who would be responsible for running such a program. > > I understand your viewpoint, but from the opposite one - the resolver > operator's one - having to apply for membership to multiple lists of > trusted resolvers, possibly with different or even contrasting > requirements, just to be usable on any browser and any application, looks > like a nightmare. Also, this would definitely be a push towards a smaller > number of bigger and more centralized resolver operators, as smaller > operators would have a harder time managing multiple accreditations. > > So there would be merit in thinking of a joint industry program to > evaluate and accredit resolvers, which could even foresee different levels > of accreditation or different policies, so that applications could still > pick different requirements, but at least the resolver could apply once > and, if meeting all the requirements, be validated for all clients. All in > all, it would not be too different from the CA machinery. > I agree that this is to some extent like a CA Root program, but I think this points in the opposite direction from the way you are suggesting: there isn't one WebPKI root program. Rather, the major OS vendors (Apple, Microsoft, and Google) all maintain their own root lists, and Mozilla operates its own. Other applications usually either rely on the OS list or copy Mozilla's list. There's some degree of collaboration here ( https://www.ccadb.org/) and one could imagine collaboration in the TRR space if there were other TRR users, but our approach here is to wait for other TRR users to emerge and then see what makes sense. -Ekr > But your point on who would run it, and "is there actually anyone willing > to work on this?", is also valid; and also, even the simplest resolver > certification program would still be more restrictive, and thus more prone > to centralization, than the current situation in which people can just > deploy a DNS resolver without having to ask for permission and it becomes > immediately available to everyone. > > -- > > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com > Office @ Via Treviso 12, 10144 Torino, Italy > > --00000000000036acae058ebd449f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Sat, Jul 27, 2019 at 7:50 PM Vitto= rio Bertola <vittor= io.bertola@open-xchange.com> wrote:
    =20 =20 =20

    Il 27 luglio 2019 17:55 Eric Rescorla <ekr@rtfm.com> ha scritto:




    On Sat, Jul 27, 2019 at 7:52 AM Michael Richardson < mcr+ietf= @sandelman.ca> wrote:

    If the extension said what the privacy was, rather than just that Moz= illa had
    vetted it, then perhaps there could be other levels of privacy.

    It's not quite clear to me what you have in mind here, but one th= ing I would like to emphasize is that the Mozilla TRR program is more than = just a self-assertion about privacy policy, in that we actively manage the = list, rather than just trusting people's self-assertions. If people wer= e interested in some other set of privacy policies, then it's not clear= to me who would be responsible for running such a program.
    I understand your viewpoint, but from the opposite one - the resolver op= erator's one - having to apply for membership to multiple lists of trus= ted resolvers, possibly with different or even contrasting requirements, ju= st to be usable on any browser and any application, looks like a nightmare.= Also, this would definitely be a push towards a smaller number of bigger a= nd more centralized resolver operators, as smaller operators would have a h= arder time managing multiple accreditations.

    So there would be merit in thinking of a joint industry program to evalu= ate and accredit resolvers, which could even foresee different levels of ac= creditation or different policies, so that applications could still pick di= fferent requirements, but at least the resolver could apply once and, if me= eting all the requirements, be validated for all clients. All in all, it wo= uld not be too different from the CA machinery.

    I agree that this is to= some extent like a CA Root program, but I think this points in the opposit= e direction from the way you are suggesting: there isn't one WebPKI roo= t program. Rather, the major OS vendors (Apple, Microsoft, and Google) all = maintain their own root lists, and Mozilla operates its own. Other applicat= ions usually either rely on the OS list or copy Mozilla's list. There&#= 39;s some degree of collaboration here (= https://www.ccadb.org/) and one could imagine collaboration in the TRR = space if there were other TRR users, but our approach here is to wait for o= ther TRR users to emerge and then see what makes sense.

    <= /div>
    -Ekr




    <= /div>

    But your point on who would run it, and "is there actually anyone w= illing to work on this?", is also valid; and also, even the simplest r= esolver certification program would still be more restrictive, and thus mor= e prone to centralization, than the current situation in which people can j= ust deploy a DNS resolver without having to ask for permission and it becom= es immediately available to everyone.

    -- 

    Vittorio Bertola | Head of Policy & Innovation, Open-Xchangevit=
torio.bertola@open-xchange.com 
    Office @ Via Treviso 12, 10144 Torin=
o, Italy
    =20
    --00000000000036acae058ebd449f-- From nobody Sun Jul 28 05:56:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC21912014A for ; Sun, 28 Jul 2019 05:56:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IjOy5fwCGDiQ for ; Sun, 28 Jul 2019 05:56:00 -0700 (PDT) Received: from mail-lf1-x12a.google.com (mail-lf1-x12a.google.com [IPv6:2a00:1450:4864:20::12a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE6DE12010C for ; Sun, 28 Jul 2019 05:55:59 -0700 (PDT) Received: by mail-lf1-x12a.google.com with SMTP id b29so32876197lfq.1 for ; Sun, 28 Jul 2019 05:55:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=tHF0sMZB1eUv/gvWiF0JpcRKfzmLp8onO9LhiBhPuJU=; b=ew3kjZLSM2EFy0BptxdPfaJxl6DsCOqpgbxL/Y1BhLY9BAzOz0+bQ8VX6ZQKg+LoYv jwyq9HypWE2qwyGparJZMXLUuaZ/wsPJyVF/Vec3e6Yu/gUdxTdpZvf1i+9f9djXG5DN YsGYVqnB9P2J7j0QnxU1M96A7Q9SD8O0QyF/HCkFOz71nxwb3jU8kIhQdiiVBrOszL1z PmXa+F+eZid0gfJ1vxyKykiNUWnh2ILJaaEcg+ChElt0DB2c+NYydrxFR50jatw8jGA9 G0rKnex198mpzavfuLeFYLx8SyBuOJ2BsNNiHFfjN6R6i3iWY3NjKIweXpj5zB88SBTI CT5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=tHF0sMZB1eUv/gvWiF0JpcRKfzmLp8onO9LhiBhPuJU=; b=YERGfjIr/u4uui0/RYll7ks43v/snszhN90IdNJBvwY+MXoTPftIAo+JrRgo5aFjPn 3Ie5djoKC7VJoOccj0RNHlUNZ2Le0V2uOKhL5wax2aR81vWNdmgIXJpHt7XS4obUGT6I 2EBAT9TU65ybhTmijVRwU2pXBoRfTa1cuZ+Wz4m0/b4f5dXsbSHCpLlyYBTKFTSx1OZI 8XEUlLH9SoVyI7tPqAULe96H6Uy1YY+JpPD2vqgbRroWyCBpJeMpph3HWx6wIomvrxtc gAD4ktwXVM8eAJV3I+8R4J5rDubgnBsjBXNHmVbQB6cKrK7Fmf+yZQmmoGdI9CZv+O24 1O2A== X-Gm-Message-State: APjAAAXajWxv+AqYXmAK2SV7v1o1tDrvX4xcDvWyDUhwioKj8IkZS8WW SJlNgSEPwBtbcaPycp9AtZg1Fv+VMr3gRHdoIJ8= X-Google-Smtp-Source: APXvYqylDSfJWv/ixId1MG2OJXhE8J0dv72i2lLBKgNn0PGLO6RypggppHayAXjAIy/oNX2gzPbLWaIvP4/v+GlAXEU= X-Received: by 2002:a19:f24e:: with SMTP id d14mr50999677lfk.184.1564318557979; Sun, 28 Jul 2019 05:55:57 -0700 (PDT) MIME-Version: 1.0 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> In-Reply-To: From: Eric Rescorla Date: Sun, 28 Jul 2019 05:55:21 -0700 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Christian Huitema , Stephen Farrell , Paul Wouters , ADD Mailing list , "Deen, Glenn" Content-Type: multipart/alternative; boundary="000000000000f6d98e058ebd4b33" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jul 2019 12:56:02 -0000 --000000000000f6d98e058ebd4b33 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, Jul 28, 2019 at 2:57 AM Patrik F=C3=A4ltstr=C3=B6m wrote: > On 27 Jul 2019, at 20:19, Christian Huitema wrote: > > > The data that I have in mind is Gmail's market share. That seems like > big enough fact. It is not unreasonable to believe that moving DNS to a w= eb > service would result in the same kind of evolution. Unless of course we d= o > something, but then the question is what. > > It is not IETF that have decided everyone should use a centralised mail > service like Gmail. IETF still give the end user a choice on what to do. > > I want IETF to have the same view on DNS. > In what way is that not what is happening? -Ekr > Patrik > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000f6d98e058ebd4b33 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Sun, Jul 28, 2019 at 2:57 AM Patri= k F=C3=A4ltstr=C3=B6m <paf=3D40frobbit.se@dmarc.ietf.org> wrote:
    On 27 Jul 2019, at 20:19, Christian Huitem= a wrote:

    > The data that I have in mind is Gmail's market share. That seems l= ike big enough fact. It is not unreasonable to believe that moving DNS to a= web service would result in the same kind of evolution. Unless of course w= e do something, but then the question is what.

    It is not IETF that have decided everyone should use a centralised mail ser= vice like Gmail. IETF still give the end user a choice on what to do.

    I want IETF to have the same view on DNS.

    In what way is that not what is happening?

    = -Ekr


    =C2=A0 =C2=A0Patrik
    --
    Add mailing list
    Add@ietf.org
    https://www.ietf.org/mailman/listinfo/add
    --000000000000f6d98e058ebd4b33-- From nobody Sun Jul 28 06:09:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A38CE12010C for ; Sun, 28 Jul 2019 06:09:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aZzWnrUdinUc for ; Sun, 28 Jul 2019 06:09:32 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.185]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4FBC4120144 for ; Sun, 28 Jul 2019 06:09:32 -0700 (PDT) Received: from [192.165.72.241] (unknown [IPv6:2a02:80:3ffc:0:9c58:fefc:c951:8d9c]) by mail.frobbit.se (Postfix) with ESMTPSA id 730232B07B; Sun, 28 Jul 2019 15:09:28 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1564319368; bh=QXv+R0CLrZpn82D/NXM3PX3bhWeJwWFpRbxT3abjsOA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DXs6LdVZFAsyf949nBjnpKHnK1s46mLP8G2Tp1Ux/88mbd3iExdJ16WBUcDXnx9L1 1RaAHdyenWnAS/WU7baPUn/43pZe7fEr4A6FKFqbafF30BfCFjF4TCxb7BqCz8YfGx bw6e7fU+m3juPWIye4a8uvEO4cSeDUaDOpxahp4M= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Eric Rescorla" Cc: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" , "ADD Mailing list" , "Deen, Glenn" , "Paul Wouters" , "Christian Huitema" , "Stephen Farrell" Date: Sun, 28 Jul 2019 15:09:27 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> In-Reply-To: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_9879C83C-012D-4F22-A7CC-CF5C10726EE1_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jul 2019 13:09:34 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_9879C83C-012D-4F22-A7CC-CF5C10726EE1_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 28 Jul 2019, at 14:55, Eric Rescorla wrote: >> It is not IETF that have decided everyone should use a centralised mai= l >> service like Gmail. IETF still give the end user a choice on what to d= o. >> >> I want IETF to have the same view on DNS. > > In what way is that not what is happening? I hope there is where we will end up ultimately, but I see individual voi= ces on this mailing list that from my perspective is asking for solutions= where the ability to choose is removed. Patrik --=_MailMate_9879C83C-012D-4F22-A7CC-CF5C10726EE1_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXT2ehw8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI1816hgCfRKWPsW4BiHgJYAvHElkdv79OekwAoIpV7ZGc 73Lh4MlsdXafbXeYeHdy =FPOl -----END PGP SIGNATURE----- --=_MailMate_9879C83C-012D-4F22-A7CC-CF5C10726EE1_=-- From nobody Sun Jul 28 06:37:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F171512018E for ; Sun, 28 Jul 2019 06:37:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w-8PM7qXMqQ5 for ; Sun, 28 Jul 2019 06:37:10 -0700 (PDT) Received: from mail-lj1-x233.google.com (mail-lj1-x233.google.com [IPv6:2a00:1450:4864:20::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBD3B1201EF for ; Sun, 28 Jul 2019 06:37:09 -0700 (PDT) Received: by mail-lj1-x233.google.com with SMTP id m23so55804124lje.12 for ; Sun, 28 Jul 2019 06:37:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=1v+4koXnqSwU+hWDAoXpcM203XxIAiVjRoQVCpdAi9M=; b=ed5ATpvPwNuW4u9atajfuYEAvcE5nonbsmMCpU91BuS/hHddtWxj2KyLzsSGdatM2/ EOqEBsa6Ys6UCwUuqUo20LhOVTYxnfm30FR+2UqsSf8lMg923Yl4nj8VWBDgLQDHrztl Af/9ErzFgHvG+ZElsVmHM+YfObZlDXff/Cld0rE6nlhX0xZAkiw2BN91D0i+t9MIqvWb SNUnXVPAS52iDjF7UDGtTakyEK189YSNiT3uBKvErCFgZ2nJXRR46XIDtm4JTZonR7LO yB6rpgrRkvU6VJXaJ2qlKsCh/kIbMjaSgIcal6soK/NiQSYUheo/R6nlB01hVvSsg/Po mhHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=1v+4koXnqSwU+hWDAoXpcM203XxIAiVjRoQVCpdAi9M=; b=PhcXTWmbxFbZWN1CXaCtMlcCEXSpvnu1ezWPh9YzpjPk+LT/fqvzI4qKHHRPMwTUR8 SJAnCtKRwQUeg87tr0HcYuMyfXw3m5xyMoPGJf8WZc3GmYmtmvzb8QJfRZBwSZFweLvH zVnPJU2Df3MeDAtDGNkzFADpsmukgeEnpPOVywyWazfZ6Uc3sYglHLwNQ9PEO5CnXj7V WvzkYXFLHSaDTUYqYqwnJdgxGQhbMhWFtCLiZzN005pTTljI/f4Odg2YmM893+UBp2Bc TlHjxylfXCspXHGepTi68TWF6ag7MlFfLlRUQxCv2TpJUEwOtc6WJQo7mElKAjnd/uYa 4tyg== X-Gm-Message-State: APjAAAWYVe0dkAm5utQwks3xAPwq52CGnosrHJeo7Y2xqqrzXC9tYXo9 3naAbRu+kebHabIpuevQ2WnEin5c6/XiCRHYu9w= X-Google-Smtp-Source: APXvYqxpb8UPT3mE1r/bBhHK5QoVuxwrKGpEDkcFfhOF49X7msQAvgdpMGdyH34Y8VgbgTADPx6aPBj/+IkD/hT99yM= X-Received: by 2002:a2e:96d0:: with SMTP id d16mr41670480ljj.14.1564321028177; Sun, 28 Jul 2019 06:37:08 -0700 (PDT) MIME-Version: 1.0 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> In-Reply-To: <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> From: Eric Rescorla Date: Sun, 28 Jul 2019 06:36:30 -0700 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , ADD Mailing list , "Deen, Glenn" , Paul Wouters , Christian Huitema , Stephen Farrell Content-Type: multipart/alternative; boundary="000000000000331058058ebddf83" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jul 2019 13:37:13 -0000 --000000000000331058058ebddf83 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, Jul 28, 2019 at 6:09 AM Patrik F=C3=A4ltstr=C3=B6m = wrote: > On 28 Jul 2019, at 14:55, Eric Rescorla wrote: > > >> It is not IETF that have decided everyone should use a centralised mai= l > >> service like Gmail. IETF still give the end user a choice on what to d= o. > >> > >> I want IETF to have the same view on DNS. > > > > In what way is that not what is happening? > > I hope there is where we will end up ultimately, but I see individual > voices on this mailing list that from my perspective is asking for > solutions where the ability to choose is removed. > Which solutions are those? -Ekr > Patrik > --000000000000331058058ebddf83 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Sun, Jul 28, 2019 at 6:09 AM Patri= k F=C3=A4ltstr=C3=B6m <paf@frobbit.se<= /a>> wrote:
    O= n 28 Jul 2019, at 14:55, Eric Rescorla wrote:

    >> It is not IETF that have decided everyone should use a centralised= mail
    >> service like Gmail. IETF still give the end user a choice on what = to do.
    >>
    >> I want IETF to have the same view on DNS.
    >
    > In what way is that not what is happening?

    I hope there is where we will end up ultimately, but I see individual voice= s on this mailing list that from my perspective is asking for solutions whe= re the ability to choose is removed.


    --000000000000331058058ebddf83-- From nobody Sun Jul 28 15:22:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72D0712006E for ; Sun, 28 Jul 2019 15:22:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3UmDhBOnvDim for ; Sun, 28 Jul 2019 15:22:25 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.185]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A3091120088 for ; Sun, 28 Jul 2019 15:22:23 -0700 (PDT) Received: from [192.168.10.199] (c-c4b7d954.028-114-73746f27.bbcust.telenor.se [84.217.183.196]) by mail.frobbit.se (Postfix) with ESMTPSA id 90B3A2B8FE; Mon, 29 Jul 2019 00:22:19 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1564352539; bh=/bP3jkTZXyIeomJ/WK6Q4Zfm+sEQkqnUfXvu99hr44Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IUIL4+dvZR1qaVkYHiN8efvCAKw0XmgaYicOKQ1v5Pj3aVD1edtYJglG2IeB+/Ao6 qePKnXl6MZXD1+59eqT3hrIU8XZzGAmLTICKaz3g73HUlBAFuBS+wApy12V7o08jve MIkZSe6tEgyqHJ6vmdnSAA3ucSABeUFzIDPX5rEI= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Eric Rescorla" Cc: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" , "ADD Mailing list" , "Deen, Glenn" , "Paul Wouters" , "Christian Huitema" , "Stephen Farrell" Date: Mon, 29 Jul 2019 00:22:18 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_5BF54F65-C5B0-47B5-AE2D-CBAE9D7BCB46_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jul 2019 22:22:27 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_5BF54F65-C5B0-47B5-AE2D-CBAE9D7BCB46_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 28 Jul 2019, at 15:36, Eric Rescorla wrote: > On Sun, Jul 28, 2019 at 6:09 AM Patrik F=C3=A4ltstr=C3=B6m wrote: > >> On 28 Jul 2019, at 14:55, Eric Rescorla wrote: >> >>>> It is not IETF that have decided everyone should use a centralised m= ail >>>> service like Gmail. IETF still give the end user a choice on what to= do. >>>> >>>> I want IETF to have the same view on DNS. >>> >>> In what way is that not what is happening? >> >> I hope there is where we will end up ultimately, but I see individual >> voices on this mailing list that from my perspective is asking for >> solutions where the ability to choose is removed. > > Which solutions are those? Once again, let me start by explicitly stating I do feel the discussion i= s going in the right direction. Partly thanks to you ekr. Now, my statement comes from the few individuals on this list which say t= hat IETF should promote DoH as envisioned as a protocol not separable fro= m other protocols explicitly doing an end run around the local access pro= vider default configuration. My point is that IETF should take a broader view on what is happening at = the moment, where for example there is a difference (as you pointed out a= few posts ago) there is a big difference between what the base open arch= itecture looks like, and what then can be done by users by for example la= unching VPN's, reconfiguring the default routing of DNS queries and appli= cations using specific configurations. To me the fact DNS resolution can be done already today in so many differ= ent ways is a strength, just like email can be set up and run in many dif= ferent ways. Many people might today use Google (I do it myself for a few= domains), but others might not for various reasons. Including their deci= sions on who they trust and why. And also including the ability access pr= oviders have to understand what is going on. Not specifically wiretap, bu= t understand what protocols are in use. I like that freedom we have, and the ability to innovate, and I want to k= eep it that way. Basically, as I wrote in a different email: I do not understand why IETF = should walk away from the base architecture we have today, that the acces= s provider do give not only routing of IP packets but also DNS resolution= to the client. But then at the same time we a. secure the communication = to that end point (query minimization and TLS), while b. we allow people = to override this by just adding another layer in the value chain. Patrik --=_MailMate_5BF54F65-C5B0-47B5-AE2D-CBAE9D7BCB46_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXT4gGw8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI181mpACeLfug/IuzVaadd8TINzGwR3qWIasAnikpn/HX JcJAk7q1uVuTrWJzThvJ =l4j1 -----END PGP SIGNATURE----- --=_MailMate_5BF54F65-C5B0-47B5-AE2D-CBAE9D7BCB46_=-- From nobody Mon Jul 29 03:59:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2AD41200D7 for ; Mon, 29 Jul 2019 03:59:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xHiBYhg52MgQ for ; Mon, 29 Jul 2019 03:59:25 -0700 (PDT) Received: from ppsw-40.csi.cam.ac.uk (ppsw-40.csi.cam.ac.uk [131.111.8.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 493D1120018 for ; Mon, 29 Jul 2019 03:59:24 -0700 (PDT) X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus Received: from grey.csi.cam.ac.uk ([131.111.57.57]:54914) by ppsw-40.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.138]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1hs3N8-001JZA-lR (Exim 4.92.1) (return-path ); Mon, 29 Jul 2019 11:59:18 +0100 Date: Mon, 29 Jul 2019 11:59:16 +0100 From: Tony Finch To: Patrick Mevzek , Michael Richardson cc: add@ietf.org In-Reply-To: <7cfa79af-3130-2c64-f8fd-f2ce7b9be585@uniregistry.com> Message-ID: References: <27369.1564183623@dooku.sandelman.ca> <7cfa79af-3130-2c64-f8fd-f2ce7b9be585@uniregistry.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 10:59:27 -0000 Patrick Mevzek wrote: > Michael Richardson wrote:> > > > > I wonder if we should define a new return other than NXDOMAIN that a > > resolver that is censoring by choice (spam, malware), such that an > > Application Doing DNSSEC could recognize as being intentional? > > Not a new return code, but an extension will provide that: > Extended DNS Errors draft-ietf-dnsop-extended-error-06 > > 4.6.1. NXDOMAIN Extended DNS Error Code 2 - Censored In a lot of cases this will not be as useful as you might hope. It's common for RPZ deployments to redirect malware domains to an informative web server rather than return NXDOMAIN. Tony. -- f.anthony.n.finch http://dotat.at/ Rattray Head to Berwick upon Tweed: East or northeast becoming variable, 3 or less, increasing 4 at times. Slight, occasionally smooth in south. Showers, fog patches. Moderate or good, occasionally very poor. From nobody Mon Jul 29 04:05:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1597120018 for ; Mon, 29 Jul 2019 04:05:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.997 X-Spam-Level: X-Spam-Status: No, score=-6.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zg9iIWaKUQp3 for ; Mon, 29 Jul 2019 04:05:01 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [IPv6:2001:1488:800:400::400]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 907801200D7 for ; Mon, 29 Jul 2019 04:05:01 -0700 (PDT) Received: from [IPv6:2001:1488:fffe:6:c0a4:829b:87d2:7b52] (unknown [IPv6:2001:1488:fffe:6:c0a4:829b:87d2:7b52]) by mail.nic.cz (Postfix) with ESMTPSA id 8440914095D; Mon, 29 Jul 2019 13:04:59 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1564398299; bh=EkSsUrNj7cu89S3PdDS/5V1EAeKN7/Jd7Vugs20mgg8=; h=To:From:Date; b=B6AI1evuU9G1lIUfw3zCXw8/smcDLL/jT3gI9Ql5s8rEMeWb8WYYqjLhBVvVBemaY 7tneMIFZ+IOGNe3ZLUPlVVPwUcTpmZR/hkI6JM1gqTUODidVmPr+KA/0TszOe+vuXZ 98oMZz+rXfXr+XmY2QrfiFpz8ps9BSn79yosApAc= To: Tony Finch Cc: Patrick Mevzek , Michael Richardson , add@ietf.org References: <27369.1564183623@dooku.sandelman.ca> <7cfa79af-3130-2c64-f8fd-f2ce7b9be585@uniregistry.com> From: =?UTF-8?B?VmxhZGltw61yIMSMdW7DoXQ=?= Openpgp: preference=signencrypt Autocrypt: addr=vladimir.cunat+ietf@nic.cz; prefer-encrypt=mutual; keydata= mQINBFgDknYBEADHEQwLBlfqbVCzq7qYcBFFTc1WCAFtqiKehOrsITnKusZw4nhYwlKQxcum gj01xJOhbfHBCBeGlDydYqemKg4IfY2nwSyPwZZYMJn7L7AGrCeytr4VMvDJ7o7qDZjjim4i fv+GUwdk3plXx6oMF4nctesI8aAOuLUHAn0PfrGfNhWoaglOKgdOI6DGjhI/aGkvy+jrI/+X sdMV+3f1RuEOfI+Yu4SXFjJyhAmqEOBRxxdHqKreIIpz3Lg38yWwiVGfwgQT+nFIz9BpHH3l Wg1uS8xM3ezceBmRYV8zT9PvbeZ57BlaTR6rLae5RYwV397PSLBqqLkB5H0TDRUFBnwBsUob LebYHmJCOydvyNv5AFkLmLZ7O4j2jFo1WPSMt3ThM6wRwqrnB4Gi+6onyrZfE1DnVZMqbxZ3 VXa+E4S5YwrfCLUErGEn+d40OtoRZmQXhRPVAsdjimMj9oFM9RoxSgUrDg6Ia3n0IrKFb++z HAFbqkR5g4qzXiOMEG621GYEex2sDEKz/PD4CVKlNI9eld4ToH592kAwzJmd+sAi+Rfos0NE zxuFd0ekAOeWoURo0zoYTSWPlMOmFMvcpH6LP3leJmY7x4z/b1ng/+7UnKonVALVPFbRbElO kIfAtLKcUEofwV1jr7DyYGPalJtiDJPomB041ZHCj2RxyXY/oQARAQABtDBWbGFkaW3DrXIg xIx1bsOhdCAod29yaykgPHZsYWRpbWlyLmN1bmF0QG5pYy5jej6JAlQEEwEIAD4CGyMFCQlm AYAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AWIQS2AGRgtgqA54IGJEnnR98flXWjqgUCWg3w 3gAKCRDnR98flXWjqmD6D/96U4cDZBrHQ5LhqybocZr/N2IS5Wr2SLLB4k2F5/W/wbL05gq6 Ha9/2TMqXoxRkhug+EAHFHxylPR43yN9rz0pjBXHrra87FAPHMqq/qqrOEUdhkytEqa6WIho aoEkdhaMhUyctjVjL2WZ0+MWeRjqedLQX+VCrOVPcVbLreRRhA9N3KPgNwbp9zCg6hEPi4l2 zZKedHkTNjKIAwJ0xZoMwFa1Y+vL8Em8Or+IBZuGBMP/ZMtasPOIQaT/Gvsyx1DDorwsoCdX 6zaTZy5DOWP3FIrMzus/YDbzwAYxSpWk/jF44ySbnJzdjU67EfG3UrsK+RRGw8aJqs3/4qHK ZMZZnNL+4wJpEdnZyFic/MXcw6FBszQEwrIOaM1WEfwzn2ExUYk2pM5zaBwq76OgrmGMzMEi cfMDyqLodwEQqR70PvRbkrh+R02LphwQ9c5AFXcrLjKMmeQlbQVarTUsrELcTK6rElC1ojS7 M37j0XzFE+kgNWn2fyBRgtnGDWEa7r+oDaueXJnEf0/4Ww28IwxakNc7r0N41GIBekwSxKdk epKFZgtVGGSDlFei5hb5LLWFljA1OS7CRVJKpbHafQjdPdb1vNqZAj4y2SJXvVVpI1KO5kq+ dFdYipORv0N2Iho6MNYbQUT1EBeU46G5N0viCoLS15/PxLhIAo+PzKpW97kCDQRYA5J2ARAA yHww3huLEtsdyqgjiGMhtEKOLmp7yFl450HY9oPcHS02U5BC1370ssNShrdOCi2ACDbe41Zx x85WcuaO1OVqung2umX047mj2xQsiTAFRDLZsQu8cQFoEy/DBL2bk7ThfK1Lh+NyZAs0UaPp DkGodS0De9osA+4T6Nf4POYaeavbYVFSdDKS4lUboBqApKnD/TzKFxFcpuFx6FN92lteTbOo jGMiLoZvELY86Kn9KuFZ8FM2ZSNHx1Z75KouufGrdkeCoZYVYiuzT+fnt2it4dIpIlnF+yxM t5LB/MSrmECB5CAFJtxzuMccm6yDUZQSWWi9vUgxIJwvt5w0CIBT353DGeP4WnH0r5YoBKoR bh7i4fT0lWvMXTG/V2lqyzBdClMebyHffMgba26Kj6oeDygDfC5aGsVaqw1Ue/qQ5QRqTJcJ V7xVLTtS1EamVqkfKwPS0zTfnrF1jQtnO/P4qkfgBRRG9BXGGrykHpXOyqmX6Z0wbV2P4j+p 02oSecDl5yVXplJfsXfbS/xXnaSkaN/7mCU29ul26cAVNxDkDPunztSFi9K9LM2T/XWYJQGX M71OpmONQJGF24lx7Wp/kobnHtbjGDzjDPC4eSL7MA56qtrWaLM+4ePKANct2q0q6c0uSLs0 Q2zochS64Mcg0YzL1sinWPN1rXLDk3lwpIsAEQEAAYkCJQQYAQgADwUCWAOSdgIbDAUJCWYB gAAKCRDnR98flXWjqn4yEACA0f1XBAg+WMaNPtIt0k15yFPfhdbOg9GhDcYGgvFIOxRuaFWw 9SLUt7OGuUnIpKxKRXtQJss98fHkijo70ONYWPuLhfRGK/wg9Ao6MuFw5G8m431CBS/awrie b6iPjvAARXJCPTTBZk/NC988jiKdCh8PbTCHDsl+gSDytP15QUrdqSfS2Wf4653ej7+jtuTj xZzmGgvNSi6JDlb9KNtmBQKQAgpnOQM46ItESmzHDnmdcvhPLUDsjwkpIJ6clasOzaObwxJi ba7iFPcGwcClCSwYjMNXFtneCGUnEAa5RBIx+i+LV1iqB3VRvTC6tMIUueoQ7cdTy6afNkhw QYXm4/pDmNT8UMdnzwnlTpFQ0CegDQRDWc+dIDDBHGEEEYBh2vTOE04KrmYUp1bQsNegPfvL woHib0jEvohPMJ2fJtZAd1SJElgwPbM8H7emKBiTsHwF8gL7G2jo7AoGpqYjqXkCRS0tSLTN r+qHh+7Ltrkbu/ZVTTfh4Q/qw3VaLYQh4C0tBma/YevQy1O2c3TZXXFz1QF8b9/Hj/3sq2Kg T1AcZ51E+xG+cb6cUqgkihmgm39xx24GPlNAdCRuq01+iILol+Wox6OwF6hmqx1EMSmxcmGo UREr0rkMnFVsWeAYeVoE4q689qxCPu9iCMJMJnkRe1o9oQYSN7my+S98gA== Message-ID: <621a587c-9f07-90ba-2ef3-be27aab1f928@nic.cz> Date: Mon, 29 Jul 2019 13:04:59 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-US X-Virus-Scanned: clamav-milter 0.100.3 at mail.nic.cz X-Virus-Status: Clean Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 11:05:04 -0000 On 7/29/19 12:59 PM, Tony Finch wrote: >> Not a new return code, but an extension will provide that: >> Extended DNS Errors draft-ietf-dnsop-extended-error-06 >> >> 4.6.1. NXDOMAIN Extended DNS Error Code 2 - Censored > In a lot of cases this will not be as useful as you might hope. It's > common for RPZ deployments to redirect malware domains to an informative > web server rather than return NXDOMAIN. At this point we could extend the draft to also allow "Censored" in positive NOERROR answers, but in that case the problem with getting the information to applications might be even more difficult.  Still, I can't immediately see any harm in allowing the combination in the standard. --Vladimir From nobody Mon Jul 29 04:30:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C259D12017F for ; Mon, 29 Jul 2019 04:30:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bHMLSsADNR-V for ; Mon, 29 Jul 2019 04:30:05 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF504120179 for ; Mon, 29 Jul 2019 04:30:04 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45xyCZ2l7dzF5X; Mon, 29 Jul 2019 13:30:02 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1564399802; bh=kMaSPMIwFCrd/xkXDk+g0U7R9bBrplvZ7Jhkb/KtljQ=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=rkU5syA2VSMOvhtyDcNWiaM2x5HDz7YFUNDCRDrLFFxmkr7mSbcjnxGvLEAZdW/UK Sc8jPmepJ51NweMdGreJz8zzwfQfWhDxAsDUJFGhXu7aSyfCDt1Kfe+TasTNmkvRvV VKzkwqarFtgHm0cBCAPBpUHjOlJitvt+/WLVdiCk= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id L2K_uDJYSKxA; Mon, 29 Jul 2019 13:30:01 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Mon, 29 Jul 2019 13:30:00 +0200 (CEST) Received: from [193.111.228.93] (unknown [193.111.228.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id 1FCE83159D0; Mon, 29 Jul 2019 07:29:58 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 1FCE83159D0 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Paul Wouters X-Mailer: iPhone Mail (16F203) In-Reply-To: <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> Date: Mon, 29 Jul 2019 07:29:57 -0400 Cc: Eric Rescorla , =?utf-8?Q?Patrik_F=C3=A4ltstr=C3=B6m?= , ADD Mailing list , "Deen, Glenn" , Christian Huitema , Stephen Farrell Content-Transfer-Encoding: quoted-printable Message-Id: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> To: =?utf-8?Q?Patrik_F=C3=A4ltstr=C3=B6m?= Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 11:30:07 -0000 > On Jul 28, 2019, at 09:09, Patrik F=C3=A4ltstr=C3=B6m wro= te: >=20 > On 28 Jul 2019, at 14:55, Eric Rescorla wrote: >=20 >>> It is not IETF that have decided everyone should use a centralised mail >>> service like Gmail. IETF still give the end user a choice on what to do.= >>>=20 >>> I want IETF to have the same view on DNS. >>=20 >> In what way is that not what is happening? >=20 > I hope there is where we will end up ultimately, but I see individual voic= es on this mailing list that from my perspective is asking for solutions whe= re the ability to choose is removed. I think that is a misconception on your end.=20 And since you don=E2=80=99t quote supporting text, let me make it clear that= I am not advocating for that in the slightest. My point was that most users= trust the quad servers more than a random coffee shop because they don=E2=80= =99t even know the coffee shop operator whereas the quads have at least some= reputation and therefor presumably are more trustworthy than a completely u= nknown entity. I=E2=80=99m not a fan of the centralization. I am a fan of removing blind tr= ust on unknown parties.=20 What we need is a decentralized quad X provider. Paul >=20 > Patrik From nobody Mon Jul 29 04:36:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 483ED120178 for ; Mon, 29 Jul 2019 04:36:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UG9D6Ywh3nC2 for ; Mon, 29 Jul 2019 04:36:00 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1DB1120131 for ; Mon, 29 Jul 2019 04:36:00 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45xyLR2szrzrn; Mon, 29 Jul 2019 13:35:59 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1564400159; bh=kDWMu0fYmv/b77oIknBOOWo9q1GtkmWbUVHaNFkbv54=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=qTGWDYs5odQPu7JNIDPCr0IfFnpXkrZIa5J8Ym5f+KqxAgkKxXTbO1zhxgT9FPWKt mQHSw99Pibmq+eiemCAWpiMvidj1mptR6j9Jcdh4CDT0/lA6Egpi1iXcfSByp6CS0v f5mf3ypwH6mKa8Mixw5M95FuxFtd7fQr8PmS0Lq0= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id VbPZf3CF38PY; Mon, 29 Jul 2019 13:35:58 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Mon, 29 Jul 2019 13:35:58 +0200 (CEST) Received: from [193.111.228.93] (unknown [193.111.228.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id 611AD3159D0; Mon, 29 Jul 2019 07:35:57 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 611AD3159D0 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Paul Wouters X-Mailer: iPhone Mail (16F203) In-Reply-To: Date: Mon, 29 Jul 2019 07:35:57 -0400 Cc: Patrick Mevzek , Michael Richardson , add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <0E2E850A-61E2-411C-A35A-2BDFF3C86D57@nohats.ca> References: <27369.1564183623@dooku.sandelman.ca> <7cfa79af-3130-2c64-f8fd-f2ce7b9be585@uniregistry.com> To: Tony Finch , rfc-ise@rfc-editor.org Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 11:36:02 -0000 > On Jul 29, 2019, at 06:59, Tony Finch wrote: >=20 >>=20 >> 4.6.1. NXDOMAIN Extended DNS Error Code 2 - Censored >=20 > In a lot of cases this will not be as useful as you might hope. It's > common for RPZ deployments to redirect malware domains to an informative > web server rather than return NXDOMAIN. I have already proposed a fix for rpz years ago that moves the censored answ= er to the additional section so that =E2=80=9Cdumb clients=E2=80=9D are prot= ected and =E2=80=9Csmart clients=E2=80=9D can do the dnssec validation of th= e censorship (and possibly override). I=E2=80=99ve completed a review of the current rpz for the ISE in the hopes t= hat the current rpz document will be published as RFC, so we can start the b= is document with this feature ASAP. Paul= From nobody Mon Jul 29 05:37:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B3191200F8 for ; Mon, 29 Jul 2019 05:37:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QerhrS4D4Zhd for ; Mon, 29 Jul 2019 05:37:44 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5F5A1200F7 for ; Mon, 29 Jul 2019 05:37:44 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 421C0242109D; Mon, 29 Jul 2019 12:37:42 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Mon, 29 Jul 2019 13:37:41 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> To: Paul Wouters X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [Add] DNS service provision and the concept of trust X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 12:37:46 -0000 > On 29 Jul 2019, at 12:29, Paul Wouters wrote: >=20 > My point was that most users trust the quad servers more than a random = coffee shop because they don=E2=80=99t even know the coffee shop = operator whereas the quads have at least some reputation and therefor = presumably are more trustworthy than a completely unknown entity. Paul, there=E2=80=99s a lot more to this notion of trust. It=E2=80=99s = not as simple as you suggest. Suppose this hypothetical coffee shop is = shoving all outbound HTTPS through some web proxy. Can the end user be = sure their DoH queries go to their =E2=80=9Ctrustworthy=E2=80=9D DoH = provider-du-jour? However another aspect of trust comes from contractual relationships. = The notion of least surprise also applies. I pay my ISP or coffee shop = for Internet service and one of those services is DNS resolution. [OK, = it=E2=80=99s buried deep in the T&C=E2=80=99s nobody reads.] I trust = (handwave!) my provider to supply that service. That implicit trust = relationship gets ripped up when some browser or web-based app uses its = own DoH resolver. Which might or might not be the same as my = provider's/coffee shop=E2=80=99s resolver or the one I hard-wired into = my device. Oh, and can you trust DoH providers to never, ever change their privacy = policies or have data breaches? And FWIW, the quad N services may well be great. They=E2=80=99re run by = fine people who I like and respect. But unless I can audit/inspect their = infrastructure, they=E2=80=99re just as much of an unknown entity as the = local coffee shop. > I=E2=80=99m not a fan of the centralization. I am a fan of removing = blind trust on unknown parties. How does that work for the 99.99% of the planet who can=E2=80=99t even = spell DNS, far less understand what it does? The same goes for other = blind trust elements that underpin pretty much everything on the = Internet. I trust my ISP has given me a unique IP address. I trust they = use a genuine ASN. I trust nobody else is making bogus BGP announcements = for that address space or is spoofing my IP address. I trust CAs = aren=E2=80=99t issuing bogus certs to people pretending to be me. I = trust nobody fakes my email address. I trust nobody impersonates me on = $social-media-platfrom. etc, etc. > What we need is a decentralized quad X provider. Only one?= From nobody Mon Jul 29 05:50:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2816C120142 for ; Mon, 29 Jul 2019 05:50:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DAvnPaAI1sdy for ; Mon, 29 Jul 2019 05:50:22 -0700 (PDT) Received: from mail-qk1-x730.google.com (mail-qk1-x730.google.com [IPv6:2607:f8b0:4864:20::730]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3023E1200F8 for ; Mon, 29 Jul 2019 05:50:22 -0700 (PDT) Received: by mail-qk1-x730.google.com with SMTP id d79so43948000qke.11 for ; Mon, 29 Jul 2019 05:50:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=r/pqk1hX+kPTYnc4cWxP9g1+harFpQc8q9l6uociidE=; b=kLy/hXS5UueP/LYvDkUZarVe4GUHZxObGcAGV5Buhp9IDDVMRD3YTpHxUnslEd+mIq GIPaq2Ftt6Mbk2EutzcuB7gR8a58xR0QMGKJ7eL7v60eaIO4MKq488x4h+u7q6d64Spw H4YfVggeg5Maz8XyvlazvuuGAldJ+giz4GfTND1mfgrcYO5A72Njiaotcm6zxSFv3VzF g7G6XYcRtTKIrgWC+2jprtgerapDmlhEY3PePgdxri/DvHldXjRanCPQrIHKPWKrOyoS Vwi7xr1B1/X1b4fsqyHhBiK0kQUELaQ4ZjQyMmCq2FBZ/6v31KA+Gm/m+0vSWrGh+a/P yyCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=r/pqk1hX+kPTYnc4cWxP9g1+harFpQc8q9l6uociidE=; b=E/nvP9s2vGIzbzSJ65xSM9zOUPSxtN9ZpoHwwGomNmqH0zYrjvoyIuwU/frK9QOjWo ajW5NZahqbMJJxsPHezt4NVeaXq7cMDS0EPoYfRFPgwg5CifL4uoxxZFqu2kC3Ovg3/x zd1Pbl80AM+6B3UbyASh4tsKTOG0HINsrQhdvj+j0aQagtXCpV86OeflS6vUkYY2eYu5 AMUb11j7Decd8qxxq/vYid6/ePWfHIm3hg+t2FuzCuZ3l0pVjVwGwhSWpxherPgHu78H tLBYtShvfLkg8EOZSVTl6KXhKqd1/fWSJoaeXbWiplidiLXbqwB7rq3pg/+3881KBiat xbbA== X-Gm-Message-State: APjAAAX9wg63J+bxq88nMbFF7lfV5d9kghZ3ffUZeNI2pO2utDG0yVqW 7XXLZKTHK/vCQtG6bUep/HZpxfxdGqv51A== X-Google-Smtp-Source: APXvYqyl3C2IQRBCYDKkJhW36YN8i7STVFpP95gPge9oMjIJkG1uUJKLuapKeqXUHt7PVBQf4lBIrw== X-Received: by 2002:a37:a6d8:: with SMTP id p207mr66700031qke.387.1564404621156; Mon, 29 Jul 2019 05:50:21 -0700 (PDT) Received: from [10.0.30.11] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id g10sm24794891qki.37.2019.07.29.05.50.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 29 Jul 2019 05:50:20 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-135B0027-2350-489E-9703-13FB89171929 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Mon, 29 Jul 2019 08:50:19 -0400 Cc: Paul Wouters , ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: <0EEEDCC2-A5AC-4E47-B34A-0AE53067E3BD@fugue.com> References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> To: Jim Reid Archived-At: Subject: Re: [Add] DNS service provision and the concept of trust X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 12:50:24 -0000 --Apple-Mail-135B0027-2350-489E-9703-13FB89171929 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On Jul 29, 2019, at 8:37 AM, Jim Reid wrote: >=20 > Can the end user be sure their DoH queries go to their =E2=80=9Ctrustworth= y=E2=80=9D DoH provider-du-jour? If PKI is working, yes. If not, this is the least of your problems. Regardin= g me having a trust relationship with the coffee shop, there are two problem= s.=20 First, the coffee shop case is explicitly where you are using a free service= . If you have a trust relationship with them, they are an ISP, despite that t= hey serve coffee.=20 Secondly, the benefit of DoH is that you have just one trust relationship to= reason about, rather than n. So even if your coffee shop is an ISP, you=E2=80= =99re still better off with DoH, unless you can=E2=80=99t find a trustworthy= DoH provider. For the case where the user is choosing DoH, it=E2=80=99s hard to come up wi= th a case where they=E2=80=99d be better off not choosing it, except for ser= vices where they will get a better CDN answer from the ISP resolver. So if we are trying to solve a real problem here, that is the problem. Do you disagree?= --Apple-Mail-135B0027-2350-489E-9703-13FB89171929 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable On Jul 29, 2019, at 8:37 AM, Jim Reid <<= a href=3D"mailto:jim@rfc1035.com">jim@rfc1035.com> wrote:

    Can the end us= er be sure their DoH queries go to their =E2=80=9Ctrustworthy=E2=80=9D DoH p= rovider-du-jour?

    If PKI is working, yes. If not, t= his is the least of your problems. Regarding me having a trust relationship w= ith the coffee shop, there are two problems. 

    = First, the coffee shop case is explicitly where you are using a free service= . If you have a trust relationship with them, they are an ISP, despite that t= hey serve coffee. 

    Secondly, the benefit of Do= H is that you have just one trust relationship to reason about, rather than <= i>n. So even if your coffee shop is an ISP, you=E2=80=99re still be= tter off with DoH, unless you can=E2=80=99t find a trustworthy DoH provider.=

    For the case where the user is choosing&nbs= p;DoH, it=E2=80=99s hard to come up with a case where they=E2=80=99d be bett= er off not choosing it, except for services where they will get a better CDN= answer from the ISP resolver.

    So if we are trying t= o solve a real problem here, that is the problem.

    Do you disagree?
    = --Apple-Mail-135B0027-2350-489E-9703-13FB89171929-- From nobody Mon Jul 29 05:52:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FA09120142 for ; Mon, 29 Jul 2019 05:52:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Uzn_jljTTZeZ for ; Mon, 29 Jul 2019 05:52:40 -0700 (PDT) Received: from mail.amsl.com (c8a.amsl.com [4.31.198.40]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B98311200F8 for ; Mon, 29 Jul 2019 05:52:40 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by c8a.amsl.com (Postfix) with ESMTP id 352811C139D; Mon, 29 Jul 2019 05:52:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from c8a.amsl.com ([127.0.0.1]) by localhost (c8a.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J2aLwYQdnnjE; Mon, 29 Jul 2019 05:52:17 -0700 (PDT) Received: from www.amsl.com (localhost [127.0.0.1]) by c8a.amsl.com (Postfix) with ESMTP id C26401C139B; Mon, 29 Jul 2019 05:52:16 -0700 (PDT) Received: from 87.113.237.133 (SquirrelMail authenticated user rfcpise) by www.amsl.com with HTTP; Mon, 29 Jul 2019 05:52:17 -0700 Message-ID: <6f632971c9aacb0e3b1f0cfec80f53c1.squirrel@www.amsl.com> In-Reply-To: <0E2E850A-61E2-411C-A35A-2BDFF3C86D57@nohats.ca> References: <27369.1564183623@dooku.sandelman.ca> <7cfa79af-3130-2c64-f8fd-f2ce7b9be585@uniregistry.com> <0E2E850A-61E2-411C-A35A-2BDFF3C86D57@nohats.ca> Date: Mon, 29 Jul 2019 05:52:17 -0700 From: "RFC ISE (Adrian Farrel)" To: "Paul Wouters" Cc: "Tony Finch" , rfc-ise@rfc-editor.org, "Patrick Mevzek" , "Michael Richardson" , add@ietf.org Reply-To: rfc-ise@rfc-editor.org User-Agent: SquirrelMail/1.4.21 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 12:52:42 -0000 I think Paul is talking about draft-vixie-dnsop-dns-rpz My understanding of the status of this draft is that it is with the authors pending updates from quite a few reviews. Once adequately updated it will be ready for publication, but I can't give you a time frame for that. Thanks, Adrian -- Adrian Farrel (ISE), rfc-ise@rfc-editor.org Paul Wouters wrote: > >> On Jul 29, 2019, at 06:59, Tony Finch wrote: >> >>> 4.6.1. NXDOMAIN Extended DNS Error Code 2 - Censored >> >> In a lot of cases this will not be as useful as you might hope. It's >> common for RPZ deployments to redirect malware domains to an >> informative web server rather than return NXDOMAIN. > > I have already proposed a fix for rpz years ago that moves the > censored answer to the additional section so that "dumb clients" are > protected and "smart clients" can do the dnssec validation of the > censorship (and possibly override). > > I've completed a review of the current rpz for the ISE in the hopes > that the current rpz document will be published as RFC, so we can > start the bis document with this feature ASAP. > > Paul From nobody Mon Jul 29 06:08:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E1231200F8 for ; Mon, 29 Jul 2019 06:08:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GmPkCuhS3bYj for ; Mon, 29 Jul 2019 06:08:20 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31C111200E7 for ; Mon, 29 Jul 2019 06:08:20 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id F2510242109D; Mon, 29 Jul 2019 13:08:15 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <0EEEDCC2-A5AC-4E47-B34A-0AE53067E3BD@fugue.com> Date: Mon, 29 Jul 2019 14:08:15 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <0EEEDCC2-A5AC-4E47-B34A-0AE53067E3BD@fugue.com> To: Ted Lemon X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] DNS service provision and the concept of trust X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 13:08:21 -0000 > On 29 Jul 2019, at 13:50, Ted Lemon wrote: >=20 > For the case where the user is choosing DoH, it=E2=80=99s hard to come = up with a case where they=E2=80=99d be better off not choosing it, = except for services where they will get a better CDN answer from the ISP = resolver. >=20 > So if we are trying to solve a real problem here, that is the problem. It=E2=80=99s one of the problems Ted, not *the* problem. There are = others. > Do you disagree? Yes. You=E2=80=99ve outlined one problem. It=E2=80=99s not the only one. = Do you agree? From nobody Mon Jul 29 06:34:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B60512013C for ; Mon, 29 Jul 2019 06:34:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0n0DjsuXUYuO for ; Mon, 29 Jul 2019 06:34:10 -0700 (PDT) Received: from mail-qk1-x731.google.com (mail-qk1-x731.google.com [IPv6:2607:f8b0:4864:20::731]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0EDCC120124 for ; Mon, 29 Jul 2019 06:34:10 -0700 (PDT) Received: by mail-qk1-x731.google.com with SMTP id t8so44111749qkt.1 for ; Mon, 29 Jul 2019 06:34:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=lAqpTVcLrg+cFwGDyiNe326EWgwLhHBMx969fWS3Hys=; b=el7VjxlQmOZjklLJXQ/Tir6Pyyzrj3MCSW2/VhZq9hAAe9dV7ZhlND3SRWcnafvIi7 q1//5qVE5X+AJqUNmj1lQ3+2lg+b7bhO4Vvg2gkswcLdeybENs1WTO8KCT38nVhRbUwz YoATbpydW5BJGMAZc4JHfZrU2Nix5q0N6/y8QbLbAX/kN1fzG7tsBB4HPL+xPq3XvQP7 D3al9EA89XyefPVZt6MAaOp01YeQMJ7QajXkXa7JFFb8p3R5zHCtQCGvWnmkg/naReTR qeuZf3v/uz0cojorMC/SNkZuuGO+X7/7tBNzFztJaDIOF2l49KQMIbU0kgaXwjBd2dwb LFwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=lAqpTVcLrg+cFwGDyiNe326EWgwLhHBMx969fWS3Hys=; b=dAm51caA0JJ8TUxN0uMiZSMz6+R+r0/7v3lC/LJgBaJig3ZUdd6+9r3pTvXRxZ12q0 Q8NrfhRPBnOZfjKWu9tonWNwDknHxRRTsG2dTfXmVjqe0qSd1Gi/hvO59/5Y4LCHgB19 n34UaVkw1FxRxAkq6MxncAJh3SdzuvSplN5aoWRAS9Ny9BEo5WqhotLWCUAepL8w1Tx/ 9qlUzqKmM/Fa8GV2GHO1VuySPOIha8/qDusD42s4mmW/V7KJTBmhEw5NsKApBrrCbTnM fExaLzFueQC1UbexR3fyKO02NP1aBBEANgoH+lRVmpTKXU7I/eRmtMGCJFbRUSVcbuX5 Ho0Q== X-Gm-Message-State: APjAAAXJUXxMhsk6JpX2enFlFrXjO1fN75V4JvNmuuzNvXL3lZiayRTJ o8f/nP6KRw0JxgL0S5uRqhA7AA== X-Google-Smtp-Source: APXvYqxp3+h0JqtaLdsG9Nc5t6hIsuk9jTVahPYt05hzezLLj3jDdEtXgTVULZISs04Gr6gK6Ni+fg== X-Received: by 2002:a05:620a:142b:: with SMTP id k11mr58335465qkj.0.1564407249042; Mon, 29 Jul 2019 06:34:09 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:c0dc:a9fc:92f6:6e37? ([2001:470:c1a2:1:c0dc:a9fc:92f6:6e37]) by smtp.gmail.com with ESMTPSA id 131sm27788739qkn.7.2019.07.29.06.34.07 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 29 Jul 2019 06:34:08 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_5309C5BC-D888-4CAA-A912-A6CBEB90F261" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Mon, 29 Jul 2019 09:34:05 -0400 In-Reply-To: Cc: ADD Mailing list To: Jim Reid References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <0EEEDCC2-A5AC-4E47-B34A-0AE53067E3BD@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] DNS service provision and the concept of trust X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 13:34:13 -0000 --Apple-Mail=_5309C5BC-D888-4CAA-A912-A6CBEB90F261 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 29, 2019, at 9:08 AM, Jim Reid wrote: > It=E2=80=99s one of the problems Ted, not *the* problem. There are = others. >=20 >> Do you disagree? >=20 > Yes. You=E2=80=99ve outlined one problem. It=E2=80=99s not the only = one. Do you agree? Jim, you came up with a bunch of problems in the message I replied to, = but as far as I could tell none of them were IETF problems. The reason = I=E2=80=99m probing you about this is actually to see if you can surface = another problem and express it in a way that=E2=80=99s clear and not = obviously something we can=E2=80=99t do anything about. When I read your message and responded to it, it seemed to be talking = about something that is a problem for the ISP, not the user, and that is = a problem because it=E2=80=99s hard on the ISP=E2=80=99s business model, = not because it=E2=80=99s hard on the ISP=E2=80=99s infrastructure. It may be that there is some additional problem that is actually a = problem for the ISP=E2=80=99s ops staff, but if there is, I do not know = what the problem is. E.g., you could say that there is a problem in that the ISP can=E2=80=99t = prevent me from using a resolver that doesn=E2=80=99t protect me from = malware. If you think that is a problem, I guess I could agree with you = in theory that it is a problem. The sense in which this is a problem = for the user is that the user isn=E2=80=99t protected against malware, = but AFAIK all of the available options do provide protection against = malware. The solution to this problem is part of the trust choice the = user is making. It=E2=80=99s a problem for the ISP only if the user is a = malefactor=E2=80=94e.g., a piece of malware, not a person. But = that=E2=80=99s not a problem we can solve, because the malware is going = to do what it=E2=80=99s going to do, and not follow the IETF=E2=80=99s = advice. If the malware uses e.g. Cloudflare, this is actually a win = for us, because now Cloudflare has intelligence about the malware it = didn=E2=80=99t have before, and an opportunity to block the queries it = sends to discover its controller. We could also say that it=E2=80=99s a problem that the Cloudflare gets = to have this information, and that reduces the ISP=E2=80=99s ability to = collect the same information. I=E2=80=99d agree with this, except that = (a) again, we don=E2=80=99t have any control over the malware, and (b) = it=E2=80=99s a business problem, not a technical problem. The IETF = shouldn=E2=80=99t be trying to help the ISP to prevent Cloudflare from = getting this information. So if this is a problem, I don=E2=80=99t see = how it=E2=80=99s an IETF problem. So this is what I mean when I say that the only problem I can see here = for the IETF to solve is the CDN problem. --Apple-Mail=_5309C5BC-D888-4CAA-A912-A6CBEB90F261 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 29, 2019, at 9:08 AM, Jim Reid <jim@rfc1035.com> wrote:
    It=E2=80=99s one of the problems Ted, not *the* problem. = There are others.

    Do you disagree?

    Yes. You=E2=80=99ve outlined one problem. It=E2=80=99s not = the only one. Do you agree?

    Jim, you came up with a bunch of problems in = the message I replied to, but as far as I could tell none of them were = IETF problems.  The reason I=E2=80=99m probing you about this is = actually to see if you can surface another problem and express it in a = way that=E2=80=99s clear and not obviously something we can=E2=80=99t do = anything about.

    When I read your message and responded to it, it seemed to be = talking about something that is a problem for the ISP, = not the user, and that is a problem because it=E2=80=99s hard on the = ISP=E2=80=99s business model, not because it=E2=80=99s hard on the = ISP=E2=80=99s infrastructure.

    It may be that there is some additional = problem that is actually a problem for the ISP=E2=80=99s ops staff, but = if there is, I do not know what the problem is.

    E.g., you could say that there is a = problem in that the ISP can=E2=80=99t prevent me from using a resolver = that doesn=E2=80=99t protect me from malware.  If you think that is = a problem, I guess I could agree with you in theory that it is a = problem.   The sense in which this is a problem for the user is = that the user isn=E2=80=99t protected against malware, but AFAIK all of = the available options do provide protection = against malware.   The solution to this problem is part of the = trust choice the user is making.

    It=E2=80=99s a problem for the ISP only = if the user is a malefactor=E2=80=94e.g., a piece of malware, not a = person.   But that=E2=80=99s not a problem we can solve, because = the malware is going to do what it=E2=80=99s going to do, and not follow = the IETF=E2=80=99s advice.   If the malware uses e.g. Cloudflare, = this is actually a win for us, because now Cloudflare has intelligence = about the malware it didn=E2=80=99t have before, and an opportunity to = block the queries it sends to discover its controller.

    We could also say that = it=E2=80=99s a problem that the Cloudflare gets to have this = information, and that reduces the ISP=E2=80=99s ability to collect the = same information.   I=E2=80=99d agree with this, except that (a) = again, we don=E2=80=99t have any control over the malware, and (b) = it=E2=80=99s a business problem, not a technical problem.  The IETF = shouldn=E2=80=99t be trying to help the ISP to prevent Cloudflare from = getting this information.   So if this is a problem, I don=E2=80=99t = see how it=E2=80=99s an IETF problem.

    So this is what I mean = when I say that the only problem I can see here for the IETF to solve is = the CDN problem.

    = --Apple-Mail=_5309C5BC-D888-4CAA-A912-A6CBEB90F261-- From nobody Mon Jul 29 06:48:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADB40120104 for ; Mon, 29 Jul 2019 06:48:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nFidgOR_Xkjz for ; Mon, 29 Jul 2019 06:48:16 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A4B01200E7 for ; Mon, 29 Jul 2019 06:48:16 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45y1H14xpzzF6T; Mon, 29 Jul 2019 15:48:13 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1564408093; bh=84ocxjnlx4EA/IEyheq62/FszpNq37D07mQ1TLiMZgI=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=sud8eO08YPUqExbrd1V9z7otAeBnjXvWlMDKZCb+ucS+Y9fsNrFGf3XP41T6wX8b1 gk+J3mWZfJXMhI90JNXwzw4IJstSHgV/f3THgzT2oQG2hopfribxFpAueu0ouMBgVi 8U9CNNNi+pjBCFyf9pII1VpuDNkBS5ujATAVrTl4= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id h3-xbyWsUyxj; Mon, 29 Jul 2019 15:48:11 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Mon, 29 Jul 2019 15:48:10 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 3908F394974; Mon, 29 Jul 2019 09:48:09 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 3908F394974 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 3026540A6FFB; Mon, 29 Jul 2019 09:48:09 -0400 (EDT) Date: Mon, 29 Jul 2019 09:48:09 -0400 (EDT) From: Paul Wouters To: Jim Reid cc: ADD Mailing list In-Reply-To: Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT Archived-At: Subject: Re: [Add] DNS service provision and the concept of trust X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 13:48:19 -0000 On Mon, 29 Jul 2019, Jim Reid wrote: >> My point was that most users trust the quad servers more than a random coffee shop because they don’t even know the coffee shop operator whereas the quads have at least some reputation and therefor presumably are more trustworthy than a completely unknown entity. > > Paul, there’s a lot more to this notion of trust. It’s not as simple as you suggest. Suppose this hypothetical coffee shop is shoving all outbound HTTPS through some web proxy. Can the end user be sure their DoH queries go to their “trustworthy” DoH provider-du-jour? The expectation is that after hotspot authentication, those networks just route my (https) packets without MITM it based on content. Your hypothethical proxy would need to pass gmail traffic without knowing the contents too - why would DoH to google be different? But your question is really moot - the coffeeshop network shouldnt require any of my trust. not for https or anything else. > However another aspect of trust comes from contractual relationships. The notion of least surprise also applies. I pay my ISP or coffee shop for Internet service and one of those services is DNS resolution. [OK, it’s buried deep in the T&C’s nobody reads.] I trust (handwave!) my provider to supply that service. That implicit trust relationship gets ripped up when some browser or web-based app uses its own DoH resolver. Which might or might not be the same as my provider's/coffee shop’s resolver or the one I hard-wired into my device. Singling out DNS from other packets in this "(free) service" to which I signed up for (un)willingly makes no sense. Sure, any of the 80+ ToS conditions can be reasonable or unreasonable. You claiming I might bypass some condition saying "We inspect/filter all DNS" is just proof putting those conditions there are unreasonable and wouldn't hold muster in a reasonable (EU) court. But regardless, contractual issues are not within the expertise of the IETF. Whether or not some govermental or commercial entity "bans" DoH is only relevant to those applications depending on it and doing some reconfiguration with or without prompting the user about the dangers. > Oh, and can you trust DoH providers to never, ever change their privacy policies or have data breaches? The IETF does not evaluate the security of peers on the internet. However, personally, I would trust the quads' security and privacy policies over any local unknown hotspot network I randmonly connect to - indepedent on the quality of their flat whites. > And FWIW, the quad N services may well be great. They’re run by fine people who I like and respect. But unless I can audit/inspect their infrastructure, they’re just as much of an unknown entity as the local coffee shop. Again, not in the realm of IETF decisions. But you can make a few assumptions. The quads run DNS as part of the core business. I would not trust them for either good quality flat whites or ethnical or organically farmed beans. Just as I don't expect the coffeeshop to have a good security and privacy policy and ongoing maintance of their wifi/router/DNS infrastructure. >> I’m not a fan of the centralization. I am a fan of removing blind trust on unknown parties. > > How does that work for the 99.99% of the planet who can’t even spell DNS Perhaps this is an engineering question to be solved by good implementations of IETF DNS protocols. >> What we need is a decentralized quad X provider. > > Only one? Maybe more than one would be good. A million+ of them, not so good :) Paul From nobody Mon Jul 29 06:57:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F00D7120124 for ; Mon, 29 Jul 2019 06:57:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vBbgTBLGIILA for ; Mon, 29 Jul 2019 06:57:05 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DFB81200E7 for ; Mon, 29 Jul 2019 06:57:05 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id B0ED8242109D; Mon, 29 Jul 2019 13:57:02 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Mon, 29 Jul 2019 14:57:02 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <3F946D85-E82B-4C45-AF01-2370268593D3@rfc1035.com> References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <0EEEDCC2-A5AC-4E47-B34A-0AE53067E3BD@fugue.com> To: Ted Lemon X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] DNS service provision and the concept of trust X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 13:57:07 -0000 > On 29 Jul 2019, at 14:34, Ted Lemon wrote: >=20 > Jim, you came up with a bunch of problems in the message I replied to, = but as far as I could tell none of them were IETF problems. The reason = I=E2=80=99m probing you about this is actually to see if you can surface = another problem and express it in a way that=E2=80=99s clear and not = obviously something we can=E2=80=99t do anything about. Ted, we=E2=80=99re talking at cross-purposes and this confusion would = best be resolved over beer. My initial point was that the issues of trust are far more complex than = Paul was suggesting. These are probably out of scope for the IETF. = Though I think the operational implications of these trust = considerations are or could be a matter for the IETF. > When I read your message and responded to it, it seemed to be talking = about something that is a problem for the ISP, not the user, No. Those problems apply to both the end user and the provider. Consider = what can happen when the end user chooses a DNS resolver (or has one = forced on them) that isn=E2=80=99t the one on offer from their ISP or = coffee shop. That third party won't be getting the support calls or = complaints when the end user has a problem - the user's (contracted) = provider will. That=E2=80=99s a problem for both the end user and their = ISP. FWIW I face these all the time because I have to switch off my = laptop=E2=80=99s validating resolver to get past the captive portal at = $coffeeshop or whatever. In a sense, I was/am violating their trust = model and therefore have to pay the penalty. > and that is a problem because it=E2=80=99s hard on the ISP=E2=80=99s = business model, not because it=E2=80=99s hard on the ISP=E2=80=99s = infrastructure. I wasn=E2=80=99t considering ISP business models at all -- just the = implied or explicit trust relationships. From nobody Mon Jul 29 08:15:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79EA2120127 for ; Mon, 29 Jul 2019 08:15:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wN-jaO0gUaau for ; Mon, 29 Jul 2019 08:15:39 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E00E12010D for ; Mon, 29 Jul 2019 08:15:39 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id AC2EB3740099; Mon, 29 Jul 2019 08:15:38 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id 7DFCF15DA2E3; Mon, 29 Jul 2019 09:15:38 -0600 (MDT) Received: from fafnir.remote.dragon.net (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 7D54815DA2E2; Mon, 29 Jul 2019 09:15:38 -0600 (MDT) From: Paul Ebersman To: Paul Wouters Cc: add@ietf.org In-reply-to: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> Comments: In-reply-to Paul Wouters message dated "Mon, 29 Jul 2019 07:29:57 -0400." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <36676.1564413338.1@fafnir.remote.dragon.net> Date: Mon, 29 Jul 2019 09:15:38 -0600 Message-Id: <20190729151538.7DFCF15DA2E3@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 15:15:41 -0000 pwouters> What we need is a decentralized quad X provider. Nice idea but highly unlikely we'll get better than quad9. (Note I'm not saying they're perfect but they're as close as we'll see to not having a hidden agenda). The logistics, hassle, cost, etc. of getting enough anycast nodes installed, the peering or transit agreements to get on the net and get the anycast announcements propogated and the staff to keep such an infrastructure running are all prohibitive for most of the world. And then you have the problem of who could afford to do that at no charge that we'd all "trust". If you're not doing that, we're back to "run your own resolver". From nobody Mon Jul 29 08:23:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68BE712019F for ; Mon, 29 Jul 2019 08:23:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yy4sLUOCwFBZ for ; Mon, 29 Jul 2019 08:23:18 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100041.outbound.protection.outlook.com [40.107.10.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C2A4A1201CF for ; Mon, 29 Jul 2019 08:23:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UOq/bIv4L9eWmXeH2Cw5LMbRfuA41ILgCtgEHqMkCIj1uW0c74NqilDVIafIz5XyJS0gzws5Z5ZN6EUrDK9jdLk0PaAJQGOTNgsq2Ve75SgJFkVXB7hLPcnD5Jd4ZkAe6aUA4/Eoc2hARbpb4xLfDzNdcubM3Y7Vx3CqhNyHiCowCQA2cL+ME7x8TX19s9AMMmEjAkzVnGlq06STEtspFea5KzXCLapEGouqPnFWR7WEsedONkzjH1LdHVv5/NU1xX6ilb+l12NRaw6rGc9gLS4Ha6JM+U/CPm0VS8KJ4xKiCi136gNV525P6wO+rbfs+WvRCOh/hk0MUOPKlrstfw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=D6LudG2zxGAAAKvPPJ+vNVqFIju1+CZxpTSENrep7VM=; b=luPdnkFUkVyokKqlN6ysaRaCpnqieRWRXIUrXdqc3p3zzkeaYf0m2uPQD9H+Fcxt6uORBnU2MED+twfBVDGC7cTSzhC7kH9rm57Tg9628OArRyq+wv063ITSWk7CD+rHx43am48wXUCbPpPt3ztuDvSC+Iv1MIklC683K05MqQclKlaSqeDtSLUxyVL3oKG0NyLLx7be3ExyU/Yyg+xOlP0N4PQQ0xZ0w3tJ2ULMeIlXVTI3nLhI068CDGto/DpUBoSQvt2aWo1tUHHXVvnP7nTcb2BN/4kt+hFkR/BaiGXlcjMQDa7dStEGtOWBSzwCZmatdUwbe5NLw00S82awNw== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=D6LudG2zxGAAAKvPPJ+vNVqFIju1+CZxpTSENrep7VM=; b=lzKUn8nj9tAxXAK5hz4pRed7NTg8jxccEZQMLkwDxuxJPYPOkn/gHF/KVSr1FdBoxkJRFlaWdfJkFxHx+iYAloTC7YD9919PELm4g/q+lsHEYdQ2oS/a3uHTFBxOVZhippoYaCqBO1LaQFgKj3/svzfb+ThWZEzbxti0Sl8h3GA= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1296.GBRP265.PROD.OUTLOOK.COM (20.176.143.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.15; Mon, 29 Jul 2019 15:23:05 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2115.005; Mon, 29 Jul 2019 15:23:05 +0000 From: Andrew Campling To: Paul Wouters CC: Eric Rescorla , =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , ADD Mailing list , "Deen, Glenn" , Christian Huitema , Stephen Farrell , =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRgp1MO+qM2WT5EmEKYuoHiytFKbhs+NA Date: Mon, 29 Jul 2019 15:23:05 +0000 Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [213.205.240.156] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: dee86706-e9cf-4398-bdc3-08d71438a790 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(7168020)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1296; x-ms-traffictypediagnostic: LO2P265MB1296: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 01136D2D90 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(376002)(34096005)(366004)(396003)(136003)(39830400003)(189003)(199004)(52536014)(9686003)(6916009)(229853002)(5660300002)(54906003)(66066001)(66556008)(8936002)(66476007)(81156014)(81166006)(25786009)(8676002)(76116006)(66446008)(64756008)(55016002)(68736007)(14454004)(305945005)(74316002)(6116002)(3846002)(476003)(6436002)(508600001)(53936002)(446003)(11346002)(44832011)(66946007)(486006)(99286004)(33656002)(6246003)(86362001)(6506007)(76176011)(2906002)(53546011)(55236004)(102836004)(186003)(256004)(71200400001)(71190400001)(7696005)(4326008)(26005)(7736002)(316002)(46492003)(148743002); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1296; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: mXFFqcoYsoorwMdEwqfZWQDvJcdaBKvViJUT+rRW6blZ0cTnWGVGrLcsUtjFajWR8tPvMUGaECmgYBK+k83IZF27UYG5g8gaDLnUTUNp4VVVLyzcRvYbdNIX1GbHhkFN0PM77KI+RJLJh8YL8UfulsM/1y4lt0TcbQry4Q1NHX1hcLU6apfCjhAJ+wKlEEoknRWI1AIR9jUlVUDXAFGAnqa09Vbr4bfBhvd5q+iXCg0dqQh0FaYfi+kSV4FOrPdOj8HUOmr4RSjL9gS0Qtfb5abicHkrhVsnvUyZ+9fIQsnnXJ/0/E9hDjWRPmMpllD+ZKBqhugGRD5XA1aUytjRq07nXJ4Y9xpahc+iYlhweZ1WFYHtGOXjf+8Hny35THDwO1Sx0EHH5Jz4MVIvYHmmFcOwjz0cdcUDk5sPUS/hLdw= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: dee86706-e9cf-4398-bdc3-08d71438a790 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Jul 2019 15:23:05.7170 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1296 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 15:23:20 -0000 PiBPbiBKdWwgMjgsIDIwMTksIGF0IDEyOjMwLCBQYXVsIFdvdXRlcnMgPHBhdWxAbm9oYXRzLmNh PiB3cm90ZToNCj4gTXkgcG9pbnQgd2FzIHRoYXQgbW9zdCB1c2VycyB0cnVzdCB0aGUgcXVhZCBz ZXJ2ZXJzIG1vcmUgdGhhbiBhIHJhbmRvbSBjb2ZmZWUgc2hvcCBiZWNhdXNlIHRoZXkgZG9u4oCZ dCBldmVuIGtub3cgdGhlIGNvZmZlZSBzaG9wIG9wZXJhdG9yIHdoZXJlYXMgdGhlIHF1YWRzIGhh dmUgYXQgbGVhc3Qgc29tZSByZXB1dGF0aW9uIGFuZCB0aGVyZWZvciBwcmVzdW1hYmx5IGFyZSBt b3JlICB0cnVzdHdvcnRoeSB0aGFuIGEgY29tcGxldGVseSB1bmtub3duIGVudGl0eS4NCg0KSSB0 aGluayB0aGlzIGFzc2VydGlvbiBpcyBxdWVzdGlvbmFibGUsIG5vdCBsZWFzdCBvZiB3aGljaCBi ZWNhdXNlIG1vc3QgdXNlcnMgaGF2ZSBub3QgaGVhcmQgb2YgRE5TIGxldCBhbG9uZSBEb0gsIGFu ZCBjZXJ0YWlubHkgZG9uJ3QgdW5kZXJzdGFuZCBlaXRoZXIuICBHaXZlbiB0aGUgdmFyaW91cyBw cml2YWN5IGlzc3VlcyB0aGF0IGhhdmUgdW5mb3J0dW5hdGVseSBlbWJyb2lsZWQgdGhlIHRlY2gg c2VjdG9yIG9mIGxhdGUsIHlvdSBtaWdodCBiZSBzdXJwcmlzZWQgdG8gZmluZCByYXRoZXIgbW9y ZSB0cnVzdCBpbiB0aGVpciBmYXZvdXJpdGUgY29mZmVlIHNob3AgdGhhbiBpbiBhIHRlY2ggY29t cGFueSB0aGF0LCBpbiBzb21lIGNhc2VzLCB0aGV5J3ZlIG5ldmVyIGhlYXJkIG9mIGJlZm9yZS4g IA0KDQoNCk9uIGEgbW9yZSBnZW5lcmFsIHBvaW50LCB3aGF0IGlzIHRoZSBiYWxhbmNlIG9mIERO UyB0cmFmZmljIGJldHdlZW4gSVNQcyBhbmQgYWx0ZXJuYXRlIHJlc29sdmVycz8gIFdoaWxzdCBJ IGRvbid0IGNsYWltIGZhbWlsaWFyaXR5IHdpdGggdGhlIFVTIG1hcmtldCwgSSBrbm93IHRoYXQg bGFyZ2UgSVNQcyBpbiB0aGUgVUsgdHlwaWNhbGx5IHJlc29sdmUgYXJvdW5kIDkwJSBvZiB0cmFm ZmljLCB1bmRlcmxpbmluZyB0aGUgZmFjdCB0aGF0IG5vbi1JU1AgRE5TIHJlc29sdXRpb24gaXMg dmVyeSBtdWNoIGFuIGVkZ2UgY2FzZSBhdCBwcmVzZW50LiAgSW4gb3RoZXIgd29yZHMsIEkgdXJn ZSBwZW9wbGUgdG8gcmVtZW1iZXIgdGhhdCB3aGF0IHlvdSBhcmUgZG9pbmcgd2lsbCBmdW5kYW1l bnRhbGx5IGNoYW5nZSBhcnJhbmdlbWVudHMgZm9yIHRoZSBtYWpvcml0eSBvZiByZWFsIHVzZXJz LCBpbiB3YXlzIHRoYXQgdGhleSBkb24ndCB1bmRlcnN0YW5kIGFuZCB0aGF0IG1heSB1bmRlcm1p bmUgdGhvc2UgY3VycmVudCBhcnJhbmdlbWVudHMgcmVnYXJkbGVzcyBvZiB0aGVpciB3aXNoZXMu ICANCg0KDQo= From nobody Mon Jul 29 08:39:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C64C01201E2 for ; Mon, 29 Jul 2019 08:39:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7HLegfZatRSC for ; Mon, 29 Jul 2019 08:39:01 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED56E1201E4 for ; Mon, 29 Jul 2019 08:39:00 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45y3kp4RGkzFMZ; Mon, 29 Jul 2019 17:38:58 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1564414738; bh=4R6Yd4w7xNVNd0x2setS0DMz3b1h5Djfo7oBhRQZHq4=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=bqM/y8q63mKYI1LBpTLf0TRtvDkibVPYycD1nwj8iojmWtUxVL9fIZEOgTefnYInb 6XiyjjJXkbL4Eeel7aNb8P5pZCD/GDc5NEU4gILL/8Ahc+SFgubTNK5T0QqIE2p72o u+htxSMjAEfQod4EGK+cDsYRJDLF0kvAdt/EtTzs= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id ByUYKMOTtqbg; Mon, 29 Jul 2019 17:38:57 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Mon, 29 Jul 2019 17:38:56 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 3AE58394974; Mon, 29 Jul 2019 11:38:55 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 3AE58394974 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 306164095AAE; Mon, 29 Jul 2019 11:38:55 -0400 (EDT) Date: Mon, 29 Jul 2019 11:38:55 -0400 (EDT) From: Paul Wouters To: Paul Ebersman cc: add@ietf.org In-Reply-To: <20190729151538.7DFCF15DA2E3@fafnir.remote.dragon.net> Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <20190729151538.7DFCF15DA2E3@fafnir.remote.dragon.net> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 15:39:03 -0000 On Mon, 29 Jul 2019, Paul Ebersman wrote: > If you're not doing that, we're back to "run your own resolver". I was thinking more along the lines of the pool.ntp.org model. You register your node, it gets checked for a while, then it is added to the pool. It is still checked for proper funtioning and if not, removed from the pool again. Obviously, the privacy bits of that model is harder to enforce, but if the pool is large enough, it might not matter as long as the majority of nodes in the pool can be trusted. Paul From nobody Mon Jul 29 08:42:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C92B120124 for ; Mon, 29 Jul 2019 08:42:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s7_v9R0So29D for ; Mon, 29 Jul 2019 08:42:29 -0700 (PDT) Received: from mail-ua1-f52.google.com (mail-ua1-f52.google.com [209.85.222.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D3C6C12012E for ; Mon, 29 Jul 2019 08:42:28 -0700 (PDT) Received: by mail-ua1-f52.google.com with SMTP id a97so24091550uaa.9 for ; Mon, 29 Jul 2019 08:42:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=AdX2lrFcbBx6+wbsMKNgQp8TXgy4Hnr2yPzo+XUJhKM=; b=pMZcdc52TGRwXJE/aYz5q2FHykZiGH77wZL2nfHkLvKTxVgUW3KqoBzV6I+LcJWgbG 5qOf3+nFm2jkS9vrHgVOW7UjtvxIrMvEPA+EDarGsW0TwrQohMNndF+k6ic5f7v027W5 8CRUQSIx9ZnYpXRqkGmxtL2KMVVQqQiXeFKJgPVSf9taYh7kdugFhP0UTr507tUP7SAf g/M/B/OCtVCxEUXeujPrOH/VuPfCppqiLd6CVeDr6DbwvMOYdNyczLkqUg0xZNdrpSPG sw5TNBbKO9/jaVJeWGKmg9b5xq+ohS4EUArDoD9PXS9ug0RPG/E5y8I7BEh9jrVzQZT1 eKUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=AdX2lrFcbBx6+wbsMKNgQp8TXgy4Hnr2yPzo+XUJhKM=; b=WCGcf6nl8lVHd/J7pRpRir8TwD4UsYM6iuYyM7RZl8c4wYobYll4tJKMFKvzZa16Tn +5ROGx7G2UJxQ8DUr3mA6VL6qpGQdd+SxFSLxi8Jvt8lryQm9OanPuv+ZMKuEgoa5UpY an3cQFaMTzxAdiJ74RNFc3PWYjLW9UVal2PxU6MEAG6PZJIQHvkIfom4tU9ZqrFhhmmC e9yaMxd6p4k6eLDsF2qhQK+8kgM7LTLHk46c+nRZukbGEjdo7WdAf6gjxcgvk4zS1ok5 8vPfKIQebL8v+Po9DNlLXo3wJXvF9o2o+Wn+q763tl30f4TBxar02vU7xAYVE5dD43/d UbyQ== X-Gm-Message-State: APjAAAWnnh7UjRRNaUEGhnD8cjWUrAIaJDODqkqhm4+XciAyYEJwjtQu DEnqcqZ+7efFp/+jSYgo5/Ef0Q== X-Google-Smtp-Source: APXvYqym7VkNvyz0qnKM11dkqEqR/LGY09lu9yFAmPsTNXXqCupup6lnGQpBnvG1EJHKgmG9RIpxqg== X-Received: by 2002:ab0:6788:: with SMTP id v8mr22852925uar.48.1564414887790; Mon, 29 Jul 2019 08:41:27 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:c0dc:a9fc:92f6:6e37? ([2001:470:c1a2:1:c0dc:a9fc:92f6:6e37]) by smtp.gmail.com with ESMTPSA id c123sm15499545vkb.23.2019.07.29.08.41.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 29 Jul 2019 08:41:26 -0700 (PDT) From: Ted Lemon Message-Id: <8C86F146-4B1D-4A6C-8BDC-7FAA8011CC3E@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_A91475B3-82DD-4C19-A586-3E469165F8C8" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Mon, 29 Jul 2019 11:41:24 -0400 In-Reply-To: Cc: Paul Wouters , Eric Rescorla , "Deen, Glenn" , =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , ADD Mailing list , Christian Huitema , Stephen Farrell To: Andrew Campling References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 15:42:31 -0000 --Apple-Mail=_A91475B3-82DD-4C19-A586-3E469165F8C8 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 29, 2019, at 11:23 AM, Andrew Campling = wrote: > I think this assertion is questionable, not least of which because = most users have not heard of DNS let alone DoH, and certainly don't = understand either. Given the various privacy issues that have = unfortunately embroiled the tech sector of late, you might be surprised = to find rather more trust in their favourite coffee shop than in a tech = company that, in some cases, they've never heard of before. =20 The way this stuff works out is that users hear about things on the = news, and modify their behavior on that basis. And they read sales = pitches, and modify their behavior on that basis. When a sales pitch = shows up in the news as having been a lie, they again modify their = behavior. So if a DoH provider were to make a promise and then break it, a couple = of things would result. First, it would get out, and people would = modify their behavior. Second, they=E2=80=99d likely face some = consequences for breaking their promise. What about a provider who = doesn=E2=80=99t make the promise in the first place? They would be = called out for it in the press, at least in theory. We don=E2=80=99t really have a say in how this process unfolds. What = we have a say in is whether the underlying technology can support user = choice in this way. It really is user choice, even though the sense in = which users are making informed decisions is different than the way we = do it. --Apple-Mail=_A91475B3-82DD-4C19-A586-3E469165F8C8 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 29, 2019, at 11:23 AM, Andrew Campling <andrew.campling@419.consulting> wrote:
    I think this assertion is questionable, not least of which = because most users have not heard of DNS let alone DoH, and certainly = don't understand either.  Given the various privacy issues that = have unfortunately embroiled the tech sector of late, you might be = surprised to find rather more trust in their favourite coffee shop than = in a tech company that, in some cases, they've never heard of before. =  

    The = way this stuff works out is that users hear about things on the news, = and modify their behavior on that basis.   And they read sales = pitches, and modify their behavior on that basis.   When a sales = pitch shows up in the news as having been a lie, they again modify their = behavior.

    So = if a DoH provider were to make a promise and then break it, a couple of = things would result.   First, it would get out, and people would = modify their behavior.  Second, they=E2=80=99d likely face some = consequences for breaking their promise.   What about a provider = who doesn=E2=80=99t make the promise in the first place?   They = would be called out for it in the press, at least in theory.

    We don=E2=80=99t really = have a say in how this process unfolds.   What we have a say in is = whether the underlying technology can support user choice in this way. =   It really is user choice, even though the sense in which users = are making informed decisions is different than the way we do = it.

    = --Apple-Mail=_A91475B3-82DD-4C19-A586-3E469165F8C8-- From nobody Mon Jul 29 08:42:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FDED120134 for ; Mon, 29 Jul 2019 08:42:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5SfNrmWpWhm2 for ; Mon, 29 Jul 2019 08:42:49 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110056.outbound.protection.outlook.com [40.107.11.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6AAB6120124 for ; Mon, 29 Jul 2019 08:42:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TUa6yERhTuIONMK+pG8hExiBm6uvhERAArVP6VAH0aekvKGU0zR8NesUfAwCF+DWxIY5kWxDNxB2MBJOG+PR7z41Djvuax3ybb3TUpAYALcmduhCovgxUP7McH/1Bi+vD7s32EkRA6GUFJkJnlmDch1+Hzstmf0aoSrLaT8N3QukK1rc+xSydVGkMf1P1aH04NIWr67m3nwwR/TIZ9EzY7d5Goqt54UbhVXxoncrPm9HTgGbIxk63yOzLUlVedm3UnKByn48Y5v1k1GTnBU7+svQfI5ImwyJ9obmT6rCwNb22eLRvPzquKhCltP3EJpNkKz/VbWisLZpwy6dHb4iJg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=c6TZZ02y848PUSXxY6VUDLJoOaXo7GuiuncJvcVxptk=; b=MAB8yogGukCOISu9Yho11yt5pd2lXSs9jy21LcU82Gq3H4KD+EWXJtZlAnjweDwzWQRH8Z3O6OWR3MkFkCOW66nr3Ppzic+Dr5AFlS93VvdF0QWbSMy/EybPPnsE7MxMImMtI6yHDnDZCnOhBdQh5+XfpF7Fh1P4OAa6HIgbPFXpOOyp5iPM0VtRoTuKUvcHpgaCGOwdMTw3EMLl/avlwbO5ysx6IHJAKdg1pAHaNR2w9JdjdOYBJoxfJiJ6LVzCv24HNX2z8mjDFFlQ4n1tAfc+6/wgzTgmvw+ChlMY4+dtT6BQeWxFOS7BZ4u6JXqr3e/ZX47HycEAxUEVD0af+Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=c6TZZ02y848PUSXxY6VUDLJoOaXo7GuiuncJvcVxptk=; b=HIhaaxisrUsefc7bmAlUoHKlAeRzlWoVoFU6yuFCDBUFQinHb8sBLqZLXAPFcm/tmKs91lz5xg6/aPc2gkBl+/OjTd+ur+WikGp3pLMr4XVoXUfV/nPWxCDe3OmMRQOFwJp461EAL8iiqVXfIGd+y89t3le1CQcpZkrR+Tdbp1I= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0383.GBRP265.PROD.OUTLOOK.COM (10.166.100.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.14; Mon, 29 Jul 2019 15:42:46 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2115.005; Mon, 29 Jul 2019 15:42:46 +0000 From: Andrew Campling To: Brian Dickson , Ted Lemon CC: =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Wes Hardaker , ADD Mailing list , Rob Sayre Thread-Topic: [Add] My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVQ8GRumJQFcoKeESpwmFfejvtJabhv2bA Date: Mon, 29 Jul 2019 15:42:46 +0000 Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [213.205.240.156] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ccbd9f11-fe6c-4a82-852d-08d7143b6773 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(7168020)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0383; x-ms-traffictypediagnostic: LO2P265MB0383: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7219; x-forefront-prvs: 01136D2D90 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39830400003)(396003)(376002)(34096005)(366004)(136003)(346002)(199004)(189003)(76176011)(4326008)(14454004)(53936002)(55016002)(44832011)(102836004)(6116002)(3846002)(790700001)(9686003)(54896002)(86362001)(6306002)(508600001)(256004)(14444005)(25786009)(186003)(66066001)(2906002)(8676002)(81166006)(81156014)(476003)(8936002)(486006)(11346002)(446003)(26005)(74316002)(7696005)(33656002)(66556008)(66476007)(64756008)(236005)(6506007)(6436002)(4744005)(66946007)(71190400001)(68736007)(71200400001)(76116006)(66446008)(53546011)(5660300002)(52536014)(7736002)(55236004)(229853002)(110136005)(6246003)(54906003)(99286004)(316002)(46492003)(148743002); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0383; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: wYTCvDeavhSXos3KSvYdpjPrk6Jz4CqdVo92M4gl6AsMNcLUDa47Ti5e4oC2EXQNKdmBSbnMzAdvuF+s04wPenJaKPet+GQ3YEB+LH6+kGsb2c2Y0EKQhdOrWspVp5f71UFhAHUc7X6QIxqmJIrXmOgshsFyC7gypqgQVAIJ8e+/mXuFHVn02KwOLLLQzzkI7NKm5pWotS2lnq9JyCwKG37FSw5VLv/hYcDhJfMVEap/Psn53l68vddzphVK/JRcx+EeFRirN1dMwBZSYU2e3XKod07AyG1tlIHHCkyNq5tKO3IShEwbdzW2SwB28afVCwjf5FmacIsaY8c1Hpx1TuVrVqknYJA+ewOkYlk5KbCrWeKbqCdXfP+GeHDiwIB2GBx6M1yxDBotEhDjiPmkeZ4wUNtdJDE3pVETx2XC4Ks= Content-Type: multipart/alternative; boundary="_000_LO2P265MB13279307DDF36C6CEDCBCDA6C2DD0LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: ccbd9f11-fe6c-4a82-852d-08d7143b6773 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Jul 2019 15:42:46.6984 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0383 Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 15:42:52 -0000 --_000_LO2P265MB13279307DDF36C6CEDCBCDA6C2DD0LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 PiBPbiBGcmksIEp1bCAyNiwgMjAxOSBhdCAxNTo1MSBCcmlhbiBEaWNrc29uIDxicmlhbi5wZXRl ci5kaWNrc29uQGdtYWlsLmNvbT4gd3JvdGU6DQoNCj4+IE9uIEZyaSwgSnVsIDI2LCAyMDE5IGF0 IDc6MTAgQU0gVGVkIExlbW9uIDxtZWxsb25AZnVndWUuY29tPG1haWx0bzptZWxsb25AZnVndWUu Y29tPj4gd3JvdGU6DQo+PiBUaGluayBpdCB0aHJvdWdoLiBEbyB5b3UgcmVhbGx5IHdhbnQgdG8g Z28gdGhlcmU/DQoNCg0KPiBJIGRvbid0IHRoaW5rICJ3YW50IiBlbnRlcnMgaW50byBpdCBwZXIg c2U7IGl0IGlzIGEgcXVlc3Rpb24gb2Ygd2hhdCBpcyByZXF1aXJlZCBpbiBvcmRlciB0byBtYWlu dGFpbiBhbGwgdGhlIGV4aXN0aW5nIGZ1bmN0aW9uYWxpdHkgZm9yIHRoaW5ncyBpbXBsZW1lbnRl ZCBpbiBETlMgdG9kYXksIGFuZCBmb3IgcHJldmVudGluZyB0aGUgcHJvYmxlbXMgY3JlYXRlZCB3 aGVuIGFwcGxpY2F0aW9ucyB1c2UgRG9IIHRvIGJ5cGFzcyBPUy1zZWxlY3RlZCByZXNvbHZlcnMu IFRoZSB2YWx1ZSBvZiAicmVxdWlyZWQiIG1heSBkaWZmZXIgYnkgZW52aXJvbm1lbnQsIGFuZCB0 aGF0IGlzIGEgYmlnIHBhcnQgb2YgdGhlIHByb2JsZW0uIFRoZSBlbnZpcm9ubWVudHMgd2hlcmUg RG9IIGRvZXNuJ3QgY3JlYXRlIHByb2JsZW1zLCBpcyB2ZXJ5IG11Y2ggYSBzdWJzZXQgb2YgZW52 aXJvbm1lbnRzIGludG8gd2hpY2ggRG9IIGFwcGxpY2F0aW9ucyBhcmUgYWxyZWFkeSBkZXBsb3ll ZCAoZXZlbiB3aXRob3V0IGhhdmluZyBEb0ggZW5hYmxlZCkuDQoNCkkgdGhpbmsgYSBrZXkgcXVl c3Rpb24gdG8gYXMgaXMsIGlmIHlvdSBkb27igJl0IGJlbGlldmUgdGhhdCB0aGUgSUVURiBoYXMg YW55IHJlc3BvbnNpYmlsaXR5IHRvIHByb3ZpZGUgZ3VpZGFuY2UgcmVnYXJkaW5nIHRoZSB1c2Ug b2YgcHJvdG9jb2xzIHRoYXQgaXQgaGFzIGludHJvZHVjZWQgb3IgY2hhbmdlcyB0aGF0IGl0IGhh cyBtYWRlLCB3aGljaCBib2R5IG9yIGJvZGllcyBkbyB5b3UgZW52aXNhZ2UgdGFraW5nIHVwIHRo aXMgdGFzaz8NCg0K --_000_LO2P265MB13279307DDF36C6CEDCBCDA6C2DD0LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlz dFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7 bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGNtOw0KCW1hcmdpbi1yaWdodDow Y207DQoJbWFyZ2luLWJvdHRvbTowY207DQoJbWFyZ2luLWxlZnQ6MzYuMHB0Ow0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1h bDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRv Ow0KCW1hcmdpbi1yaWdodDowY207DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFy Z2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29u YWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2lu ZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsN Cgltc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUzt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6 ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9 DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5p dGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjE4NzEwNzg3NTsNCgltc28tbGlzdC10 ZW1wbGF0ZS1pZHM6NjgyNTU1MDY4O30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWIt c3RvcDozNi4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpT eW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDo3Mi4wcHQ7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNv LWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCW1z by1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxldmVsMw0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0K CW1zby1sZXZlbC10YWItc3RvcDoxMDguMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7 DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10 YWItc3RvcDoxNDQuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1p bHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoxODAu MHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTgu MHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyMTYuMHB0Ow0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGww OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyNTIuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsOA0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDoyODguMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJ Zm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWIt c3RvcDozMjQuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6 V2luZ2RpbmdzO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjkyNzAzMjcyODsNCgltc28tbGlz dC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTA5OTQ2NzE0MCAxODAwOTc0 NTIgMTM0ODA3NTU1IDEzNDgwNzU1NyAxMzQ4MDc1NTMgMTM0ODA3NTU1IDEzNDgwNzU1NyAxMzQ4 MDc1NTMgMTM0ODA3NTU1IDEzNDgwNzU1Nzt9DQpAbGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVs LXN0YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5n ZGluZ3M7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250 LWZhbWlseTpDYWxpYnJpO30NCkBsaXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBw dDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTps ZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0K QGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJD b3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7 DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDgNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlz dCBsMTpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5n ZGluZ3M7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTow Y207fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVs dHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0t W2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlk bWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2Vu ZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9ImJsdWUiIHZsaW5rPSJw dXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZndDsgT24gRnJpLCBKdWwgMjYsIDIwMTkgYXQgMTU6NTEgPHNwYW4gbGFuZz0iRU4tVVMiPkJy aWFuIERpY2tzb24gJmx0O2JyaWFuLnBldGVyLmRpY2tzb25AZ21haWwuY29tJmd0Ow0KPC9zcGFu Pndyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQ7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZndDsmZ3Q7IE9uIEZyaSwgSnVsIDI2LCAyMDE5IGF0IDc6MTAgQU0gVGVkIExlbW9uICZs dDs8YSBocmVmPSJtYWlsdG86bWVsbG9uQGZ1Z3VlLmNvbSI+bWVsbG9uQGZ1Z3VlLmNvbTwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBjbSAwY20g MGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowY20iPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7Jmd0OyBUaGluayBpdCB0aHJvdWdoLiBEbyB5 b3UgcmVhbGx5IHdhbnQgdG8gZ28gdGhlcmU/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0 eWxlPSJtYXJnaW4tbGVmdDowY20iPiZndDsgSSBkb24ndCB0aGluayAmcXVvdDt3YW50JnF1b3Q7 IGVudGVycyBpbnRvIGl0IHBlciBzZTsgaXQgaXMgYSBxdWVzdGlvbiBvZiB3aGF0IGlzIHJlcXVp cmVkIGluIG9yZGVyIHRvIG1haW50YWluIGFsbCB0aGUgZXhpc3RpbmcgZnVuY3Rpb25hbGl0eSBm b3IgdGhpbmdzIGltcGxlbWVudGVkIGluIEROUyB0b2RheSwgYW5kIGZvciBwcmV2ZW50aW5nIHRo ZSBwcm9ibGVtcyBjcmVhdGVkDQogd2hlbiBhcHBsaWNhdGlvbnMgdXNlIERvSCB0byBieXBhc3Mg T1Mtc2VsZWN0ZWQgcmVzb2x2ZXJzLiBUaGUgdmFsdWUgb2YgJnF1b3Q7cmVxdWlyZWQmcXVvdDsg bWF5IGRpZmZlciBieSBlbnZpcm9ubWVudCwgYW5kIHRoYXQgaXMgYSBiaWcgcGFydCBvZiB0aGUg cHJvYmxlbS4gVGhlIGVudmlyb25tZW50cyB3aGVyZSBEb0ggZG9lc24ndCBjcmVhdGUgcHJvYmxl bXMsIGlzIHZlcnkgbXVjaCBhIHN1YnNldCBvZiBlbnZpcm9ubWVudHMgaW50byB3aGljaCBEb0gg YXBwbGljYXRpb25zDQogYXJlIGFscmVhZHkgZGVwbG95ZWQgKGV2ZW4gd2l0aG91dCBoYXZpbmcg RG9IIGVuYWJsZWQpLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+SSB0aGluayBhIGtleSBxdWVzdGlvbiB0byBhcyBp cywgaWYgeW91IGRvbuKAmXQgYmVsaWV2ZSB0aGF0IHRoZSBJRVRGIGhhcyBhbnkgcmVzcG9uc2li aWxpdHkgdG8gcHJvdmlkZSBndWlkYW5jZSByZWdhcmRpbmcgdGhlIHVzZSBvZiBwcm90b2NvbHMg dGhhdCBpdCBoYXMgaW50cm9kdWNlZCBvciBjaGFuZ2VzIHRoYXQgaXQgaGFzIG1hZGUsIHdoaWNo IGJvZHkNCiBvciBib2RpZXMgZG8geW91IGVudmlzYWdlIHRha2luZyB1cCB0aGlzIHRhc2s/Jm5i c3A7Jm5ic3A7IDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_LO2P265MB13279307DDF36C6CEDCBCDA6C2DD0LO2P265MB1327GBRP_-- From nobody Mon Jul 29 08:48:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A38DB120089 for ; Mon, 29 Jul 2019 08:48:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PigbT-UAVdXr for ; Mon, 29 Jul 2019 08:48:13 -0700 (PDT) Received: from mail-vs1-xe32.google.com (mail-vs1-xe32.google.com [IPv6:2607:f8b0:4864:20::e32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E283120077 for ; Mon, 29 Jul 2019 08:48:13 -0700 (PDT) Received: by mail-vs1-xe32.google.com with SMTP id u124so41130381vsu.2 for ; Mon, 29 Jul 2019 08:48:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=KenWKLXdbzEns9eijS7McFPdno2qjV6Gqed7KikSWJo=; b=tnEcff0i0AWRfqHREYuFWOMl+9RPQQvVdP5jpt+RX/ih4ioAIIaxa6EPnAMbQi+Eih 0Ine+ETSkxXLIMI6JONl+UXbzE6ZQ2KDsA0F7t3YqZbGsASV6jenARv1a7mb0wXOsL1f Hnx7Udr6t/vnrD3lsmy/keypB/JaC18lXePiw+nqbjmhwL4nv91/ZWZ1uxw03RzHBDgl rZINO1ufoWsEvNqUiSxD7e+Wh3drI1Ica1VwcWyNj7ghzr6n5JgaLeY4qL65wMhQlmQM lZPzfqdxHvv8KKFKoNqBPeFy9Yjk5lJ4+g93yFp/X4pKSfOKVQpubFr4ryppIhHrao5r Vr5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=KenWKLXdbzEns9eijS7McFPdno2qjV6Gqed7KikSWJo=; b=EDXQ4818/pbTHCRTUXZRYzntNEef/UCwU6m7XsE4IgPTD2X5IxBaqXwvf2yu62gCLB PjQGCgu+xHOnZXlu5ea7W5axsMi8OO5P+Z/7HLRZLUR6v8UPqDj4P1bMFvMwtaLICOc3 jN//Dkl417HOKsRYZTn1KSgd+in/iCaPxrl2/R7fSn0dYKv4GS9H1IvLe6QTTa7uL/rq hC6L5GXae0cWMWMxcyk2Mv6nqUw/NWZp0ikwauGH0/nUfiHTKYQrWt8mxtxWOe1hLJVk FOTc2Gbtqtk4ckSEB16cPkC7zDMEFoGqMhO8JGj27z+SZOOMYIRKKyMjtGkHcIclCwbm eYJg== X-Gm-Message-State: APjAAAVc3FZ7dnfOE7TvTSpVopf/Gv0M5AOHOxJFjMO1ps6oUiA9coIG QQz7MzHGy2wrpkVAYWHlpIlsCCCbdOI= X-Google-Smtp-Source: APXvYqx14rec0x404LALcNtmeNT4whr5/aIZjcAgjteUxXMvnwMH7ue0eeIRf4COEjbTFEhS3KNBbQ== X-Received: by 2002:a05:6102:2008:: with SMTP id p8mr69347546vsr.188.1564415292113; Mon, 29 Jul 2019 08:48:12 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:c0dc:a9fc:92f6:6e37? ([2001:470:c1a2:1:c0dc:a9fc:92f6:6e37]) by smtp.gmail.com with ESMTPSA id j80sm10183485vkj.47.2019.07.29.08.48.11 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 29 Jul 2019 08:48:11 -0700 (PDT) From: Ted Lemon Message-Id: <1F642DC4-5B36-4EA3-B748-4EFF4E4DE329@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_4C2AE6F4-E968-412F-976C-C6028081649F" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Mon, 29 Jul 2019 11:48:09 -0400 In-Reply-To: <3F946D85-E82B-4C45-AF01-2370268593D3@rfc1035.com> Cc: ADD Mailing list To: Jim Reid References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <0EEEDCC2-A5AC-4E47-B34A-0AE53067E3BD@fugue.com> <3F946D85-E82B-4C45-AF01-2370268593D3@rfc1035.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] DNS service provision and the concept of trust X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 15:48:16 -0000 --Apple-Mail=_4C2AE6F4-E968-412F-976C-C6028081649F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 29, 2019, at 9:57 AM, Jim Reid wrote: >> When I read your message and responded to it, it seemed to be talking = about something that is a problem for the ISP, not the user, >=20 > No. Those problems apply to both the end user and the provider. = Consider what can happen when the end user chooses a DNS resolver (or = has one forced on them) that isn=E2=80=99t the one on offer from their = ISP or coffee shop. That third party won't be getting the support calls = or complaints when the end user has a problem - the user's (contracted) = provider will. That=E2=80=99s a problem for both the end user and their = ISP. Is it? It sounds like a quality of implementation issue: if I am using = Firefox and it is doing DoH, does it have a choice of resolvers, or only = one? If only one, that=E2=80=99s a poor implementation, which will = indeed fail. Yes, they might call the ISP. But how is that different = than any of the other varied ways that internet services can fail that = might trigger a call to the ISP? I sometimes find that my home router = fails=E2=80=94something goes wrong with DHCP, or DNS, and I=E2=80=99m = offline until I turn it off and then on again. I haven=E2=80=99t ever = called the ISP as a result of this. Is it normal for users to do so? = Don=E2=80=99t ISPs already have a process for dealing with this problem? = Suppose a bad browser DoH implementation fails in the way you = describe. How many calls does the ISP have to receive on it before it = goes into the problem resolution tree and starts showing up in the =E2=80=98= on hold=E2=80=99 information dump? Does the IETF currently provide advice to ISPs on how to deal with = outages of this sort? Should we? Do ISPs need us to? > FWIW I face these all the time because I have to switch off my = laptop=E2=80=99s validating resolver to get past the captive portal at = $coffeeshop or whatever. In a sense, I was/am violating their trust = model and therefore have to pay the penalty. This is a bug in the way your laptop interacts with captive portals. = The IETF has a working group that works on this topic.= --Apple-Mail=_4C2AE6F4-E968-412F-976C-C6028081649F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 29, 2019, at 9:57 AM, Jim Reid <jim@rfc1035.com> wrote:
    When I read your message and = responded to it, it seemed to be talking about something that is a = problem for the ISP, not the user,

    No. Those = problems apply to both the end user and the provider. Consider what can = happen when the end user chooses a DNS resolver (or has one forced on = them) that isn=E2=80=99t the one on offer from their ISP or coffee shop. = That third party won't be getting the support calls or complaints when = the end user has a problem - the user's (contracted) provider will. = That=E2=80=99s a problem for both the end user and their ISP.

    Is it?   It sounds like a quality of = implementation issue: if I am using Firefox and it is doing DoH, does it = have a choice of resolvers, or only one?   If only one, that=E2=80=99= s a poor implementation, which will indeed fail.   Yes, they might = call the ISP.   But how is that different than any of the other = varied ways that internet services can fail that might trigger a call to = the ISP?   I sometimes find that my home router fails=E2=80=94somethi= ng goes wrong with DHCP, or DNS, and I=E2=80=99m offline until I turn it = off and then on again.   I haven=E2=80=99t ever called the ISP as a = result of this.   Is it normal for users to do so?   Don=E2=80=99= t ISPs already have a process for dealing with this problem?   = Suppose a bad browser DoH implementation fails in the way you describe. =   How many calls does the ISP have to receive on it before it goes = into the problem resolution tree and starts showing up in the =E2=80=98on = hold=E2=80=99 information dump?

    Does the = IETF currently provide advice to ISPs on how to deal with outages of = this sort?   Should we?   Do ISPs need us to?

    FWIW I face these all the time because I have to switch off = my laptop=E2=80=99s validating resolver to get past the captive portal = at $coffeeshop or whatever. In a sense, I was/am violating their trust = model and therefore have to pay the = penalty.

    This is a bug in the way your laptop interacts with captive = portals.   The IETF has a working group that works on this = topic.
    = --Apple-Mail=_4C2AE6F4-E968-412F-976C-C6028081649F-- From nobody Mon Jul 29 08:51:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EEC9120077 for ; Mon, 29 Jul 2019 08:51:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KUg2VY8dcwrS for ; Mon, 29 Jul 2019 08:51:09 -0700 (PDT) Received: from mail-vs1-xe2e.google.com (mail-vs1-xe2e.google.com [IPv6:2607:f8b0:4864:20::e2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A4A31120120 for ; Mon, 29 Jul 2019 08:51:09 -0700 (PDT) Received: by mail-vs1-xe2e.google.com with SMTP id 190so41110893vsf.9 for ; Mon, 29 Jul 2019 08:51:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=8Hfd20RGo/RAtuXUgmX/I2AnHqXNE5STdoYF/htft4o=; b=mUVdPTOmwEYqc0bCyN7MKoL3BVyt7g/Gtj99rhpDc0YUmdPeSwE7rB/0A45XtdPu/1 WuPxD8Iknd/GfX4CvskoI4VBSaNzu6hHeX56VYS2Pg/PzgWEdC/JoxRJd0Nu/d41CxTS /71bXrKT5wWjzkh8PgTAz1XeBje4n+GrR+g0KofNiFTagngWVvkx+t+iZJaxMYsbF5FX YTelHvYnRZGJ0T2WOaN7kLv/Ii1RVgTOl2AGglpNqj8D6HH4pUV87hxQbDyM8PyxyidR ZTMj/Wthy3TD/jK3WyECan2C5T5P86naxCLYpkSUVXNTk2KwKRvAuKO0EXjyqHxDlTM6 v1sg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=8Hfd20RGo/RAtuXUgmX/I2AnHqXNE5STdoYF/htft4o=; b=gCOvwFbRCpUnfRiLZQKW719KtZEkcyJnj+f4pF/CxeTcZdlPR1/CgY6rLUrHUJ7/um 10QZAm6ib7O32RXsqWvP8/9ZAMxIk2OYB1v5HCQOS84j/EXoyT+4UKWmPf7miAgW1B8p mmB8kiDcpuxO48+SEwVogAq+clzF2Gld/kS+ANOblRGfRCuTQTmIVm3xQQyaICoeNRJ6 begVQbbMH5gjOFqQVxtaGqNTjmEo+GLGgzRhxWxug/QTqAdfnx7LS6tj7tQeTqZHRCTP xD4qPHfPsLuxm5IQg7ZuRigR2NneRxAwIVwxi0T7EDAvPnWOPeA6qieJPGlTcgK2zdIH 2+mQ== X-Gm-Message-State: APjAAAXse576YUFaYNZTDlMGQEkT5EViHPkfhSIT0Ui6dUGcHjC2NjpO PRTtvroMIErOKKIoazIcsp85BA== X-Google-Smtp-Source: APXvYqyv/MTAHeVp9MmyHkgS46Wiq1w38Gu5oF36rvctT1Fo3WcTQzs1RIZaRqvWtDc/GR3b9zAEtg== X-Received: by 2002:a67:c202:: with SMTP id i2mr71666868vsj.203.1564415468671; Mon, 29 Jul 2019 08:51:08 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:c0dc:a9fc:92f6:6e37? ([2001:470:c1a2:1:c0dc:a9fc:92f6:6e37]) by smtp.gmail.com with ESMTPSA id o123sm12484640vsd.9.2019.07.29.08.51.07 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 29 Jul 2019 08:51:08 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_24B718F8-C4B6-48D1-831F-6095D2880C96" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Mon, 29 Jul 2019 11:51:03 -0400 In-Reply-To: Cc: Brian Dickson , =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Wes Hardaker , ADD Mailing list , Rob Sayre To: Andrew Campling References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 15:51:11 -0000 --Apple-Mail=_24B718F8-C4B6-48D1-831F-6095D2880C96 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 29, 2019, at 11:42 AM, Andrew Campling = wrote: > I think a key question to as is, if you don=E2=80=99t believe that the = IETF has any responsibility to provide guidance regarding the use of = protocols that it has introduced or changes that it has made, which body = or bodies do you envisage taking up this task? =20 I=E2=80=99m still stuck back on the question of what advice the IETF = ought to provide. If there=E2=80=99s advice that you think we are = qualified to provide, what is it? If we provided it, would it be = followed? --Apple-Mail=_24B718F8-C4B6-48D1-831F-6095D2880C96 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 29, 2019, at 11:42 AM, Andrew Campling <andrew.campling@419.consulting> wrote:
    I think a key question to as is, = if you don=E2=80=99t believe that the IETF has any responsibility to = provide guidance regarding the use of protocols that it has introduced = or changes that it has made, which body or bodies do you envisage taking = up this task?  

    I=E2=80=99m still stuck back on the question = of what advice the IETF ought to provide.   If there=E2=80=99s = advice that you think we are qualified to provide, what is it?   If = we provided it, would it be followed?

    = --Apple-Mail=_24B718F8-C4B6-48D1-831F-6095D2880C96-- From nobody Mon Jul 29 08:51:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4222F120124 for ; Mon, 29 Jul 2019 08:51:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4lqUBlKNesup for ; Mon, 29 Jul 2019 08:51:48 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DE05120077 for ; Mon, 29 Jul 2019 08:51:48 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id 25C8E3740099; Mon, 29 Jul 2019 08:51:48 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id EA58815DA847; Mon, 29 Jul 2019 09:51:47 -0600 (MDT) Received: from fafnir.remote.dragon.net (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id E9C8515DA846; Mon, 29 Jul 2019 09:51:47 -0600 (MDT) From: Paul Ebersman To: Paul Wouters cc: add@ietf.org In-reply-to: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <20190729151538.7DFCF15DA2E3@fafnir.remote.dragon.net> Comments: In-reply-to Paul Wouters message dated "Mon, 29 Jul 2019 11:38:55 -0400." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <37559.1564415507.1@fafnir.remote.dragon.net> Date: Mon, 29 Jul 2019 09:51:47 -0600 Message-Id: <20190729155147.EA58815DA847@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 15:51:50 -0000 ebersman> If you're not doing that, we're back to "run your own ebersman> resolver". paul> I was thinking more along the lines of the pool.ntp.org model. NTP isn't nearly as latency sensitive, since it's designed to deal with this and it's not a human waiting for a page load. NTP also deals nicely with having multiple sources, some of which aren't good/accurate and still get to one answer. It would also require changes to client/device OS stacks. There is a reason that there are a very limited number of large open recursive DNS services well anycasted, well distributed and well run. It's not because being centralizes was the primary goal; it's because it's expensive and difficult. Much like email, you can run your own server. But getting trusted IP space, doing SPF/DKIM/DMARC correctly, getting large email services to accept your email, dealing with DDoS, etc are all hard and beyond most users. Most users will take ease over privacy. And the step function to go from easy to privacy is a fairly high technical bar for most users. I think that we're going to keep with this for most of the world: - run your own resolver for a small group of techies - accept your ISP/company resolvers - use a centralized service like the quadX There will probably be a small number will use a DoT/DoH service that isn't run by one of the big RDNS servers. Perhaps we should be talking to device OS vendors like Apple, Microsoft, etc. to put a fully recursive validating resolver built into the OS... From nobody Mon Jul 29 09:04:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C58C412016F for ; Mon, 29 Jul 2019 09:04:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P_ZqYo_w2yUM for ; Mon, 29 Jul 2019 09:04:21 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110066.outbound.protection.outlook.com [40.107.11.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D34AC120134 for ; Mon, 29 Jul 2019 09:04:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OFDR9mlhJRUWDmiL9V2fUPbDD8NOFUReYQueRQEZtlUA4p/j/sqc2i28LCw63pAFzdrHSBHmxnfAtID+y8Gf0FLVgJVyOxvRvcQHcHtTzL0hxAHpFW6wWRuUO/CJhBYo7Ql3cM5rnKcTbt5IAir3QTpey+kJbEq4EKsvm48RxucWWdGmp2MGaY9lS/82j/pkp5clDcvr7jRa4zgxfEwKeNCR8NySVev6NqaOv+FB9VR/kRWrTptfufiO0iH2K9gUcAXW9r8gyTkWxip9N9XoiEabgfLn8ohGw08vRs4jqh2RDc7WajJOqzBkxak2iJ1B/z8SRuf43xLenMrFhL3m4w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SryA38/jD9EHW3yuN9wJvKNGD9gajDgMoxQ22Ef7Goo=; b=nLPbXL6kosETvEoKHb5uGKr542NeolhSz3Uc/mKZ4m+9UTG69vnNLCCNqrP5AEiUKY9RCO6HTzJ5VErYN2MSQP53BZeesLP2AA+pQ2HpnC2Od3FFI4hiJWLkFFjzLyaMcgzDuTLG5AoZmGa9Sap187dKp9eftc+M/nzij3BRv4rKlwrnsUIJhbVthi8t0dhJNnawOewO1GxUmtc8kflvM9SFaAwxbqJ25NHKrxgCdhVWQ5/LmGXJBAa9WvCbD5CV+qCiG3AITGzUNTAwAq5uaDxPZZHyLrr08hgtHrIJRkVKN3E2HsoYy3SiNgsVvSr0Mme4MlVr+MJJpCg/NDKJ/w== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SryA38/jD9EHW3yuN9wJvKNGD9gajDgMoxQ22Ef7Goo=; b=n+WSa5GQS8UutuEBBOH3np9ay/owsps94U0qdVoYhcvIf0fOTLHGZTC8jn9dTyWkBZjmFGGVW4WONbZqs7VAlMC0Z0wboW97MGIhtujAzbt88Oy41FIcWdfngyEnjT+q0erCwwD09/zeEsL0FnQw71XedGOuFPKL5gPa5gOS7Ys= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0111.GBRP265.PROD.OUTLOOK.COM (10.166.102.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.15; Mon, 29 Jul 2019 16:04:18 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2115.005; Mon, 29 Jul 2019 16:04:18 +0000 From: Andrew Campling To: Eric Rescorla CC: Christian Huitema , Stephen Farrell , Paul Wouters , ADD Mailing list , "Deen, Glenn" Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRidGMO+qM2WT5EmEKYuoHiytFA== Date: Mon, 29 Jul 2019 16:04:18 +0000 Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [213.205.240.156] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 7b03fb4b-7442-4079-7022-08d7143e6966 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(7168020)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0111; x-ms-traffictypediagnostic: LO2P265MB0111: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 01136D2D90 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(396003)(346002)(136003)(34096005)(376002)(39830400003)(199004)(189003)(446003)(54906003)(14454004)(508600001)(71200400001)(71190400001)(99286004)(54896002)(6306002)(9686003)(53936002)(236005)(55016002)(7696005)(6246003)(6916009)(4326008)(25786009)(86362001)(7736002)(74316002)(68736007)(44832011)(6116002)(5660300002)(52536014)(11346002)(256004)(316002)(476003)(486006)(76176011)(55236004)(6436002)(81156014)(53546011)(229853002)(33656002)(102836004)(66066001)(26005)(3846002)(186003)(790700001)(66446008)(66556008)(66476007)(76116006)(66946007)(64756008)(8936002)(2906002)(8676002)(81166006)(6506007)(46492003)(148743002); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0111; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: gEnYhoyFvrjFfvkOp3KPsyqk01whUCTv+vciBE2vGjftM1sfnxhvukrUy5X+n2detyNMLQUsCp1Ws/LFOBUI10HaAvLlnVbvp7gU864xgidutYZDCPYfSwjvq1aBsrJuDep/nB17QcLcIN6kFJdDHjgzqjJEhHnEM4HTIz1tEuK8TIZ8ZMb8z/FFUuZoGexKl5KUeARZIMBrebNt+8wmAvngTFD1wOpExhQ432MSoyVAIDYIWFNmJeh2WpURXTPhaQBlzilpQqTcjeINs3IP1NJp2c8DAjANj/DLORGsBuP2Z75dsV7oHWF+tU8ABRdxA9Hm9FHzR0eEDiqFhnUWRa3SL3eZmOTmCCnhnySyxYLfS4AZVqbiWVkpU9f4SV4CTUTt7xzbvkD1fUZAn+SZ3bHXbuBa31Ov5ukSNHh/Bwo= Content-Type: multipart/alternative; boundary="_000_LO2P265MB1327E4613BBDBD2BDF0B3640C2DD0LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 7b03fb4b-7442-4079-7022-08d7143e6966 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Jul 2019 16:04:18.4423 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0111 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 16:04:24 -0000 --_000_LO2P265MB1327E4613BBDBD2BDF0B3640C2DD0LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 PiBPbiBTdW4sIEp1bCAyOCwgMjAxOSBhdCAxMzo1NSBFcmljIFJlc2NvcmxhIDxla3JAcnRmbS5j b20+IHdyb3RlOg0KDQo+PiAgT24gU3VuLCBKdWwgMjgsIDIwMTkgYXQgMjo1NyBBTSBQYXRyaWsg RsOkbHRzdHLDtm0gPHBhZj00MGZyb2JiaXQuc2VAZG1hcmMuaWV0Zi5vcmc8bWFpbHRvOjQwZnJv YmJpdC5zZUBkbWFyYy5pZXRmLm9yZz4+IHdyb3RlOg0KT24gMjcgSnVsIDIwMTksIGF0IDIwOjE5 LCBDaHJpc3RpYW4gSHVpdGVtYSB3cm90ZToNCg0KPiBUaGUgZGF0YSB0aGF0IEkgaGF2ZSBpbiBt aW5kIGlzIEdtYWlsJ3MgbWFya2V0IHNoYXJlLiBUaGF0IHNlZW1zIGxpa2UgYmlnIGVub3VnaCBm YWN0LiBJdCBpcyBub3QgdW5yZWFzb25hYmxlIHRvIGJlbGlldmUgdGhhdCBtb3ZpbmcgRE5TIHRv IGEgd2ViIHNlcnZpY2Ugd291bGQgcmVzdWx0IGluIHRoZSBzYW1lIGtpbmQgb2YgZXZvbHV0aW9u LiBVbmxlc3Mgb2YgY291cnNlIHdlIGRvIHNvbWV0aGluZywgYnV0IHRoZW4gdGhlIHF1ZXN0aW9u IGlzIHdoYXQuDQoNCkl0IGlzIG5vdCBJRVRGIHRoYXQgaGF2ZSBkZWNpZGVkIGV2ZXJ5b25lIHNo b3VsZCB1c2UgYSBjZW50cmFsaXNlZCBtYWlsIHNlcnZpY2UgbGlrZSBHbWFpbC4gSUVURiBzdGls bCBnaXZlIHRoZSBlbmQgdXNlciBhIGNob2ljZSBvbiB3aGF0IHRvIGRvLg0KDQpJIHdhbnQgSUVU RiB0byBoYXZlIHRoZSBzYW1lIHZpZXcgb24gRE5TLg0KDQo+IEluIHdoYXQgd2F5IGlzIHRoYXQg bm90IHdoYXQgaXMgaGFwcGVuaW5nPw0KDQpJIHRoaW5rIHBhcnQgb2YgdGhlIHByb2JsZW0gaGVy ZSBpcyB0aGF0LCBieSBoYXZpbmcgRG9IIG9wZXJhdGUgaW4gdGhlIGFwcGxpY2F0aW9uIGxheWVy LCB0aGVyZSBpcyBubyByZWFsIGNlcnRhaW50eSB0aGF0IHRoZSB1c2VyIHdpbGwgYmUgY29uc3Vs dGVkIHJlZ2FyZGluZyB0aGUgdXNlIG9mIGEgcGFydGljdWxhciByZXNvbHZlciwgYW5kIHRoYXQg dGhlaXIgd2lzaGVzIHdpbGwgYmUgcmVzcGVjdGVkIGlmIHRoZXkgYXJlLiAgRXNwZWNpYWxseSBh cyB0aGVpciBwcmVmZXJyZWQgcmVzb2x2ZXIgbWF5IG5vdCBiZSBzaWduZWQgdXAgdG8gYSBnaXZl biB2ZW5kb3LigJlzIHJlc29sdmVyIHByb2dyYW1tZSwgc28gbWF5IG5vdCBldmVuIGJlIHJlYWRp bHkgYXZhaWxhYmxlIGFzIGFuIG9wdGlvbiBmb3IgdGhlbSB0byBzZWxlY3QgaW4gdGhlIGZpcnN0 IHBsYWNlLg0KDQpUaGUgY3VycmVudCBwcm9wb3NhbHMgYXBwZWFyIHRvIHBheSBsaXR0bGUgbW9y ZSB0aGFuIGxpcCBzZXJ2aWNlIHRvIHRoZSBuZWVkcyBhbmQgZXhwZWN0YXRpb25zIG9mIGVuZCB1 c2Vycywgd2l0aCB0aGUgY2xhaW1lZCBhZGRpdGlvbmFsIHByaXZhY3kgc2VlbWluZ2x5IGJlaW5n IHVzZWQgdG8ganVzdGlmeSB0aGlzLiAgKEV2ZW4gdGhvdWdoIHRoZSBwcml2YWN5IG9uIG9mZmVy IGlzIGEgYmFja3dhcmQgc3RlcCBmcm9tIERvVCkuDQoNCg== --_000_LO2P265MB1327E4613BBDBD2BDF0B3640C2DD0LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxp Lk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlv cml0eTozNDsNCgltYXJnaW4tdG9wOjBjbTsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1hcmdpbi1i b3R0b206MGNtOw0KCW1hcmdpbi1sZWZ0OjM2LjBwdDsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9 DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHls ZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmln aHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsN Cglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30N CnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQg NzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0 aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZh dWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwh LS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86 aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFb ZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGluaz0iYmx1ZSIgdmxpbms9 InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jmd0OyBPbiBTdW4sIEp1bCAyOCwgMjAxOSBhdCAxMzo1NSA8c3BhbiBsYW5nPSJFTi1VUyI+ RXJpYyBSZXNjb3JsYSAmbHQ7ZWtyQHJ0Zm0uY29tJmd0Ow0KPC9zcGFuPndyb3RlOjxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7Jmd0OyZuYnNwOyBPbiBT dW4sIEp1bCAyOCwgMjAxOSBhdCAyOjU3IEFNIFBhdHJpayBGw6RsdHN0csO2bSAmbHQ7cGFmPTxh IGhyZWY9Im1haWx0bzo0MGZyb2JiaXQuc2VAZG1hcmMuaWV0Zi5vcmciPjQwZnJvYmJpdC5zZUBk bWFyYy5pZXRmLm9yZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBw dDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdo dDowY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjI0LjZwdCI+ T24gMjcgSnVsIDIwMTksIGF0IDIwOjE5LCBDaHJpc3RpYW4gSHVpdGVtYSB3cm90ZTo8YnI+DQo8 YnI+DQomZ3Q7IFRoZSBkYXRhIHRoYXQgSSBoYXZlIGluIG1pbmQgaXMgR21haWwncyBtYXJrZXQg c2hhcmUuIFRoYXQgc2VlbXMgbGlrZSBiaWcgZW5vdWdoIGZhY3QuIEl0IGlzIG5vdCB1bnJlYXNv bmFibGUgdG8gYmVsaWV2ZSB0aGF0IG1vdmluZyBETlMgdG8gYSB3ZWIgc2VydmljZSB3b3VsZCBy ZXN1bHQgaW4gdGhlIHNhbWUga2luZCBvZiBldm9sdXRpb24uIFVubGVzcyBvZiBjb3Vyc2Ugd2Ug ZG8gc29tZXRoaW5nLCBidXQgdGhlbiB0aGUgcXVlc3Rpb24gaXMNCiB3aGF0Ljxicj4NCjxicj4N Ckl0IGlzIG5vdCBJRVRGIHRoYXQgaGF2ZSBkZWNpZGVkIGV2ZXJ5b25lIHNob3VsZCB1c2UgYSBj ZW50cmFsaXNlZCBtYWlsIHNlcnZpY2UgbGlrZSBHbWFpbC4gSUVURiBzdGlsbCBnaXZlIHRoZSBl bmQgdXNlciBhIGNob2ljZSBvbiB3aGF0IHRvIGRvLjxicj4NCjxicj4NCkkgd2FudCBJRVRGIHRv IGhhdmUgdGhlIHNhbWUgdmlldyBvbiBETlMuPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7IEluIHdoYXQgd2F5IGlzIHRoYXQg bm90IHdoYXQgaXMgaGFwcGVuaW5nPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+SSB0aGluayBwYXJ0IG9mIHRoZSBw cm9ibGVtIGhlcmUgaXMgdGhhdCwgYnkgaGF2aW5nIERvSCBvcGVyYXRlIGluIHRoZSBhcHBsaWNh dGlvbiBsYXllciwgdGhlcmUgaXMgbm8gcmVhbCBjZXJ0YWludHkgdGhhdCB0aGUgdXNlciB3aWxs IGJlIGNvbnN1bHRlZCByZWdhcmRpbmcgdGhlIHVzZSBvZiBhIHBhcnRpY3VsYXIgcmVzb2x2ZXIs IGFuZCB0aGF0IHRoZWlyDQogd2lzaGVzIHdpbGwgYmUgcmVzcGVjdGVkIGlmIHRoZXkgYXJlLiZu YnNwOyBFc3BlY2lhbGx5IGFzIHRoZWlyIHByZWZlcnJlZCByZXNvbHZlciBtYXkgbm90IGJlIHNp Z25lZCB1cCB0byBhIGdpdmVuIHZlbmRvcuKAmXMgcmVzb2x2ZXIgcHJvZ3JhbW1lLCBzbyBtYXkg bm90IGV2ZW4gYmUgcmVhZGlseSBhdmFpbGFibGUgYXMgYW4gb3B0aW9uIGZvciB0aGVtIHRvIHNl bGVjdCBpbiB0aGUgZmlyc3QgcGxhY2UuJm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQiPlRoZSBjdXJyZW50IHByb3Bvc2FscyBhcHBlYXIgdG8gcGF5IGxp dHRsZSBtb3JlIHRoYW4gbGlwIHNlcnZpY2UgdG8gdGhlIG5lZWRzIGFuZCBleHBlY3RhdGlvbnMg b2YgZW5kIHVzZXJzLCB3aXRoIHRoZSBjbGFpbWVkIGFkZGl0aW9uYWwgcHJpdmFjeSBzZWVtaW5n bHkgYmVpbmcgdXNlZCB0byBqdXN0aWZ5IHRoaXMuJm5ic3A7IChFdmVuIHRob3VnaCB0aGUgcHJp dmFjeQ0KIG9uIG9mZmVyIGlzIGEgYmFja3dhcmQgc3RlcCBmcm9tIERvVCkuJm5ic3A7IDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_LO2P265MB1327E4613BBDBD2BDF0B3640C2DD0LO2P265MB1327GBRP_-- From nobody Mon Jul 29 09:13:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 45F2D120234 for ; Mon, 29 Jul 2019 09:13:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dpoyu4TgcFfW for ; Mon, 29 Jul 2019 09:13:53 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F179A120251 for ; Mon, 29 Jul 2019 09:13:50 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id BE0A33808A; Mon, 29 Jul 2019 12:13:26 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id CCE21C73; Mon, 29 Jul 2019 12:13:48 -0400 (EDT) From: Michael Richardson To: =?us-ascii?Q?=3D=3FUTF-8=3FB=3FVmxhZGltw61yIMSMdW7DoXQ=3D=3F=3D?= cc: Tony Finch , Patrick Mevzek , add@ietf.org In-Reply-To: <621a587c-9f07-90ba-2ef3-be27aab1f928@nic.cz> References: <27369.1564183623@dooku.sandelman.ca> <7cfa79af-3130-2c64-f8fd-f2ce7b9be585@uniregistry.com> <621a587c-9f07-90ba-2ef3-be27aab1f928@nic.cz> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 16:13:55 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Vladim=C3=ADr =C4=8Cun=C3=A1t wrote: >>> Not a new return code, but an extension will provide that: Extended >>> DNS Errors draft-ietf-dnsop-extended-error-06 >>>=20 >>> 4.6.1. NXDOMAIN Extended DNS Error Code 2 - Censored >> In a lot of cases this will not be as useful as you might hope. It's >> common for RPZ deployments to redirect malware domains to an >> informative web server rather than return NXDOMAIN. > At this point we could extend the draft to also allow "Censored" in > positive NOERROR answers, but in that case the problem with getting t= he > information to applications might be even more difficult.=C2=A0 Still= , I > can't immediately see any harm in allowing the combination in the > standard. Not if it's the Application Doing the DNSSEC. =2D-=20 ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | IoT architect = [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [ --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl0/GzwACgkQgItw+93Q 3WUewAf8DYxa6tpJanMRiTMn5cjIJkahZ821xmhgdy/3EzGfYVAZZ/XQk38ypLRb J09TNh7g+kv0qZDR4iUjg8U7Q4ZPuxU9PovxogInCGgNsqNs8IgSb88GGGZMyAZX RiGrTLaKuahprLyVPUbB3dqxWC3Iphoj6HauVA53EvG24Lr8RP6JO9wMVpZEK5iM ZxCp+p4vOCQZzLsu7oxpZBRbdiOcWlorn2HYN6OY8xbNaoKvdq/cP2RxZ9QFsvsL W6FGrUyniW95hQo8DX0ogi2ukZpXLPXFtFQ0xswQZH0GwgGMxcMBQXnw0zMZmLTW zxHoC13cRivzYfDM/teuketdeoJIag== =R8nN -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Jul 29 09:14:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77D6F120234 for ; Mon, 29 Jul 2019 09:14:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MFE03csOgdFq for ; Mon, 29 Jul 2019 09:14:36 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110053.outbound.protection.outlook.com [40.107.11.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E095E12024B for ; Mon, 29 Jul 2019 09:14:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=E9etNhJkUgbGo5z+zowCvUCwIwkKSnAlAknfyUvaFpaDgJDE+Co/43sNVYUoWrUUxeKEgt3xUqBHCb2zMtmeN5ofMw7BEMN1Og0Py8DK/1KAmWLeShnGcAZyiO6gofpG+ZspctZfo+Oih2rEKVy+nKWTbt7htm/OHZYRdoCuPi0yVGuPF0ecZ4PbWVuUeNdSQGyBY4ONDa/wF62CPYwYNDWhhJRdDIbfNNeO9W1UBbGijjN0nVqP73zUfeK/k+P3zGCRDEykdXW1Wrj5PPxld5Yheb/iZTLIRoM7qRzyG14naRgH2gUGfmAhNY7YLrey+q1d+cqGFVMFI2Rjdi+msQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ma7wwEL6+pw+koYWO/GU661mm1bHMEIS6H+S5Y8+FcM=; b=C77qb0XiI/THxNRck+AwvWqy4c02gdRP1BUqimyLf6f1guMUpuLLOQMI+KDfqu6F1vUxhWQmmZkIbpHGzdURCpj8CRMBKtglUivLpFfL46Osy59qzF6jsaR0bE0FgGmeoTeb9UQmX7RHVaVmHMWID1MD3Usb6WwjbI78vwf3cvwCv0+wtnI/VENR2lsX26FI8kKmVS639ppa67syvSPArs6oW7lKp5OzMnmxOOXcN2Qj9QEBqmDWWcs1KwJ4FrRAy7LCuoqAag3ZcasFCbMf8pk3q4lWRc7onMfcHehd/qMvPA3L0iKfR15kdN4pPW2iBFQ+8oLMClv36vfFAWpf4A== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ma7wwEL6+pw+koYWO/GU661mm1bHMEIS6H+S5Y8+FcM=; b=hMWRqAah/kISR9gVWYE8ovPM9Liuv9ZyPcv0Lid+vlnhjwnRB1x0jvwDXYg85KDJ+hDBhcGtYZDAmqDErgwF78Ok00AOzs22ggLXU6jGwVWKM2ylINO53dMzE02Ju+ondT72UiH/6uq2zkcJ9oVZSGKIigCnVmbyEB3U+k1QwL8= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1677.GBRP265.PROD.OUTLOOK.COM (20.176.146.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.14; Mon, 29 Jul 2019 16:14:33 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2115.005; Mon, 29 Jul 2019 16:14:33 +0000 From: Andrew Campling To: Ted Lemon CC: Brian Dickson , =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Wes Hardaker , ADD Mailing list , Rob Sayre Thread-Topic: [Add] My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVQ8GRumJQFcoKeESpwmFfejvtJabhv2bAgAAD8ICAAAWCcA== Date: Mon, 29 Jul 2019 16:14:33 +0000 Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [213.205.240.156] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 633e8f04-f5fe-448b-49ce-08d7143fd7e4 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(7168020)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1677; x-ms-traffictypediagnostic: LO2P265MB1677: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 01136D2D90 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(396003)(346002)(34096005)(376002)(39830400003)(136003)(189003)(199004)(229853002)(6506007)(102836004)(76176011)(7696005)(66946007)(66556008)(64756008)(66446008)(55236004)(66476007)(76116006)(99286004)(53546011)(316002)(6436002)(74316002)(6916009)(54906003)(6246003)(33656002)(4326008)(236005)(7736002)(55016002)(54896002)(6306002)(9686003)(53936002)(14454004)(71190400001)(71200400001)(508600001)(66066001)(25786009)(256004)(14444005)(86362001)(11346002)(8676002)(3846002)(26005)(52536014)(446003)(186003)(2906002)(81156014)(44832011)(66574012)(8936002)(486006)(790700001)(6116002)(81166006)(476003)(68736007)(5660300002)(46492003)(148743002); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1677; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 4gOVeP3YeVmEn5AdABiLpb76G+lZpDXBgExg8eK1z56qXtGT+DU4AoeaoQ1RB0c1jgMKTOCiX+BGqstD412odEZdhdX4l96VKjtE29J5NJxI3eRV6/Rqv0xrmlY2RmrWg/1ODb9FI6q4m9bBS60PKDxd4pcJTs75IwJ+swMQuViPLaaqYfo5R+x8TrADSrI9IOO+oMKf5NS+Fnz3+XEm8fjTtjCPrsxdmD/83ewYa++fhImJCO716ffnQ1FLUxrXkYW5FGwRy1ebLw5blDL3bFTO57lcwPR8/Wolls1k6F1hjgmoI6gKt0MUZgYqx3RuqcDYPoM7YjoK5BH4zKv7x2LLuHpz7H1lyVvrWr66LLzsfhl66ZNqLPDh2JYXXx5JhWbyOIq+hsr90dc1MNrfh/Zzygqk3Rm4LVQHIIckem8= Content-Type: multipart/alternative; boundary="_000_LO2P265MB132725BA4993DB0799A8B3F3C2DD0LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 633e8f04-f5fe-448b-49ce-08d7143fd7e4 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Jul 2019 16:14:33.2982 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1677 Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 16:14:38 -0000 --_000_LO2P265MB132725BA4993DB0799A8B3F3C2DD0LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCkZyb206IFRlZCBMZW1vbiA8bWVsbG9uQGZ1Z3VlLmNvbT4NClNlbnQ6IDI5IEp1bHkgMjAx OSAxNjo1MQ0KVG86IEFuZHJldyBDYW1wbGluZyA8YW5kcmV3LmNhbXBsaW5nQDQxOS5jb25zdWx0 aW5nPg0KQ2M6IEJyaWFuIERpY2tzb24gPGJyaWFuLnBldGVyLmRpY2tzb25AZ21haWwuY29tPjsg UGF0cmlrIEbDpGx0c3Ryw7ZtIDxwYWY9NDBmcm9iYml0LnNlQGRtYXJjLmlldGYub3JnPjsgV2Vz IEhhcmRha2VyIDx3amhuczFAaGFyZGFrZXJzLm5ldD47IEFERCBNYWlsaW5nIGxpc3QgPGFkZEBp ZXRmLm9yZz47IFJvYiBTYXlyZSA8c2F5cmVyQGdtYWlsLmNvbT4NClN1YmplY3Q6IFJlOiBbQWRk XSBNeSBsb25nZXIgbGlzdCBvZiBxdWVzdGlvbnMgW2Zyb20gcGFydGlhbCBkaXN0cmlidXRpb24g YXQgdGhlIE1JQ10NCg0KT24gSnVsIDI5LCAyMDE5LCBhdCAxMTo0MiBBTSwgQW5kcmV3IENhbXBs aW5nIDxhbmRyZXcuY2FtcGxpbmdANDE5LmNvbnN1bHRpbmc8bWFpbHRvOmFuZHJldy5jYW1wbGlu Z0A0MTkuY29uc3VsdGluZz4+IHdyb3RlOg0KSSB0aGluayBhIGtleSBxdWVzdGlvbiB0byBhcyBp cywgaWYgeW91IGRvbuKAmXQgYmVsaWV2ZSB0aGF0IHRoZSBJRVRGIGhhcyBhbnkgcmVzcG9uc2li aWxpdHkgdG8gcHJvdmlkZSBndWlkYW5jZSByZWdhcmRpbmcgdGhlIHVzZSBvZiBwcm90b2NvbHMg dGhhdCBpdCBoYXMgaW50cm9kdWNlZCBvciBjaGFuZ2VzIHRoYXQgaXQgaGFzIG1hZGUsIHdoaWNo IGJvZHkgb3IgYm9kaWVzIGRvIHlvdSBlbnZpc2FnZSB0YWtpbmcgdXAgdGhpcyB0YXNrPw0KDQpJ 4oCZbSBzdGlsbCBzdHVjayBiYWNrIG9uIHRoZSBxdWVzdGlvbiBvZiB3aGF0IGFkdmljZSB0aGUg SUVURiBvdWdodCB0byBwcm92aWRlLiAgIElmIHRoZXJl4oCZcyBhZHZpY2UgdGhhdCB5b3UgdGhp bmsgd2UgYXJlIHF1YWxpZmllZCB0byBwcm92aWRlLCB3aGF0IGlzIGl0PyAgIElmIHdlIHByb3Zp ZGVkIGl0LCB3b3VsZCBpdCBiZSBmb2xsb3dlZD8NCg0KDQpJIHRoaW5rIFBhdHJpayBGw6RsdHN0 csO2bSBtYWRlIGEgZ29vZCBzdGFydCBvbiB0aGlzIGluIGhpcyByZXNwb25zZSBvbiBGcmlkYXkg KDA2OjUyKToNCg0KDQpJRVRGIGlzIGluIHRoZSBkYW5nZXIgb2YganVzdCBsb29raW5nIGF0IG9u ZSBwaWVjZSBvZiBvZiB0aGUgcHV6emxlIGFuZCBmb3JnZXR0aW5nIHRoZSBhcmNoaXRlY3R1cmUg aXQgaXMgcmVzcG9uc2libGUgZm9yLg0KDQoNCg0KVGhlIElFVEYgaXMgcmVzcG9uc2libGUgZm9y IGVuc3VyaW5nICJJbnRlcm5ldCB3b3JrcyIsIGFuZCB0aGlzIHRvZGF5IGltcGxpZXMgYWJpbGl0 eSBmb3Igbm90IG9ubHkgZW5kIHVzZXJzIHRvIGRvIHRoZWlyIHRoaW5nLCBidXQgYWxzbyBlbnRl cnByaXNlcywgYWNjZXNzIHByb3ZpZGVycyBhbmQgd2hhdCBub3QuDQoNCg0KDQpMZWdpc2xhdGlv biBpbiB0aGUgd29ybGQgaXMgaW4gSUVURiBvbmx5IHRhbGtlZCBhYm91dCBpbiB0aGUgZm9ybSBv ZiAiYmFkIFN0YXRlcyB0aGF0IHJlcXVpcmUgYmxvY2tpbmciIGJ1dCB3ZSBhbHNvIGhhdmUgU3Rh dGVzIHRoYXQgaGF2ZSByZXF1aXJlbWVudHMgb24gYWNjZXNzIHByb3ZpZGVycyB0aGF0IHRoZSBJ bnRlcm5ldCBBY2Nlc3MgbXVzdCB3b3JrLCB3aXRoIHNldmVyZSBwZW5hbHRpZXMgaWYgaXQgZG9l cyBub3QuIElmIElFVEYgYnkganVzdCBsb29raW5nIGF0IHNvbWUgbG9jYWwgcHJvdG9jb2wgZGV0 YWlsIGlzIGNoYW5naW5nIHRoaXMgb3ZlcnNpZ2h0IGFiaWxpdHkgZnJvbSB0aGUgU3RhdGUgdG8g ZW5zdXJlIElTUHMgZG8gdGhlIHJpZ2h0IHRoaW5nIChyZWdhcmRpbmcgTmV0d29yayBUcmFuc3Bh cmVuY3ksIE9wZW4gSW50ZXJuZXQgQWNjZXNzIGFuZCB3aGF0IG5vdCkgdGhlbiBJRVRGIGhhcyB0 aGUgcmVzcG9uc2liaWxpdHkgdG8gbm90IG9ubHkgZXhwbGFpbiB0aGlzIHRvIHRoZSBsZWdpc2xh dG9ycyBhbmQgU3RhdGVzIGFyb3VuZCB0aGUgd29ybGQgYW5kIGFsc28gaWYgbmVlZGVkIGNvbWUg dXAgd2l0aCBvdGhlciBwcm90b2NvbCBjaGFuZ2VzIG5lZWRlZCBpbiB0aGUgd2hvbGUgYXJjaGl0 ZWN0dXJlIHRoYXQgZW5zdXJlIGZ1dHVyZSBmdW5jdGlvbmFsaXR5Lg0KDQoNCg0KVGhhdCBTdGF0 ZXMgb3IgRW50ZXJwcmlzZXMgd2FudCB0byBibG9jayBhY2Nlc3MgdG8gY2VydGFpbiBkb21haW4g bmFtZXMgaXMgc29tZXRoaW5nIHRoYXQgd2lsbCBub3QgZ28gYXdheSBqdXN0IGJlY2F1c2Ugc29t ZSBpbmRpdmlkdWFscyBhbmQgaW5kaXZpZHVhbCBjb21wYW5pZXMgYWN0aXZlIGluIHRoZSBJRVRG IGhhdmUgc29tZSBjb29sIGlkZWFzIG9uIGhvdyB0byBkbyBETlMuDQoNCg0KDQpJdCBpcyB0aW1l IGZvciBJRVRGIHRvIGdyb3cgdXAgYW5kIGJlIGEgcmVhbCBzdGFuZGFyZCBvcmdhbml6YXRpb24g cmVhbGx5IHRha2luZyBzb21lIHJlYWwgcmVzcG9uc2liaWxpdGllcy4gQW5kIGZvciBleGFtcGxl IGZvciBldmVyeSBwcm9wb3NlZCBwcm90b2NvbCBjaGFuZ2UgcmVnYXJkaW5nIEROUyByZXNvbHV0 aW9uIGFuc3dlciB0aGUgcXVlc3Rpb25zIGFuZCBtb3JlOg0KDQoNCg0KLSBXaG8gaXMgcmVzcG9u c2libGUgZm9yIEROUyByZXNvbHV0aW9uIGZyb20gdGhlIGVuZCB1c2VycyBwZXJzcGVjdGl2ZT8N Cg0KLSBIb3cgY2FuIGxlZ2lzbGF0aW9uIGVuc3VyZSB0aGlzIHJlc3BvbnNpYmlsaXR5IHN0YXlz IHRoZXJlPw0KDQotIEhvdyBpcyBhbiBlbnRlcnByaXNlIG9yIG5ldHdvcmsgcHJvdmlkZXIgZW5z dXJpbmcgbmFtZSByZXNvbHV0aW9uIGlzIGFjY29yZGluZyB0byBpdHMgcG9saWNpZXM/DQoNCi0g SG93IGlzIHRoZSBlbmQgdXNlciBnaXZlbiB0aGUgYWJvdmUgbWFraW5nIGEgY29uc2Npb3VzIGNo b2ljZSBhbmQgb3B0LW91dCBvZiB0aGUgbWVjaGFuaXNtcyBwcm92aWRlZCBhbmQgcnVuIG9uIGhl ciBvd24/DQoNCg0KDQpUaGUgZGFuZ2VyIGlzIHdoZW4gYSBjb3JuZXIgb2YgdGhlIElFVEYgc2F5 IHRoYXQgZXZlcnkgdXNlciBvZiB0aGUgaW50ZXJuZXQgaXMgbm93IG9wdGluZyBvdXQgd2l0aG91 dCB0aGF0IGJlaW5nIGtub3duIHRvIGFueW9uZSBvcGVyYXRpb25hbGx5IGludm9sdmVkIChpbmNs dWRpbmcgbGVnYWxseSksIGFuZCB3aXRob3V0IElFVEYgaGF2aW5nIHRvb2xzIGluIHBsYWNlIHRv IGVuc3VyZSByZXNwb25zaWJpbGl0aWVzIHN0aWxsIGV4aXN0cyBhbmQgcG9saWNpZXMgY2FuIGJl IGltcGxlbWVudGVkLg0KDQo= --_000_LO2P265MB132725BA4993DB0799A8B3F3C2DD0LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb1BsYWluVGV4dCwgbGkuTXNv UGxhaW5UZXh0LCBkaXYuTXNvUGxhaW5UZXh0DQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglt c28tc3R5bGUtbGluazoiUGxhaW4gVGV4dCBDaGFyIjsNCgltYXJnaW46MGNtOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTO30NCnAubXNvbm9ybWFs MCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9y bWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207DQoJbXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZTox MS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0 eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLlBsYWluVGV4dENo YXINCgl7bXNvLXN0eWxlLW5hbWU6IlBsYWluIFRleHQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJQbGFpbiBUZXh0IjsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjsNCgltc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUzt9DQouTXNvQ2hw RGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0 O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46 NzIuMHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpX b3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNo YXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRp Zl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0 Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0Pjwv eG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9ImJsdWUi IHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1 YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBj bSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIj5G cm9tOjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiPiBUZWQgTGVtb24gJmx0O21lbGxvbkBm dWd1ZS5jb20mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gMjkgSnVseSAyMDE5IDE2OjUxPGJyPg0K PGI+VG86PC9iPiBBbmRyZXcgQ2FtcGxpbmcgJmx0O2FuZHJldy5jYW1wbGluZ0A0MTkuY29uc3Vs dGluZyZndDs8YnI+DQo8Yj5DYzo8L2I+IEJyaWFuIERpY2tzb24gJmx0O2JyaWFuLnBldGVyLmRp Y2tzb25AZ21haWwuY29tJmd0OzsgUGF0cmlrIEbDpGx0c3Ryw7ZtICZsdDtwYWY9NDBmcm9iYml0 LnNlQGRtYXJjLmlldGYub3JnJmd0OzsgV2VzIEhhcmRha2VyICZsdDt3amhuczFAaGFyZGFrZXJz Lm5ldCZndDs7IEFERCBNYWlsaW5nIGxpc3QgJmx0O2FkZEBpZXRmLm9yZyZndDs7IFJvYiBTYXly ZSAmbHQ7c2F5cmVyQGdtYWlsLmNvbSZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtBZGRd IE15IGxvbmdlciBsaXN0IG9mIHF1ZXN0aW9ucyBbZnJvbSBwYXJ0aWFsIGRpc3RyaWJ1dGlvbiBh dCB0aGUgTUlDXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIEp1bCAyOSwgMjAxOSwgYXQgMTE6NDIgQU0sIEFuZHJldyBDYW1wbGluZyAmbHQ7PGEgaHJl Zj0ibWFpbHRvOmFuZHJldy5jYW1wbGluZ0A0MTkuY29uc3VsdGluZyI+YW5kcmV3LmNhbXBsaW5n QDQxOS5jb25zdWx0aW5nPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGJs b2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQi PkkgdGhpbmsgYSBrZXkgcXVlc3Rpb24gdG8gYXMgaXMsIGlmIHlvdSBkb27igJl0IGJlbGlldmUg dGhhdCB0aGUgSUVURiBoYXMgYW55IHJlc3BvbnNpYmlsaXR5IHRvIHByb3ZpZGUgZ3VpZGFuY2Ug cmVnYXJkaW5nIHRoZSB1c2Ugb2YgcHJvdG9jb2xzIHRoYXQgaXQgaGFzIGludHJvZHVjZWQgb3Ig Y2hhbmdlcyB0aGF0IGl0IGhhcyBtYWRlLCB3aGljaCBib2R5DQogb3IgYm9kaWVzIGRvIHlvdSBl bnZpc2FnZSB0YWtpbmcgdXAgdGhpcyB0YXNrPyZuYnNwOyZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J4oCZ bSBzdGlsbCBzdHVjayBiYWNrIG9uIHRoZSBxdWVzdGlvbiBvZiB3aGF0IGFkdmljZSB0aGUgSUVU RiBvdWdodCB0byBwcm92aWRlLiAmbmJzcDsgSWYgdGhlcmXigJlzIGFkdmljZSB0aGF0IHlvdSB0 aGluayB3ZSBhcmUgcXVhbGlmaWVkIHRvIHByb3ZpZGUsIHdoYXQgaXMgaXQ/ICZuYnNwOyBJZiB3 ZSBwcm92aWRlZCBpdCwgd291bGQgaXQgYmUgZm9sbG93ZWQ/PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdCI+SSB0aGluayBQYXRyaWsgRsOkbHRzdHLDtm0gbWFkZSBhIGdvb2Qg c3RhcnQgb24gdGhpcyBpbiBoaXMgcmVzcG9uc2Ugb24gRnJpZGF5ICgwNjo1Mik6PG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPklFVEYgaXMgaW4gdGhlIGRhbmdlciBv ZiBqdXN0IGxvb2tpbmcgYXQgb25lIHBpZWNlIG9mIG9mIHRoZSBwdXp6bGUgYW5kIGZvcmdldHRp bmcgdGhlIGFyY2hpdGVjdHVyZSBpdCBpcyByZXNwb25zaWJsZSBmb3IuPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJtYXJnaW4t bGVmdDozNi4wcHQiPlRoZSBJRVRGIGlzIHJlc3BvbnNpYmxlIGZvciBlbnN1cmluZyAmcXVvdDtJ bnRlcm5ldCB3b3JrcyZxdW90OywgYW5kIHRoaXMgdG9kYXkgaW1wbGllcyBhYmlsaXR5IGZvciBu b3Qgb25seSBlbmQgdXNlcnMgdG8gZG8gdGhlaXIgdGhpbmcsIGJ1dCBhbHNvIGVudGVycHJpc2Vz LCBhY2Nlc3MgcHJvdmlkZXJzIGFuZCB3aGF0IG5vdC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+TGVnaXNsYXRpb24gaW4gdGhlIHdvcmxkIGlzIGluIElFVEYgb25seSB0YWxrZWQgYWJvdXQg aW4gdGhlIGZvcm0gb2YgJnF1b3Q7YmFkIFN0YXRlcyB0aGF0IHJlcXVpcmUgYmxvY2tpbmcmcXVv dDsgYnV0IHdlIGFsc28gaGF2ZSBTdGF0ZXMgdGhhdCBoYXZlIHJlcXVpcmVtZW50cyBvbiBhY2Nl c3MgcHJvdmlkZXJzIHRoYXQgdGhlIEludGVybmV0IEFjY2VzcyBtdXN0IHdvcmssDQogd2l0aCBz ZXZlcmUgcGVuYWx0aWVzIGlmIGl0IGRvZXMgbm90LiBJZiBJRVRGIGJ5IGp1c3QgbG9va2luZyBh dCBzb21lIGxvY2FsIHByb3RvY29sIGRldGFpbCBpcyBjaGFuZ2luZyB0aGlzIG92ZXJzaWdodCBh YmlsaXR5IGZyb20gdGhlIFN0YXRlIHRvIGVuc3VyZSBJU1BzIGRvIHRoZSByaWdodCB0aGluZyAo cmVnYXJkaW5nIE5ldHdvcmsgVHJhbnNwYXJlbmN5LCBPcGVuIEludGVybmV0IEFjY2VzcyBhbmQg d2hhdCBub3QpIHRoZW4gSUVURiBoYXMNCiB0aGUgcmVzcG9uc2liaWxpdHkgdG8gbm90IG9ubHkg ZXhwbGFpbiB0aGlzIHRvIHRoZSBsZWdpc2xhdG9ycyBhbmQgU3RhdGVzIGFyb3VuZCB0aGUgd29y bGQgYW5kIGFsc28gaWYgbmVlZGVkIGNvbWUgdXAgd2l0aCBvdGhlciBwcm90b2NvbCBjaGFuZ2Vz IG5lZWRlZCBpbiB0aGUgd2hvbGUgYXJjaGl0ZWN0dXJlIHRoYXQgZW5zdXJlIGZ1dHVyZSBmdW5j dGlvbmFsaXR5LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5UaGF0IFN0YXRlcyBvciBFbnRl cnByaXNlcyB3YW50IHRvIGJsb2NrIGFjY2VzcyB0byBjZXJ0YWluIGRvbWFpbiBuYW1lcyBpcyBz b21ldGhpbmcgdGhhdCB3aWxsIG5vdCBnbyBhd2F5IGp1c3QgYmVjYXVzZSBzb21lIGluZGl2aWR1 YWxzIGFuZCBpbmRpdmlkdWFsIGNvbXBhbmllcyBhY3RpdmUgaW4gdGhlIElFVEYgaGF2ZSBzb21l IGNvb2wgaWRlYXMgb24gaG93DQogdG8gZG8gRE5TLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij5JdCBpcyB0aW1lIGZvciBJRVRGIHRvIGdyb3cgdXAgYW5kIGJlIGEgcmVhbCBzdGFuZGFyZCBv cmdhbml6YXRpb24gcmVhbGx5IHRha2luZyBzb21lIHJlYWwgcmVzcG9uc2liaWxpdGllcy4gQW5k IGZvciBleGFtcGxlIGZvciBldmVyeSBwcm9wb3NlZCBwcm90b2NvbCBjaGFuZ2UgcmVnYXJkaW5n IEROUyByZXNvbHV0aW9uIGFuc3dlciB0aGUgcXVlc3Rpb25zDQogYW5kIG1vcmU6PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJt YXJnaW4tbGVmdDozNi4wcHQiPi0gV2hvIGlzIHJlc3BvbnNpYmxlIGZvciBETlMgcmVzb2x1dGlv biBmcm9tIHRoZSBlbmQgdXNlcnMgcGVyc3BlY3RpdmU/PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij4tIEhvdyBjYW4gbGVn aXNsYXRpb24gZW5zdXJlIHRoaXMgcmVzcG9uc2liaWxpdHkgc3RheXMgdGhlcmU/PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij4tIEhvdyBpcyBhbiBlbnRlcnByaXNlIG9yIG5ldHdvcmsgcHJvdmlkZXIgZW5zdXJpbmcgbmFt ZSByZXNvbHV0aW9uIGlzIGFjY29yZGluZyB0byBpdHMgcG9saWNpZXM/PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij4tIEhv dyBpcyB0aGUgZW5kIHVzZXIgZ2l2ZW4gdGhlIGFib3ZlIG1ha2luZyBhIGNvbnNjaW91cyBjaG9p Y2UgYW5kIG9wdC1vdXQgb2YgdGhlIG1lY2hhbmlzbXMgcHJvdmlkZWQgYW5kIHJ1biBvbiBoZXIg b3duPzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjM2LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5UaGUgZGFuZ2VyIGlzIHdoZW4gYSBjb3Ju ZXIgb2YgdGhlIElFVEYgc2F5IHRoYXQgZXZlcnkgdXNlciBvZiB0aGUgaW50ZXJuZXQgaXMgbm93 IG9wdGluZyBvdXQgd2l0aG91dCB0aGF0IGJlaW5nIGtub3duIHRvIGFueW9uZSBvcGVyYXRpb25h bGx5IGludm9sdmVkIChpbmNsdWRpbmcgbGVnYWxseSksIGFuZCB3aXRob3V0IElFVEYgaGF2aW5n IHRvb2xzIGluDQogcGxhY2UgdG8gZW5zdXJlIHJlc3BvbnNpYmlsaXRpZXMgc3RpbGwgZXhpc3Rz IGFuZCBwb2xpY2llcyBjYW4gYmUgaW1wbGVtZW50ZWQuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_LO2P265MB132725BA4993DB0799A8B3F3C2DD0LO2P265MB1327GBRP_-- From nobody Mon Jul 29 09:22:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D1A6D120140 for ; Mon, 29 Jul 2019 09:22:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1HlZRk1yrwS9 for ; Mon, 29 Jul 2019 09:22:36 -0700 (PDT) Received: from mail-lj1-x234.google.com (mail-lj1-x234.google.com [IPv6:2a00:1450:4864:20::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83CAF1200CC for ; Mon, 29 Jul 2019 09:22:35 -0700 (PDT) Received: by mail-lj1-x234.google.com with SMTP id z28so4931112ljn.4 for ; Mon, 29 Jul 2019 09:22:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZbDQV3VVwab8FUET+yIMHlnKlLh/8wCBeczCdodWoW8=; b=ud589DUQTHdScg4vbmKIfqwwP5Qj9ach/EiCAVGbo19B/t5xw/7Fhww3/uOc/8Q2ip uvaNi8y0aOmHJ5h+9xgomP3UCKD5vabSx2W7EDKMnA3Z6MvBQU0poZO7y+RNd5TjqVFw AHK4BcIzTeWhB6XYnXQM7zYpDGDnNo3KfKMbg0IaaSIjRRYDLipShDQpGFRW+r64Iqrb u6oAYKhTk1qAs1HYGeFaUowFkpuEuAn9CGCleCT9f8OkZx4QSkAEnbxFhoecusWZ8kvz s9N13wctWJLPABnwMK0mT9uG4bpEm6PZJlAbN5NoLhM5/Qy6uUFg9xPaVlRc2+UdI7GZ M7Ag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZbDQV3VVwab8FUET+yIMHlnKlLh/8wCBeczCdodWoW8=; b=p4e310R4dcu9ijYolgpFS/5cArYzH3lJIa0c8RLf619NmRf2OBd7TS45lbmTKGbR+k vwiOC/NvLKERjjaBs0eMNo3wfPOiEF8XInlm4NZ7aRu36OcpGIw4QUuR7st5DhpzfKkD r2t5H5aLeguChir8z4NzZBaaPldbQYaz91eMgV8AJR/gFu8bjNxaBf6GbIskfoEPT7l4 QOXPYp9Eua/sPiehRRsEZiuCkxDEbNG1CZy7EHT172Z7Bsyflo/upn78ckSTryGPAlRo ZwrgoTLJVHfid/6qVa6SJcLX02yK1kZMSr7Bw2nIGGH3ixaV+wTYeEzDxMUzcC2FJnHI Q6bQ== X-Gm-Message-State: APjAAAX5fLfFVtvCONGcD5aZYRnfja9JDtPs2mrZ/l/TlhvYQB+5aKRt phsKqyy1uOmrqp54KCKMgQskrzlOCto7gWhfi48= X-Google-Smtp-Source: APXvYqwxgHE8u+vIN+/Qf66qMeOvk9H0iI+3lVjZ2dXOaLiPpQRJ+Feo3nWN9fTYr4qYO9iyFqYWQTtZD4um66m4YPs= X-Received: by 2002:a2e:3008:: with SMTP id w8mr59447935ljw.13.1564417353683; Mon, 29 Jul 2019 09:22:33 -0700 (PDT) MIME-Version: 1.0 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> In-Reply-To: From: Eric Rescorla Date: Mon, 29 Jul 2019 09:21:56 -0700 Message-ID: To: Andrew Campling Cc: Christian Huitema , Stephen Farrell , Paul Wouters , ADD Mailing list , "Deen, Glenn" Content-Type: multipart/alternative; boundary="000000000000a5aa33058ed44c28" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 16:22:39 -0000 --000000000000a5aa33058ed44c28 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Jul 29, 2019 at 9:04 AM Andrew Campling wrote: > > On Sun, Jul 28, 2019 at 13:55 Eric Rescorla wrote: > > > > >> On Sun, Jul 28, 2019 at 2:57 AM Patrik F=C3=A4ltstr=C3=B6m 40frobbit.se@dmarc.ietf.org> wrote: > > On 27 Jul 2019, at 20:19, Christian Huitema wrote: > > > The data that I have in mind is Gmail's market share. That seems like > big enough fact. It is not unreasonable to believe that moving DNS to a w= eb > service would result in the same kind of evolution. Unless of course we d= o > something, but then the question is what. > > It is not IETF that have decided everyone should use a centralised mail > service like Gmail. IETF still give the end user a choice on what to do. > > I want IETF to have the same view on DNS. > > > > > In what way is that not what is happening? > > > > I think part of the problem here is that, by having DoH operate in the > application layer, there is no real certainty that the user will be > consulted regarding the use of a particular resolver, and that their wish= es > will be respected if they are. > As I said in Montreal, it's not like the user was consulted regarding the use of the network provided resolver. As a general matter, users aren't aware of DNS at all. > Especially as their preferred resolver may not be signed up to a given > vendor=E2=80=99s resolver programme, so may not even be readily available= as an > option for them to select in the first place. > Firefox, at least, allows the user to configure any DoH resolver of their choice -- whether the resolver is part of our program or ont -- in a fashion not much different from how they would configure the OS resolver (i.e., there is a preference pane). > > The current proposals appear to pay little more than lip service to the > needs and expectations of end users, with the claimed additional privacy > seemingly being used to justify this. (Even though the privacy on offer = is > a backward step from DoT). > It's hard to really respond to this statement because DoT is two different things. I don't agree that DoH to a TRR is a step back from DoT to the local ISP resolver for the reasons that have already been discussed at length, namely the inadequacy of the local resolver's privacy guarantees. When implemented correctly, DoT to a TRR and DoH to a TRR have relatively similar privacy properties, as laid out in https://tools.ietf.org/html/rfc8484#section-8 -Ekr > --000000000000a5aa33058ed44c28 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Mon, Jul 29, 2019 at 9:04 AM Andre= w Campling <andrew.campling@419.consulting> wrote:

    > On Sun, Jul 28, 2019 at 13:55 Eric Rescorla <ekr= @rtfm.com> wrote:

    =C2=A0

    >>=C2=A0 On Sun, Jul 28, 2019 at 2:57 AM Patri= k F=C3=A4ltstr=C3=B6m <paf=3D40frobbit.se@dmarc.ietf.org> wrote:<= /u>

    On 27 Jul 2019, at 20:1= 9, Christian Huitema wrote:

    > The data that I have in mind is Gmail's market share. That seems l= ike big enough fact. It is not unreasonable to believe that moving DNS to a= web service would result in the same kind of evolution. Unless of course w= e do something, but then the question is what.

    It is not IETF that have decided everyone should use a centralised mail ser= vice like Gmail. IETF still give the end user a choice on what to do.

    I want IETF to have the same view on DNS.

    =C2=A0

    > In what way is that not what is happening?

    =C2=A0

    I think part of the p= roblem here is that, by having DoH operate in the application layer, there = is no real certainty that the user will be consulted regarding the use of a= particular resolver, and that their wishes will be respected if they are.=C2=A0


    As I said in Montreal, it's = not like the user was consulted regarding the use of the network provided r= esolver. As a general matter, users aren't aware of DNS at all.

    =C2=A0

    = Especially as their preferred resolver may not be signed up to a given vend= or=E2=80=99s resolver programme, so may not even be readily available as an= option for them to select in the first place.=C2=A0


    F= irefox, at least, allows the user to configure any DoH resolver of their ch= oice -- whether the resolver is part of our program or ont -- in a fashion = not much different from how they would configure the OS resolver (i.e., the= re is a preference pane).

    =C2=A0

    The current proposals= appear to pay little more than lip service to the needs and expectations o= f end users, with the claimed additional privacy seemingly being used to ju= stify this.=C2=A0 (Even though the privacy on offer is a backward step from DoT).=C2=A0

    =

    It's hard to really respon= d to this statement because DoT is two different things. I don't agree = that DoH to a TRR is a step back from DoT to the local ISP resolver for the= reasons that have already been discussed at length, namely the inadequacy = of the local resolver's privacy guarantees. When implemented correctly,= DoT to a TRR and DoH to a TRR have relatively similar privacy properties, = as laid out in ht= tps://tools.ietf.org/html/rfc8484#section-8

    -E= kr

    <= u>

    =C2=A0<= /span>

    --000000000000a5aa33058ed44c28-- From nobody Mon Jul 29 09:27:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7280B1202B3 for ; Mon, 29 Jul 2019 09:27:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.997 X-Spam-Level: X-Spam-Status: No, score=-6.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eRSLJ5CLs2ZT for ; Mon, 29 Jul 2019 09:27:16 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [217.31.204.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57F0C1202B2 for ; Mon, 29 Jul 2019 09:27:16 -0700 (PDT) Received: from [IPv6:2001:1488:fffe:6:854b:e178:9543:2b0e] (unknown [IPv6:2001:1488:fffe:6:854b:e178:9543:2b0e]) by mail.nic.cz (Postfix) with ESMTPSA id 4ACA9140B71; Mon, 29 Jul 2019 18:27:14 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1564417634; bh=9muWJwhlMohVvH9zMqou1ArSns9RbenrOnw3QGKs3XM=; h=To:From:Date; b=i9tAHR1MTjXmC4ugWWrgfvfSGUY2JGMfWRCG6nbwpOTbjTG+nbXuid2cLI1bf1mN3 IwiUFUi1P3SXJwb3bxCddUwGNojFWuxuvhKTf6tJQOQX0tR5Zd/2t8PCdFSisFKrSZ uOIi+TeNkIOFPcJBz04xkqoykcXIH27fqwFguBNc= To: Michael Richardson Cc: add@ietf.org References: <27369.1564183623@dooku.sandelman.ca> <7cfa79af-3130-2c64-f8fd-f2ce7b9be585@uniregistry.com> <621a587c-9f07-90ba-2ef3-be27aab1f928@nic.cz> <31150.1564416828@localhost> From: =?UTF-8?B?VmxhZGltw61yIMSMdW7DoXQ=?= Openpgp: preference=signencrypt Autocrypt: addr=vladimir.cunat+ietf@nic.cz; prefer-encrypt=mutual; keydata= mQINBFgDknYBEADHEQwLBlfqbVCzq7qYcBFFTc1WCAFtqiKehOrsITnKusZw4nhYwlKQxcum gj01xJOhbfHBCBeGlDydYqemKg4IfY2nwSyPwZZYMJn7L7AGrCeytr4VMvDJ7o7qDZjjim4i fv+GUwdk3plXx6oMF4nctesI8aAOuLUHAn0PfrGfNhWoaglOKgdOI6DGjhI/aGkvy+jrI/+X sdMV+3f1RuEOfI+Yu4SXFjJyhAmqEOBRxxdHqKreIIpz3Lg38yWwiVGfwgQT+nFIz9BpHH3l Wg1uS8xM3ezceBmRYV8zT9PvbeZ57BlaTR6rLae5RYwV397PSLBqqLkB5H0TDRUFBnwBsUob LebYHmJCOydvyNv5AFkLmLZ7O4j2jFo1WPSMt3ThM6wRwqrnB4Gi+6onyrZfE1DnVZMqbxZ3 VXa+E4S5YwrfCLUErGEn+d40OtoRZmQXhRPVAsdjimMj9oFM9RoxSgUrDg6Ia3n0IrKFb++z HAFbqkR5g4qzXiOMEG621GYEex2sDEKz/PD4CVKlNI9eld4ToH592kAwzJmd+sAi+Rfos0NE zxuFd0ekAOeWoURo0zoYTSWPlMOmFMvcpH6LP3leJmY7x4z/b1ng/+7UnKonVALVPFbRbElO kIfAtLKcUEofwV1jr7DyYGPalJtiDJPomB041ZHCj2RxyXY/oQARAQABtDBWbGFkaW3DrXIg xIx1bsOhdCAod29yaykgPHZsYWRpbWlyLmN1bmF0QG5pYy5jej6JAlQEEwEIAD4CGyMFCQlm AYAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AWIQS2AGRgtgqA54IGJEnnR98flXWjqgUCWg3w 3gAKCRDnR98flXWjqmD6D/96U4cDZBrHQ5LhqybocZr/N2IS5Wr2SLLB4k2F5/W/wbL05gq6 Ha9/2TMqXoxRkhug+EAHFHxylPR43yN9rz0pjBXHrra87FAPHMqq/qqrOEUdhkytEqa6WIho aoEkdhaMhUyctjVjL2WZ0+MWeRjqedLQX+VCrOVPcVbLreRRhA9N3KPgNwbp9zCg6hEPi4l2 zZKedHkTNjKIAwJ0xZoMwFa1Y+vL8Em8Or+IBZuGBMP/ZMtasPOIQaT/Gvsyx1DDorwsoCdX 6zaTZy5DOWP3FIrMzus/YDbzwAYxSpWk/jF44ySbnJzdjU67EfG3UrsK+RRGw8aJqs3/4qHK ZMZZnNL+4wJpEdnZyFic/MXcw6FBszQEwrIOaM1WEfwzn2ExUYk2pM5zaBwq76OgrmGMzMEi cfMDyqLodwEQqR70PvRbkrh+R02LphwQ9c5AFXcrLjKMmeQlbQVarTUsrELcTK6rElC1ojS7 M37j0XzFE+kgNWn2fyBRgtnGDWEa7r+oDaueXJnEf0/4Ww28IwxakNc7r0N41GIBekwSxKdk epKFZgtVGGSDlFei5hb5LLWFljA1OS7CRVJKpbHafQjdPdb1vNqZAj4y2SJXvVVpI1KO5kq+ dFdYipORv0N2Iho6MNYbQUT1EBeU46G5N0viCoLS15/PxLhIAo+PzKpW97kCDQRYA5J2ARAA yHww3huLEtsdyqgjiGMhtEKOLmp7yFl450HY9oPcHS02U5BC1370ssNShrdOCi2ACDbe41Zx x85WcuaO1OVqung2umX047mj2xQsiTAFRDLZsQu8cQFoEy/DBL2bk7ThfK1Lh+NyZAs0UaPp DkGodS0De9osA+4T6Nf4POYaeavbYVFSdDKS4lUboBqApKnD/TzKFxFcpuFx6FN92lteTbOo jGMiLoZvELY86Kn9KuFZ8FM2ZSNHx1Z75KouufGrdkeCoZYVYiuzT+fnt2it4dIpIlnF+yxM t5LB/MSrmECB5CAFJtxzuMccm6yDUZQSWWi9vUgxIJwvt5w0CIBT353DGeP4WnH0r5YoBKoR bh7i4fT0lWvMXTG/V2lqyzBdClMebyHffMgba26Kj6oeDygDfC5aGsVaqw1Ue/qQ5QRqTJcJ V7xVLTtS1EamVqkfKwPS0zTfnrF1jQtnO/P4qkfgBRRG9BXGGrykHpXOyqmX6Z0wbV2P4j+p 02oSecDl5yVXplJfsXfbS/xXnaSkaN/7mCU29ul26cAVNxDkDPunztSFi9K9LM2T/XWYJQGX M71OpmONQJGF24lx7Wp/kobnHtbjGDzjDPC4eSL7MA56qtrWaLM+4ePKANct2q0q6c0uSLs0 Q2zochS64Mcg0YzL1sinWPN1rXLDk3lwpIsAEQEAAYkCJQQYAQgADwUCWAOSdgIbDAUJCWYB gAAKCRDnR98flXWjqn4yEACA0f1XBAg+WMaNPtIt0k15yFPfhdbOg9GhDcYGgvFIOxRuaFWw 9SLUt7OGuUnIpKxKRXtQJss98fHkijo70ONYWPuLhfRGK/wg9Ao6MuFw5G8m431CBS/awrie b6iPjvAARXJCPTTBZk/NC988jiKdCh8PbTCHDsl+gSDytP15QUrdqSfS2Wf4653ej7+jtuTj xZzmGgvNSi6JDlb9KNtmBQKQAgpnOQM46ItESmzHDnmdcvhPLUDsjwkpIJ6clasOzaObwxJi ba7iFPcGwcClCSwYjMNXFtneCGUnEAa5RBIx+i+LV1iqB3VRvTC6tMIUueoQ7cdTy6afNkhw QYXm4/pDmNT8UMdnzwnlTpFQ0CegDQRDWc+dIDDBHGEEEYBh2vTOE04KrmYUp1bQsNegPfvL woHib0jEvohPMJ2fJtZAd1SJElgwPbM8H7emKBiTsHwF8gL7G2jo7AoGpqYjqXkCRS0tSLTN r+qHh+7Ltrkbu/ZVTTfh4Q/qw3VaLYQh4C0tBma/YevQy1O2c3TZXXFz1QF8b9/Hj/3sq2Kg T1AcZ51E+xG+cb6cUqgkihmgm39xx24GPlNAdCRuq01+iILol+Wox6OwF6hmqx1EMSmxcmGo UREr0rkMnFVsWeAYeVoE4q689qxCPu9iCMJMJnkRe1o9oQYSN7my+S98gA== Message-ID: Date: Mon, 29 Jul 2019 18:27:14 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <31150.1564416828@localhost> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-US X-Virus-Scanned: clamav-milter 0.100.3 at mail.nic.cz X-Virus-Status: Clean Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 16:27:28 -0000 On 7/29/19 6:13 PM, Michael Richardson wrote: > Vladimír Čunát wrote: > >>> Not a new return code, but an extension will provide that: Extended > >>> DNS Errors draft-ietf-dnsop-extended-error-06 > >>> > >>> 4.6.1. NXDOMAIN Extended DNS Error Code 2 - Censored > >> In a lot of cases this will not be as useful as you might hope. It's > >> common for RPZ deployments to redirect malware domains to an > >> informative web server rather than return NXDOMAIN. > > > At this point we could extend the draft to also allow "Censored" in > > positive NOERROR answers, but in that case the problem with getting the > > information to applications might be even more difficult.  Still, I > > can't immediately see any harm in allowing the combination in the > > standard. > > Not if it's the Application Doing the DNSSEC. Well, that's a general problem of filtering/modifying DNS before the last validation point, but extended errors actually allow the application to know why the data is wrong and that it's pointless to retry. Validation never prevented denying the answers (causing SERVFAILs), so spoofing this filtering doesn't seem to bring new risks (at a quick glance).  And if you add a secure transport to the filtering resolver (DoT, DoH), you authenticate even that part. --Vladimir From nobody Mon Jul 29 10:01:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4A99120350 for ; Mon, 29 Jul 2019 10:01:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ux1ijZKB8QWZ for ; Mon, 29 Jul 2019 10:01:15 -0700 (PDT) Received: from mail-ua1-x92b.google.com (mail-ua1-x92b.google.com [IPv6:2607:f8b0:4864:20::92b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 173F312034D for ; Mon, 29 Jul 2019 10:01:14 -0700 (PDT) Received: by mail-ua1-x92b.google.com with SMTP id c4so24234809uad.1 for ; Mon, 29 Jul 2019 10:01:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=9/lIaLBf5Q7A+ALbJRMw7p0435e0vLlutgRo/LWgyjc=; b=Rps9hBJ8DaTzqWssJzZcoBvAWSOF2AXDyG9EHKVQOg3YPDMXEa/1E1R9eiGb2VPQ1g pRLj2xl6eHI7LDJ8ljok5QfH5CEJLQanKw14/hOOVwvVY4puhEin5fQ/e0D47vZyMurN ZbM9UoA2Bt7HCXR9ZovSJAnrQDvmOvxpkUfEWovPnIWnmqZmCO0HARXnl/FjWGy6Z+KN ilv136MP3CVDyEvaddxROMO7QfeLcuj9T8Zt4J5YHEhGwFaKxMXRdFXHpBf40g0K6PrE a9SQpRZ3TunTVtWqmzevMZfowQ8Jof7qC8Tqxr6Fi55ynKczsATEAldABEgypYYBJCbB wvfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=9/lIaLBf5Q7A+ALbJRMw7p0435e0vLlutgRo/LWgyjc=; b=I/vStN6hqjrRC85RKy+tZzuTeR5jB8W9+wXUz83OrbdHz/mevK+Rua25w7Y0yOQzdb IOo73474FQReOLFnIwXlMQL8cOwgzB8y+C3JuGFdIKwAsgZIG5BvcDt+R+8ObhPFYJ40 rjx2rK0zIb9matSDuEk6NmQzX2Z+GO46oES5XoEp5DmkshhUDA8le9Co/BVM0zU2imJv XidSqeSQiGhoVGzqAfZcL3MmAVmFyCyxT1Z1n7HleLZ4nn02QWeP4KFIX7RCDhLDEt6I cfDKfhlrlkYkEZ/YY8JrJiX5dskHnJqq6R1eCWa++tkWOiyEtrnWoQKdA5QhJ6TXkUD/ AS0A== X-Gm-Message-State: APjAAAVkJpgkYvh1lrmCLnomU6uufg9FvbxbeGUFkXp9IttSQIKbzjF4 TB7OgjObbfAElK7HsfHCEJ5g3CBm5l4= X-Google-Smtp-Source: APXvYqzTZrGlBdEtXpEw0p6fg2A2Q6XD9PSfPEwIdATdvdXO0SwYIPgo7v24xaAp1kFicaBx8SHcfw== X-Received: by 2002:ab0:6911:: with SMTP id b17mr17417793uas.18.1564419673091; Mon, 29 Jul 2019 10:01:13 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:c0dc:a9fc:92f6:6e37? ([2001:470:c1a2:1:c0dc:a9fc:92f6:6e37]) by smtp.gmail.com with ESMTPSA id y71sm13790402vsc.19.2019.07.29.10.01.11 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 29 Jul 2019 10:01:12 -0700 (PDT) From: Ted Lemon Message-Id: <3261C555-E196-46F0-8606-60FCA80A3DF1@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_07DED222-8D21-47B5-A39A-F2060093DA50" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Mon, 29 Jul 2019 13:01:10 -0400 In-Reply-To: Cc: Brian Dickson , =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Wes Hardaker , ADD Mailing list , Rob Sayre To: Andrew Campling References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <2E080C62-CFC9-4851-B2AE-701E5D543A71@frobbit.se> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 17:01:18 -0000 --Apple-Mail=_07DED222-8D21-47B5-A39A-F2060093DA50 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 29, 2019, at 12:14 PM, Andrew Campling = wrote: > I think Patrik F=C3=A4ltstr=C3=B6m made a good start on this in his = response on Friday (06:52): Do you see any action items in Patrik=E2=80=99s message? Can you = mention one specific action that you think we should take, based on what = Patrik has said? E.g., how would the IETF make tools that ensure responsibilities still = exist and policies can be implemented? --Apple-Mail=_07DED222-8D21-47B5-A39A-F2060093DA50 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 29, 2019, at 12:14 PM, Andrew Campling <andrew.campling@419.consulting> wrote:
    I think = Patrik F=C3=A4ltstr=C3=B6m made a good start on this in his response on = Friday (06:52):

    Do you see any action items in Patrik=E2=80=99s = message?   Can you mention one specific action that you think we = should take, based on what Patrik has said?

    E.g., how would the IETF make tools that ensure = responsibilities still exist and policies can be = implemented?

    = --Apple-Mail=_07DED222-8D21-47B5-A39A-F2060093DA50-- From nobody Mon Jul 29 10:27:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC9321203BE for ; Mon, 29 Jul 2019 10:27:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pTdjgTQfPhAM for ; Mon, 29 Jul 2019 10:27:54 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B48A71203BD for ; Mon, 29 Jul 2019 10:27:53 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45y68R14Vkz5JB; Mon, 29 Jul 2019 19:27:51 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1564421271; bh=07TiN9ZjGAmyINV23wJExBEbs+fr0813eRnCfmP1uOg=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=EpcyRhaSBotzQLZzw4asGD8kxJZeZDGG7mWveyMmslOObttQClYV93MJHnGDvzglV i8x40JUsL4lROVbHrBIWgJ4DYCW/x+tDpK1jUe43GWcutbz4/LiBnyl7jtDCDDcJ68 0LWMExMjrOziBfroBH8HO69VvvSTgNOdy3No4mdA= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id dAKsjShwcU0D; Mon, 29 Jul 2019 19:27:49 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Mon, 29 Jul 2019 19:27:49 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 539E1394974; Mon, 29 Jul 2019 13:27:48 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 539E1394974 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 4AFCA40A6FFE; Mon, 29 Jul 2019 13:27:48 -0400 (EDT) Date: Mon, 29 Jul 2019 13:27:48 -0400 (EDT) From: Paul Wouters To: Paul Ebersman cc: add@ietf.org In-Reply-To: <20190729155147.EA58815DA847@fafnir.remote.dragon.net> Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <20190729151538.7DFCF15DA2E3@fafnir.remote.dragon.net> <20190729155147.EA58815DA847@fafnir.remote.dragon.net> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 17:27:56 -0000 On Mon, 29 Jul 2019, Paul Ebersman wrote: > paul> I was thinking more along the lines of the pool.ntp.org model. > > NTP isn't nearly as latency sensitive, since it's designed to deal with > this and it's not a human waiting for a page load. NTP also deals nicely > with having multiple sources, some of which aren't good/accurate and > still get to one answer. If you think DNS is latency sensitive, I can advise you to install an ad-blocker instead. Browers might think latency is the only useful metric for DNS, but it is not. It's as meaningful as horse power is on modern cars. > It would also require changes to client/device OS stacks. I'm fine with needing configuration changes and using the local network suggested resolver by default. I'll leave that discussion up to the browser vendors. > There is a reason that there are a very limited number of large open > recursive DNS services well anycasted, well distributed and well > run. It's not because being centralizes was the primary goal; it's > because it's expensive and difficult. Mostly due to UDP reflection/amplification attacks, which are not present if your open resolver runs with DNS COOKIES or TCP, which it will when using DoT or DoH. (note I am running an open resolver for the last 15 years. It does not see much downtime at all. > Much like email, you can run your own server. the problem of running your own resolver server that hardly anyone else uses, is that is has bad privacy properties. Getting privacy means mixing up a large number of people's queries. Hence the pool.ntp.org model and not the "spin up your own el cheapo aws node". > But getting trusted IP > space, doing SPF/DKIM/DMARC correctly, getting large email services to > accept your email, dealing with DDoS, etc are all hard and beyond most > users. None of this relates to the DNS discussion. > Most users will take ease over privacy. And the step function to > go from easy to privacy is a fairly high technical bar for most users. Again, I will leave up the defaults discussion to the browsers and the apps that feel they have something to offer to the user beyond the DHCP provided untrusted DNS resolver. > Perhaps we should be talking to device OS vendors like Apple, Microsoft, > etc. to put a fully recursive validating resolver built into the OS... While that's great, it is not very relevant to this discussion, as those validating resolvers still either have to 1) forward queries to locally recommended resolver or 2) forward to a known quad or 3) go without forwarder. Where 1) is the status quo, and 3) is the worst privacy case compared to the disinterested RDNS service. Paul From nobody Mon Jul 29 10:42:49 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A20D312010F for ; Mon, 29 Jul 2019 10:42:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uhn2zC39-091 for ; Mon, 29 Jul 2019 10:42:45 -0700 (PDT) Received: from uplift.swm.pp.se (swm.pp.se [212.247.200.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B4321200A1 for ; Mon, 29 Jul 2019 10:42:45 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 26AB4B4; Mon, 29 Jul 2019 19:42:43 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1564422163; bh=BjH+2UL9izib6C2wjC6NRgRFC8X8MjKTHbEW9soX7Ms=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=4FI3YEg8cAIoOYgaoJmcys8Pv1Z1FIxLeaBQVKcBkPOhvNaLSq4CpRFLdF0jj2rRO RteOIdL8BRrLpGUYGLvjkufJFjdUmhcQv64OkflcXDKr6WjcFYb5zH6+ezBPEvCaeQ glTuytuw3ZYMDqfcFs8Yej5wTWjqNZfX2i+bebs8= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 22DFDB0; Mon, 29 Jul 2019 19:42:43 +0200 (CEST) Date: Mon, 29 Jul 2019 19:42:43 +0200 (CEST) From: Mikael Abrahamsson To: Jim Reid cc: Paul Wouters , ADD Mailing list In-Reply-To: Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="-137064504-2015279421-1564405245=:25725" Archived-At: Subject: Re: [Add] DNS service provision and the concept of trust X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 17:42:48 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. ---137064504-2015279421-1564405245=:25725 Content-Type: text/plain; CHARSET=ISO-8859-7; FORMAT=flowed Content-Transfer-Encoding: 8BIT On Mon, 29 Jul 2019, Jim Reid wrote: > How does that work for the 99.99% of the planet who cant even spell > DNS, far less understand what it does? The same goes for other blind > trust elements that underpin pretty much everything on the Internet. I > trust my ISP has given me a unique IP address. I trust they use a > genuine ASN. I trust nobody else is making bogus BGP announcements for > that address space or is spoofing my IP address. I trust CAs arent > issuing bogus certs to people pretending to be me. I trust nobody fakes > my email address. I trust nobody impersonates me on > $social-media-platfrom. etc, etc. I'm very concerned about this being chosen for the user and now all of a sudden different applications on their computer might use different resolvers without their knowledge. It makes for extremely confusing customer support calls. I'd also like to +1 to what Lorenzo said in the ADD meeting. This isn't about DoT, DoH or what other transport people might come up with. This is about "what resolver am I using right now?" and if this is all of a sudden different across application, operating system, home or however someone might carve it. Historically, this has been the same across everything unless someone specifically brought up a VPN or did explicit configuration. Personally, I trust my ISP both with moving my packets and performing lookups. I don't want my queries to all of a sudden end up somewhere else without my knowledge, especially not some data-collecting cloud provider that happens to have some commercial deal with my browser vendor. The failure cases both when it comes to GDPR or similar, and purely technical problems (if the cloud provider resolver stops working and I get an error page, who do I call?). But, looking at it from another perspective I also see the need in some places to try to make the traffic as much secret/verified as possible, for instance when there is pervasive monitoring or alteration of it. I don't see any other way to understand the users choice/preference unless we ask them. People install a TOR browser because they want to circumvent something. This is an active choice. If they install a VPN, then they make the choice to run both traffic (and potentially DNS queries) through this VPN. This is also a choice. The same way the user today can make a choice when it comes to "I want to run my browser in incognito/private mode", we need to ask them the same thing about their DNS lookups if we want to stop using the operating system provided one. I feel a lot of this discussion has touch points on the whole MIF / Provisioning Domains topic, and also with a touch of "captive portal" (in that specific information needs to be conveyed to applications and different information needs to be used depending on who the application intends to talk to). It's quite possible that I would like to use one DoH server for some domains, and use my system default one for others. This would probably help some of the VPN issues I have (where each tunnel just thinks they "own" the entire operating system including resolver setting). Preferrably I'd like the operating system and VPN application to just configure this for me so that split horizon works as expected (I get different results depending on if the VPN tunnel to the internal network is up or down). -- Mikael Abrahamsson email: swmike@swm.pp.se ---137064504-2015279421-1564405245=:25725-- From nobody Mon Jul 29 10:56:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26A54120114 for ; Mon, 29 Jul 2019 10:56:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XUrSO9O9YQw0 for ; Mon, 29 Jul 2019 10:56:09 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DA0C1200A1 for ; Mon, 29 Jul 2019 10:56:09 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 17FFABE39; Mon, 29 Jul 2019 18:56:08 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xoYNYcZI2CaH; Mon, 29 Jul 2019 18:56:06 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 9337EBE2C; Mon, 29 Jul 2019 18:56:06 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564422966; bh=PACwQ0iBrMDgk0JDoq7BPLd0m5cz/7XIJq9XIWXunps=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=xOm8vCk9LcbZHWO75pSG44U+oziVAhXCj6rHpfdf6l4N12xiW//4r2j6wRRMzkIDN MjsWFds2/r60/F2jJqujOG/6lzUJMKEDaMVWG8IdYmvhg5LR5FODCjTUkrCyn2Eupo kDD9Yufu8p7NdJeBnPyyTXRNOIX7E7KDuXKTBcME= To: Paul Wouters , Paul Ebersman Cc: add@ietf.org References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <20190729151538.7DFCF15DA2E3@fafnir.remote.dragon.net> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <04a6cb4d-b96d-a050-e93c-8b40ef48c5c8@cs.tcd.ie> Date: Mon, 29 Jul 2019 18:56:05 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="8zAXGfIEgCBJfrsGQANgXZvSNBMEa9rCq" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 17:56:11 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --8zAXGfIEgCBJfrsGQANgXZvSNBMEa9rCq Content-Type: multipart/mixed; boundary="dgWaIo4vSUGGDcNg8AyQ4qfRhViqfKXS2"; protected-headers="v1" From: Stephen Farrell To: Paul Wouters , Paul Ebersman Cc: add@ietf.org Message-ID: <04a6cb4d-b96d-a050-e93c-8b40ef48c5c8@cs.tcd.ie> Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <20190729151538.7DFCF15DA2E3@fafnir.remote.dragon.net> In-Reply-To: --dgWaIo4vSUGGDcNg8AyQ4qfRhViqfKXS2 Content-Type: multipart/mixed; boundary="------------FAD82BA2BCE6C73913283884" Content-Language: en-GB This is a multi-part message in MIME format. --------------FAD82BA2BCE6C73913283884 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 29/07/2019 16:38, Paul Wouters wrote: > I was thinking more along the lines of the pool.ntp.org model. FWIW, I think it'd be great to see a more fleshed-out version of this idea. Even if it doesn't fly, I think that might be a useful way to elicit some more structured argument about this problem-space. So, I'd encourage you (or someone) to try flesh it out some. Cheers, S. --------------FAD82BA2BCE6C73913283884 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------FAD82BA2BCE6C73913283884-- --dgWaIo4vSUGGDcNg8AyQ4qfRhViqfKXS2-- --8zAXGfIEgCBJfrsGQANgXZvSNBMEa9rCq Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0/MzUACgkQWrL68XsX K+oARQ//blzISAemMk3Gpb1L4A/yvs3PF2XgA+y8LPTy69KViY3jBtLHaNFyhupL ACCbns+DWSYQWZ7TGalLzxiw1Jf03MT6KCjbGzi9gVjcipHcS+p6YEwG4kyAeqgY dB1SGkXu5mqghBXTIdetwZ+ZULb7FGbOnyINTES1LWTysT/Tk3Tmi4FhO4mR1AuM X3HVEWFjYHjKaVoBwQUsh5rlQ9u4ViGj/j6GymuFO5HrGgV3FuoNi8lO5equEand tkLaIruN6V5AxekqptYThOECFA80Q7j3LESQK3CwP08F85BeTyji9VsPxEwXlMea pAPe/NRnpIM84ysFFTUPb9D0fMRdEhtTo0HFlsLucQHEi0VUtkAmDLIl6YiGBNKT E2uiUVQQUuP4zc1T9HfClags+Kc+FmttZg6LTgioJvziq0+C4J5hbEGS9NLiViHX IiutoVh37XyPuiitmT6GPxbmk/AHnG10WKHhTKPWQpiNIygpBD/JPo6/L9Br5nA4 5YFXAPNcNlB0BB/feDvi3orsAy6RG/R89SnZKwUESczXGTnK5XW3+ITxmJxSHIcK FrPMRaO+K3SJ0cTlMyuIOcJ1YGYjs1gusBqCpHlshEwCdaD42pNfEUVJXPL23PPL aqZatWej9iZC+JcfZYUAATQeWIsApHVF0pqakCKLKrV3uq/IfYM= =hHdp -----END PGP SIGNATURE----- --8zAXGfIEgCBJfrsGQANgXZvSNBMEa9rCq-- From nobody Mon Jul 29 15:08:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 74949120090 for ; Mon, 29 Jul 2019 15:08:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2mUvIWYYZyzU for ; Mon, 29 Jul 2019 15:08:51 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36DE312004E for ; Mon, 29 Jul 2019 15:08:51 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id E028D3740099; Mon, 29 Jul 2019 15:08:50 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id ADFA115DD791; Mon, 29 Jul 2019 16:08:50 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id A70A115DD790; Mon, 29 Jul 2019 16:08:50 -0600 (MDT) From: Paul Ebersman To: Paul Wouters cc: add@ietf.org In-reply-to: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <20190729151538.7DFCF15DA2E3@fafnir.remote.dragon.net> <20190729155147.EA58815DA847@fafnir.remote.dragon.net> Comments: In-reply-to Paul Wouters message dated "Mon, 29 Jul 2019 13:27:48 -0400." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <45741.1564438130.1@fafnir.local> Date: Mon, 29 Jul 2019 16:08:50 -0600 Message-Id: <20190729220850.ADFA115DD791@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 22:08:52 -0000 paul> I was thinking more along the lines of the pool.ntp.org model. ebersman> NTP isn't nearly as latency sensitive, since it's designed to ebersman> deal with this and it's not a human waiting for a page ebersman> load. NTP also deals nicely with having multiple sources, some ebersman> of which aren't good/accurate and still get to one answer. paul> If you think DNS is latency sensitive, I can advise you to install paul> an ad-blocker instead. paul> Browers might think latency is the only useful metric for DNS, but paul> it is not. It's as meaningful as horse power is on modern cars. It's not always just ads and much of what ADD is all about is browser usage, so it is relevant to this comparison. And regardless of if you care about latency as the most important metric, we're still talking about an NTP design trying to be rammed onto a DNS design. You'd started by talking about a replacement for the quadX anycasted RDNS services. I'm curious how you think that maps to pool.ntp.org. If you are talking about widely distributed anycast, whose address space and infrastructure are you planning on using and who will deal with all the peering to get the anycast announced? If you're not talking about using one single pair of anycast v4 and pair of v6 but using whatever local unicast addrs are available, how are you getting it to clients? That's why I mentioned client OS changes. Unless you're planning to try to get this into CPE routers? If you think the browser will be doing it, how will the browser get said addrs and how will a user see this and get a choice? ebersman> There is a reason that there are a very limited number of ebersman> large open recursive DNS services well anycasted, well ebersman> distributed and well run. It's not because being centralizes ebersman> was the primary goal; it's because it's expensive and ebersman> difficult. paul> Mostly due to UDP reflection/amplification attacks, which are not paul> present if your open resolver runs with DNS COOKIES or TCP, which paul> it will when using DoT or DoH. (note I am running an open resolver paul> for the last 15 years. It does not see much downtime at all. No. Mostly due to the expense of being in dozens of data centers around the world to be sufficiently distributed, the cost or connections to get all the IXs or transit providers to accept your BGP announcements of your anycast and the staff to watch that 7x24. If you're not doing that, you're not a valid comparis to the quadX folks at all. So, love to hear how a pool.ntp.org clone would actually work for DNS and be better than running a local resolver. From nobody Tue Jul 30 14:49:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DDE0120111 for ; Tue, 30 Jul 2019 14:49:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UpgXTqN33o2Z for ; Tue, 30 Jul 2019 14:49:23 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F1D1120074 for ; Tue, 30 Jul 2019 14:49:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1564523347; x=2428436947; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=YGfpS8bKVBLZH8dgldBNoCGTLE0oe9karGsFANQ9ArM=; b=DYgfuwcMqD/rKEr8Ze+yz8HBaYGu2QbB13wWg5AWbp5Or6R+b1d0QkAPxsbSrNIK IgL86mnWTnrfMU7vmfta1EofDwGcMF7Kq/0X2xahzoIuj1Kw8BsVuYUyje1DxN5w SnaP200K0AfeYM61o1tyCleIOyFn86DRJfWMzl810TOUnfkFAmdEIVB3wZL3TD/U BXFzkwtG/as+y+fqP+T0pWtuP4HjqlLIGMHUZDzqmDm+GqbIE6eEXezFNqt0GzD+ 1P31ziAwre5Tcw2sPoDvvJPMl9C2yT1VA+/pghstPmAxjgKhQ7lfChp3HaLKtd/t JYaBFapWAcbV9Nx7Uen66g==; X-AuditID: a2962c47-ab9ff7000002e144-9d-5d40bb53fe75 Received: from copdcexc33.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 3E.F9.57668.35BB04D5; Tue, 30 Jul 2019 15:49:07 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by copdcexc33.cable.comcast.com (147.191.125.132) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Tue, 30 Jul 2019 17:49:21 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Tue, 30 Jul 2019 17:49:21 -0400 From: "Livingood, Jason" To: Adam Roach , "add@ietf.org" Thread-Topic: [Add] meeting hum: should the IETF take up this work? Thread-Index: AQHVQaQWSIb2oY9ssEeUjC1jPdmyRKbZCskAgAABXACAAAQtgIABMd6AgAD6woCAAGikAIAIF/KA Date: Tue, 30 Jul 2019 21:49:21 +0000 Message-ID: <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [68.87.29.9] Content-Type: text/plain; charset="utf-8" Content-ID: <1A22C91B6F65D84D87AF74B69A5C4D61@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprLKsWRmVeSWpSXmKPExsWSUDRnsm7wbodYg9V/TS32/F3EbvH/9Do2 ByaPJUt+MnnM2vmEJYApqoHRpiSjKDWxxCU1LTWvONWOSwED2CSlpuUXpbomFuVUBqXmpCZi VwZSmZKak1mWWqSP1Rh9rOYkdDFlPJ22k63gBF/FtSPr2RoYZ/B1MXJySAiYSPTtWcPexcjF ISRwhEniysnZUE4Lk8TS/WcZIZzTjBJHrj1hBmlhEzCTuLvwCpgtIuAgMf3/FRYQW1jASWLp /cXsEHFnicdbPzFC2FESM593sILYLAKqEo+aPoDZvAIuEnMWnYZasIRZYubFv2wgCU4Be4lX V76ALWAUEJP4fmoNE4jNLCAucevJfCaIuwUkluw5zwxhi0q8fPwPbKiogL7El3ObWCDichLL ft4BquEA6tWUWL9LH2KMlcTGhUdYIWxFiSndD9kh7hGUODnzCVSruMThIztYJzBKzEKyeRbC pFlIJs1CMmkWkkkLGFlXMfIamhnpGZoa6JmY6JkbbmIEJppF03TcdzB+OB97iFGAg1GJh7d9 qUOsEGtiWXFl7iFGCQ5mJRHexeL2sUK8KYmVValF+fFFpTmpxYcYpTlYlMR5D0/WiBUSSE8s Sc1OTS1ILYLJMnFwSjUwevzY8mS2+a/bf51Nclzebpv1PmB/3+Xked7fSli/ikY+O6okH9uw dYF9iM6xfINp3UG7anWXWrDeYGR5Fr360MkMp5rL+vynoguiO1N4tsxkm8275NPBdacPdl60 j7rmtkamMMf9ybanO89eLXL4vOzZTqPLGjPm5e05sbOom++smpLaxSJmViWW4oxEQy3mouJE ALhb1+QwAwAA Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 21:49:26 -0000 T24gNy8yNS8xOSwgMTA6MTIgQU0sICJBZGQgb24gYmVoYWxmIG9mIEFkYW0gUm9hY2giIDxhZGQt Ym91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YgYWRhbUBub3N0cnVtLmNvbT4gd3JvdGU6DQo+ IFlvdSBjYW4gc2VlLCBmb3IgZXhhbXBsZSwgQ2xvdWRmbGFyZSdzIGFzc29jaWF0ZWQgcHJpdmFj eSANCiAgICBwb2xpY3kgYXQgaHR0cHM6Ly9kZXZlbG9wZXJzLmNsb3VkZmxhcmUuY29tLzEuMS4x LjEvY29tbWl0bWVudC10by1wcml2YWN5L3ByaXZhY3ktcG9saWN5L2ZpcmVmb3gvIA0KIA0KW0pM XSBUaGlzIHNwZWFrcyB0byB0aGUgRE5TIHF1ZXJ5L3Jlc3BvbnNlLiBCdXQgd2l0aCBEb0gsIHRo aXMgaXMgY29udGFpbmVkIGluc2lkZSBvZiBhbiBIVFRQIGVudmVsb3BlLCBzbyB0byBzcGVhaywg d2hpY2ggaGFzIG11Y2ggbW9yZSByaWNoIHRyYWNraW5nIC0gbm90ZWQgYXQgaHR0cHM6Ly93d3cu Y2xvdWRmbGFyZS5jb20vcHJpdmFjeXBvbGljeS8gdW5kZXIgd2Vic2l0ZSB2aXNpdG9ycyAod2hp Y2ggSSBwcmVzdW1lIGFwcGxpZXMgdG8gYWxsIEhUVFAgdHJhbnNhY3Rpb25zKS4gU28gdGhlIGNv bmZsdWVuY2Ugb2YgRE5TIGFuZCBIVFRQIGhlcmUgc2VlbXMgaW50ZXJlc3RpbmcgdG8gYmV0dGVy IHVuZGVyc3RhbmQgYW5kIGRvY3VtZW50IGFzIFRSUi1zdHlsZSBwb2xpY2llcyBldm9sdmUuIFNp bmNlIHRoZXJlIGlzIGFuIEhUVFAgc2VydmVyIGludm9sdmVkIGluIERvSCwgcHJlc3VtYWJseSBh bGwgdGhlIG5vcm1hbCBIVFRQIGxvZyBpdGVtcyBhcmUgc2VlbiAmIHByb2Nlc3NlZCBhbmQgY2Fu IGJlIGxvZ2dlZCwgbGlrZSB1c2VyIGFnZW50LCBjb29raWVzLCBhbmQgc28gb24uDQoNCltKTF0g SW4gYWRkaXRpb24sIEkgc3VzcGVjdCBhIGNvbmNlcm4gKGZvciB0aGUgdmVyeSBoaWdoIHNjYWxl IGNlbnRyYWxpc2VkIERvSCBwbGF0Zm9ybXMpIGlzIG5vdCBqdXN0IHRoZSBwZXItdXNlciBwcml2 YWN5IHBvbGljeSBidXQgYWxzbyB3aGF0IGFnZ3JlZ2F0ZWQgYnVzaW5lc3MgaW50ZWxsaWdlbmNl IGEgZ2xvYmFsIHNjYWxlIHBsYXRmb3JtIHdvdWxkIGJlIGFibGUgdG8gZGV2ZWxvcCAoZS5nLiBv ZiBhIHBvcHVsYXRpb24gb2YgNTAwTSB1c2VycywgaG93IG1hbnkgaGF2ZSBxdWVyaWVkIGZvciAq Lm5ldGZsaXguY29tIGluIHRoZSBwYXN0IE4gaG91cnMsIGJ5IGNvdW50cnksIEFTTiwgdXNlciBh Z2VudCwgZXRjLiksIHJlbGF0aXZlIHRvIGNvbXBldGl0b3JzIG9yIHBvdGVudGlhbCBjb21wZXRp dG9ycy4gU28gSSBzdXNwZWN0IHRoZXNlIGNvbmNlcm5zIG1heSBhcmlzZSwgYXQgbGVhc3QgZm9y IHBsYXRmb3JtcyBvZiB2ZXJ5IGhpZ2ggc2NhbGUgLyBwZW5ldHJhdGlvbi4gIA0KDQo= From nobody Tue Jul 30 15:11:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8771B1200C5 for ; Tue, 30 Jul 2019 15:11:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jrKSumiear78 for ; Tue, 30 Jul 2019 15:11:02 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 005FE120045 for ; Tue, 30 Jul 2019 15:11:01 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id 0885D37401E4; Tue, 30 Jul 2019 15:11:00 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id C71B315E88D1; Tue, 30 Jul 2019 16:11:00 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id C2C8F15E88D0; Tue, 30 Jul 2019 16:11:00 -0600 (MDT) From: Paul Ebersman To: "Livingood, Jason" cc: add@ietf.org In-reply-to: <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> Comments: In-reply-to "Livingood, Jason" message dated "Tue, 30 Jul 2019 21:49:21 -0000." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <65250.1564524660.1@fafnir.local> Content-Transfer-Encoding: quoted-printable Date: Tue, 30 Jul 2019 16:11:00 -0600 Message-Id: <20190730221100.C71B315E88D1@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 22:11:03 -0000 aroach> policy at https://developers.cloudflare.com/1.1.1.1/commitment-to-= privacy/privacy-policy/firefox/ = = JLivingood> This speaks to the DNS query/response. But with DoH, this is JLivingood> contained inside of an HTTP envelope, so to speak, which has JLivingood> much more rich tracking - noted at JLivingood> https://www.cloudflare.com/privacypolicy/ under website JLivingood> visitors (which I presume applies to all HTTP JLivingood> transactions). So the confluence of DNS and HTTP here seems JLivingood> interesting to better understand and document as TRR-style JLivingood> policies evolve. Since there is an HTTP server involved in JLivingood> DoH, presumably all the normal HTTP log items are seen & JLivingood> processed and can be logged, like user agent, cookies, and JLivingood> so on. Indeed. While things like java going away and more users trying to use privacy badger and other things to make browser fingerprinting less accurate, it's still scarily accurate. Being able to tie DNS queries and individual browsers is yet another step down that slippery slope to privacy loss. From nobody Wed Jul 31 00:56:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 806D91200C3 for ; Wed, 31 Jul 2019 00:56:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zh5b-ylZKkc2 for ; Wed, 31 Jul 2019 00:56:40 -0700 (PDT) Received: from mail-io1-xd43.google.com (mail-io1-xd43.google.com [IPv6:2607:f8b0:4864:20::d43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC50A120098 for ; Wed, 31 Jul 2019 00:56:39 -0700 (PDT) Received: by mail-io1-xd43.google.com with SMTP id o9so30688174iom.3 for ; Wed, 31 Jul 2019 00:56:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=JewZzA9f2DfXbZ0owRem8QgTtL7CotFIeatkkGsaxVA=; b=ebRAo8C3jr55NXiJTjIU1HVZJDyxrB0RTWDKHALGxrb0hBHxdR4smcZvY9emU76Dqw WizlCvaeRkqJaLl2jpn69Mrc4DPfQ275sgxyOrw4viFFNNtbkUMVnfHeOiZFo9OIeu+u lkdKZ5rzK9QtZrTtgCxQRTGWSUUNsLCCf+QZ/0E1HoumYBdmIWWGJxmOcoB+QcPwmIpt W9pQ0T84zi2+CN92s0TD6Mf4TJNiaapAIVOZ1tthobjWb0MDyLW0rHGMvajv6p9N170N qorJRP+JyPjBsbWWVh+mYeb6OmVizUD8+poFDKjigMnhEISEN4J4lVzDrbiY8JM3SqTW HG2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JewZzA9f2DfXbZ0owRem8QgTtL7CotFIeatkkGsaxVA=; b=RdwNbzUlCZVgSyCwjgZiiqRmpX9YfNoIRQDj8Im4kkNSqHtzUtVX63zgbj6p2jKfh0 LJ3v/LL+DVTn/2VtMRkqdIMcR0UnBV5ogYmKr0PHjqGbJlzTZqOwRpS+5encBrfg0eMp 83ZfWZQf+MRJmMakQWs2ueRkjXgjzAI2Q7FBiN1JtFG2BNYKu+z4PMsLNP21p79hhBIy Mep9ytSkFyP5kr6r9hdYXK2E5r+H4Pf6AsWt0lHcxvFVDjQXguKGpnsbPxySsPPxdhCv nu/Wrsj5v6ofuhiclRnTOcJaPorTnLKgIsh9NByBs7WPCzTq7i0wBZ+Q5Mjc37U9kxuQ 16rw== X-Gm-Message-State: APjAAAWROTw2ek9xNtz3RVjVbIUQ0FOHkFvwTvw92DvLZp+9my0Oon5N 64pU2WVK5mrV5zbBA3uRBiE5Ee9zv5jm3Jd6o6s= X-Google-Smtp-Source: APXvYqwNGuRSint23FoRhgQKkM0qwTQpTjVTnXSiPTEc7a+zMn7pzNz/4or7bL9SxGRd79Nxw6SCseNOU0A6WmDRKxs= X-Received: by 2002:a02:5a02:: with SMTP id v2mr120541663jaa.124.1564559799162; Wed, 31 Jul 2019 00:56:39 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> <20190730221100.C71B315E88D1@fafnir.remote.dragon.net> In-Reply-To: <20190730221100.C71B315E88D1@fafnir.remote.dragon.net> From: Rob Sayre Date: Wed, 31 Jul 2019 00:56:27 -0700 Message-ID: To: Paul Ebersman Cc: "Livingood, Jason" , add@ietf.org Content-Type: multipart/alternative; boundary="0000000000000f1c18058ef577b9" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 07:56:42 -0000 --0000000000000f1c18058ef577b9 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 30, 2019 at 3:11 PM Paul Ebersman wrote: > Being able to tie DNS queries and individual browsers is yet another step down that slippery slope to privacy loss. Well, browsers are actively working on fingerprinting. Another situation to consider: maybe operating systems will start shipping their own default DNS servers. It doesn't seem like that would be out of bounds for ChromeOS or iOS, for example. They already rely on several online services. It also seems like they would probably make enterprise/parental controls available, since they already do that. It looks like we're considering a legacy case, where the local network provider runs an unencrypted DNS server. I don't think there's anything for the IETF to do here, as I wrote at the very beginning of this thread. thanks, Rob --0000000000000f1c18058ef577b9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On Tue, Jul 30, 2019 at 3:11 PM Paul Eber= sman <list-add@dragon.net>= wrote:
    > Being able to tie DNS queries and indivi= dual browsers is yet another step down that slippery slope to privacy loss.=

    Well, browsers are actively working o= n fingerprinting.

    Another situation to consider: m= aybe operating systems will start shipping their own default DNS servers. I= t doesn't seem like that would be out of bounds for ChromeOS or iOS, fo= r example. They already rely on several online services. It also seems like= they would probably make enterprise/parental controls available, since the= y already do that.

    It looks like we're conside= ring a legacy case, where the local network provider runs an unencrypted DN= S server. I don't think there's anything for the IETF to do here, a= s I wrote at the very=C2=A0beginning of this thread.

    thanks,
    Rob

    --0000000000000f1c18058ef577b9-- From nobody Wed Jul 31 05:12:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE56A120156 for ; Wed, 31 Jul 2019 05:12:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EbMTfIaYkrpf for ; Wed, 31 Jul 2019 05:12:03 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFF55120153 for ; Wed, 31 Jul 2019 05:12:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1564575121; x=2428488721; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=n88HpcOnrHXBbo0JrycAUhH9O4phZPXeLSxB3krU0m8=; b=Kx56+akw6Q0dCYQEgsggNUTu+2+rbrlpX5jG2RG+6bkjcsgc703HVhrhv0MLvvJn o5l7O9w570TdPxG/uV0wiTuiwtvDmoTapY7pmt9ChftMCz4Lb82Xq3dpJ4jxcoeD zU8bc9cI2PD1DituaVKxs2D1c4lzvlJn0ZeDpW3JmGL1hqE7xUb61d8cINNbPlr5 ujsuOYW3Cz9JoHsE3aN7XXv+xv/d+mhwKCwMmFDoTocfX0cHrCeKbMS4ol9yfdAU Ap2z0HUfqp8jrtmueDA3tg5uI9sFZf5cnmPKDI/FS0Ag1PS8p9NZl1CmFl4n1wVc o8ZflYOMu9lHHifX/HXklA==; X-AuditID: 60729ed4-227ff700000013e0-85-5d4185913a49 Received: from COPDCEXC36.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 78.41.05088.195814D5; Wed, 31 Jul 2019 06:12:01 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC36.cable.comcast.com (147.191.125.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Wed, 31 Jul 2019 08:12:00 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Wed, 31 Jul 2019 08:12:00 -0400 From: "Livingood, Jason" To: Paul Wouters , ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRBOC3ti8Rb/3OkuCKX8Zf7Korabe21IAgAAO7QCAACA1AIABBgcAgAAx2YCAAAPxgIABdoiAgALtVgA= Date: Wed, 31 Jul 2019 12:12:00 +0000 Message-ID: <2BF62C0F-B2E9-4E09-9B50-4E592EF6691F@cable.comcast.com> References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [96.114.156.7] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprFKsWRmVeSWpSXmKPExsWSUDRnsu7EVsdYg3lP1Cz+n17HZvH+1iUm ByaPJUt+Mnl8n8cUwBTVwGhTklGUmljikpqWmlecaselgAFsklLT8otSXROLciqDUnNSE7Er A6lMSc3JLEst0sdqjD5WcxK6mDLud91jKljAXjHp8zPGBsYO9i5GTg4JAROJ9h+H2boYuTiE BI4wSdy/NQfKaWGSuPziNyuEc5pRYk37ZlaQFjYBM4m7C68wg9giAk4Sje+fg9nCAmkSryd1 M0HE0yU+zj7GCGEnSbyb+gZsHYuAqsT7XY/B5vAKuEjMOrgULC4kcJBNYv52sDmcArYSDbf+ sYDYjAJiEt9PrQGbySwgLnHryXwmiLMFJJbsOc8MYYtKvHz8D2ymqIC+xJdzm1gg4goSPROm A9VwAPVqSqzfpQ9hWkmcW6sBMVFRYkr3Q3aIawQlTs58AtUpLnH4yA7WCYwSs5AsnoUwaBbC oFlIBs1CMmgBI+sqRj5LMz1DQxM9Q1MLPSNDo02M4BQz78oOxsvTPQ4xCnAwKvHwhhU5xgqx JpYVV+YeYpTgYFYS4V0sbh8rxJuSWFmVWpQfX1Sak1p8iFGag0VJnDdvr06skEB6Yklqdmpq QWoRTJaJg1OqgbHFdNbzT28/eet997089bE63+aelH9/tc1PzHfQbUvUjNjGkFZ0tuR07QwR Lteoubm/JZ+oaTbPYd18olYy99fDY9ul87tuqR87XmK62CiqxUjg/6s/SYm5c4J+u0/YbC1/ hr3bqUMthPd03M1dP+PvRWtv594zsyiIf33xTe8pjc1rVhX/na/EUpyRaKjFXFScCACgcCw0 LQMAAA== Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 12:12:05 -0000 T24gNy8yOS8xOSwgNzozMCBBTSwgIkFkZCBvbiBiZWhhbGYgb2YgUGF1bCBXb3V0ZXJzIiA8YWRk LWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIHBhdWxAbm9oYXRzLmNhPiB3cm90ZToNCj4g ICAgSeKAmW0gbm90IGEgZmFuIG9mIHRoZSBjZW50cmFsaXphdGlvbi4gSSBhbSBhIGZhbiBvZiBy ZW1vdmluZyBibGluZCB0cnVzdCBvbiB1bmtub3duIHBhcnRpZXMuIA0KDQpUaGUgcG90ZW50aWFs IGZvciBhbiB1bmtub3duIHBhcnR5IHNlZW1zIHRvIGFyaXNlIHdoZW4gYW4gYXBwIGNoYW5nZXMg ZnJvbSB0aGUgdXNlcidzIHR5cGljYWwgcmVzb2x2ZXIgdG8gc29tZSB1bmtub3duLXRvLXRoZS11 c2VyIHBhcnR5LCBzbyBJIGFncmVlIHRoaXMgaXMgYSByaXNrLiBBbmQgSSBhbHNvIGZlZWwgaXQg aXMgaGlnaCB0aW1lIHdlIGFsbCwgc3Ryb25nbHksIHB1c2ggYmFjayBvbiB0aGUgZHJhbWF0aWMg cmlzZSBhbmQgcG90ZW50aWFsIGZ1dHVyZSBjb250aW51YXRpb24gdG93YXJkcyBjb25zb2xpZGF0 aW9uL2NlbnRyYWxpc2F0aW9uLiBUaGlzIHNlZW1zIGFuIHVuYWNjZXB0YWJsZSBzdGF0ZSBmb3Ig dGhlIEludGVybmV0IGFuZCBmb3Igc29jaWV0eSwgYW5kIHdlIGNhbid0IGp1c3Qgc2hydWcgaXQg b2ZmIC0gd2UgaGF2ZSBhIHJvbGUgdG8gcGxheSBoZXJlIHRvbyBJTU8uICANCiANCg0K From nobody Wed Jul 31 05:26:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04936120165 for ; Wed, 31 Jul 2019 05:26:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HKeFW-RlfLEi for ; Wed, 31 Jul 2019 05:26:11 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 12B201200F9 for ; Wed, 31 Jul 2019 05:26:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1564575954; x=2428489554; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=hn7xJ/eicsDX8qQi1PqLv5brO/u39n1pNylhgQsiQJk=; b=NBf39gbspwWrkm6dphXuLBFw5kfqPB7OM7SDQFDe8ACiuGa93vSBrlej3Q/CUQCu dgNa7/ou6T+gT6ABO+04n7lMOYEy5q0chBCaIv1rZzKZWZuJyiMNMJNA4byEV7ES eBr2x2EeQQGk7GHYSGV3BUlfE4VzfBKhBFssh4wiQa0BVBIXvMt3mlC1+iXGqjVA z0YFQkW7r+xl6QqZeAcYeitGevQHn27891AOK4PskE2Qk1A0qo/X4z847MY6an7q IrtroxAfzyxDP2kxs4IlufhuP3KV+iA6K2V0Yg2xEljTYqIsVhb0fGT58pUMyTR4 B85YhISl2EtukJcKoQsLxQ==; X-AuditID: a2962c47-a9fff7000002e144-35-5d4188d2a9af Received: from COPDCEXC38.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 30.9A.57668.2D8814D5; Wed, 31 Jul 2019 06:25:54 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC38.cable.comcast.com (147.191.125.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Wed, 31 Jul 2019 08:26:08 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Wed, 31 Jul 2019 08:26:08 -0400 From: "Livingood, Jason" To: Eric Rescorla , ADD Mailing list Thread-Topic: [Add] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVR5shjLoCJeXgaUezjs9lZQKVaA== Date: Wed, 31 Jul 2019 12:26:08 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [68.87.29.9] Content-Type: multipart/alternative; boundary="_000_C3CF1B14720D495088F9AD868259CFBBcablecomcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupnleLIzCtJLcpLzFFi42JJKJozWfdSh2OswZ2nBhb/T69js1jx+hy7 A5PHkiU/mTwmP25jDmCKamC0KckoSk0scUlNS80rTrXjUsAANkmpaflFqa6JRTmVQak5qYnY lYFUpqTmZJalFuljNUYfqzkJV5gyVlx5xViwz6/izN/TzA2MS326GDk5JARMJLaeWsTaxcjF ISRwhElixZE2dpCEkEALk8TRLhOIxGlGiZ1r7zKBJNgEzCTuLrzCDGKLCDhKNG+YzQJiCwtE S0z/uZwRIh4j0bbrKROErSfxffpMoBoODhYBVYnPH+xBwrwCLhJbd6wC28UoICbx/dQasHJm AXGJW0/mM0EcJyCxZM95ZghbVOLl43+sILaogL7El3ObWCDichLLft5hhuhNl1j0aQ4zxHxB iZMzn0DViEscPrKDdQKjyCwkK2YhaZmFpGUW0KXMApoS63fpQ5QoSkzpfsgOYWtItM6ZC2Vb Sdxp/saMrGYBI8cqRl5DMyM9Q1MDPRMTPXPDTYzAZLJomo77DsYP52MPMQpwMCrx8C4sdIwV Yk0sK67MPcQowcGsJMK7WNw+Vog3JbGyKrUoP76oNCe1+BCjNAeLkjjv4ckasUIC6Yklqdmp qQWpRTBZJg5OqQbGIK/DZwK4wtKZM9RFtB2sz6vVpU6aP+NU797km2+DRctzUmw942YICv71 ku5yeaWqw3f1cJzqLe4j+QwiuhutTTqTwgtieNYYrd2sdsvY6e7aUvmZYrViHenblXUu9P14 eveV1aXK22br+hO+aZayJkYnTd9yqIPRdI2xxvmQRcdfBPCKrFFiKc5INNRiLipOBADHFxZd IgMAAA== Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 12:26:13 -0000 --_000_C3CF1B14720D495088F9AD868259CFBBcablecomcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RnJvbTogQWRkIDxhZGQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIEVyaWMgUmVzY29y bGEgPGVrckBydGZtLmNvbT4NCj4gQXMgSSBzYWlkIGluIE1vbnRyZWFsLCBpdCdzIG5vdCBsaWtl IHRoZSB1c2VyIHdhcyBjb25zdWx0ZWQgcmVnYXJkaW5nIHRoZSB1c2Ugb2YgdGhlIG5ldHdvcmsg cHJvdmlkZWQgcmVzb2x2ZXIuDQoNCkROUyByZXNvbHZlciBJUHMgaGF2ZSBhbHdheXMgYmVlbiBh c3NpZ25lZCBieSBESENQIG9yIG90aGVyIG5ldHdvcmsgYm9vdHN0cmFwcGluZyBtZXRob2QuIFRo aXMgaXMgd2hhdCB1c2VycyBleHBlY3QgYW5kIHJlcXVpcmUgaW4gb3JkZXIgdG8gaGF2ZSB3b3Jr aW5nIEludGVybmV0IGFjY2Vzcy4gSVNQcyDigJMgYW5kIG90aGVyIG5ldHdvcmsgb3BlcmF0b3Jz IC0gdGFrZSB0aGUgcGVyc3BlY3RpdmUgdGhhdCBwcm92aWRpbmcgRE5TIGlzIGEga2V5IHBhcnQg b2YgcHJvdmlkaW5nIEludGVybmV0IHNlcnZpY2VzLCB0aGV5IHByb3ZpZGUgdXNlciBzdXBwb3J0 IGZvciB0aGlzLCBoYXZlIEZBUXMsIGFyZSBib3VuZCBieSBhcHBsaWNhYmxlIHBvbGljaWVzIGFu ZCBsZWdhbCBhZ3JlZW1lbnRzIHdpdGggdXNlcnMsIGJvdW5kIGJ5IGxvY2FsIHJlZ3VsYXRpb24v bGF3LCBldGMuIE1vemlsbGEgdGFrZXMgYSBkaWZmZXJlbnQgcGVyc3BlY3RpdmUgdGhhdCB0aGVz ZSBhcmUgc2VwYXJhYmxlLCBhbmQgdGhhdCBtYXR0ZXIgaGFzIGFyaXNlbiBpbiBpbnRlcmVzdGlu ZyB3YXlzIGluIHRoZSBNb3ppbGxhIHYuIEZDQyBjYXNlIHdoaWNoIGlzIGN1cnJlbnRseSBvbi1n b2luZyAoc2VlIFNlY3Rpb24gMiBvZiBodHRwczovL2Jsb2cubW96aWxsYS5vcmcvd3AtY29udGVu dC91cGxvYWRzLzIwMTgvMTEvYXMtZmlsZWQtTW96aWxsYS12LUZDQy1Kb2ludC1SZXBseS1Ccmll Zi0xNk5vdjIwMTgucGRmKS4gSXQgc2VlbXMgdG90YWxseSBmaW5lIHRvIG1lIHRoYXQgdGhlcmUg YXJlIGRpZmZlcmVudCBwZXJzcGVjdGl2ZXMgaGVyZSBhcyBpbiBhbGwgdGhpbmdzIGluIGxpZmUs IGFuZCBpdCBpcyBjb21wbGV0ZWx5IG5vcm1hbCBmb3IgdGhlcmUgdG8gYmUgdGVuc2lvbiBiZXR3 ZWVuIGRpZmZlcmVudCB0ZWNobmljYWwgYXBwcm9hY2hlcy4gUGVyaGFwcyB3ZSBjYW4gYWNrbm93 bGVkZ2UgdGhlcmUgYXJlIGRpZmZlcmVudCBwZXJzcGVjdGl2ZXMgaGVyZSBhbmQgbW92ZSBvbiDi gJMgdGhpcyBjZXJ0YWlubHkgd29u4oCZdCBiZSBzb2x2ZWQgb24gdGhpcyBsaXN0LCBpbiBvbmUg Y291cnQgY2FzZSwgYXQgdGhlIElFVEYsIGV0Yy4NCg0KPiBBcyBhIGdlbmVyYWwgbWF0dGVyLCB1 c2VycyBhcmVuJ3QgYXdhcmUgb2YgRE5TIGF0IGFsbC4NCg0KV2hpY2ggaXMgYXMgaXQgcGVyaGFw cyBzaG91bGQgYmUuIFVzZXJzIGtub3cgd2hlbiBETlMgYnJlYWtzIOKAkyB0aGV5IGRlc2NyaWJl IGl0IGFzIHRoZSBJbnRlcm5ldCBub3Qgd29ya2luZy4gVGhpcyBpcyBwZXJoYXBzIGFuIGFyZ3Vt ZW50IHRoYXQgaXQgaXMgaW5leHRyaWNhYmx5IGxpbmtlZCBpbiB0aGUgbWluZCBvZiB1c2VycyAo bm90IElFVEbigJllcnMpIHdpdGggSW50ZXJuZXQgYWNjZXNzIHNlcnZpY2VzLiBCdXQgYXMgSSBz YWlkIGFib3ZlLCBpdCBzZWVtcyB1bmxpa2VseSB0aGUgbWFueSBkaWZmZXJlbnQgcGVyc3BlY3Rp dmVzIGV4cHJlc3NlZCBvbiB0aGUgbGlzdCB3aWxsIHNvb24gY29udmVyZ2UgYW5kIGV2ZXJ5b25l IGFncmVlLiBOb3Qgc3VyZSB3aGVyZSB0byBnbyBmcm9tIGhlcmUg4oCTIG90aGVyIHRoYW4gZm9y IHVzIGFsbCB0byB0YWtlIGEgc3RlcCBiYWNrLCBhY2tub3dsZWRnZSAmIHJlc3BlY3Qgb3VyIGRp ZmZlcmluZyB2aWV3cG9pbnRzLCBhbmQgbW92ZSBvbiB0byBzb21ldGhpbmcgbW9yZSBwcm9kdWN0 aXZlLiA6LSkNCg0KDQoNCg0KDQoNCg== --_000_C3CF1B14720D495088F9AD868259CFBBcablecomcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: <9C51131D1353CA4AA5CC0DD64A994804@comcast.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIFwoQm9keSBD U1wpIjsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAyIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0 aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJn aW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxp bmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0 aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2 Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6 MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxl ZnQ6LjVpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlv bjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGlu O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48 IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNw aWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHht bD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBk YXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0K PGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFz cz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5BZGQgJmx0O2FkZC1ib3VuY2VzQGlldGYu b3JnJmd0OyBvbiBiZWhhbGYgb2YgRXJpYyBSZXNjb3JsYSAmbHQ7ZWtyQHJ0Zm0uY29tJmd0Ozxi cj4NCjwvc3Bhbj4mZ3Q7IEFzIEkgc2FpZCBpbiBNb250cmVhbCwgaXQncyBub3QgbGlrZSB0aGUg dXNlciB3YXMgY29uc3VsdGVkIHJlZ2FyZGluZyB0aGUgdXNlIG9mIHRoZSBuZXR3b3JrIHByb3Zp ZGVkIHJlc29sdmVyLg0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjE0LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxNC4wcHQiPkROUyBy ZXNvbHZlciBJUHMgaGF2ZSBhbHdheXMgYmVlbiBhc3NpZ25lZCBieSBESENQIG9yIG90aGVyIG5l dHdvcmsgYm9vdHN0cmFwcGluZyBtZXRob2QuIFRoaXMgaXMgd2hhdCB1c2VycyBleHBlY3QgYW5k IHJlcXVpcmUgaW4gb3JkZXIgdG8gaGF2ZSB3b3JraW5nIEludGVybmV0IGFjY2Vzcy4gSVNQcyDi gJMgYW5kIG90aGVyIG5ldHdvcmsgb3BlcmF0b3JzDQogLSB0YWtlIHRoZSBwZXJzcGVjdGl2ZSB0 aGF0IHByb3ZpZGluZyBETlMgaXMgYSBrZXkgcGFydCBvZiBwcm92aWRpbmcgSW50ZXJuZXQgc2Vy dmljZXMsIHRoZXkgcHJvdmlkZSB1c2VyIHN1cHBvcnQgZm9yIHRoaXMsIGhhdmUgRkFRcywgYXJl IGJvdW5kIGJ5IGFwcGxpY2FibGUgcG9saWNpZXMgYW5kIGxlZ2FsIGFncmVlbWVudHMgd2l0aCB1 c2VycywgYm91bmQgYnkgbG9jYWwgcmVndWxhdGlvbi9sYXcsIGV0Yy4gTW96aWxsYSB0YWtlcyBh IGRpZmZlcmVudA0KIHBlcnNwZWN0aXZlIHRoYXQgdGhlc2UgYXJlIHNlcGFyYWJsZSwgYW5kIHRo YXQgbWF0dGVyIGhhcyBhcmlzZW4gaW4gaW50ZXJlc3Rpbmcgd2F5cyBpbiB0aGUgTW96aWxsYSB2 LiBGQ0MgY2FzZSB3aGljaCBpcyBjdXJyZW50bHkgb24tZ29pbmcgKHNlZSBTZWN0aW9uIDIgb2Yg aHR0cHM6Ly9ibG9nLm1vemlsbGEub3JnL3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDE4LzExL2FzLWZp bGVkLU1vemlsbGEtdi1GQ0MtSm9pbnQtUmVwbHktQnJpZWYtMTZOb3YyMDE4LnBkZikuDQogSXQg c2VlbXMgdG90YWxseSBmaW5lIHRvIG1lIHRoYXQgdGhlcmUgYXJlIGRpZmZlcmVudCBwZXJzcGVj dGl2ZXMgaGVyZSBhcyBpbiBhbGwgdGhpbmdzIGluIGxpZmUsIGFuZCBpdCBpcyBjb21wbGV0ZWx5 IG5vcm1hbCBmb3IgdGhlcmUgdG8gYmUgdGVuc2lvbiBiZXR3ZWVuIGRpZmZlcmVudCB0ZWNobmlj YWwgYXBwcm9hY2hlcy4gUGVyaGFwcyB3ZSBjYW4gYWNrbm93bGVkZ2UgdGhlcmUgYXJlIGRpZmZl cmVudCBwZXJzcGVjdGl2ZXMgaGVyZSBhbmQNCiBtb3ZlIG9uIOKAkyB0aGlzIGNlcnRhaW5seSB3 b27igJl0IGJlIHNvbHZlZCBvbiB0aGlzIGxpc3QsIGluIG9uZSBjb3VydCBjYXNlLCBhdCB0aGUg SUVURiwgZXRjLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTQuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7IEFzIGEgZ2VuZXJhbCBtYXR0ZXIsIHVzZXJzIGFy ZW4ndCBhd2FyZSBvZiBETlMgYXQgYWxsLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxNC4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTQu MHB0Ij5XaGljaCBpcyBhcyBpdCBwZXJoYXBzIHNob3VsZCBiZS4gVXNlcnMga25vdyB3aGVuIERO UyBicmVha3Mg4oCTIHRoZXkgZGVzY3JpYmUgaXQgYXMgdGhlIEludGVybmV0IG5vdCB3b3JraW5n LiBUaGlzIGlzIHBlcmhhcHMgYW4gYXJndW1lbnQgdGhhdCBpdCBpcyBpbmV4dHJpY2FibHkgbGlu a2VkIGluIHRoZSBtaW5kIG9mIHVzZXJzIChub3QgSUVURuKAmWVycykgd2l0aA0KIEludGVybmV0 IGFjY2VzcyBzZXJ2aWNlcy4gQnV0IGFzIEkgc2FpZCBhYm92ZSwgaXQgc2VlbXMgdW5saWtlbHkg dGhlIG1hbnkgZGlmZmVyZW50IHBlcnNwZWN0aXZlcyBleHByZXNzZWQgb24gdGhlIGxpc3Qgd2ls bCBzb29uIGNvbnZlcmdlIGFuZCBldmVyeW9uZSBhZ3JlZS4gTm90IHN1cmUgd2hlcmUgdG8gZ28g ZnJvbSBoZXJlIOKAkyBvdGhlciB0aGFuIGZvciB1cyBhbGwgdG8gdGFrZSBhIHN0ZXAgYmFjaywg YWNrbm93bGVkZ2UgJmFtcDsgcmVzcGVjdA0KIG91ciBkaWZmZXJpbmcgdmlld3BvaW50cywgYW5k IG1vdmUgb24gdG8gc29tZXRoaW5nIG1vcmUgcHJvZHVjdGl2ZS4gOi0pPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxNC4w cHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTQuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE0LjBwdCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxNC4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTQuMHB0Ij48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjE0LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Jv ZHk+DQo8L2h0bWw+DQo= --_000_C3CF1B14720D495088F9AD868259CFBBcablecomcastcom_-- From nobody Wed Jul 31 06:02:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B55E12011C for ; Wed, 31 Jul 2019 06:02:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pYB3CTbdrq1D for ; Wed, 31 Jul 2019 06:02:22 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB303120018 for ; Wed, 31 Jul 2019 06:02:21 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 6DB79B0; Wed, 31 Jul 2019 15:02:19 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1564578139; bh=OvxyIzCJdBm8DFeinWeDpj518WgPcYRB111WXe9WajQ=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=arzQvB29ZAkSaejiC3HEtWkyKKGSxT1B7LCuvs80x570FfqVSuLoIexCplxX3T4Ul TMf0nWQcOIPrVO+sIyuOTzxBAQ/i0bNEloryK13GxcZ9XX4vwn9bi0oS2H/uPYMqyg RV3U8C0LxoKptnru5l04MeyAwHlYhR2Ln2jL9fG4= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 6B66DAF; Wed, 31 Jul 2019 15:02:19 +0200 (CEST) Date: Wed, 31 Jul 2019 15:02:19 +0200 (CEST) From: Mikael Abrahamsson To: Eric Rescorla cc: ADD Mailing list In-Reply-To: Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 13:02:24 -0000 On Mon, 29 Jul 2019, Eric Rescorla wrote: > As I said in Montreal, it's not like the user was consulted regarding > the use of the network provided resolver. As a general matter, users > aren't aware of DNS at all. Indeed. This is how it's always been. They expect this to be part of their Internet access functionality. The ones who do not make explicit choices by configuring a VPN, enable incognito mode, run a TOR browser because they explicitly want to change how things work. The proposal from several parties now seems to be to change this without asking the user. This is a big change. The user might not want to share their DNS lookups with whatever DoH resolver that the browser vendor has chosen. How do you know? Putting me end-user hat on, I trust my ISP more than I trust any of the common quad-whatever DNS resolver operators out there. I do not want my DNS lookups to all of a sudden end up somewhere else without my explicit consent. I expect unless I am asked and explicitly accept to not follow my DHCP configured resolver, for that DHCP configured resolver to be used. Not anything else. I feel we're back in the bad old days where a browser would just change what default browser I want to use, just because I happened to install that browser. Those kinds of policy choices are for me explicitly to make, not for the browser vendor to do for me. I don't want the browser vendor to choose search engine for me and I don't want the browser vendor to choose DNS resolver for me, without asking. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Wed Jul 31 06:48:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5A6912004F for ; Wed, 31 Jul 2019 06:48:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n4YmUfZZyBmN for ; Wed, 31 Jul 2019 06:48:45 -0700 (PDT) Received: from mail-lf1-x12c.google.com (mail-lf1-x12c.google.com [IPv6:2a00:1450:4864:20::12c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CBEB0120018 for ; Wed, 31 Jul 2019 06:48:44 -0700 (PDT) Received: by mail-lf1-x12c.google.com with SMTP id h28so47473821lfj.5 for ; Wed, 31 Jul 2019 06:48:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=MOj21ndAxtMdrs7nnIBYhdz4n8rxja6Fxm8nkbY0fAg=; b=C+5n1IaXKKbqLq1Hf2m+ZhAcNV1dyt2jEPabXt7GVHGcrTayS7c0w1tfnb9ixtOZoz 5WVXelSlWqdu9vPMJEOIhx9K2Spu107Y1BGfaEBy/kLgOV/ofI1WFIvmR5aaCUKHEV2u MP/eDNEgFqSPG6Ith3XWRlAXaI2lOgUS/nRsdoQCAIh2vj02zqgzH5xMWgxsBCOIDwJk IWwGQuur9l30zniP2QWWHkTzHTmDCCkdG2wwRJ8fS3V8gdvdkbIjA4ZsBmpLkHn73ya8 NWLHljNjagcl2VNmFl7XhiUJHXXH+x1LIKnUooYCsmcZumcR5XEwv6WxHEnpq8FG05rD vadw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=MOj21ndAxtMdrs7nnIBYhdz4n8rxja6Fxm8nkbY0fAg=; b=OZBqwSk7qWI1kC/3JvH6ZgSBRAckX7GrJ4wjKzIeuEuEVEGpR2fe/ARQkim5AT/ykl t7VSK5wTx0z9xy+f5rKK2x1FwEMOOYLEkjyYwNJ0gql8Phme7RNQA4svqTAghWS5AW7+ xWhQ2VcJ9RO/lFFRkzMekSbNyWBPP13nWpFWJ+sCJ8MeScGM5NZuR7onZE7Yh3SWm/Yw 9/avZOFVKgxL/dIITyKgGNatydwhhA1g4SIlavtnCBIKQefIBRpxTuV6tqloudQsp336 LvwsH83zG6YtT6NFmIbxxsKhgHy3UD2rbISslTdFpxjJuN7+DARSLh1yBmUScNhfNjjA eLvQ== X-Gm-Message-State: APjAAAWxhBIzH139uC3cC1ewjOxd2dRaG9I4n0sR22NnTl7H0Gx0tWjj g+X5F42KtpwR0oG4G51DDJdNm5R0BAKqbR74S+g= X-Google-Smtp-Source: APXvYqyMuNcQNML4VV/Kibu3nx7oy0ZZvBTqKtFXNxQtYbiuBK0uTHWkftrdnSLj+hLoyed9XPLKOP33cmoIrq3xbKU= X-Received: by 2002:a19:4a50:: with SMTP id x77mr13808206lfa.91.1564580923072; Wed, 31 Jul 2019 06:48:43 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Wed, 31 Jul 2019 06:48:06 -0700 Message-ID: To: "Livingood, Jason" Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000247105058efa629f" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 13:48:47 -0000 --000000000000247105058efa629f Content-Type: text/plain; charset="UTF-8" On Wed, Jul 31, 2019 at 5:26 AM Livingood, Jason < Jason_Livingood@comcast.com> wrote: > *From: *Add on behalf of Eric Rescorla < > ekr@rtfm.com> > > As I said in Montreal, it's not like the user was consulted regarding > the use of the network provided resolver. > > > > DNS resolver IPs have always been assigned by DHCP or other network > bootstrapping method. > Well, at least recently. For quite some time, people got their IP addresses manually or via ARP and then manually configured their resolvers. But I agree that for a long time it's been via DHCP. This is what users expect and require in order to have working Internet > access. > I don't agree with this in two respects. First, the users don't expect it because they don't know about DHCP at all. Second, I think the evidence is pretty strong that they don't require it, given that plenty of people have their resolver configured to 8.8.8.8 or 1.1.1.1. Indeed, if it weren't the case that users could get working Internet access without their ISP providing it, then the present debate wouldn't be happening. -Ekr --000000000000247105058efa629f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Wed, Jul 31, 2019 at 5:26 AM Livin= good, Jason <Jason_Living= ood@comcast.com> wrote:

    From: = Add <add-bounces@ietf.org> o= n behalf of Eric Rescorla <ekr@rtfm.com>
    > As I said in Montreal, it's not like the user was consulted= regarding the use of the network provided resolver.

    =C2=A0<= /span>

    DNS resolver IPs have= always been assigned by DHCP or other network bootstrapping method.=


    Well, at least recently. F= or quite some time, people got their IP addresses manually or via ARP and t= hen manually configured their resolvers. But I agree that for a long time i= t's been via DHCP.


    This is what users expect and require in order to have workin= g Internet access.


    I= don't agree with this in two respects. First, the users don't expe= ct it because they don't=C2=A0 know about DHCP at all. Second, I think = the evidence is pretty strong that they don't require it, given that pl= enty of people have their resolver configured to 8.8.8.8 or 1.1.1.1. Indeed= , if it weren't the case that users could get working Internet access w= ithout their ISP providing it, then the present debate wouldn't be happ= ening.

    -Ekr
    --000000000000247105058efa629f-- From nobody Wed Jul 31 07:01:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A14812012E for ; Wed, 31 Jul 2019 07:01:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ptwDihC87Zfm for ; Wed, 31 Jul 2019 07:01:07 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3860A120077 for ; Wed, 31 Jul 2019 07:01:07 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id 028893740099; Wed, 31 Jul 2019 07:01:07 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id CDA3215EDF38; Wed, 31 Jul 2019 08:01:06 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id C6CAE15EDF37; Wed, 31 Jul 2019 08:01:06 -0600 (MDT) From: Paul Ebersman To: Eric Rescorla cc: "Livingood, Jason" , ADD Mailing list In-reply-to: References: Comments: In-reply-to Eric Rescorla message dated "Wed, 31 Jul 2019 06:48:06 -0700." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <80393.1564581666.1@fafnir.local> Date: Wed, 31 Jul 2019 08:01:06 -0600 Message-Id: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 14:01:09 -0000 ekr> I don't agree with this in two respects. First, the users don't ekr> expect it because they don't know about DHCP at all. Second, I ekr> think the evidence is pretty strong that they don't require it, ekr> given that plenty of people have their resolver configured to ekr> 8.8.8.8 or 1.1.1.1. Indeed, if it weren't the case that users could ekr> get working Internet access without their ISP providing it, then ekr> the present debate wouldn't be happening. Many users of 8.8.8.8 do so because they get it via DHCP. I'm seeing this much more often in captive portals, where said operator has decided not to do DNS themselves. Many local ISPs do the same. I seem to recall Vietnam being over 80% google for this reason? (Geoff Huston has done a couple of presos about this). From nobody Wed Jul 31 07:02:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8ECF7120018 for ; Wed, 31 Jul 2019 07:02:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IJSaKz1zSX46 for ; Wed, 31 Jul 2019 07:02:50 -0700 (PDT) Received: from mail-lj1-x22d.google.com (mail-lj1-x22d.google.com [IPv6:2a00:1450:4864:20::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CDEE912000E for ; Wed, 31 Jul 2019 07:02:49 -0700 (PDT) Received: by mail-lj1-x22d.google.com with SMTP id v24so65845532ljg.13 for ; Wed, 31 Jul 2019 07:02:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=o3aGReJLKAPVgdolHhHpNlX1lxdztKXgslLdMHOfEVc=; b=ct32CNSumCd6D1HddVPFgPAcddKXd1VQH56Y1x83JBQHvRC7/GKwm6tvn9gA28HoBL eUsWWZRj64GMCkdt2qnyfak8ZpdNs04wwWrWUrTkpMTBEDJ9GUDEZNM2kaJ09AmupyLl xnBWqPhfPZFQY7qeNxQ65lDS7JYRNRB9otGUHyrYz8ZB4U/+hXfFyMAJRqs+14XvAzCU dBtmvuML3DHsb3+OZjodQ76U+3urz30C+iaKX1m/w8Hn4N6gBtPSSO15e9QA/iEJdYRu b9Lt+lQZRq2GjkKdaJhKLZBQ05GPZQGaRL/Bi0K30pXeiFcvxH5BmNDgVjU7x0swowRL 9qpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=o3aGReJLKAPVgdolHhHpNlX1lxdztKXgslLdMHOfEVc=; b=X+iKOUZG5UDq9kkHUOagak+cvLgMt3/TyUuE5XpYbZleR8hqAfULasJTI5oEK94H/d nsASMBybR1oFdahaFu/w/dVqFGAnaNPz88RtwaMpoa8ED4OJg54y99+5fE3vel6iEWXx W0Fuz0ZwAyCrI7iXioICnTH8ttGI/T0ciSNFlbyCCa4UJ+ftfEg0sLBPVDHAwET8Ip4Z SnW7Ept9G2tFBkSZwoIrffyQGG7pPZEXp1269pEsHwQtH4n3XznxptGP41GtF1aAE8ig zccq4kgk/VcnHzf+LMhBjkXqc/IetrdTDWkNCnYja/6VQjQcobsGfUeaetk9PWURAqhN K1Sg== X-Gm-Message-State: APjAAAU8uoigXkg3gEGmTei7VasUHHXutTk6N+tnh1Af0aHRU6GcGmIR H6hfz6tOA8V+qad1At37/mk5l01El83D/cj6hOWJKw== X-Google-Smtp-Source: APXvYqxOSw+9gcRcZPa70GSULobMIBuAy2a6zqPM1dEHctSce/k3nFcRo+c7HFT/Sxagdu84DOvNVfiX0ch0yCioaoA= X-Received: by 2002:a2e:b0e6:: with SMTP id h6mr12550346ljl.18.1564581767996; Wed, 31 Jul 2019 07:02:47 -0700 (PDT) MIME-Version: 1.0 References: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> In-Reply-To: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> From: Eric Rescorla Date: Wed, 31 Jul 2019 07:02:12 -0700 Message-ID: To: Paul Ebersman Cc: "Livingood, Jason" , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000080f6d8058efa9474" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 14:02:52 -0000 --00000000000080f6d8058efa9474 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 31, 2019 at 7:01 AM Paul Ebersman wrote: > ekr> I don't agree with this in two respects. First, the users don't > ekr> expect it because they don't know about DHCP at all. Second, I > ekr> think the evidence is pretty strong that they don't require it, > ekr> given that plenty of people have their resolver configured to > ekr> 8.8.8.8 or 1.1.1.1. Indeed, if it weren't the case that users could > ekr> get working Internet access without their ISP providing it, then > ekr> the present debate wouldn't be happening. > > Many users of 8.8.8.8 do so because they get it via DHCP. Absolutely true, but I'm not sure why that matters. The fact is that many also manually configure it, and no matter how it is configured, it's not the ISP providing the service. -Ekr I'm seeing > this much more often in captive portals, where said operator has decided > not to do DNS themselves. Many local ISPs do the same. I seem to recall > Vietnam being over 80% google for this reason? (Geoff Huston has done a > couple of presos about this). > --00000000000080f6d8058efa9474 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Wed, Jul 31, 2019 at 7:01 AM Paul = Ebersman <list-add@dragon.net= > wrote:
    ekr&= gt; I don't agree with this in two respects. First, the users don't=
    ekr> expect it because they don't know about DHCP at all. Second, I<= br> ekr> think the evidence is pretty strong that they don't require it,=
    ekr> given that plenty of people have their resolver configured to
    ekr> 8.8.8.8 or 1.1.1.1. Indeed, if it weren't the case that users c= ould
    ekr> get working Internet access without their ISP providing it, then ekr> the present debate wouldn't be happening.

    Many users of 8.8.8.8 do so because they get it via DHCP.

    Absolutely true, but I'm not sure why that matters. The= fact is that many also manually configure it, and no matter how it is conf= igured, it's not the ISP providing the service.

    -Ekr


    I'm seeing
    this much more often in captive portals, where said operator has decided not to do DNS themselves. Many local ISPs do the same. I seem to recall
    Vietnam being over 80% google for this reason? (Geoff Huston has done a
    couple of presos about this).
    --00000000000080f6d8058efa9474-- From nobody Wed Jul 31 07:08:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56AD512006D for ; Wed, 31 Jul 2019 07:08:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eN4vJygLhV5v for ; Wed, 31 Jul 2019 07:08:23 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE0D412004F for ; Wed, 31 Jul 2019 07:08:21 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id 3F70A3740099; Wed, 31 Jul 2019 07:08:20 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id 488DA15EE1FF; Wed, 31 Jul 2019 08:08:20 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 41E8015EE1FE; Wed, 31 Jul 2019 08:08:20 -0600 (MDT) From: Paul Ebersman To: Eric Rescorla cc: "Livingood, Jason" , ADD Mailing list In-reply-to: References: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> Comments: In-reply-to Eric Rescorla message dated "Wed, 31 Jul 2019 07:02:12 -0700." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <80582.1564582100.1@fafnir.local> Date: Wed, 31 Jul 2019 08:08:20 -0600 Message-Id: <20190731140820.488DA15EE1FF@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 14:08:24 -0000 ebersman> Many users of 8.8.8.8 do so because they get it via DHCP. ekr> Absolutely true, but I'm not sure why that matters. The fact is ekr> that many also manually configure it, and no matter how it is ekr> configured, it's not the ISP providing the service. In some cases, like Vietnam, it is the ISP who chose 8.8.8.8 and the users just use it like any other DCHP supplied resolvers. I think the point is that while the quadX services are a measurable percentage of users, it's still not how the majority of the internet gets their resolvers, i.e. that the majority still don't knowingly choose their resolver or even know there are choices. From nobody Wed Jul 31 07:09:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E64C120018 for ; Wed, 31 Jul 2019 07:09:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BWfmbSUVXxPw for ; Wed, 31 Jul 2019 07:09:19 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7382F12000E for ; Wed, 31 Jul 2019 07:09:19 -0700 (PDT) Received: from pps.filterd (m0048208.ppops.net [127.0.0.1]) by m0048208.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x6VE7pPb027233 for ; Wed, 31 Jul 2019 10:09:18 -0400 Received: from usaoamgip001.mail.tfayd.com ([173.213.212.135]) by m0048208.ppops.net-00176a04. with ESMTP id 2u30q3fsr8-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 31 Jul 2019 10:09:18 -0400 Received: from unknown (HELO potemwp00004.mail.tfayd.com) ([10.40.78.204]) by usaoamgip001.mail.tfayd.com with ESMTP; 31 Jul 2019 10:07:32 -0400 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00041.mail.tfayd.com (100.124.56.65) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 31 Jul 2019 08:09:16 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00029.mail.tfayd.com (100.124.56.53) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 31 Jul 2019 08:09:14 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 31 Jul 2019 08:09:14 -0600 From: "Deen, Glenn (NBCUniversal)" To: Paul Ebersman CC: Eric Rescorla , "Livingood, Jason" , ADD Mailing list Thread-Topic: [EXTERNAL] Re: [Add] My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVR5shjLoCJeXgaUezjs9lZQKVaKblIogAgAADoQD//52yEw== Date: Wed, 31 Jul 2019 14:09:14 +0000 Message-ID: References: , <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> In-Reply-To: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-31_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907310144 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 14:09:21 -0000 > On Jul 31, 2019, at 8:01 AM, Paul Ebersman wrote: >=20 > Many users of 8.8.8.8 do so because they get it via DHCP. I'm seeing > this much more often in captive portals, where said operator has decided > not to do DNS themselves. Many local ISPs do the same. I seem to recall > Vietnam being over 80% google for this reason? (Geoff Huston has done a > couple of presos about this). Also worth noting it=92s hardcoded into chromecast devices as I recall.=20 Which also bumps up the numbers even on households/users that use the dhcp = provided dns.=20 Glenn = From nobody Wed Jul 31 07:11:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A5FE12006D for ; Wed, 31 Jul 2019 07:11:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QnAC64HXQ7E6 for ; Wed, 31 Jul 2019 07:11:51 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59B6112004F for ; Wed, 31 Jul 2019 07:11:51 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 0673B242109D; Wed, 31 Jul 2019 14:11:49 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 31 Jul 2019 15:11:48 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <8763F656-928B-49A8-B27F-431DCC02142F@rfc1035.com> References: To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [Add] quad-N usage data X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 14:11:52 -0000 > On 31 Jul 2019, at 14:48, Eric Rescorla wrote: >=20 > given that plenty of people have their resolver configured to 8.8.8.8 = or 1.1.1.1 While I'm sure that=E2=80=99s true, what data does Mozilla (or anyone = else) have to quantify just how big =E2=80=9Cmany people=E2=80=9D = actually is? Or for bonus points, how many of those many people made a = deliberate decision to use these resolvers instead of them being chosen = for them (DHCP, captive portal, browser confguration, etc)? Apologies too for a meaningful and relevant Subject: header. :-) From nobody Wed Jul 31 07:25:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4411F12011D for ; Wed, 31 Jul 2019 07:25:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yHCedx2vji9B for ; Wed, 31 Jul 2019 07:24:58 -0700 (PDT) Received: from mail-lf1-x12b.google.com (mail-lf1-x12b.google.com [IPv6:2a00:1450:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37DE812004F for ; Wed, 31 Jul 2019 07:24:58 -0700 (PDT) Received: by mail-lf1-x12b.google.com with SMTP id p197so47571728lfa.2 for ; Wed, 31 Jul 2019 07:24:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=K/qQ+pg0ZPDnIhkiluu6NiqdWrzCe0KXQQGO6CqxzTU=; b=Gvs5E1m/CS6OmfPE9pKnY5veVyTbLKOkNTBsReUFFo7QdXKsOgcSCu+8l0q78tjKPX WWnSe+LbZiI+8Dd8l9yubo4mRz1vz7PkJAlgz/0BCzAEQQL43JB2H2h4oUDWW96sPO04 /DM/WSfYqqTx+Htko58P1O8XxlonblltQ75jtXJwxeWohtG3xuWJi9xETQQmAAwkpVD1 Rtlq9vNeoVSJ+AMl3NMDdx7uNP6c67dO46RK8NkRUNR3F6XPT0djdGDrmlJDeC6x5aHq zzDKW4r8zZdBuaYVkcG2UrF1/82XFBmW02e9HvDhwdXXZy6cfFjR9n+FKtrxpbfm3QgF iCWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=K/qQ+pg0ZPDnIhkiluu6NiqdWrzCe0KXQQGO6CqxzTU=; b=P3aiMoknWnszTo/57zCO0C5bi4VDG8jCcEPQwKnKB/7xQkOj+ye+Z+nEO8W9DyZFzF Jp2MyagLUYtUUFZ0QtXcbFUGNXQuBnwnc+MJb4jxKFH7Dm+KNser/6JefBM0p6IMVryc sWEhaBbEkgAL99J4SYFYkXKJ+OhlhHT/iY/e3jFru639z0b4AeHlGuM1tUPpIaexUTRG pioqHryMN2fTJ3E6GGgcyZ+vPs7KbijAj8ebUslpgPFZir0CvSgROtjKxteiG3cSZh9U FpjeqjtmxLiBPeBaZuZ8Dw7y77fWEjbkM896H3NmKsCHFLt4lg7qE6jiGSb1vDxPCbvk cxLg== X-Gm-Message-State: APjAAAUoKJkdWcHhZOFPSoVXzeko3sJ3MHKGC6HDm/ae43PTsP8uznnA FuhPhVj4ZBtLdqzrM7qvKsnh+eE9pLzNRRGzUO0= X-Google-Smtp-Source: APXvYqx9SveT+fmzNtgf/znKbt9mZDsbUC4DtQp1WyEq76tlrArh1xBd7b/yeAgdZ+foGbrDh0dVaqEtIN6G+CKwBik= X-Received: by 2002:a05:6512:1da:: with SMTP id f26mr57386260lfp.129.1564583096313; Wed, 31 Jul 2019 07:24:56 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> In-Reply-To: <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> From: Eric Rescorla Date: Wed, 31 Jul 2019 07:24:19 -0700 Message-ID: To: "Livingood, Jason" Cc: Adam Roach , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000ad80a4058efae3d0" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 14:25:00 -0000 --000000000000ad80a4058efae3d0 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 30, 2019 at 2:49 PM Livingood, Jason < Jason_Livingood@comcast.com> wrote: > On 7/25/19, 10:12 AM, "Add on behalf of Adam Roach" on behalf of adam@nostrum.com> wrote: > > You can see, for example, Cloudflare's associated privacy > policy at > https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ > > [JL] This speaks to the DNS query/response. But with DoH, this is > contained inside of an HTTP envelope, so to speak, which has much more rich > tracking - noted at https://www.cloudflare.com/privacypolicy/ under > website visitors (which I presume applies to all HTTP transactions). No, this is not our understanding. Rather, the privacy policy for DoH covers every aspect of DoH, including the HTTP portion. The Cloudflare Privacy Policy is a separate policy for CF websites and does not govern the resolver. So the confluence of DNS and HTTP here seems interesting to better > understand and document as TRR-style policies evolve. Since there is an > HTTP server involved in DoH, presumably all the normal HTTP log items are > seen & processed and can be logged, like user agent, cookies, and so on. > Firefox doesn't send cookies for DoH. We do send User-Agent, and we could look at removing that, but given TLS ClientHello fingerprinting, that's probably not adding a huge amount of additional information. -Ekr > [JL] In addition, I suspect a concern (for the very high scale centralised > DoH platforms) is not just the per-user privacy policy but also what > aggregated business intelligence a global scale platform would be able to > develop (e.g. of a population of 500M users, how many have queried for *. > netflix.com in the past N hours, by country, ASN, user agent, etc.), > relative to competitors or potential competitors. So I suspect these > concerns may arise, at least for platforms of very high scale / > penetration. > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000ad80a4058efae3d0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Tue, Jul 30, 2019 at 2:49 PM Livin= good, Jason <Jason_Living= ood@comcast.com> wrote:
    On 7/25/19, 10:12 AM, "Add on behalf of Adam Roach"= ; <add-bounces= @ietf.org on behalf of adam@nostrum.com> wrote:
    > You can see, for example, Cloudflare's associated privacy
    =C2=A0 =C2=A0 policy at https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy= /privacy-policy/firefox/

    [JL] This speaks to the DNS query/response. But with DoH, this is contained= inside of an HTTP envelope, so to speak, which has much more rich tracking= - noted at https://www.cloudflare.com/privacypolicy/ u= nder website visitors (which I presume applies to all HTTP transactions). <= /blockquote>

    No, this is not our understanding. Rather, the privacy policy for DoH covers=20 every aspect of DoH, including the HTTP portion. The Cloudflare Privacy=20 Policy is a separate policy for CF websites and does not govern the=20 resolver.


    So the= confluence of DNS and HTTP here seems interesting to better understand and= document as TRR-style policies evolve. Since there is an HTTP server invol= ved in DoH, presumably all the normal HTTP log items are seen & process= ed and can be logged, like user agent, cookies, and so on.
    =

    Firefox doesn't send cookies for DoH. We do send Us= er-Agent, and we could look at removing that, but given TLS ClientHello fin= gerprinting, that's probably not adding a huge amount of additional inf= ormation.

    -Ekr


    [JL] In addition, I suspect a concern (for the very high scale centralised = DoH platforms) is not just the per-user privacy policy but also what aggreg= ated business intelligence a global scale platform would be able to develop= (e.g. of a population of 500M users, how many have queried for *.netflix.com in the past N hours, by country, ASN, user agent, etc.), relative to comp= etitors or potential competitors. So I suspect these concerns may arise, at= least for platforms of very high scale / penetration.=C2=A0

    --
    Add mailing list
    Add@ietf.org
    https://www.ietf.org/mailman/listinfo/add
    --000000000000ad80a4058efae3d0-- From nobody Wed Jul 31 07:26:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6327120189 for ; Wed, 31 Jul 2019 07:26:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EvyO1BzuTeiI for ; Wed, 31 Jul 2019 07:26:22 -0700 (PDT) Received: from mail-lj1-x229.google.com (mail-lj1-x229.google.com [IPv6:2a00:1450:4864:20::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3437F120198 for ; Wed, 31 Jul 2019 07:26:20 -0700 (PDT) Received: by mail-lj1-x229.google.com with SMTP id x25so65879953ljh.2 for ; Wed, 31 Jul 2019 07:26:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=dbc1k/CSP2FfVSmg8hTJuIgJrh/3A3iNOttjbpNo6h0=; b=Pq5fbO9KjL1WlCKZUviFBYWYctpp0peQFzAoCGKJJ+AX+Qsdm3Iv1ArYnOf3EznFm7 D3d2ozTJyvwsrNPX69BWowKxPEGVOfWmK7rSNtMcafPWvZkt5JN1gnyrCWYAg9wfYEtS oxk2c7RqlmJm8eAjgUDsAlxUTuJPyIGcpD/HOI79nHYPPP6ITQ01KQYbWb7ZhMhJwJUV JT8a3OesUfc7wP9JFC5EFPOAz8LkKUyNoiq7cHo5fYR0u94DMOoVBqkwqcHnKBXmEIeS ksH4lxOAo9d1s/QMgV3TzrnK2PIenNPqzuV1vEJy44nYk4LpjCPSX2qZ6uweOwPU5EKb mleA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=dbc1k/CSP2FfVSmg8hTJuIgJrh/3A3iNOttjbpNo6h0=; b=p+jGYlR6EMw/4LEB80SIWuPWh1myg7OsAfSDwyr1/Ih5UJEDfwFwZf6DnTEmJFT9ld mdur3SS9NnFc9xVrqkTe2Ou8LIRXhjbiYmx4Y2x5vC+V8XIaTzdAOCOSwzuf5fWJG/+c kBaiZA3kNZofNJvKMO4kNS8+eDW3/y7HUBXT0LFnlPflrIzks4l5ep1rrQe0hdLcDiYn 6sqBDl7SevZVrd6lNSQWtoaq6PJDCorJ4s+UsJBK/QEwuXQFouHfbEdqYJMXNKA+FhKu IMQfsE1P2zr0k/Yq0yVh+t5kAQsyQieYdoRWoDAlsNmsjIH7hB2ga9DB2lWllz+zAH44 Akdw== X-Gm-Message-State: APjAAAV2JrTxFAdyTp0NNAEP/mjzBWldGoJRYlHmYoByd+1qH137gchn c/AEJVn3qdGP4P1a0FkWgJkaWBxbru7+KSrvtH4= X-Google-Smtp-Source: APXvYqyS3hfuUbTpq/duBBZBkI9W04Tuwzy9IBmZqhlCIVS2gp13kWxfeFQcLc9ZaEN3GJG4NtPHDfbTGUmWzefjfIs= X-Received: by 2002:a2e:96d0:: with SMTP id d16mr51474012ljj.14.1564583178475; Wed, 31 Jul 2019 07:26:18 -0700 (PDT) MIME-Version: 1.0 References: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> <20190731140820.488DA15EE1FF@fafnir.remote.dragon.net> In-Reply-To: <20190731140820.488DA15EE1FF@fafnir.remote.dragon.net> From: Eric Rescorla Date: Wed, 31 Jul 2019 07:25:42 -0700 Message-ID: To: Paul Ebersman Cc: "Livingood, Jason" , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000932e2e058efae8ee" Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 14:26:24 -0000 --000000000000932e2e058efae8ee Content-Type: text/plain; charset="UTF-8" On Wed, Jul 31, 2019 at 7:08 AM Paul Ebersman wrote: > > ebersman> Many users of 8.8.8.8 do so because they get it via DHCP. > > ekr> Absolutely true, but I'm not sure why that matters. The fact is > ekr> that many also manually configure it, and no matter how it is > ekr> configured, it's not the ISP providing the service. > > In some cases, like Vietnam, it is the ISP who chose 8.8.8.8 and the > users just use it like any other DCHP supplied resolvers. > > I think the point is that while the quadX services are a measurable > percentage of users, it's still not how the majority of the internet > gets their resolvers, i.e. that the majority still don't knowingly > choose their resolver or even know there are choices. > Yes, I agree that the majority of users don't knowingly choose their resolver. -Ekr --000000000000932e2e058efae8ee Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Wed, Jul 31, 2019 at 7:08 AM Paul = Ebersman <list-add@dragon.net= > wrote:
    =C2= =A0 =C2=A0 =C2=A0
    ebersman> Many users of 8.8.8.8 do so because they get it via DHCP.

    ekr> Absolutely true, but I'm not sure why that matters. The fact is=
    ekr> that many also manually configure it, and no matter how it is
    ekr> configured, it's not the ISP providing the service.

    In some cases, like Vietnam, it is the ISP who chose 8.8.8.8 and the
    users just use it like any other DCHP supplied resolvers.

    I think the point is that while the quadX services are a measurable
    percentage of users, it's still not how the majority of the internet gets their resolvers, i.e. that the majority still don't knowingly
    choose their resolver or even know there are choices.
    =
    Yes, I agree that the majority of users don't knowingly = choose their resolver.

    -Ekr

    --000000000000932e2e058efae8ee-- From nobody Wed Jul 31 07:49:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC8DE1201E3 for ; Wed, 31 Jul 2019 07:49:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yAd7gjreM0-0 for ; Wed, 31 Jul 2019 07:49:13 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2966C120203 for ; Wed, 31 Jul 2019 07:49:08 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 31 Jul 2019 07:49:06 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Wed, 31 Jul 2019 07:49:06 -0700 From: Paul Hoffman To: "Deen, Glenn (NBCUniversal)" CC: ADD Mailing list Thread-Topic: [Ext] [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVR68Z50SwezNXIU+S4WHfyz5Www== Date: Wed, 31 Jul 2019 14:49:05 +0000 Message-ID: References: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [Ext] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 14:49:15 -0000 T24gSnVsIDMxLCAyMDE5LCBhdCA3OjA5IEFNLCBEZWVuLCBHbGVubiAoTkJDVW5pdmVyc2FsKSA8 R2xlbm4uRGVlbkBuYmN1bmkuY29tPiB3cm90ZToNCj4gDQo+IA0KPiANCj4+IE9uIEp1bCAzMSwg MjAxOSwgYXQgODowMSBBTSwgUGF1bCBFYmVyc21hbiA8bGlzdC1hZGRAZHJhZ29uLm5ldD4gd3Jv dGU6DQo+PiANCj4+IE1hbnkgdXNlcnMgb2YgOC44LjguOCBkbyBzbyBiZWNhdXNlIHRoZXkgZ2V0 IGl0IHZpYSBESENQLiBJJ20gc2VlaW5nDQo+PiB0aGlzIG11Y2ggbW9yZSBvZnRlbiBpbiBjYXB0 aXZlIHBvcnRhbHMsIHdoZXJlIHNhaWQgb3BlcmF0b3IgaGFzIGRlY2lkZWQNCj4+IG5vdCB0byBk byBETlMgdGhlbXNlbHZlcy4gTWFueSBsb2NhbCBJU1BzIGRvIHRoZSBzYW1lLiBJIHNlZW0gdG8g cmVjYWxsDQo+PiBWaWV0bmFtIGJlaW5nIG92ZXIgODAlIGdvb2dsZSBmb3IgdGhpcyByZWFzb24/ IChHZW9mZiBIdXN0b24gaGFzIGRvbmUgYQ0KPj4gY291cGxlIG9mIHByZXNvcyBhYm91dCB0aGlz KS4NCj4gDQo+IEFsc28gd29ydGggbm90aW5nIGl04oCZcyBoYXJkY29kZWQgaW50byBjaHJvbWVj YXN0IGRldmljZXMgYXMgSSByZWNhbGwuIA0KDQpBdHRyaWJ1dGlvbiwgcGxlYXNlPyBJIGhhZCBo ZWFyZCB0aGF0LCBhbmQgaGFkIGFsc28gaGVhcmQgaXQgd2FzIGRlYnVua2VkLCB0aGF0IHRoZSBj YWxscyB0byA4LjguOC44IHdlcmUgZm9yIGJvb3RzdHJhcHBpbmcgb25seSBhbmQgdGhlbiBub3Qg dXNlZCBhZ2Fpbi4gSG93ZXZlciwgSSBuZXZlciBoZWFyZCBhbnlvbmUgc2F5IGVpdGhlciBkZWZp bml0aXZlbHksIGFuZCBkaWQgbm90IGdvIGxvb2sgYXQgdGhlIHNvdXJjZSBjb2RlLg0KDQotLVBh dWwgSG9mZm1hbg== From nobody Wed Jul 31 07:53:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 17DEF120203 for ; Wed, 31 Jul 2019 07:53:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pTiT6QH8AyHx for ; Wed, 31 Jul 2019 07:53:29 -0700 (PDT) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5FF18120270 for ; Wed, 31 Jul 2019 07:53:29 -0700 (PDT) Received: by mail-io1-xd31.google.com with SMTP id q22so17087860iog.4 for ; Wed, 31 Jul 2019 07:53:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=6WvFSNLCsyjVefmAdnZ8yHscomkWgk7QF4NCLgTJAQk=; b=RwLsd6e4y3q2SSnjN83U5unnA2OTdu7xmgHNIVdFbGr8PiU8ZNBSBHoZE5AnEfZNRh WuM0tYaIvqFIyfkOsKmn9YlTrVqSDAcvRh92gWlDV6WIoT+ur0vqi/5jTl8S1j35RuJX H3penlUt76wYo2TT5S2rY3JclBN9Gxp6Lh770= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=6WvFSNLCsyjVefmAdnZ8yHscomkWgk7QF4NCLgTJAQk=; b=c1q26w86BxYuDMp5up2EoqRUy6cXtLTB2Li6/y46OBrpvNn4cQ2lj65eYoeMPDqyqh sCAsNrM3RA9GH4VJmJyqjEG0W4vDg4ZFsGzcZCBgs6kDZ5psQ4NfQguaNZuJn9neOOeg 2KaMNWo6bzCkoTh4+P9KefBg5iW0harYW1Fn7JWFRt0rC1FDRWJsb+Y1mZZemT5DIzsP XBUQvTipQrdpxhc9/zyz3J6r0RxRgHRlodiTENEBmxNF5wQxgwGwebfQCVRhoJuD47Y8 6I70i7BygmWrMimKm3WzOoE9uif6ERW6Gq5eBsaTltE/pjN8s/8gi2XIE+PC0KWNkZEM o4sQ== X-Gm-Message-State: APjAAAWtmnFTcZ7uYJyoQfWjHhkg/VDNiFAYyuCfdztTZQstbUmRsel4 VQ1WC09uzseC/xBXRGDhUz0= X-Google-Smtp-Source: APXvYqydTtW5kJoNRmRC/nSHwW25wOjivyaNaOAZEewKSKSJKdmcFh9nCSZ8Ik5yEamOBEUSW2D7FQ== X-Received: by 2002:a5d:9613:: with SMTP id w19mr76468776iol.140.1564584808381; Wed, 31 Jul 2019 07:53:28 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id t133sm101165117iof.21.2019.07.31.07.53.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 31 Jul 2019 07:53:26 -0700 (PDT) From: Joe Abley Message-Id: <03BDCFFF-F85E-412A-BC35-2AA3262C3C84@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_5704542B-9EE6-4284-B1DA-517C99EE4DAC"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 31 Jul 2019 10:53:25 -0400 In-Reply-To: Cc: "Deen, Glenn (NBCUniversal)" , ADD Mailing list To: Paul Hoffman References: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 14:53:31 -0000 --Apple-Mail=_5704542B-9EE6-4284-B1DA-517C99EE4DAC Content-Type: multipart/alternative; boundary="Apple-Mail=_1C02925F-A09B-4B3B-8258-C879F8DCB999" --Apple-Mail=_1C02925F-A09B-4B3B-8258-C879F8DCB999 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On 31 Jul 2019, at 10:49, Paul Hoffman wrote: > On Jul 31, 2019, at 7:09 AM, Deen, Glenn (NBCUniversal) = wrote: >=20 >> On Jul 31, 2019, at 8:01 AM, Paul Ebersman = wrote: >>=20 >>> Many users of 8.8.8.8 do so because they get it via DHCP. I'm seeing >>> this much more often in captive portals, where said operator has = decided >>> not to do DNS themselves. Many local ISPs do the same. I seem to = recall >>> Vietnam being over 80% google for this reason? (Geoff Huston has = done a >>> couple of presos about this). >>=20 >> Also worth noting it=E2=80=99s hardcoded into chromecast devices as I = recall. >=20 > Attribution, please? Paul Vixie's findings have been widely reported, e.g. = https://www.businessinsider.com/paul-vixie-blasts-google-chromecast-2019-2= = Joe --Apple-Mail=_1C02925F-A09B-4B3B-8258-C879F8DCB999 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = 31 Jul 2019, at 10:49, Paul Hoffman <paul.hoffman@icann.org> wrote:

    On Jul 31, = 2019, at 7:09 AM, Deen, Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:

    On Jul 31, 2019, at 8:01 AM, Paul Ebersman <list-add@dragon.net>= wrote:

    Many users of 8.8.8.8 do = so because they get it via DHCP. I'm seeing
    this much more = often in captive portals, where said operator has decided
    not to do DNS themselves. Many local ISPs do the same. I seem = to recall
    Vietnam being over 80% google for this reason? = (Geoff Huston has done a
    couple of presos about this).

    Also worth noting it=E2=80=99s = hardcoded into chromecast devices as I recall.

    Attribution, = please?

    Paul = Vixie's findings have been widely reported, e.g.



    Joe
    = --Apple-Mail=_1C02925F-A09B-4B3B-8258-C879F8DCB999-- --Apple-Mail=_5704542B-9EE6-4284-B1DA-517C99EE4DAC Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXUGrZQAKCRA0jwy9hlI6 LLxPAJ9/Ap7MFC075agJA3Mp3ZdROGaUXQCgvz6uPKc8HbJ9opFYgrtWhT/QjQI= =O7Dm -----END PGP SIGNATURE----- --Apple-Mail=_5704542B-9EE6-4284-B1DA-517C99EE4DAC-- From nobody Wed Jul 31 07:57:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54E2712006D for ; Wed, 31 Jul 2019 07:57:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g4IbNKG21A_4 for ; Wed, 31 Jul 2019 07:57:03 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6034912004F for ; Wed, 31 Jul 2019 07:57:03 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 31 Jul 2019 07:57:01 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Wed, 31 Jul 2019 07:57:01 -0700 From: Paul Hoffman To: Joe Abley CC: ADD Mailing list Thread-Topic: [Add] [Ext] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVR6+4iMQ//TmXr06Q7WMC0klI6qblRmOA Date: Wed, 31 Jul 2019 14:57:01 +0000 Message-ID: References: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> <03BDCFFF-F85E-412A-BC35-2AA3262C3C84@hopcount.ca> In-Reply-To: <03BDCFFF-F85E-412A-BC35-2AA3262C3C84@hopcount.ca> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [Ext] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 14:57:05 -0000 T24gSnVsIDMxLCAyMDE5LCBhdCA3OjUzIEFNLCBKb2UgQWJsZXkgPGphYmxleUBob3Bjb3VudC5j YT4gd3JvdGU6DQo+IA0KPiBPbiAzMSBKdWwgMjAxOSwgYXQgMTA6NDksIFBhdWwgSG9mZm1hbiA8 cGF1bC5ob2ZmbWFuQGljYW5uLm9yZz4gd3JvdGU6DQo+IA0KPj4gT24gSnVsIDMxLCAyMDE5LCBh dCA3OjA5IEFNLCBEZWVuLCBHbGVubiAoTkJDVW5pdmVyc2FsKSA8R2xlbm4uRGVlbkBuYmN1bmku Y29tPiB3cm90ZToNCj4+IA0KPj4+IE9uIEp1bCAzMSwgMjAxOSwgYXQgODowMSBBTSwgUGF1bCBF YmVyc21hbiA8bGlzdC1hZGRAZHJhZ29uLm5ldD4gd3JvdGU6DQo+Pj4gDQo+Pj4+IE1hbnkgdXNl cnMgb2YgOC44LjguOCBkbyBzbyBiZWNhdXNlIHRoZXkgZ2V0IGl0IHZpYSBESENQLiBJJ20gc2Vl aW5nDQo+Pj4+IHRoaXMgbXVjaCBtb3JlIG9mdGVuIGluIGNhcHRpdmUgcG9ydGFscywgd2hlcmUg c2FpZCBvcGVyYXRvciBoYXMgZGVjaWRlZA0KPj4+PiBub3QgdG8gZG8gRE5TIHRoZW1zZWx2ZXMu IE1hbnkgbG9jYWwgSVNQcyBkbyB0aGUgc2FtZS4gSSBzZWVtIHRvIHJlY2FsbA0KPj4+PiBWaWV0 bmFtIGJlaW5nIG92ZXIgODAlIGdvb2dsZSBmb3IgdGhpcyByZWFzb24/IChHZW9mZiBIdXN0b24g aGFzIGRvbmUgYQ0KPj4+PiBjb3VwbGUgb2YgcHJlc29zIGFib3V0IHRoaXMpLg0KPj4+IA0KPj4+ IEFsc28gd29ydGggbm90aW5nIGl04oCZcyBoYXJkY29kZWQgaW50byBjaHJvbWVjYXN0IGRldmlj ZXMgYXMgSSByZWNhbGwuIA0KPj4gDQo+PiBBdHRyaWJ1dGlvbiwgcGxlYXNlPw0KPiANCj4gUGF1 bCBWaXhpZSdzIGZpbmRpbmdzIGhhdmUgYmVlbiB3aWRlbHkgcmVwb3J0ZWQsIGUuZy4NCj4gDQo+ IGh0dHBzOi8vd3d3LmJ1c2luZXNzaW5zaWRlci5jb20vcGF1bC12aXhpZS1ibGFzdHMtZ29vZ2xl LWNocm9tZWNhc3QtMjAxOS0yDQoNClRoYXQgYXJ0aWNsZSBkb2VzIG5vdCBzYXkgbW9yZSB0aGFu IHRoYXQgUGF1bCBzYXcgYXQgbGVhc3Qgb25lIHF1ZXJ5IGdvIHRvIDguOC44LjggZnJvbSBoaXMg Q2hyb21lY2FzdC4gSSBhc2tlZCBmb3IgbW9yZSBkZXRhaWw6DQoNCj4gSSBoYWQgaGVhcmQgdGhh dCwgYW5kIGhhZCBhbHNvIGhlYXJkIGl0IHdhcyBkZWJ1bmtlZCwgdGhhdCB0aGUgY2FsbHMgdG8g OC44LjguOCB3ZXJlIGZvciBib290c3RyYXBwaW5nIG9ubHkgYW5kIHRoZW4gbm90IHVzZWQgYWdh aW4uIEhvd2V2ZXIsIEkgbmV2ZXIgaGVhcmQgYW55b25lIHNheSBlaXRoZXIgZGVmaW5pdGl2ZWx5 LCBhbmQgZGlkIG5vdCBnbyBsb29rIGF0IHRoZSBzb3VyY2UgY29kZS4NCg0KVGhpcyBpcyBhIHRl Y2huaWNhbCBtYWlsaW5nIGxpc3QsIGFuZCBhc2tpbmcgZm9yIHRlY2huaWNhbCBkZXRhaWwgb24g Y2xhaW1zIHNlZW1zIGFwcHJvcHJpYXRlLiBGb3IgYWxsIEkga25vdywgUGF1bFYgYWxyZWFkeSBo YXMgc3VjaCBkZXRhaWwsIGJ1dCBJIGhhdmUgbm90IHNlZW4gaXQgcHVibGlzaGVkIGFueXdoZXJl Lg0KDQotLVBhdWwgSG9mZm1hbg== From nobody Wed Jul 31 07:58:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E8A7412004F for ; Wed, 31 Jul 2019 07:58:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WSvM4H3Z-_uZ for ; Wed, 31 Jul 2019 07:58:07 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C1E212006D for ; Wed, 31 Jul 2019 07:58:07 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id f4so136947632ioh.6 for ; Wed, 31 Jul 2019 07:58:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=WNK761cNHa/+UwzBU8v2UKT/+H6T3JSTTaJ9lIKTxpw=; b=UZ5VJAFKD/yO4OHTVtrk5o4DlAxfeBsV/SeHtaYFs4QayyApIZZ7xrCWboFN6nN5Uf dQYH0+iISKvexEjlShUeyKvsgZGSKt16nhVBO9A6lmERvsSmn6PZLNVmsoGpb1JSW0gJ HKu1iVojmTaN75GRLC4UuOiSwiCDkud/ZNNas= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=WNK761cNHa/+UwzBU8v2UKT/+H6T3JSTTaJ9lIKTxpw=; b=h2fz3sxunU8TRLn74mJlgSlWQ7Vx0x7zxknDus04A2i8pB6aP9bU58luau93VQ780I U6W44PS++TMUXnl3wuG4lJi89srKTBQ2pIf67+xx6E2BDkS3C7NGiD9iIFI+p3HuaQx2 CSkozIfogHozj7O+/u6BUzKN6i1sZhGf9bPf0MZ10XaWydyGRw7KoFjIybIhJKv2Io/e sy9gy7Wa5cnk0ydob+5zDU2qEj7OVmmHh5YtmvbJbrX9fyTAJmFxdL1s7MaPQCWEmZco CjkpxWr0YN+hSh/mm3H4k1cJGOPH46fWqduKXpRI7KVA9jD6xtHGJ0FI5xgdMM+gmCeO OA1Q== X-Gm-Message-State: APjAAAUFC3LjNQ+Gq+4melyQ+Hs0i5kcs8bKLAVxuw5FN3g2kXvUuPB1 tM9YRpFAErcwOcPQJwq3KBw= X-Google-Smtp-Source: APXvYqxFTy/0qP8u5/X2aahJ9ehhMOX7Ihi+3LI+Hig1fG0NIjvyjeFUvZgiJiPOsACS35S4t3sBIA== X-Received: by 2002:a5e:8c11:: with SMTP id n17mr44179682ioj.64.1564585086712; Wed, 31 Jul 2019 07:58:06 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id n7sm53081875ioo.79.2019.07.31.07.58.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 31 Jul 2019 07:58:05 -0700 (PDT) From: Joe Abley Message-Id: <69501F01-A554-4E23-B753-1F7A1FF7EF93@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_180F9E1D-2390-4CE8-925A-D84E28C8F10D"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 31 Jul 2019 10:58:04 -0400 In-Reply-To: Cc: ADD Mailing list To: Paul Hoffman References: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> <03BDCFFF-F85E-412A-BC35-2AA3262C3C84@hopcount.ca> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 14:58:09 -0000 --Apple-Mail=_180F9E1D-2390-4CE8-925A-D84E28C8F10D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 31 Jul 2019, at 10:57, Paul Hoffman wrote: > This is a technical mailing list, and asking for technical detail on = claims seems appropriate. For all I know, PaulV already has such detail, = but I have not seen it published anywhere. Perhaps you could ask him directly instead of asking a list he's not = subscribed to :-) Joe --Apple-Mail=_180F9E1D-2390-4CE8-925A-D84E28C8F10D Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXUGsfAAKCRA0jwy9hlI6 LBd9AJ4+BzHu3D390PAazaAWtmJ/fjdYvwCfaciLGNAo3WcnaVgtr5pFbprKX/A= =0AK5 -----END PGP SIGNATURE----- --Apple-Mail=_180F9E1D-2390-4CE8-925A-D84E28C8F10D-- From nobody Wed Jul 31 08:22:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 940631202CA for ; Wed, 31 Jul 2019 08:22:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c9DpGg91mtZQ for ; Wed, 31 Jul 2019 08:22:20 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 899D91202C7 for ; Wed, 31 Jul 2019 08:22:20 -0700 (PDT) Received: from pps.filterd (m0047965.ppops.net [127.0.0.1]) by m0047965.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x6VFCo7x010013 for ; Wed, 31 Jul 2019 11:22:20 -0400 Received: from usaoamgip002.mail.tfayd.com ([173.213.212.136]) by m0047965.ppops.net-00176a04. with ESMTP id 2u3akvarp6-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 31 Jul 2019 11:22:19 -0400 Received: from unknown (HELO potemwp00005.mail.tfayd.com) ([10.40.78.204]) by usaoamgip002.mail.tfayd.com with ESMTP; 31 Jul 2019 11:18:37 -0400 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00025.mail.tfayd.com (100.124.56.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 31 Jul 2019 09:22:15 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 31 Jul 2019 09:22:15 -0600 From: "Deen, Glenn (NBCUniversal)" To: Paul Hoffman CC: ADD Mailing list , "Deen, Glenn (NBCUniversal)" Thread-Topic: [Ext] [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVR68hav73HFGaz0iMJquVj37tLabk0XEA Date: Wed, 31 Jul 2019 15:22:14 +0000 Message-ID: References: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [100.124.57.31] x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="utf-8" Content-ID: <06CD4E607807FC458EFCA457601F8B02@NBCUNI.COM> X-CFilter-Loop: Forward Content-Transfer-Encoding: Quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-31_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907310156 Archived-At: Subject: Re: [Add] [Ext] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 15:22:23 -0000 =0D=0A=0D=0A=EF=BB=BFOn 7/31/19, 8:49 AM, "Paul Hoffman" wrote:=0D=0A=0D=0A On Jul 31, 2019, at 7:09 AM, Deen, Glenn (N= BCUniversal) wrote:=0D=0A > =0D=0A > =0D= =0A > =0D=0A >> On Jul 31, 2019, at 8:01 AM, Paul Ebersman wrote:=0D=0A >> =0D=0A >> Many users of 8.8.8.8 do so bec= ause they get it via DHCP. I'm seeing=0D=0A >> this much more often in c= aptive portals, where said operator has decided=0D=0A >> not to do DNS t= hemselves. Many local ISPs do the same. I seem to recall=0D=0A >> Vietna= m being over 80% google for this reason? (Geoff Huston has done a=0D=0A = >> couple of presos about this).=0D=0A > =0D=0A > Also worth noting i= t=E2=80=99s hardcoded into chromecast devices as I recall. =0D=0A =0D=0A= | Attribution, please? I had heard that, and had also heard it was debun= ked, that the calls to 8.8.8.8 were for bootstrapping only and then not use= d again. However, I never heard anyone say either |definitively, and did no= t go look at the source code.=0D=0A =0D=0A| --Paul Hoffman=0D=0A=0D= =0A[gd] https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__forum.netgat= e.com_topic_59709_force-2Da-2Dchromecast-2Dto-2Duse-2Drouter-2Ddns&d=3DDwIG= aQ&c=3DLO_8KzsOlAGvgA6hdGI4v02U_XLiES0sR51Zca0yIy4&r=3DwydU3q1Yp1BqA26aKLU0= jQ&m=3DjRVT6FPOVY2i8C0LG7kLNsD1Ig4bqvjsNGc1mIzuwcw&s=3DHBO6-0jkBu7k7s76Kbhr= b0cDIjEBrKTx7ehNpwGQRp4&e=3D =0D=0A=0D=0A[gd] Then there was the Vixie repo= rt=0D=0A=0D=0A[gd] https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__= www.businessinsider.com_paul-2Dvixie-2Dblasts-2Dgoogle-2Dchromecast-2D2019-= 2D2-3Futm-5Fsource-3Dreddit.com&d=3DDwIGaQ&c=3DLO_8KzsOlAGvgA6hdGI4v02U_XLi= ES0sR51Zca0yIy4&r=3DwydU3q1Yp1BqA26aKLU0jQ&m=3DjRVT6FPOVY2i8C0LG7kLNsD1Ig4b= qvjsNGc1mIzuwcw&s=3DOHAjANWjScv-BmwJKE910mr3G0kW6hD8-xCzHLo4zOg&e=3D =0D=0A= =0D=0A=0D=0A[gd] -glenn=0D=0A=0D=0A= From nobody Wed Jul 31 08:22:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 146041202C7 for ; Wed, 31 Jul 2019 08:22:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P6Roql2h4ozE for ; Wed, 31 Jul 2019 08:22:22 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F3481202C9 for ; Wed, 31 Jul 2019 08:22:20 -0700 (PDT) Received: from pps.filterd (m0048207.ppops.net [127.0.0.1]) by m0048207.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x6VFCp5v011967 for ; Wed, 31 Jul 2019 11:22:18 -0400 Received: from usaoamgip001.mail.tfayd.com ([173.213.212.135]) by m0048207.ppops.net-00176a04. with ESMTP id 2u372bd46c-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 31 Jul 2019 11:22:18 -0400 Received: from unknown (HELO potemwp00009.mail.tfayd.com) ([10.40.78.204]) by usaoamgip001.mail.tfayd.com with ESMTP; 31 Jul 2019 11:20:31 -0400 Received: from potemwp00032.mail.tfayd.com (100.124.56.56) by potemwp00024.mail.tfayd.com (100.124.56.48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 31 Jul 2019 09:22:15 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00032.mail.tfayd.com (100.124.56.56) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 31 Jul 2019 09:22:14 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 31 Jul 2019 09:22:14 -0600 From: "Deen, Glenn (NBCUniversal)" To: Paul Hoffman , Joe Abley CC: ADD Mailing list , "Deen, Glenn (NBCUniversal)" Thread-Topic: [Add] [Ext] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVR6++kCsBcZ4BSU6GvYlsWvTB4KblNaCA//+eRoA= Date: Wed, 31 Jul 2019 15:22:14 +0000 Message-ID: References: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> <03BDCFFF-F85E-412A-BC35-2AA3262C3C84@hopcount.ca> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [100.124.57.31] x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-31_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907310156 Archived-At: Subject: Re: [Add] [Ext] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 15:22:23 -0000 DQoNCu+7v09uIDcvMzEvMTksIDg6NTcgQU0sICJBZGQgb24gYmVoYWxmIG9mIFBhdWwgSG9mZm1h biIgPGFkZC1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBwYXVsLmhvZmZtYW5AaWNhbm4u b3JnPiB3cm90ZToNCiAgICANCiAgICBUaGlzIGlzIGEgdGVjaG5pY2FsIG1haWxpbmcgbGlzdCwg YW5kIGFza2luZyBmb3IgdGVjaG5pY2FsIGRldGFpbCBvbiBjbGFpbXMgc2VlbXMgYXBwcm9wcmlh dGUuIEZvciBhbGwgSSBrbm93LCBQYXVsViBhbHJlYWR5IGhhcyBzdWNoIGRldGFpbCwgYnV0IEkg aGF2ZSBub3Qgc2VlbiBpdCBwdWJsaXNoZWQgYW55d2hlcmUuDQogICAgDQogICAgLS1QYXVsIEhv ZmZtYW4NCg0KW0dEXSBUb3RhbGx5IGxlZ2l0aW1hdGUgcG9pbnQuICBJbiBhIHF1aWNrIHNlYXJj aCBJIGVhc2lseSBmb3VuZCBudW1lcm91cyBwb3N0cyBmcm9tIHBlb3BsZSBkZWFsaW5nIHdpdGgg dHJ5aW5nIHRvIGNoYW5nZSB0aGUgY2hyb21lY2FzdCBzZXR0aW5ncywgc28gdGhpcyBzZWVtcyB0 byBiZSBhIHBlcnZhc2l2ZSBvYnNlcnZhdGlvbiBiZXlvbmQganVzdCBQYXVsVi4gICAgDQoNCltH RF0gIEknbSBhdCBhIGNvbmZlcmVuY2Ugd2l0aG91dCBhY2Nlc3MgdG8gYSBjaHJvbWVjYXN0IG9y IGxhYiBuZXR3b3JrLCBidXQgaXQgc2VlbXMgaXQgd291bGQgYmUgc2ltcGxlIGVub3VnaCBmb3Ig c29tZW9uZSBvbiB0aGlzIGxpc3Qgd2l0aCBhY2Nlc3MgdG8gYSAgY2hyb21lY2FzdCBhbmQgc29t ZSBuZXR3b3JrIG1vbml0b3JpbmcgdG8gdmVyaWZ5IHRoZSBiZWhhdmlvci4gDQoNCi1nbGVubg0K DQo= From nobody Wed Jul 31 08:25:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0ECC0120132 for ; Wed, 31 Jul 2019 08:25:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telefonica.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1B69MoXvgsYb for ; Wed, 31 Jul 2019 08:25:50 -0700 (PDT) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10125.outbound.protection.outlook.com [40.107.1.125]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A7ED12012C for ; Wed, 31 Jul 2019 08:25:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hhFRJaXgdfCXgjRu0vesfHIlRuo1VsvrW/hjAUp0xqopRjkrRp7GjYQPcpC4vjC6IPvkEXKgmyLMq8DdgDJziwUoflDUsyZ7J+8VFWquC3mwz+zAoHd2z6VtR8axIYWco01KF/kUr5Ifc+JhfuV25QiWnCSdIV5kSp4NldG+6yPc+5gFub45fV74Jj88wcbnHTEnlT8IXg8wP90KF4LiLcoy+Kkr671RIfBNcIgZKLt95q8FwlSErmFGBa5iXAyK0sFgWzHdlNt6YRitB7ukABfLEPAOsg/7M1t2z2aA9Jzlf5s7F1R95Q1/0HKW7ivydKFuO/fYt4raWqetcZx/iA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jrsBV5Euewi0nOMIyg0uGHo9/9PRrUlNLvo5iIGqAzU=; b=WTg0QucNx1MZwa2x4qYqyqOXJQZpqlFuRiKak0pj1jPecIPT1PXeI2cuFYh1hYup+qUHQpi4NwD5kzdbmrk3ZoAvPG6wFLZEzv7ceWqJrhdk9V3lr8ag6LElbCqzAhEauD4ig3w2CyYWpHkgiGXxMZvABDkdzsw/e+Mj+wOdurUMCMxDHTjGh21PeHa1R2Rh2Ib/Ysts6hE0cV4PdkL07vzGmIQWosBysabn0Q80bhvSAiNLE11CiCmYKEIG5HQXmVPJ25SeyH9tjpx5/rxSeR0RmEpg53av2c+k98Og1TYBxhKPz6waBz9g+P8WqrUU2yjP3KvWw0fWKU7QJEg1Lg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=telefonica.com;dmarc=pass action=none header.from=telefonica.com;dkim=pass header.d=telefonica.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telefonica.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jrsBV5Euewi0nOMIyg0uGHo9/9PRrUlNLvo5iIGqAzU=; b=dHduNpvZw2v89W/t09/aamx/zNLl8Rp2vTD3fzUuBr0X0w2yiBka71DJ9MWGkVNjA/vEtpy+15vxUIv1om5BhBnc6QHzNFeNkvrKJT2GNaH1TVm1QEwOylYvy5znP/09KPj+govgIFObs/QsIoSFaJzeiCDgKJM7FqbesYFFkAY= Received: from DB3PR0602MB3788.eurprd06.prod.outlook.com (52.134.70.148) by DB3PR0602MB3769.eurprd06.prod.outlook.com (52.134.70.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.14; Wed, 31 Jul 2019 15:25:46 +0000 Received: from DB3PR0602MB3788.eurprd06.prod.outlook.com ([fe80::9c53:d10:400e:c71]) by DB3PR0602MB3788.eurprd06.prod.outlook.com ([fe80::9c53:d10:400e:c71%5]) with mapi id 15.20.2115.005; Wed, 31 Jul 2019 15:25:46 +0000 From: "Diego R. Lopez" To: Eric Rescorla , "Livingood, Jason" CC: "add@ietf.org" , Adam Roach Thread-Topic: [Add] meeting hum: should the IETF take up this work? Thread-Index: AQHVQaN6W0OKjL9v+0y8Y3h3cwbqjqbYx7wAgAABXACAAAQtgIABMd6AgAD6woCAAGikAIAIW3qAgAEV/YD//84bAA== Date: Wed, 31 Jul 2019 15:25:46 +0000 Message-ID: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.c.190715 authentication-results: spf=none (sender IP is ) smtp.mailfrom=diego.r.lopez@telefonica.com; x-originating-ip: [88.16.178.60] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 5e48570a-fc08-451f-fd07-08d715cb5c5e x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:DB3PR0602MB3769; x-ms-traffictypediagnostic: DB3PR0602MB3769: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 011579F31F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(39860400002)(346002)(396003)(366004)(136003)(376002)(199004)(189003)(40134004)(446003)(2906002)(6512007)(6306002)(54896002)(76176011)(14454004)(236005)(11346002)(4326008)(476003)(3846002)(2616005)(790700001)(6116002)(25786009)(86362001)(76116006)(66446008)(66476007)(66556008)(53386004)(64756008)(68736007)(36756003)(53546011)(478600001)(486006)(45080400002)(66946007)(966005)(6506007)(316002)(229853002)(6436002)(5070765005)(786003)(6246003)(26005)(66066001)(33656002)(6486002)(110136005)(54906003)(58126008)(99286004)(66574012)(8936002)(5660300002)(606006)(256004)(14444005)(81166006)(7736002)(71200400001)(71190400001)(186003)(8676002)(53936002)(102836004)(81156014); DIR:OUT; SFP:1102; SCL:1; SRVR:DB3PR0602MB3769; H:DB3PR0602MB3788.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: telefonica.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: gThb72bPGRRt7UzT+jxy1yv8mwgJGPYkQImd6+VZCjW/XGJVymR3pA3NzBn2FR5BQ9JwJXhSY7jPvsPbTabV6D9nqN5IfJR+taDMUJokB53YKAhuIMD1ptY4Zg8CGngsCc8j9svd6Sf54yEBR50ksXj5e+UkzaB0JMksCwyOBMV0isIa4SGc+m5PraKpurrt9T9cI+iWHfisc6925+Pmr0x67o/aH3H6wnVN98WwH3/6ItmdFTs11YDkJwfZZTPIDfc44Z3u2sFAZzYICwtiyjBX4E/vaYp4yjN0IvEZIYyD1zptZcxR7tIzkLCmt9vosft5Cn1Id7gIIPILwXVxh03Mmqued/gAvzkoSDAeXr+kQCJSu6qlSIj8WuHiDj4T5/q5CPtgP1QD1DVo28HIz60gfSe1EqGrxU/v+aAb0xE= Content-Type: multipart/alternative; boundary="_000_FB0D3A9ABE9645CFAD0FE63ADEB7F97Atelefonicacom_" MIME-Version: 1.0 X-OriginatorOrg: telefonica.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5e48570a-fc08-451f-fd07-08d715cb5c5e X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Jul 2019 15:25:46.6658 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9744600e-3e04-492e-baa1-25ec245c6f10 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: diego.r.lopez@telefonica.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB3PR0602MB3769 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 15:25:54 -0000 --_000_FB0D3A9ABE9645CFAD0FE63ADEB7F97Atelefonicacom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gMzEvMDcvMjAxOSwgMTY6MjUsICJBZGQgb24gYmVoYWxmIG9mIEVyaWMgUmVzY29ybGEiIDxh ZGQtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86YWRkLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFs ZiBvZiBla3JAcnRmbS5jb208bWFpbHRvOmVrckBydGZtLmNvbT4+IHdyb3RlOg0KDQoNCg0KT24g VHVlLCBKdWwgMzAsIDIwMTkgYXQgMjo0OSBQTSBMaXZpbmdvb2QsIEphc29uIDxKYXNvbl9MaXZp bmdvb2RAY29tY2FzdC5jb208bWFpbHRvOkphc29uX0xpdmluZ29vZEBjb21jYXN0LmNvbT4+IHdy b3RlOg0KT24gNy8yNS8xOSwgMTA6MTIgQU0sICJBZGQgb24gYmVoYWxmIG9mIEFkYW0gUm9hY2gi IDxhZGQtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86YWRkLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJl aGFsZiBvZiBhZGFtQG5vc3RydW0uY29tPG1haWx0bzphZGFtQG5vc3RydW0uY29tPj4gd3JvdGU6 DQo+IFlvdSBjYW4gc2VlLCBmb3IgZXhhbXBsZSwgQ2xvdWRmbGFyZSdzIGFzc29jaWF0ZWQgcHJp dmFjeQ0KICAgIHBvbGljeSBhdCBodHRwczovL2RldmVsb3BlcnMuY2xvdWRmbGFyZS5jb20vMS4x LjEuMS9jb21taXRtZW50LXRvLXByaXZhY3kvcHJpdmFjeS1wb2xpY3kvZmlyZWZveC8NCg0KW0pM XSBUaGlzIHNwZWFrcyB0byB0aGUgRE5TIHF1ZXJ5L3Jlc3BvbnNlLiBCdXQgd2l0aCBEb0gsIHRo aXMgaXMgY29udGFpbmVkIGluc2lkZSBvZiBhbiBIVFRQIGVudmVsb3BlLCBzbyB0byBzcGVhaywg d2hpY2ggaGFzIG11Y2ggbW9yZSByaWNoIHRyYWNraW5nIC0gbm90ZWQgYXQgaHR0cHM6Ly93d3cu Y2xvdWRmbGFyZS5jb20vcHJpdmFjeXBvbGljeS8gdW5kZXIgd2Vic2l0ZSB2aXNpdG9ycyAod2hp Y2ggSSBwcmVzdW1lIGFwcGxpZXMgdG8gYWxsIEhUVFAgdHJhbnNhY3Rpb25zKS4NCg0KTm8sIHRo aXMgaXMgbm90IG91ciB1bmRlcnN0YW5kaW5nLiBSYXRoZXIsIHRoZSBwcml2YWN5IHBvbGljeSBm b3IgRG9IIGNvdmVycyBldmVyeSBhc3BlY3Qgb2YgRG9ILCBpbmNsdWRpbmcgdGhlIEhUVFAgcG9y dGlvbi4gVGhlIENsb3VkZmxhcmUgUHJpdmFjeSBQb2xpY3kgaXMgYSBzZXBhcmF0ZSBwb2xpY3kg Zm9yIENGIHdlYnNpdGVzIGFuZCBkb2VzIG5vdCBnb3Zlcm4gdGhlIHJlc29sdmVyLg0KDQoNClNv IHRoZSBjb25mbHVlbmNlIG9mIEROUyBhbmQgSFRUUCBoZXJlIHNlZW1zIGludGVyZXN0aW5nIHRv IGJldHRlciB1bmRlcnN0YW5kIGFuZCBkb2N1bWVudCBhcyBUUlItc3R5bGUgcG9saWNpZXMgZXZv bHZlLiBTaW5jZSB0aGVyZSBpcyBhbiBIVFRQIHNlcnZlciBpbnZvbHZlZCBpbiBEb0gsIHByZXN1 bWFibHkgYWxsIHRoZSBub3JtYWwgSFRUUCBsb2cgaXRlbXMgYXJlIHNlZW4gJiBwcm9jZXNzZWQg YW5kIGNhbiBiZSBsb2dnZWQsIGxpa2UgdXNlciBhZ2VudCwgY29va2llcywgYW5kIHNvIG9uLg0K DQpGaXJlZm94IGRvZXNuJ3Qgc2VuZCBjb29raWVzIGZvciBEb0guIFdlIGRvIHNlbmQgVXNlci1B Z2VudCwgYW5kIHdlIGNvdWxkIGxvb2sgYXQgcmVtb3ZpbmcgdGhhdCwgYnV0IGdpdmVuIFRMUyBD bGllbnRIZWxsbyBmaW5nZXJwcmludGluZywgdGhhdCdzIHByb2JhYmx5IG5vdCBhZGRpbmcgYSBo dWdlIGFtb3VudCBvZiBhZGRpdGlvbmFsIGluZm9ybWF0aW9uLg0KDQotRWtyDQoNClRoaXMgaW1w bGllcyB0aGUgY29tYmluYXRpb24gRmlyZWZveC9DbG91ZGZsYXJlIGRvZXMgbm90IHBvc2UgYSBz aWduaWZpY2FudCBwcml2YWN5IHJpc2suIEZhaXIgZW5vdWdoLiBCdXQgdGhlIGdlbmVyYWwgY2Fz ZSBvZiB3aGF0ZXZlci10aGUtYXBwIHVzaW5nIGEgaGFyZHdpcmVkIERPSCByZXNvbHZlciByZW1h aW5zLCBtdWNoIHRoZSBzYW1lIGFzIHRoZSBhcmNoZXR5cGFsIGNvZmZlZXNob3AgcmVzb2x2ZXIg Y29tcGFyZWQgdG8gd2VsbC1iZWhhdmVkLCBjb250cmFjdC1ib3VuZGVkIElTUHMuDQoNCi0tDQoi RXN0YSB2ZXogbm8gZmFsbGFyZW1vcywgRG9jdG9yIEluZmllcm5vIg0KDQpEciBEaWVnbyBSLiBM b3Bleg0KVGVsZWZvbmljYSBJK0QNCmh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9pbi9kcjJsb3Bl ei8NCg0KZS1tYWlsOiBkaWVnby5yLmxvcGV6QHRlbGVmb25pY2EuY29tPG1haWx0bzpkaWVnby5y LmxvcGV6QHRlbGVmb25pY2EuY29tPg0KVGVsOiAgICAgICAgICszNCA5MTMgMTI5IDA0MQ0KTW9i aWxlOiAgKzM0IDY4MiAwNTEgMDkxDQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t DQoNCg0KDQpbSkxdIEluIGFkZGl0aW9uLCBJIHN1c3BlY3QgYSBjb25jZXJuIChmb3IgdGhlIHZl cnkgaGlnaCBzY2FsZSBjZW50cmFsaXNlZCBEb0ggcGxhdGZvcm1zKSBpcyBub3QganVzdCB0aGUg cGVyLXVzZXIgcHJpdmFjeSBwb2xpY3kgYnV0IGFsc28gd2hhdCBhZ2dyZWdhdGVkIGJ1c2luZXNz IGludGVsbGlnZW5jZSBhIGdsb2JhbCBzY2FsZSBwbGF0Zm9ybSB3b3VsZCBiZSBhYmxlIHRvIGRl dmVsb3AgKGUuZy4gb2YgYSBwb3B1bGF0aW9uIG9mIDUwME0gdXNlcnMsIGhvdyBtYW55IGhhdmUg cXVlcmllZCBmb3IgKi5uZXRmbGl4LmNvbTxodHRwOi8vbmV0ZmxpeC5jb20+IGluIHRoZSBwYXN0 IE4gaG91cnMsIGJ5IGNvdW50cnksIEFTTiwgdXNlciBhZ2VudCwgZXRjLiksIHJlbGF0aXZlIHRv IGNvbXBldGl0b3JzIG9yIHBvdGVudGlhbCBjb21wZXRpdG9ycy4gU28gSSBzdXNwZWN0IHRoZXNl IGNvbmNlcm5zIG1heSBhcmlzZSwgYXQgbGVhc3QgZm9yIHBsYXRmb3JtcyBvZiB2ZXJ5IGhpZ2gg c2NhbGUgLyBwZW5ldHJhdGlvbi4NCg0KLS0NCkFkZCBtYWlsaW5nIGxpc3QNCkFkZEBpZXRmLm9y ZzxtYWlsdG86QWRkQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby9hZGQNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg0KRXN0ZSBtZW5z YWplIHkgc3VzIGFkanVudG9zIHNlIGRpcmlnZW4gZXhjbHVzaXZhbWVudGUgYSBzdSBkZXN0aW5h dGFyaW8sIHB1ZWRlIGNvbnRlbmVyIGluZm9ybWFjacOzbiBwcml2aWxlZ2lhZGEgbyBjb25maWRl bmNpYWwgeSBlcyBwYXJhIHVzbyBleGNsdXNpdm8gZGUgbGEgcGVyc29uYSBvIGVudGlkYWQgZGUg ZGVzdGluby4gU2kgbm8gZXMgdXN0ZWQuIGVsIGRlc3RpbmF0YXJpbyBpbmRpY2FkbywgcXVlZGEg bm90aWZpY2FkbyBkZSBxdWUgbGEgbGVjdHVyYSwgdXRpbGl6YWNpw7NuLCBkaXZ1bGdhY2nDs24g eS9vIGNvcGlhIHNpbiBhdXRvcml6YWNpw7NuIHB1ZWRlIGVzdGFyIHByb2hpYmlkYSBlbiB2aXJ0 dWQgZGUgbGEgbGVnaXNsYWNpw7NuIHZpZ2VudGUuIFNpIGhhIHJlY2liaWRvIGVzdGUgbWVuc2Fq ZSBwb3IgZXJyb3IsIGxlIHJvZ2Ftb3MgcXVlIG5vcyBsbyBjb211bmlxdWUgaW5tZWRpYXRhbWVu dGUgcG9yIGVzdGEgbWlzbWEgdsOtYSB5IHByb2NlZGEgYSBzdSBkZXN0cnVjY2nDs24uDQoNClRo ZSBpbmZvcm1hdGlvbiBjb250YWluZWQgaW4gdGhpcyB0cmFuc21pc3Npb24gaXMgcHJpdmlsZWdl ZCBhbmQgY29uZmlkZW50aWFsIGluZm9ybWF0aW9uIGludGVuZGVkIG9ubHkgZm9yIHRoZSB1c2Ug b2YgdGhlIGluZGl2aWR1YWwgb3IgZW50aXR5IG5hbWVkIGFib3ZlLiBJZiB0aGUgcmVhZGVyIG9m IHRoaXMgbWVzc2FnZSBpcyBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgeW91IGFyZSBoZXJl Ynkgbm90aWZpZWQgdGhhdCBhbnkgZGlzc2VtaW5hdGlvbiwgZGlzdHJpYnV0aW9uIG9yIGNvcHlp bmcgb2YgdGhpcyBjb21tdW5pY2F0aW9uIGlzIHN0cmljdGx5IHByb2hpYml0ZWQuIElmIHlvdSBo YXZlIHJlY2VpdmVkIHRoaXMgdHJhbnNtaXNzaW9uIGluIGVycm9yLCBkbyBub3QgcmVhZCBpdC4g UGxlYXNlIGltbWVkaWF0ZWx5IHJlcGx5IHRvIHRoZSBzZW5kZXIgdGhhdCB5b3UgaGF2ZSByZWNl aXZlZCB0aGlzIGNvbW11bmljYXRpb24gaW4gZXJyb3IgYW5kIHRoZW4gZGVsZXRlIGl0Lg0KDQpF c3RhIG1lbnNhZ2VtIGUgc2V1cyBhbmV4b3Mgc2UgZGlyaWdlbSBleGNsdXNpdmFtZW50ZSBhbyBz ZXUgZGVzdGluYXTDoXJpbywgcG9kZSBjb250ZXIgaW5mb3JtYcOnw6NvIHByaXZpbGVnaWFkYSBv dSBjb25maWRlbmNpYWwgZSDDqSBwYXJhIHVzbyBleGNsdXNpdm8gZGEgcGVzc29hIG91IGVudGlk YWRlIGRlIGRlc3Rpbm8uIFNlIG7Do28gw6kgdm9zc2Egc2VuaG9yaWEgbyBkZXN0aW5hdMOhcmlv IGluZGljYWRvLCBmaWNhIG5vdGlmaWNhZG8gZGUgcXVlIGEgbGVpdHVyYSwgdXRpbGl6YcOnw6Nv LCBkaXZ1bGdhw6fDo28gZS9vdSBjw7NwaWEgc2VtIGF1dG9yaXphw6fDo28gcG9kZSBlc3RhciBw cm9pYmlkYSBlbSB2aXJ0dWRlIGRhIGxlZ2lzbGHDp8OjbyB2aWdlbnRlLiBTZSByZWNlYmV1IGVz dGEgbWVuc2FnZW0gcG9yIGVycm8sIHJvZ2Ftb3MtbGhlIHF1ZSBub3MgbyBjb211bmlxdWUgaW1l ZGlhdGFtZW50ZSBwb3IgZXN0YSBtZXNtYSB2aWEgZSBwcm9jZWRhIGEgc3VhIGRlc3RydWnDp8Oj bw0K --_000_FB0D3A9ABE9645CFAD0FE63ADEB7F97Atelefonicacom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uZ21haWwtYy1tZXNzYWdlYm9k eQ0KCXttc28tc3R5bGUtbmFtZTpnbWFpbC1jLW1lc3NhZ2VfX2JvZHk7fQ0Kc3Bhbi5FbWFpbFN0 eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0K CXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzAuODVwdCAz LjBjbSA3MC44NXB0IDMuMGNtO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlv bjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVs dHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0t W2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlk bWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2Vu ZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJw bGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5PbiAzMS8wNy8yMDE5 LCAxNjoyNSwgJnF1b3Q7QWRkIG9uIGJlaGFsZiBvZiBFcmljIFJlc2NvcmxhJnF1b3Q7ICZsdDs8 L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmFkZC1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBsYW5nPSJF Ti1VUyI+YWRkLWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLVVTIj4g b24gYmVoYWxmIG9mDQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmVrckBydGZtLmNvbSI+PHNwYW4g bGFuZz0iRU4tVVMiPmVrckBydGZtLmNvbTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMiPiZn dDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+T24gVHVlLCBKdWwgMzAsIDIwMTkgYXQgMjo0OSBQTSBM aXZpbmdvb2QsIEphc29uICZsdDs8YSBocmVmPSJtYWlsdG86SmFzb25fTGl2aW5nb29kQGNvbWNh c3QuY29tIj5KYXNvbl9MaXZpbmdvb2RAY29tY2FzdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1s ZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBwdDttYXJnaW4t bGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDozNi4wcHQiPk9uIDcvMjUvMTksIDEwOjEyIEFNLCAmcXVvdDtBZGQgb24g YmVoYWxmIG9mIEFkYW0gUm9hY2gmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzphZGQtYm91bmNl c0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmFkZC1ib3VuY2VzQGlldGYub3JnPC9hPiBvbiBi ZWhhbGYgb2YNCjxhIGhyZWY9Im1haWx0bzphZGFtQG5vc3RydW0uY29tIiB0YXJnZXQ9Il9ibGFu ayI+YWRhbUBub3N0cnVtLmNvbTwvYT4mZ3Q7IHdyb3RlOjxicj4NCiZndDsgWW91IGNhbiBzZWUs IGZvciBleGFtcGxlLCBDbG91ZGZsYXJlJ3MgYXNzb2NpYXRlZCBwcml2YWN5IDxicj4NCiZuYnNw OyAmbmJzcDsgcG9saWN5IGF0IDxhIGhyZWY9Imh0dHBzOi8vZGV2ZWxvcGVycy5jbG91ZGZsYXJl LmNvbS8xLjEuMS4xL2NvbW1pdG1lbnQtdG8tcHJpdmFjeS9wcml2YWN5LXBvbGljeS9maXJlZm94 LyIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0cHM6Ly9kZXZlbG9wZXJzLmNsb3VkZmxhcmUuY29tLzEu MS4xLjEvY29tbWl0bWVudC10by1wcml2YWN5L3ByaXZhY3ktcG9saWN5L2ZpcmVmb3gvPC9hPg0K PGJyPg0KPGJyPg0KW0pMXSBUaGlzIHNwZWFrcyB0byB0aGUgRE5TIHF1ZXJ5L3Jlc3BvbnNlLiBC dXQgd2l0aCBEb0gsIHRoaXMgaXMgY29udGFpbmVkIGluc2lkZSBvZiBhbiBIVFRQIGVudmVsb3Bl LCBzbyB0byBzcGVhaywgd2hpY2ggaGFzIG11Y2ggbW9yZSByaWNoIHRyYWNraW5nIC0gbm90ZWQg YXQNCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmNsb3VkZmxhcmUuY29tL3ByaXZhY3lwb2xpY3kvIiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuY2xvdWRmbGFyZS5jb20vcHJpdmFjeXBvbGljeS88 L2E+IHVuZGVyIHdlYnNpdGUgdmlzaXRvcnMgKHdoaWNoIEkgcHJlc3VtZSBhcHBsaWVzIHRvIGFs bCBIVFRQIHRyYW5zYWN0aW9ucykuDQo8bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGNsYXNzPSJnbWFpbC1jLW1lc3NhZ2Vib2R5 Ij5ObywgdGhpcyBpcyBub3Qgb3VyIHVuZGVyc3RhbmRpbmcuIFJhdGhlciwgdGhlIHByaXZhY3kg cG9saWN5IGZvciBEb0ggY292ZXJzIGV2ZXJ5IGFzcGVjdCBvZiBEb0gsIGluY2x1ZGluZyB0aGUg SFRUUCBwb3J0aW9uLiBUaGUgQ2xvdWRmbGFyZSBQcml2YWN5IFBvbGljeSBpcyBhIHNlcGFyYXRl IHBvbGljeQ0KIGZvciBDRiB3ZWJzaXRlcyBhbmQgZG9lcyBub3QgZ292ZXJuIHRoZSByZXNvbHZl ci48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBjbSAwY20g MGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowY20iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+U28gdGhlIGNvbmZsdWVuY2Ug b2YgRE5TIGFuZCBIVFRQIGhlcmUgc2VlbXMgaW50ZXJlc3RpbmcgdG8gYmV0dGVyIHVuZGVyc3Rh bmQgYW5kIGRvY3VtZW50IGFzIFRSUi1zdHlsZSBwb2xpY2llcyBldm9sdmUuIFNpbmNlIHRoZXJl IGlzIGFuIEhUVFAgc2VydmVyIGludm9sdmVkIGluIERvSCwgcHJlc3VtYWJseSBhbGwgdGhlIG5v cm1hbCBIVFRQIGxvZyBpdGVtcw0KIGFyZSBzZWVuICZhbXA7IHByb2Nlc3NlZCBhbmQgY2FuIGJl IGxvZ2dlZCwgbGlrZSB1c2VyIGFnZW50LCBjb29raWVzLCBhbmQgc28gb24uPG86cD48L286cD48 L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5GaXJlZm94IGRv ZXNuJ3Qgc2VuZCBjb29raWVzIGZvciBEb0guIFdlIGRvIHNlbmQgVXNlci1BZ2VudCwgYW5kIHdl IGNvdWxkIGxvb2sgYXQgcmVtb3ZpbmcgdGhhdCwgYnV0IGdpdmVuIFRMUyBDbGllbnRIZWxsbyBm aW5nZXJwcmludGluZywgdGhhdCdzIHByb2JhYmx5IG5vdCBhZGRpbmcgYSBodWdlIGFtb3VudCBv ZiBhZGRpdGlvbmFsIGluZm9ybWF0aW9uLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4tRWtyPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPlRoaXMg aW1wbGllcyB0aGUgY29tYmluYXRpb24gRmlyZWZveC9DbG91ZGZsYXJlIGRvZXMgbm90IHBvc2Ug YSBzaWduaWZpY2FudCBwcml2YWN5IHJpc2suIEZhaXIgZW5vdWdoLiBCdXQgdGhlIGdlbmVyYWwg Y2FzZSBvZiB3aGF0ZXZlci10aGUtYXBwIHVzaW5nIGEgaGFyZHdpcmVkIERPSCByZXNvbHZlciBy ZW1haW5zLCBtdWNoIHRoZQ0KIHNhbWUgYXMgdGhlIGFyY2hldHlwYWwgY29mZmVlc2hvcCByZXNv bHZlciBjb21wYXJlZCB0byB3ZWxsLWJlaGF2ZWQsIGNvbnRyYWN0LWJvdW5kZWQgSVNQcy48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4tLTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0Ij4mcXVvdDtFc3RhIHZleiBubyBmYWxsYXJlbW9zLCBEb2N0b3IgSW5m aWVybm8mcXVvdDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPkRy IERpZWdvIFIuIExvcGV6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPlRlbGVmb25pY2EgSSYjNDM7RDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0Ij48YSBocmVmPSJodHRwczovL3d3dy5saW5rZWRpbi5jb20vaW4vZHIybG9w ZXovIj48c3BhbiBzdHlsZT0iY29sb3I6IzA1NjNDMSI+aHR0cHM6Ly93d3cubGlua2VkaW4uY29t L2luL2RyMmxvcGV6Lzwvc3Bhbj48L2E+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNwOzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0Ij5lLW1haWw6Jm5ic3A7PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjEwLjBwdCI+PGEgaHJlZj0ibWFpbHRvOmRpZWdvLnIubG9wZXpAdGVs ZWZvbmljYS5jb20iPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzA1NjNDMSI+PHNw YW4gbGFuZz0iRU4tVVMiPmRpZWdvLnIubG9wZXpAdGVsZWZvbmljYS5jb208L3NwYW4+PC9zcGFu PjwvYT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdCI+VGVsOiZuYnNwOyZuYnNwOyZuYnNwOyAmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgJiM0MzszNCA5MTMgMTI5IDA0MTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dCI+TW9iaWxlOiAmbmJzcDsmIzQzOzM0IDY4MiAwNTEgMDkxPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNp emU6MTAuMHB0Ij4tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tPC9zcGFuPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBwdDtt YXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48YnI+DQpbSkxd IEluIGFkZGl0aW9uLCBJIHN1c3BlY3QgYSBjb25jZXJuIChmb3IgdGhlIHZlcnkgaGlnaCBzY2Fs ZSBjZW50cmFsaXNlZCBEb0ggcGxhdGZvcm1zKSBpcyBub3QganVzdCB0aGUgcGVyLXVzZXIgcHJp dmFjeSBwb2xpY3kgYnV0IGFsc28gd2hhdCBhZ2dyZWdhdGVkIGJ1c2luZXNzIGludGVsbGlnZW5j ZSBhIGdsb2JhbCBzY2FsZSBwbGF0Zm9ybSB3b3VsZCBiZSBhYmxlIHRvIGRldmVsb3AgKGUuZy4g b2YgYSBwb3B1bGF0aW9uIG9mIDUwME0gdXNlcnMsDQogaG93IG1hbnkgaGF2ZSBxdWVyaWVkIGZv ciAqLjwvc3Bhbj48YSBocmVmPSJodHRwOi8vbmV0ZmxpeC5jb20iIHRhcmdldD0iX2JsYW5rIj5u ZXRmbGl4LmNvbTwvYT4gaW4gdGhlIHBhc3QgTiBob3VycywgYnkgY291bnRyeSwgQVNOLCB1c2Vy IGFnZW50LCBldGMuKSwgcmVsYXRpdmUgdG8gY29tcGV0aXRvcnMgb3IgcG90ZW50aWFsIGNvbXBl dGl0b3JzLiBTbyBJIHN1c3BlY3QgdGhlc2UgY29uY2VybnMgbWF5IGFyaXNlLCBhdCBsZWFzdCBm b3IgcGxhdGZvcm1zDQogb2YgdmVyeSBoaWdoIHNjYWxlIC8gcGVuZXRyYXRpb24uJm5ic3A7IDxi cj4NCjxicj4NCi0tIDxicj4NCkFkZCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86 QWRkQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+QWRkQGlldGYub3JnPC9hPjxicj4NCjxhIGhy ZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkIiB0YXJnZXQ9Il9i bGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQ8L2E+PG86cD48 L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8YnI+DQo8 aHI+DQo8Zm9udCBmYWNlPSJBcmlhbCIgY29sb3I9IkdyYXkiIHNpemU9IjEiPjxicj4NCkVzdGUg bWVuc2FqZSB5IHN1cyBhZGp1bnRvcyBzZSBkaXJpZ2VuIGV4Y2x1c2l2YW1lbnRlIGEgc3UgZGVz dGluYXRhcmlvLCBwdWVkZSBjb250ZW5lciBpbmZvcm1hY2nDs24gcHJpdmlsZWdpYWRhIG8gY29u ZmlkZW5jaWFsIHkgZXMgcGFyYSB1c28gZXhjbHVzaXZvIGRlIGxhIHBlcnNvbmEgbyBlbnRpZGFk IGRlIGRlc3Rpbm8uIFNpIG5vIGVzIHVzdGVkLiBlbCBkZXN0aW5hdGFyaW8gaW5kaWNhZG8sIHF1 ZWRhIG5vdGlmaWNhZG8gZGUgcXVlIGxhDQogbGVjdHVyYSwgdXRpbGl6YWNpw7NuLCBkaXZ1bGdh Y2nDs24geS9vIGNvcGlhIHNpbiBhdXRvcml6YWNpw7NuIHB1ZWRlIGVzdGFyIHByb2hpYmlkYSBl biB2aXJ0dWQgZGUgbGEgbGVnaXNsYWNpw7NuIHZpZ2VudGUuIFNpIGhhIHJlY2liaWRvIGVzdGUg bWVuc2FqZSBwb3IgZXJyb3IsIGxlIHJvZ2Ftb3MgcXVlIG5vcyBsbyBjb211bmlxdWUgaW5tZWRp YXRhbWVudGUgcG9yIGVzdGEgbWlzbWEgdsOtYSB5IHByb2NlZGEgYSBzdSBkZXN0cnVjY2nDs24u PGJyPg0KPGJyPg0KVGhlIGluZm9ybWF0aW9uIGNvbnRhaW5lZCBpbiB0aGlzIHRyYW5zbWlzc2lv biBpcyBwcml2aWxlZ2VkIGFuZCBjb25maWRlbnRpYWwgaW5mb3JtYXRpb24gaW50ZW5kZWQgb25s eSBmb3IgdGhlIHVzZSBvZiB0aGUgaW5kaXZpZHVhbCBvciBlbnRpdHkgbmFtZWQgYWJvdmUuIElm IHRoZSByZWFkZXIgb2YgdGhpcyBtZXNzYWdlIGlzIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50 LCB5b3UgYXJlIGhlcmVieSBub3RpZmllZCB0aGF0IGFueSBkaXNzZW1pbmF0aW9uLA0KIGRpc3Ry aWJ1dGlvbiBvciBjb3B5aW5nIG9mIHRoaXMgY29tbXVuaWNhdGlvbiBpcyBzdHJpY3RseSBwcm9o aWJpdGVkLiBJZiB5b3UgaGF2ZSByZWNlaXZlZCB0aGlzIHRyYW5zbWlzc2lvbiBpbiBlcnJvciwg ZG8gbm90IHJlYWQgaXQuIFBsZWFzZSBpbW1lZGlhdGVseSByZXBseSB0byB0aGUgc2VuZGVyIHRo YXQgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyBjb21tdW5pY2F0aW9uIGluIGVycm9yIGFuZCB0aGVu IGRlbGV0ZSBpdC48YnI+DQo8YnI+DQpFc3RhIG1lbnNhZ2VtIGUgc2V1cyBhbmV4b3Mgc2UgZGly aWdlbSBleGNsdXNpdmFtZW50ZSBhbyBzZXUgZGVzdGluYXTDoXJpbywgcG9kZSBjb250ZXIgaW5m b3JtYcOnw6NvIHByaXZpbGVnaWFkYSBvdSBjb25maWRlbmNpYWwgZSDDqSBwYXJhIHVzbyBleGNs dXNpdm8gZGEgcGVzc29hIG91IGVudGlkYWRlIGRlIGRlc3Rpbm8uIFNlIG7Do28gw6kgdm9zc2Eg c2VuaG9yaWEgbyBkZXN0aW5hdMOhcmlvIGluZGljYWRvLCBmaWNhIG5vdGlmaWNhZG8gZGUgcXVl IGENCiBsZWl0dXJhLCB1dGlsaXphw6fDo28sIGRpdnVsZ2HDp8OjbyBlL291IGPDs3BpYSBzZW0g YXV0b3JpemHDp8OjbyBwb2RlIGVzdGFyIHByb2liaWRhIGVtIHZpcnR1ZGUgZGEgbGVnaXNsYcOn w6NvIHZpZ2VudGUuIFNlIHJlY2ViZXUgZXN0YSBtZW5zYWdlbSBwb3IgZXJybywgcm9nYW1vcy1s aGUgcXVlIG5vcyBvIGNvbXVuaXF1ZSBpbWVkaWF0YW1lbnRlIHBvciBlc3RhIG1lc21hIHZpYSBl IHByb2NlZGEgYSBzdWEgZGVzdHJ1acOnw6NvPGJyPg0KPC9mb250Pg0KPC9ib2R5Pg0KPC9odG1s Pg0K --_000_FB0D3A9ABE9645CFAD0FE63ADEB7F97Atelefonicacom_-- From nobody Wed Jul 31 08:55:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5EC8D1203D2 for ; Wed, 31 Jul 2019 08:55:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D0-haTWgxZbW for ; Wed, 31 Jul 2019 08:55:19 -0700 (PDT) Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E807F1203A0 for ; Wed, 31 Jul 2019 08:55:18 -0700 (PDT) Received: by mail-lj1-x22e.google.com with SMTP id k18so66100996ljc.11 for ; Wed, 31 Jul 2019 08:55:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=LpWu7dtU1laGRfv+FHpZqmq9HHS6aS3IEbz+V9z+n+A=; b=ZxbERRVUSr1jfhIxYtAjitk0O7G60dF413MdST2C7glEev1D/ejOGL11tjp3cbJuII UICF+rAF00c8SCRFJdb42vXZLru993SgQwX2gEN3ZJdBTK7R+EMwNjMj3BZdsyrc7Dd1 qqiqN8tTSEUme5kGB7lLI9gWdryybQ6fw1ZFtH8YGRTXSYgPLwogIMcOOilp2m16tpuC +uNIy/UaBP8ZptXQeITwWFEoYIWTXhSlEn8TbUJJbNZke193u9qOo8AEllbdZAqUeL33 oBWn6FfN3pq5+q7x/WqY9VFzImZGn73/byCQE7C/1gw3kcgHQTjVHmwtt74+6VhSZIoG /TWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=LpWu7dtU1laGRfv+FHpZqmq9HHS6aS3IEbz+V9z+n+A=; b=mqkg9PulQUvbXWFCO3dXKSaAG1wHzO8ti+cHaJo15678fKScr/OKdbEH+rN6UI7H2k TWUqga/fpOqQyZSuexbUsvToDtsJ0tf0O+aBZs5GlzSXlr52oi2O4vkDs8kGmTucwE/H xM5bmYx2K9bglBz419mu4po33uR6SjT7dQZbbL5Erhx+GG3++C64kpV/anv1wg6xGCOL EOpAcShqM21FT2CKqPPRkcjTRgnL43YjE1oZWW5ZKkMYwy4sHoPlSHt5RnwHjZkQEnUD eFonV4TiQu4CJl8043DVaKcwINJAb0Z0P1TceaZDp0OyBmeJ26iaBdpjzQGrpUfdtzsn ccyg== X-Gm-Message-State: APjAAAWsfycq3EYV1470juhZ83gYcZIW0SjVLRCJR34Sjm+IhyyrvzBo JZuWJ3vhEX5MQVfo6OfZmAqEMuvZ2QR0iltFVso= X-Google-Smtp-Source: APXvYqx7bLZEHnY2xKSErshNYgq8QcXJxaitb9rHFgEowfV8rm6VTtjGDIVwix0nPaLH/RO8cemmjnPu3z+OFDGq6Gs= X-Received: by 2002:a2e:9b84:: with SMTP id z4mr48358708lji.75.1564588517084; Wed, 31 Jul 2019 08:55:17 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> In-Reply-To: From: Eric Rescorla Date: Wed, 31 Jul 2019 08:54:39 -0700 Message-ID: To: "Diego R. Lopez" Cc: "Livingood, Jason" , "add@ietf.org" , Adam Roach Content-Type: multipart/alternative; boundary="000000000000c7df36058efc2662" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 15:55:28 -0000 --000000000000c7df36058efc2662 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 31, 2019 at 8:25 AM Diego R. Lopez wrote: > On 31/07/2019, 16:25, "Add on behalf of Eric Rescorla" < > add-bounces@ietf.org on behalf of ekr@rtfm.com> wrote: > > > > > > > > On Tue, Jul 30, 2019 at 2:49 PM Livingood, Jason < > Jason_Livingood@comcast.com> wrote: > > On 7/25/19, 10:12 AM, "Add on behalf of Adam Roach" on behalf of adam@nostrum.com> wrote: > > You can see, for example, Cloudflare's associated privacy > policy at > https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-p= olicy/firefox/ > > [JL] This speaks to the DNS query/response. But with DoH, this is > contained inside of an HTTP envelope, so to speak, which has much more ri= ch > tracking - noted at https://www.cloudflare.com/privacypolicy/ under > website visitors (which I presume applies to all HTTP transactions). > > > > No, this is not our understanding. Rather, the privacy policy for DoH > covers every aspect of DoH, including the HTTP portion. The Cloudflare > Privacy Policy is a separate policy for CF websites and does not govern t= he > resolver. > > > > > > So the confluence of DNS and HTTP here seems interesting to better > understand and document as TRR-style policies evolve. Since there is an > HTTP server involved in DoH, presumably all the normal HTTP log items are > seen & processed and can be logged, like user agent, cookies, and so on. > > > > Firefox doesn't send cookies for DoH. We do send User-Agent, and we could > look at removing that, but given TLS ClientHello fingerprinting, that's > probably not adding a huge amount of additional information. > > > > -Ekr > > > > This implies the combination Firefox/Cloudflare does not pose a > significant privacy risk. Fair enough. But the general case of > whatever-the-app using a hardwired DOH resolver remains, much the same as > the archetypal coffeeshop resolver compared to well-behaved, > contract-bounded ISPs. > This seems to be assuming a number of facts about how ISPs behave that are not in evidence. -Ekr > > -- > > "Esta vez no fallaremos, Doctor Infierno" > > > > Dr Diego R. Lopez > > Telefonica I+D > > https://www.linkedin.com/in/dr2lopez/ > > > > e-mail: diego.r.lopez@telefonica.com > > Tel: +34 913 129 041 > > Mobile: +34 682 051 091 > > ---------------------------------- > > > > > > > [JL] In addition, I suspect a concern (for the very high scale centralise= d > DoH platforms) is not just the per-user privacy policy but also what > aggregated business intelligence a global scale platform would be able to > develop (e.g. of a population of 500M users, how many have queried for *. > netflix.com in the past N hours, by country, ASN, user agent, etc.), > relative to competitors or potential competitors. So I suspect these > concerns may arise, at least for platforms of very high scale / > penetration. > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > ------------------------------ > > Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, > puede contener informaci=C3=B3n privilegiada o confidencial y es para uso > exclusivo de la persona o entidad de destino. Si no es usted. el > destinatario indicado, queda notificado de que la lectura, utilizaci=C3= =B3n, > divulgaci=C3=B3n y/o copia sin autorizaci=C3=B3n puede estar prohibida en= virtud de > la legislaci=C3=B3n vigente. Si ha recibido este mensaje por error, le ro= gamos > que nos lo comunique inmediatamente por esta misma v=C3=ADa y proceda a s= u > destrucci=C3=B3n. > > The information contained in this transmission is privileged and > confidential information intended only for the use of the individual or > entity named above. If the reader of this message is not the intended > recipient, you are hereby notified that any dissemination, distribution o= r > copying of this communication is strictly prohibited. If you have receive= d > this transmission in error, do not read it. Please immediately reply to t= he > sender that you have received this communication in error and then delete > it. > > Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinat=C3= =A1rio, > pode conter informa=C3=A7=C3=A3o privilegiada ou confidencial e =C3=A9 pa= ra uso exclusivo > da pessoa ou entidade de destino. Se n=C3=A3o =C3=A9 vossa senhoria o des= tinat=C3=A1rio > indicado, fica notificado de que a leitura, utiliza=C3=A7=C3=A3o, divulga= =C3=A7=C3=A3o e/ou > c=C3=B3pia sem autoriza=C3=A7=C3=A3o pode estar proibida em virtude da le= gisla=C3=A7=C3=A3o vigente. > Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique > imediatamente por esta mesma via e proceda a sua destrui=C3=A7=C3=A3o > --000000000000c7df36058efc2662 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Wed, Jul 31, 2019 at 8:25 AM Diego= R. Lopez <diego.r.lopez= @telefonica.com> wrote:

    On 3= 1/07/2019, 16:25, "Add on behalf of Eric Rescorla" <add-bounces@ietf.org on behalf of ekr@rtfm.com> wrote:

    <= /u>=C2=A0

    <= /u>=C2=A0

    <= /u>=C2=A0

    On Tue, Jul 30, 2019 at 2= :49 PM Livingood, Jason <Jason_Livingood@comcast.com> wrote:<= /p>

    On 7/25/19, 10:12 AM, &qu= ot;Add on behalf of Adam Roach" <add-bounces@ietf.org on behalf of adam@nostrum.com&= gt; wrote:
    > You can see, for example, Cloudflare's associated privacy
    =C2=A0 =C2=A0 policy at https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-pol= icy/firefox/

    [JL] This speaks to the DNS query/response. But with DoH, this is contained= inside of an HTTP envelope, so to speak, which has much more rich tracking= - noted at htt= ps://www.cloudflare.com/privacypolicy/ under website visitors (which I = presume applies to all HTTP transactions).

    =C2=A0

    No, this is not our understanding. R= ather, the privacy policy for DoH covers every aspect of DoH, including the= HTTP portion. The Cloudflare Privacy Policy is a separate policy for CF websites and does not govern the resolver.

    =C2=A0

    =C2=A0

    So the confluence of DNS = and HTTP here seems interesting to better understand and document as TRR-st= yle policies evolve. Since there is an HTTP server involved in DoH, presuma= bly all the normal HTTP log items are seen & processed and can be logged, like user agent, cookies, and = so on.

    =C2=A0

    Firefox doesn't send = cookies for DoH. We do send User-Agent, and we could look at removing that,= but given TLS ClientHello fingerprinting, that's probably not adding a= huge amount of additional information.

    =C2=A0<= /span>

    -Ekr=

    =C2=A0

    This i= mplies the combination Firefox/Cloudflare does not pose a significant priva= cy risk. Fair enough. But the general case of whatever-the-app using a hard= wired DOH resolver remains, much the same as the archetypal coffeeshop resolver compared to well-behaved, contr= act-bounded ISPs.


    This seems to be assuming a number of facts about how ISPs = behave that are not in evidence.

    -Ekr
    =

    =

    =C2=A0

    --

    "Esta vez no fal= laremos, Doctor Infierno"

    =C2=A0<= /span>

    Dr Diego R. Lopez<= /u>

    Telefonica I+D=

    https://www.linkedin.com/in/dr2lopez/=C2=A0

    =C2=A0<= /span>

    e-mail:=C2=A0<= span style=3D"font-size:10pt" lang=3D"EN-GB">diego.r.lopez@telefonica.com=

    Tel:= =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 +34 913 129 041

    Mobile= : =C2=A0+34 682 051 091

    ------= ----------------------------

    =C2=A0

    =C2=A0


    [JL] In addition, I suspect a concern (for the very high scale centralised = DoH platforms) is not just the per-user privacy policy but also what aggreg= ated business intelligence a global scale platform would be able to develop= (e.g. of a population of 500M users, how many have queried for *.    netflix.com in the past N hours, by country, ASN, user agen= t, etc.), relative to competitors or potential competitors. So I suspect th= ese concerns may arise, at least for platforms of very high scale / penetration.=C2=A0

    --
    Add mailing list
    Add@ietf.org
    htt= ps://www.ietf.org/mailman/listinfo/add



    Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, pu= ede contener informaci=C3=B3n privilegiada o confidencial y es para uso exc= lusivo de la persona o entidad de destino. Si no es usted. el destinatario = indicado, queda notificado de que la lectura, utilizaci=C3=B3n, divulgaci=C3=B3n y/o copia sin autorizaci=C3=B3= n puede estar prohibida en virtud de la legislaci=C3=B3n vigente. Si ha rec= ibido este mensaje por error, le rogamos que nos lo comunique inmediatament= e por esta misma v=C3=ADa y proceda a su destrucci=C3=B3n.

    The information contained in this transmission is privileged and confidenti= al information intended only for the use of the individual or entity named = above. If the reader of this message is not the intended recipient, you are= hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If y= ou have received this transmission in error, do not read it. Please immedia= tely reply to the sender that you have received this communication in error= and then delete it.

    Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinat=C3=A1= rio, pode conter informa=C3=A7=C3=A3o privilegiada ou confidencial e =C3=A9= para uso exclusivo da pessoa ou entidade de destino. Se n=C3=A3o =C3=A9 vo= ssa senhoria o destinat=C3=A1rio indicado, fica notificado de que a leitura, utiliza=C3=A7=C3=A3o, divulga=C3=A7=C3=A3o e/ou c=C3=B3pia sem au= toriza=C3=A7=C3=A3o pode estar proibida em virtude da legisla=C3=A7=C3=A3o = vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique= imediatamente por esta mesma via e proceda a sua destrui=C3=A7=C3=A3o
    --000000000000c7df36058efc2662-- From nobody Wed Jul 31 08:56:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BCAE1203A7 for ; Wed, 31 Jul 2019 08:56:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id znqZPBKcJPyK for ; Wed, 31 Jul 2019 08:56:05 -0700 (PDT) Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DDDA61203AE for ; Wed, 31 Jul 2019 08:56:04 -0700 (PDT) Received: by mail-lj1-x22f.google.com with SMTP id z28so11896632ljn.4 for ; Wed, 31 Jul 2019 08:56:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=O+IYS+8oC6chz1vYUjsoB6C5T+QsgPfMU5TNkLsvxgw=; b=sOlvaYn0UJrnTmiIeBQ0LPLrNQabvACe3B47RZhovJa4Bj34P2Prs6wfpZRgSb8GyI SNM8SHldICDahpmv1KAQjSTBYFk7yrkq56NrjWvj51QcaSG7PWq0riD674RtTJcIZYqR buZjI6fj2P4BRjmcVhSi/GnKAia8bmqdtNVhNrqOtRlXVsiEbYFpzspg+XpZA7R3WdJA xyC3mmO3UuDyemuLTyjq7jUbiGxOP/Bp8iWTnLkRPf/VHUgjxBKqGahL1KOHsTjN2qKu kRN06cKydvnVjMVeDYVGzYS+18a1C4ZUy0Ua2X1JhLGTq3hwQNcgaJegeVtN/8r6yufh Ov4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=O+IYS+8oC6chz1vYUjsoB6C5T+QsgPfMU5TNkLsvxgw=; b=kJGsZK2InoMfzi+hWZYqMJgGRfOpSRsiDahwKVK7anLlPtCbg7+JK9FgCDOkXJ/l5C OoMFbolOVVqKR5fPojJSOSLkCxd6w0x8qJCSYYrKy6l0HDyZ3Z8o6RbtT2xjebxeapdN aWTX1vE/NwwtQ0fe4YZ71B54xWOL7rUEVQdzmprpBPv4/QLtkJHrgfpqdKX8k/98UER6 mECVIbhUw+NIqyo7c2OKiFYDIPLb8DAHy0r7zxzhg2Ckzb4N9CtbfEN3hcYEJYwE2a8c ZnDOdIHhtI6JZqpjCxzRuO1y8wXETaUk4mIaUg5AuExMOC/5sqFbAugupr+NKwTglGf9 ppFQ== X-Gm-Message-State: APjAAAUISRNSh87xSdPhxWyZNv4TFgOJ4Uf7dKUymVKpyjYQXja/WRr6 XkcExfnk+wFkqDKrQroqYLBeaVxKRBqN4SCvqURzgA== X-Google-Smtp-Source: APXvYqwqIz2uV6tFsatpdgBBINTHOF9jah4/UZZJR7FboH7HDEXnO0uNmwubCeG6OELd90WaxDdhuR10mZZxP1KfuPA= X-Received: by 2002:a2e:3008:: with SMTP id w8mr65947074ljw.13.1564588563098; Wed, 31 Jul 2019 08:56:03 -0700 (PDT) MIME-Version: 1.0 References: <8763F656-928B-49A8-B27F-431DCC02142F@rfc1035.com> In-Reply-To: <8763F656-928B-49A8-B27F-431DCC02142F@rfc1035.com> From: Eric Rescorla Date: Wed, 31 Jul 2019 08:55:26 -0700 Message-ID: To: Jim Reid Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000086008b058efc29f3" Archived-At: Subject: Re: [Add] quad-N usage data X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 15:56:11 -0000 --00000000000086008b058efc29f3 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 31, 2019 at 7:11 AM Jim Reid wrote: > > > > On 31 Jul 2019, at 14:48, Eric Rescorla wrote: > > > > given that plenty of people have their resolver configured to 8.8.8.8 o= r > 1.1.1.1 > > While I'm sure that=E2=80=99s true, what data does Mozilla (or anyone els= e) have > to quantify just how big =E2=80=9Cmany people=E2=80=9D actually is? I seem to remember seeing something, but I don't have it to hand. Or for bonus points, how many of those many people made a deliberate > decision to use these resolvers instead of them being chosen for them > (DHCP, captive portal, browser confguration, etc)? > I agree that very few did, but I'm not sure what point you think that makes. The reason I mentioned the broad use of alternate resolvers was to point out that ISP-provided DNS service is not an essential part of Internet connectivity. -Ekr > Apologies too for a meaningful and relevant Subject: header. :-) > > --00000000000086008b058efc29f3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Wed, Jul 31, 2019 at 7:11 AM Jim R= eid <jim@rfc1035.co= m> wrote:


    > On 31 Jul 2019, at 14:48, Eric Rescorla <ekr@rtfm.com> wrote:
    >
    > given that plenty of people have their resolver configured to 8.8.8.8 = or 1.1.1.1

    While I'm sure that=E2=80=99s true, what data does Mozilla (or anyone e= lse) have to quantify just how big =E2=80=9Cmany people=E2=80=9D actually i= s?

    =C2=A0I seem to remember seeing somethi= ng, but I don't have it to hand.


    Or for bonus points, how man= y of those many people made a deliberate decision to use these resolvers in= stead of them being chosen for them (DHCP, captive portal, browser confgura= tion, etc)?

    I agree that very few did, = but I'm not sure what point you think that makes. The reason I mentione= d the broad use of alternate resolvers was to point out that ISP-provided D= NS service is not an essential part of Internet connectivity.

    -Ekr


    Apologies too for a meaningful and relevant Subject: header. :-)

    --00000000000086008b058efc29f3-- From nobody Wed Jul 31 08:59:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCAD21202B8 for ; Wed, 31 Jul 2019 08:58:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oYHGCWHq9Mto for ; Wed, 31 Jul 2019 08:58:57 -0700 (PDT) Received: from mail-wm1-x335.google.com (mail-wm1-x335.google.com [IPv6:2a00:1450:4864:20::335]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B66F31202B5 for ; Wed, 31 Jul 2019 08:58:56 -0700 (PDT) Received: by mail-wm1-x335.google.com with SMTP id g67so56208305wme.1 for ; Wed, 31 Jul 2019 08:58:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=wc6DjdMhYtIkpeeS0lgmVVamzn5Yy5hLbsRhnE5KxzY=; b=Xu3lH2C6qCYflsz7DLar0mY78mf+ivJYIGM96i9iFQ8ZOOCmkI7sGnS5872d1a9T1L rY9gVntOUjzWp2+7p0d5hk+b0lZzE6uqBw7Q3Tq812sU/I3Ehs4B7SFjIHCIqUMpDaVE 4I2YNNmvlPhJ+D4oBlt6s+miKpFeA9lozFuVRZsMDru9XXyKNWdxGHvx3cNHT2iIodF1 FRjPUL6ZYjp5AK5axv/P5ZVr1yogwr9Ev2X+LXGiLpN7DWCis/1HYRHvUYvCeS7bmxPQ RTvBjQueNEYePGVDpHflG8hSbloAaecPPzjlNxbnnsy3Zllt4o4NsUnZf0GrboSmwbaK HEWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=wc6DjdMhYtIkpeeS0lgmVVamzn5Yy5hLbsRhnE5KxzY=; b=CSvXEdhWB7vIzR367Afx6AJndvxTYhFqKA5Y+t1MSOF8Splj0kQmtBKwItGMFfL7UN 8zRM9IbpNAGygWVYTd5pOd5uLk9OANXTQUVrPDA8CI5WFT+bsPSTMOgIUm52HOW76NEy BEwWVG0cLGKOpnJW5DqeTUExFmpYjMLqp+NRYTGLonbouPHo6Tspi4aFPKDjtG4ocoXM ZIEan/vG72GUkbtZ48CN64BPdGiJj1OgYMn9dCNS7ysIFISDNLOsK9Qiv9iZht4MLd6o W7SNFsW6WSuBqbhwO9O6zDo4GrfypBsJFbNn7UuNTswhi8j8rd9e4JfUSVhM/M/BKNav QWyQ== X-Gm-Message-State: APjAAAVLExd+xyK1B/AWAuwOtZRtzeoxvn1Y0xpYWqJZqTHyLmjlpcKc cbZXywSc+po6mmrQ5unhMJgHQ9dwKICdykdMd341ew== X-Google-Smtp-Source: APXvYqxSOuH0OiZ6NGmvj7ogey2je+0O8ltmlHlRUeNix3fxSL+T5dnvYYalzhpT6iT1fbc7nzZXwPgCmagJLubcit4= X-Received: by 2002:a7b:c106:: with SMTP id w6mr117476037wmi.80.1564588734826; Wed, 31 Jul 2019 08:58:54 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> In-Reply-To: From: Eric Orth Date: Wed, 31 Jul 2019 11:58:42 -0400 Message-ID: To: "Diego R. Lopez" Cc: Eric Rescorla , "Livingood, Jason" , "add@ietf.org" , Adam Roach Content-Type: multipart/alternative; boundary="000000000000c2d0de058efc3373" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 15:59:00 -0000 --000000000000c2d0de058efc3373 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 31, 2019 at 11:26 AM Diego R. Lopez < diego.r.lopez@telefonica.com> wrote: > On 31/07/2019, 16:25, "Add on behalf of Eric Rescorla" < > add-bounces@ietf.org on behalf of ekr@rtfm.com> wrote: > > > > > > > > On Tue, Jul 30, 2019 at 2:49 PM Livingood, Jason < > Jason_Livingood@comcast.com> wrote: > > On 7/25/19, 10:12 AM, "Add on behalf of Adam Roach" on behalf of adam@nostrum.com> wrote: > > You can see, for example, Cloudflare's associated privacy > policy at > https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-p= olicy/firefox/ > > [JL] This speaks to the DNS query/response. But with DoH, this is > contained inside of an HTTP envelope, so to speak, which has much more ri= ch > tracking - noted at https://www.cloudflare.com/privacypolicy/ under > website visitors (which I presume applies to all HTTP transactions). > > > > No, this is not our understanding. Rather, the privacy policy for DoH > covers every aspect of DoH, including the HTTP portion. The Cloudflare > Privacy Policy is a separate policy for CF websites and does not govern t= he > resolver. > > > > > > So the confluence of DNS and HTTP here seems interesting to better > understand and document as TRR-style policies evolve. Since there is an > HTTP server involved in DoH, presumably all the normal HTTP log items are > seen & processed and can be logged, like user agent, cookies, and so on. > > > > Firefox doesn't send cookies for DoH. We do send User-Agent, and we could > look at removing that, but given TLS ClientHello fingerprinting, that's > probably not adding a huge amount of additional information. > Chrome has similar behavior. DoH requests do not send or accept cookies and are blocked from sharing sockets/connections/etc with any requests that do. Recent work has also minimized other standard headers, eg setting user-agent to simply "Chrome" and accept-language to "*". Similar privacy mitigations and considerations for DoH/DoT/etc may be useful to document in an Informational or BCP. Best if applications implementing these protocols make informed decisions around privacy practices. > > > -Ekr > > > > This implies the combination Firefox/Cloudflare does not pose a > significant privacy risk. Fair enough. But the general case of > whatever-the-app using a hardwired DOH resolver remains, much the same as > the archetypal coffeeshop resolver compared to well-behaved, > contract-bounded ISPs. > > > > -- > > "Esta vez no fallaremos, Doctor Infierno" > > > > Dr Diego R. Lopez > > Telefonica I+D > > https://www.linkedin.com/in/dr2lopez/ > > > > e-mail: diego.r.lopez@telefonica.com > > Tel: +34 913 129 041 > > Mobile: +34 682 051 091 > > ---------------------------------- > > > > > > > [JL] In addition, I suspect a concern (for the very high scale centralise= d > DoH platforms) is not just the per-user privacy policy but also what > aggregated business intelligence a global scale platform would be able to > develop (e.g. of a population of 500M users, how many have queried for *. > netflix.com in the past N hours, by country, ASN, user agent, etc.), > relative to competitors or potential competitors. So I suspect these > concerns may arise, at least for platforms of very high scale / > penetration. > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > ------------------------------ > > Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, > puede contener informaci=C3=B3n privilegiada o confidencial y es para uso > exclusivo de la persona o entidad de destino. Si no es usted. el > destinatario indicado, queda notificado de que la lectura, utilizaci=C3= =B3n, > divulgaci=C3=B3n y/o copia sin autorizaci=C3=B3n puede estar prohibida en= virtud de > la legislaci=C3=B3n vigente. Si ha recibido este mensaje por error, le ro= gamos > que nos lo comunique inmediatamente por esta misma v=C3=ADa y proceda a s= u > destrucci=C3=B3n. > > The information contained in this transmission is privileged and > confidential information intended only for the use of the individual or > entity named above. If the reader of this message is not the intended > recipient, you are hereby notified that any dissemination, distribution o= r > copying of this communication is strictly prohibited. If you have receive= d > this transmission in error, do not read it. Please immediately reply to t= he > sender that you have received this communication in error and then delete > it. > > Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinat=C3= =A1rio, > pode conter informa=C3=A7=C3=A3o privilegiada ou confidencial e =C3=A9 pa= ra uso exclusivo > da pessoa ou entidade de destino. Se n=C3=A3o =C3=A9 vossa senhoria o des= tinat=C3=A1rio > indicado, fica notificado de que a leitura, utiliza=C3=A7=C3=A3o, divulga= =C3=A7=C3=A3o e/ou > c=C3=B3pia sem autoriza=C3=A7=C3=A3o pode estar proibida em virtude da le= gisla=C3=A7=C3=A3o vigente. > Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique > imediatamente por esta mesma via e proceda a sua destrui=C3=A7=C3=A3o > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000c2d0de058efc3373 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Wed, Jul 31, 2019 at 11:26 AM Dieg= o R. Lopez <diego.r.lope= z@telefonica.com> wrote:

    On 3= 1/07/2019, 16:25, "Add on behalf of Eric Rescorla" <add-bounces@ietf.org on behalf of ekr@rtfm.com> wrote:

    <= /u>=C2=A0

    <= /u>=C2=A0

    <= /u>=C2=A0

    On Tue, Jul 30, 2019 at 2= :49 PM Livingood, Jason <Jason_Livingood@comcast.com> wrote:<= /p>

    On 7/25/19, 10:12 AM, &qu= ot;Add on behalf of Adam Roach" <add-bounces@ietf.org on behalf of adam@nostrum.com&= gt; wrote:
    > You can see, for example, Cloudflare's associated privacy
    =C2=A0 =C2=A0 policy at https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-pol= icy/firefox/

    [JL] This speaks to the DNS query/response. But with DoH, this is contained= inside of an HTTP envelope, so to speak, which has much more rich tracking= - noted at htt= ps://www.cloudflare.com/privacypolicy/ under website visitors (which I = presume applies to all HTTP transactions).

    =C2=A0

    No, this is not our understanding. R= ather, the privacy policy for DoH covers every aspect of DoH, including the= HTTP portion. The Cloudflare Privacy Policy is a separate policy for CF websites and does not govern the resolver.

    =C2=A0

    =C2=A0

    So the confluence of DNS = and HTTP here seems interesting to better understand and document as TRR-st= yle policies evolve. Since there is an HTTP server involved in DoH, presuma= bly all the normal HTTP log items are seen & processed and can be logged, like user agent, cookies, and = so on.

    =C2=A0

    Firefox doesn't send = cookies for DoH. We do send User-Agent, and we could look at removing that,= but given TLS ClientHello fingerprinting, that's probably not adding a= huge amount of additional information.


    Chrome has similar behavior.=C2=A0 DoH reque= sts do not send or accept cookies and are blocked from sharing sockets/conn= ections/etc with any requests that do.=C2=A0 Recent work has also minimized= other standard headers, eg setting user-agent to simply "Chrome"= and accept-language to "*".

    Similar pri= vacy mitigations and considerations for DoH/DoT/etc may be useful to docume= nt in an Informational or BCP.=C2=A0 Best if applications implementing thes= e protocols make informed decisions around privacy practices.
    =C2= =A0

    =C2=A0<= /span>

    -Ekr=

    =C2=A0

    This i= mplies the combination Firefox/Cloudflare does not pose a significant priva= cy risk. Fair enough. But the general case of whatever-the-app using a hard= wired DOH resolver remains, much the same as the archetypal coffeeshop resolver compared to well-behaved, contr= act-bounded ISPs.

    =C2=A0

    --

    "Esta vez no fal= laremos, Doctor Infierno"

    =C2=A0<= /span>

    Dr Diego R. Lopez<= /u>

    Telefonica I+D=

    https://www.linkedin.com/in/dr2lopez/=C2=A0

    =C2=A0<= /span>

    e-mail:=C2=A0<= span lang=3D"EN-GB" style=3D"font-size:10pt">diego.r.lopez@telefonica.com=

    Tel:= =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 +34 913 129 041

    Mobile= : =C2=A0+34 682 051 091

    ------= ----------------------------

    =C2=A0

    =C2=A0


    [JL] In addition, I suspect a concern (for the very high scale centralised = DoH platforms) is not just the per-user privacy policy but also what aggreg= ated business intelligence a global scale platform would be able to develop= (e.g. of a population of 500M users, how many have queried for *.    netflix.com in the past N hours, by country, ASN, user agen= t, etc.), relative to competitors or potential competitors. So I suspect th= ese concerns may arise, at least for platforms of very high scale / penetration.=C2=A0

    --
    Add mailing list
    Add@ietf.org
    htt= ps://www.ietf.org/mailman/listinfo/add



    Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, pu= ede contener informaci=C3=B3n privilegiada o confidencial y es para uso exc= lusivo de la persona o entidad de destino. Si no es usted. el destinatario = indicado, queda notificado de que la lectura, utilizaci=C3=B3n, divulgaci=C3=B3n y/o copia sin autorizaci=C3=B3= n puede estar prohibida en virtud de la legislaci=C3=B3n vigente. Si ha rec= ibido este mensaje por error, le rogamos que nos lo comunique inmediatament= e por esta misma v=C3=ADa y proceda a su destrucci=C3=B3n.

    The information contained in this transmission is privileged and confidenti= al information intended only for the use of the individual or entity named = above. If the reader of this message is not the intended recipient, you are= hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If y= ou have received this transmission in error, do not read it. Please immedia= tely reply to the sender that you have received this communication in error= and then delete it.

    Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinat=C3=A1= rio, pode conter informa=C3=A7=C3=A3o privilegiada ou confidencial e =C3=A9= para uso exclusivo da pessoa ou entidade de destino. Se n=C3=A3o =C3=A9 vo= ssa senhoria o destinat=C3=A1rio indicado, fica notificado de que a leitura, utiliza=C3=A7=C3=A3o, divulga=C3=A7=C3=A3o e/ou c=C3=B3pia sem au= toriza=C3=A7=C3=A3o pode estar proibida em virtude da legisla=C3=A7=C3=A3o = vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique= imediatamente por esta mesma via e proceda a sua destrui=C3=A7=C3=A3o
    --
    Add mailing list
    Add@ietf.org
    https://www.ietf.org/mailman/listinfo/add
    --000000000000c2d0de058efc3373-- From nobody Wed Jul 31 09:05:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D080D1203DA for ; Wed, 31 Jul 2019 09:04:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telefonica.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w9K7ZKR_tip0 for ; Wed, 31 Jul 2019 09:04:53 -0700 (PDT) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00134.outbound.protection.outlook.com [40.107.0.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1961D1203B7 for ; Wed, 31 Jul 2019 09:04:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WNTbV8DF1155aIIIFQBXmE8+2hVQeT/lr2Ycs9ZmJJeHqEWQZfTVEEVw7LbBdyBN+py1r3QZcKlk4pSPe9Rv9lPHaxk9QjuSL6iTlkJedAh//+Kjf5aoYsdH1sDDShIgt5YUXE2kMw5kCePj+rPrS7mn5zr3DAMgKSkmIRrKZfstwUaqKdqaD16pC1ZpwT73GpBd19Nj0VmYFrUIZU5mJf6W5cc4nNhSKg5cbQArkAwGzTWv9OCPfXHR3PAhn2d22j9lWqB1V+Lj1X507qAik1D0Slkq6+zC7vEA1wtFYDsBWDoSCz6wAKLTfWtTocdxhIgfrLDGWg9qY1MmwNOmPg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qC2mJi9t6G2Wi67RUeLXY41+drXu/La0aKSWrOCBr90=; b=L7Qpx1SA4t6tRAvSz5obTiF5rtm5U/fXasYN9o5EnQaseYkH4E+HBv+m5pBprg27lgNyXqRNm3nlLH/EDV6hA9sP6g9Z+b2H6+x4QdiLKRF0rpp5fc3SC0nSVbT5400xuyzu8x5eV+p+JbLzAI4RLnr44eYnhDkLd8XLXCQzrX/i0caIkTGY81ZGsNS+qPcHIjhas3VzTM/8ku34h9Ujztu9ILch3VPldaN4wsAcl3c65qs6/dencDGO8YS4/c/dA/jRWl/InyaZN8w/rhoxBWsFsMxBqB8VO4s357oaLA9+56iU7UGDtFU/zqxCY6+zFRGN/5zUIe2aP1VPvcUucg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=telefonica.com;dmarc=pass action=none header.from=telefonica.com;dkim=pass header.d=telefonica.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telefonica.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qC2mJi9t6G2Wi67RUeLXY41+drXu/La0aKSWrOCBr90=; b=gnQGxG8DWDDKGQ3n6uYT99MyyPBNuI1GrJycbmKmqr0QZs397SXKWhrv/OiUpC8aIMHczdjrSDCNWidTyELmGHBCd2u5/JK8L/kuZFLH3cQLINVlSXxeSTWt0Hn2HUpZ7MGna41H/oe0MjPReMmdYS9sagPrKkU86fTBz1Ckwms= Received: from DB3PR0602MB3788.eurprd06.prod.outlook.com (52.134.70.148) by DB3PR0602MB3738.eurprd06.prod.outlook.com (52.134.71.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Wed, 31 Jul 2019 16:04:50 +0000 Received: from DB3PR0602MB3788.eurprd06.prod.outlook.com ([fe80::9c53:d10:400e:c71]) by DB3PR0602MB3788.eurprd06.prod.outlook.com ([fe80::9c53:d10:400e:c71%5]) with mapi id 15.20.2115.005; Wed, 31 Jul 2019 16:04:50 +0000 From: "Diego R. Lopez" To: Eric Rescorla CC: "Livingood, Jason" , "add@ietf.org" , Adam Roach Thread-Topic: [Add] meeting hum: should the IETF take up this work? Thread-Index: AQHVQaN6W0OKjL9v+0y8Y3h3cwbqjqbYx7wAgAABXACAAAQtgIABMd6AgAD6woCAAGikAIAIW3qAgAEV/YD//84bAIAASyKA//+/xgA= Date: Wed, 31 Jul 2019 16:04:50 +0000 Message-ID: <23B6F36E-36E8-4BE6-8E9C-37E0F99FF409@telefonica.com> References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.c.190715 authentication-results: spf=none (sender IP is ) smtp.mailfrom=diego.r.lopez@telefonica.com; x-originating-ip: [88.16.178.60] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 09d7b2c3-5445-4c1d-f4cb-08d715d0d16e x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:DB3PR0602MB3738; x-ms-traffictypediagnostic: DB3PR0602MB3738: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 011579F31F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(376002)(366004)(396003)(136003)(346002)(39860400002)(199004)(189003)(40134004)(3846002)(6116002)(58126008)(54906003)(786003)(316002)(76176011)(5660300002)(6486002)(8936002)(66574012)(7736002)(14454004)(606006)(229853002)(26005)(81156014)(86362001)(53546011)(8676002)(53936002)(2906002)(81166006)(68736007)(102836004)(6246003)(6436002)(99286004)(33656002)(256004)(11346002)(446003)(66946007)(186003)(14444005)(66066001)(25786009)(486006)(478600001)(236005)(36756003)(966005)(54896002)(6306002)(6512007)(66446008)(6916009)(6506007)(76116006)(4326008)(476003)(2616005)(5070765005)(71200400001)(71190400001)(45080400002)(66476007)(66556008)(64756008); DIR:OUT; SFP:1102; SCL:1; SRVR:DB3PR0602MB3738; H:DB3PR0602MB3788.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: telefonica.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: y4DnZw7kMqkTcsNh9u+AZeOCbVmm89R0i2z0CiXHhRzDDuduK06tEWNUN0H6aR54bIRTQtjU7Czi7HWmanCuDq2YcrCrRZcO04NQXZRjCrpIA+0pIiRA4ghFnwk0QxHdC6k47NEnGWbTJmco+7NhX+jAlNOOImGEKxCYBbErC2rxVlk1fZl+QVoMdwrfXrs/iFXdFadk7JxuI6IsdhyhUIUF7Di2+nHckALZaEzheHnOLyy9fG92Id7meh0Kn4s5gq3kEcE5tgfUbykZgbsPb0ABYYk451PxDSCX9kvjKtOt8zfKuJQMJBQACdUGjGwoLIHoSbNS5sAejnr3UWtWZrFAx9mSITFfYCLy+5PMYResk10MM95FhrLcJqHxvPneT6e+/L0kvDrohwW0mmI+8wMKRINaH8ugQJZFpN522jk= Content-Type: multipart/alternative; boundary="_000_23B6F36E36E84BE68E9C37E0F99FF409telefonicacom_" MIME-Version: 1.0 X-OriginatorOrg: telefonica.com X-MS-Exchange-CrossTenant-Network-Message-Id: 09d7b2c3-5445-4c1d-f4cb-08d715d0d16e X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Jul 2019 16:04:50.6105 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9744600e-3e04-492e-baa1-25ec245c6f10 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: diego.r.lopez@telefonica.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB3PR0602MB3738 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 16:05:04 -0000 --_000_23B6F36E36E84BE68E9C37E0F99FF409telefonicacom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gMzEvMDcvMjAxOSwgMTc6NTUsICJFcmljIFJlc2NvcmxhIiA8ZWtyQHJ0Zm0uY29tPG1haWx0 bzpla3JAcnRmbS5jb20+PiB3cm90ZToNCg0KT24gV2VkLCBKdWwgMzEsIDIwMTkgYXQgODoyNSBB TSBEaWVnbyBSLiBMb3BleiA8ZGllZ28uci5sb3BlekB0ZWxlZm9uaWNhLmNvbTxtYWlsdG86ZGll Z28uci5sb3BlekB0ZWxlZm9uaWNhLmNvbT4+IHdyb3RlOg0KT24gMzEvMDcvMjAxOSwgMTY6MjUs ICJBZGQgb24gYmVoYWxmIG9mIEVyaWMgUmVzY29ybGEiIDxhZGQtYm91bmNlc0BpZXRmLm9yZzxt YWlsdG86YWRkLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFsZiBvZiBla3JAcnRmbS5jb208bWFp bHRvOmVrckBydGZtLmNvbT4+IHdyb3RlOg0KT24gVHVlLCBKdWwgMzAsIDIwMTkgYXQgMjo0OSBQ TSBMaXZpbmdvb2QsIEphc29uIDxKYXNvbl9MaXZpbmdvb2RAY29tY2FzdC5jb208bWFpbHRvOkph c29uX0xpdmluZ29vZEBjb21jYXN0LmNvbT4+IHdyb3RlOg0KT24gNy8yNS8xOSwgMTA6MTIgQU0s ICJBZGQgb24gYmVoYWxmIG9mIEFkYW0gUm9hY2giIDxhZGQtYm91bmNlc0BpZXRmLm9yZzxtYWls dG86YWRkLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFsZiBvZiBhZGFtQG5vc3RydW0uY29tPG1h aWx0bzphZGFtQG5vc3RydW0uY29tPj4gd3JvdGU6DQo+IFlvdSBjYW4gc2VlLCBmb3IgZXhhbXBs ZSwgQ2xvdWRmbGFyZSdzIGFzc29jaWF0ZWQgcHJpdmFjeQ0KICAgIHBvbGljeSBhdCBodHRwczov L2RldmVsb3BlcnMuY2xvdWRmbGFyZS5jb20vMS4xLjEuMS9jb21taXRtZW50LXRvLXByaXZhY3kv cHJpdmFjeS1wb2xpY3kvZmlyZWZveC8NCg0KW0pMXSBUaGlzIHNwZWFrcyB0byB0aGUgRE5TIHF1 ZXJ5L3Jlc3BvbnNlLiBCdXQgd2l0aCBEb0gsIHRoaXMgaXMgY29udGFpbmVkIGluc2lkZSBvZiBh biBIVFRQIGVudmVsb3BlLCBzbyB0byBzcGVhaywgd2hpY2ggaGFzIG11Y2ggbW9yZSByaWNoIHRy YWNraW5nIC0gbm90ZWQgYXQgaHR0cHM6Ly93d3cuY2xvdWRmbGFyZS5jb20vcHJpdmFjeXBvbGlj eS8gdW5kZXIgd2Vic2l0ZSB2aXNpdG9ycyAod2hpY2ggSSBwcmVzdW1lIGFwcGxpZXMgdG8gYWxs IEhUVFAgdHJhbnNhY3Rpb25zKS4NCk5vLCB0aGlzIGlzIG5vdCBvdXIgdW5kZXJzdGFuZGluZy4g UmF0aGVyLCB0aGUgcHJpdmFjeSBwb2xpY3kgZm9yIERvSCBjb3ZlcnMgZXZlcnkgYXNwZWN0IG9m IERvSCwgaW5jbHVkaW5nIHRoZSBIVFRQIHBvcnRpb24uIFRoZSBDbG91ZGZsYXJlIFByaXZhY3kg UG9saWN5IGlzIGEgc2VwYXJhdGUgcG9saWN5IGZvciBDRiB3ZWJzaXRlcyBhbmQgZG9lcyBub3Qg Z292ZXJuIHRoZSByZXNvbHZlci4NClNvIHRoZSBjb25mbHVlbmNlIG9mIEROUyBhbmQgSFRUUCBo ZXJlIHNlZW1zIGludGVyZXN0aW5nIHRvIGJldHRlciB1bmRlcnN0YW5kIGFuZCBkb2N1bWVudCBh cyBUUlItc3R5bGUgcG9saWNpZXMgZXZvbHZlLiBTaW5jZSB0aGVyZSBpcyBhbiBIVFRQIHNlcnZl ciBpbnZvbHZlZCBpbiBEb0gsIHByZXN1bWFibHkgYWxsIHRoZSBub3JtYWwgSFRUUCBsb2cgaXRl bXMgYXJlIHNlZW4gJiBwcm9jZXNzZWQgYW5kIGNhbiBiZSBsb2dnZWQsIGxpa2UgdXNlciBhZ2Vu dCwgY29va2llcywgYW5kIHNvIG9uLg0KRmlyZWZveCBkb2Vzbid0IHNlbmQgY29va2llcyBmb3Ig RG9ILiBXZSBkbyBzZW5kIFVzZXItQWdlbnQsIGFuZCB3ZSBjb3VsZCBsb29rIGF0IHJlbW92aW5n IHRoYXQsIGJ1dCBnaXZlbiBUTFMgQ2xpZW50SGVsbG8gZmluZ2VycHJpbnRpbmcsIHRoYXQncyBw cm9iYWJseSBub3QgYWRkaW5nIGEgaHVnZSBhbW91bnQgb2YgYWRkaXRpb25hbCBpbmZvcm1hdGlv bi4NCi1Fa3INClRoaXMgaW1wbGllcyB0aGUgY29tYmluYXRpb24gRmlyZWZveC9DbG91ZGZsYXJl IGRvZXMgbm90IHBvc2UgYSBzaWduaWZpY2FudCBwcml2YWN5IHJpc2suIEZhaXIgZW5vdWdoLiBC dXQgdGhlIGdlbmVyYWwgY2FzZSBvZiB3aGF0ZXZlci10aGUtYXBwIHVzaW5nIGEgaGFyZHdpcmVk IERPSCByZXNvbHZlciByZW1haW5zLCBtdWNoIHRoZSBzYW1lIGFzIHRoZSBhcmNoZXR5cGFsIGNv ZmZlZXNob3AgcmVzb2x2ZXIgY29tcGFyZWQgdG8gd2VsbC1iZWhhdmVkLCBjb250cmFjdC1ib3Vu ZGVkIElTUHMuDQpUaGlzIHNlZW1zIHRvIGJlIGFzc3VtaW5nIGEgbnVtYmVyIG9mIGZhY3RzIGFi b3V0IGhvdyBJU1BzIGJlaGF2ZSB0aGF0IGFyZSBub3QgaW4gZXZpZGVuY2UuDQoNCi1Fa3INCg0K SSB3YXMgbm90IG1ha2luZyBhbnkgYXNzdW1wdGlvbiBvbiBjb25jcmV0ZSBiZWhhdmlvcnMgKGFu ZCBmYXIgYmUgaXQgZnJvbSBtZSB0byBzdGFydCBhbm90aGVyIHNlbWktcmVsaWdpb3VzIGRpc2N1 c3Npb24gb24gdGhlIGJlaGF2aW9yIGFuZC9vciBtb3RpdmF0aW9ucyBvZiBkaWZmZXJlbnQgYWN0 b3JzKSwganVzdCBwb2ludGluZyB0aGF0IHdlIG11c3QgY29uc2lkZXIgYmVoYXZpb3JzIGluIGFs bCBjYXNlcywgaW5jbHVkaW5nIGFwcHMgYW5kIGRldmljZXMgaW4gZ2VuZXJhbCwgdGhlIHNhbWUg d2F5IHdlIGNvbnNpZGVyIGFsbCBraW5kcyBvZiBhY2Nlc3MgcHJvdmlkZXJzLg0KDQotLQ0KIkVz dGEgdmV6IG5vIGZhbGxhcmVtb3MsIERvY3RvciBJbmZpZXJubyINCg0KRHIgRGllZ28gUi4gTG9w ZXoNClRlbGVmb25pY2EgSStEDQpodHRwczovL3d3dy5saW5rZWRpbi5jb20vaW4vZHIybG9wZXov DQoNCmUtbWFpbDogZGllZ28uci5sb3BlekB0ZWxlZm9uaWNhLmNvbTxtYWlsdG86ZGllZ28uci5s b3BlekB0ZWxlZm9uaWNhLmNvbT4NClRlbDogICAgICAgICArMzQgOTEzIDEyOSAwNDENCk1vYmls ZTogICszNCA2ODIgMDUxIDA5MQ0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0K DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KDQpFc3RlIG1lbnNhamUgeSBzdXMg YWRqdW50b3Mgc2UgZGlyaWdlbiBleGNsdXNpdmFtZW50ZSBhIHN1IGRlc3RpbmF0YXJpbywgcHVl ZGUgY29udGVuZXIgaW5mb3JtYWNpw7NuIHByaXZpbGVnaWFkYSBvIGNvbmZpZGVuY2lhbCB5IGVz IHBhcmEgdXNvIGV4Y2x1c2l2byBkZSBsYSBwZXJzb25hIG8gZW50aWRhZCBkZSBkZXN0aW5vLiBT aSBubyBlcyB1c3RlZC4gZWwgZGVzdGluYXRhcmlvIGluZGljYWRvLCBxdWVkYSBub3RpZmljYWRv IGRlIHF1ZSBsYSBsZWN0dXJhLCB1dGlsaXphY2nDs24sIGRpdnVsZ2FjacOzbiB5L28gY29waWEg c2luIGF1dG9yaXphY2nDs24gcHVlZGUgZXN0YXIgcHJvaGliaWRhIGVuIHZpcnR1ZCBkZSBsYSBs ZWdpc2xhY2nDs24gdmlnZW50ZS4gU2kgaGEgcmVjaWJpZG8gZXN0ZSBtZW5zYWplIHBvciBlcnJv ciwgbGUgcm9nYW1vcyBxdWUgbm9zIGxvIGNvbXVuaXF1ZSBpbm1lZGlhdGFtZW50ZSBwb3IgZXN0 YSBtaXNtYSB2w61hIHkgcHJvY2VkYSBhIHN1IGRlc3RydWNjacOzbi4NCg0KVGhlIGluZm9ybWF0 aW9uIGNvbnRhaW5lZCBpbiB0aGlzIHRyYW5zbWlzc2lvbiBpcyBwcml2aWxlZ2VkIGFuZCBjb25m aWRlbnRpYWwgaW5mb3JtYXRpb24gaW50ZW5kZWQgb25seSBmb3IgdGhlIHVzZSBvZiB0aGUgaW5k aXZpZHVhbCBvciBlbnRpdHkgbmFtZWQgYWJvdmUuIElmIHRoZSByZWFkZXIgb2YgdGhpcyBtZXNz YWdlIGlzIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCB5b3UgYXJlIGhlcmVieSBub3RpZmll ZCB0aGF0IGFueSBkaXNzZW1pbmF0aW9uLCBkaXN0cmlidXRpb24gb3IgY29weWluZyBvZiB0aGlz IGNvbW11bmljYXRpb24gaXMgc3RyaWN0bHkgcHJvaGliaXRlZC4gSWYgeW91IGhhdmUgcmVjZWl2 ZWQgdGhpcyB0cmFuc21pc3Npb24gaW4gZXJyb3IsIGRvIG5vdCByZWFkIGl0LiBQbGVhc2UgaW1t ZWRpYXRlbHkgcmVwbHkgdG8gdGhlIHNlbmRlciB0aGF0IHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMg Y29tbXVuaWNhdGlvbiBpbiBlcnJvciBhbmQgdGhlbiBkZWxldGUgaXQuDQoNCkVzdGEgbWVuc2Fn ZW0gZSBzZXVzIGFuZXhvcyBzZSBkaXJpZ2VtIGV4Y2x1c2l2YW1lbnRlIGFvIHNldSBkZXN0aW5h dMOhcmlvLCBwb2RlIGNvbnRlciBpbmZvcm1hw6fDo28gcHJpdmlsZWdpYWRhIG91IGNvbmZpZGVu Y2lhbCBlIMOpIHBhcmEgdXNvIGV4Y2x1c2l2byBkYSBwZXNzb2Egb3UgZW50aWRhZGUgZGUgZGVz dGluby4gU2UgbsOjbyDDqSB2b3NzYSBzZW5ob3JpYSBvIGRlc3RpbmF0w6FyaW8gaW5kaWNhZG8s IGZpY2Egbm90aWZpY2FkbyBkZSBxdWUgYSBsZWl0dXJhLCB1dGlsaXphw6fDo28sIGRpdnVsZ2HD p8OjbyBlL291IGPDs3BpYSBzZW0gYXV0b3JpemHDp8OjbyBwb2RlIGVzdGFyIHByb2liaWRhIGVt IHZpcnR1ZGUgZGEgbGVnaXNsYcOnw6NvIHZpZ2VudGUuIFNlIHJlY2ViZXUgZXN0YSBtZW5zYWdl bSBwb3IgZXJybywgcm9nYW1vcy1saGUgcXVlIG5vcyBvIGNvbXVuaXF1ZSBpbWVkaWF0YW1lbnRl IHBvciBlc3RhIG1lc21hIHZpYSBlIHByb2NlZGEgYSBzdWEgZGVzdHJ1acOnw6NvDQo= --_000_23B6F36E36E84BE68E9C37E0F99FF409telefonicacom_ Content-Type: text/html; charset="utf-8" Content-ID: <854FCEA3CDA7774F8BF61275AA2BBA0B@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uZ21haWwtbS0zOTk5Mzc3MzQ2 MTExMzQ4OTIzZ21haWwtYy1tZXNzYWdlYm9keQ0KCXttc28tc3R5bGUtbmFtZTpnbWFpbC1tXy0z OTk5Mzc3MzQ2MTExMzQ4OTIzZ21haWwtYy1tZXNzYWdlYm9keTt9DQpzcGFuLkVtYWlsU3R5bGUx OQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21z by1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29y ZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3MC44NXB0IDMuMGNt IDcwLjg1cHQgMy4wY207fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9 DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRVMiIGxpbms9ImJsdWUiIHZsaW5r PSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5PbiAzMS8w Ny8yMDE5LCAxNzo1NSwgJnF1b3Q7RXJpYyBSZXNjb3JsYSZxdW90OyAmbHQ7PC9zcGFuPjxhIGhy ZWY9Im1haWx0bzpla3JAcnRmbS5jb20iPjxzcGFuIGxhbmc9IkVOLVVTIj5la3JAcnRmbS5jb208 L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYu MHB0Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij5PbiBXZWQsIEp1bCAzMSwgMjAxOSBhdCA4OjI1IEFNIERpZWdvIFIuIExvcGV6ICZsdDs8YSBo cmVmPSJtYWlsdG86ZGllZ28uci5sb3BlekB0ZWxlZm9uaWNhLmNvbSI+ZGllZ28uci5sb3BlekB0 ZWxlZm9uaWNhLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBw dDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdo dDowY20iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 NzIuMHB0Ij4NCjxzcGFuIGxhbmc9IkVOLVVTIj5PbiAzMS8wNy8yMDE5LCAxNjoyNSwgJnF1b3Q7 QWRkIG9uIGJlaGFsZiBvZiBFcmljIFJlc2NvcmxhJnF1b3Q7ICZsdDs8L3NwYW4+PGEgaHJlZj0i bWFpbHRvOmFkZC1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gbGFuZz0i RU4tVVMiPmFkZC1ib3VuY2VzQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1VUyI+ IG9uIGJlaGFsZiBvZg0KPC9zcGFuPjxhIGhyZWY9Im1haWx0bzpla3JAcnRmbS5jb20iIHRhcmdl dD0iX2JsYW5rIj48c3BhbiBsYW5nPSJFTi1VUyI+ZWtyQHJ0Zm0uY29tPC9zcGFuPjwvYT48c3Bh biBsYW5nPSJFTi1VUyI+Jmd0OyB3cm90ZTo8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6NzIuMHB0Ij4N CjxzcGFuIGxhbmc9IkVOLVVTIj5PbiBUdWUsIEp1bCAzMCwgMjAxOSBhdCAyOjQ5IFBNIExpdmlu Z29vZCwgSmFzb24gJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86SmFzb25fTGl2aW5nb29kQGNv bWNhc3QuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gbGFuZz0iRU4tVVMiPkphc29uX0xpdmlu Z29vZEBjb21jYXN0LmNvbTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgd3JvdGU6 PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgd2luZG93dGV4dCAxLjBwdDtwYWRkaW5nOjBjbSAwY20g MGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0 OjBjbTttYXJnaW4tYm90dG9tOjUuMHB0O2JvcmRlci1jb2xvcjpjdXJyZW50Y29sb3IgY3VycmVu dGNvbG9yIGN1cnJlbnRjb2xvciByZ2IoMjA0LDIwNCwyMDQpIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDo3Mi4wcHQiPg0KT24gNy8yNS8xOSwgMTA6MTIgQU0sICZxdW90O0Fk ZCBvbiBiZWhhbGYgb2YgQWRhbSBSb2FjaCZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFkZC1i b3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+YWRkLWJvdW5jZXNAaWV0Zi5vcmc8L2E+ IG9uIGJlaGFsZiBvZg0KPGEgaHJlZj0ibWFpbHRvOmFkYW1Abm9zdHJ1bS5jb20iIHRhcmdldD0i X2JsYW5rIj5hZGFtQG5vc3RydW0uY29tPC9hPiZndDsgd3JvdGU6PGJyPg0KJmd0OyBZb3UgY2Fu IHNlZSwgZm9yIGV4YW1wbGUsIENsb3VkZmxhcmUncyBhc3NvY2lhdGVkIHByaXZhY3kgPGJyPg0K Jm5ic3A7ICZuYnNwOyBwb2xpY3kgYXQgPGEgaHJlZj0iaHR0cHM6Ly9kZXZlbG9wZXJzLmNsb3Vk ZmxhcmUuY29tLzEuMS4xLjEvY29tbWl0bWVudC10by1wcml2YWN5L3ByaXZhY3ktcG9saWN5L2Zp cmVmb3gvIiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL2RldmVsb3BlcnMuY2xvdWRmbGFyZS5j b20vMS4xLjEuMS9jb21taXRtZW50LXRvLXByaXZhY3kvcHJpdmFjeS1wb2xpY3kvZmlyZWZveC88 L2E+DQo8YnI+DQo8YnI+DQpbSkxdIFRoaXMgc3BlYWtzIHRvIHRoZSBETlMgcXVlcnkvcmVzcG9u c2UuIEJ1dCB3aXRoIERvSCwgdGhpcyBpcyBjb250YWluZWQgaW5zaWRlIG9mIGFuIEhUVFAgZW52 ZWxvcGUsIHNvIHRvIHNwZWFrLCB3aGljaCBoYXMgbXVjaCBtb3JlIHJpY2ggdHJhY2tpbmcgLSBu b3RlZCBhdA0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuY2xvdWRmbGFyZS5jb20vcHJpdmFjeXBvbGlj eS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5jbG91ZGZsYXJlLmNvbS9wcml2YWN5cG9s aWN5LzwvYT4gdW5kZXIgd2Vic2l0ZSB2aXNpdG9ycyAod2hpY2ggSSBwcmVzdW1lIGFwcGxpZXMg dG8gYWxsIEhUVFAgdHJhbnNhY3Rpb25zKS4NCjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3Rl Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDo3Mi4wcHQiPg0KPHNw YW4gY2xhc3M9ImdtYWlsLW0tMzk5OTM3NzM0NjExMTM0ODkyM2dtYWlsLWMtbWVzc2FnZWJvZHki PjxzcGFuIGxhbmc9IkVOLVVTIj5ObywgdGhpcyBpcyBub3Qgb3VyIHVuZGVyc3RhbmRpbmcuDQo8 L3NwYW4+UmF0aGVyLCB0aGUgcHJpdmFjeSBwb2xpY3kgZm9yIERvSCBjb3ZlcnMgZXZlcnkgYXNw ZWN0IG9mIERvSCwgaW5jbHVkaW5nIHRoZSBIVFRQIHBvcnRpb24uIFRoZSBDbG91ZGZsYXJlIFBy aXZhY3kgUG9saWN5IGlzIGEgc2VwYXJhdGUgcG9saWN5IGZvciBDRiB3ZWJzaXRlcyBhbmQgZG9l cyBub3QgZ292ZXJuIHRoZSByZXNvbHZlci48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCB3aW5kb3d0 ZXh0IDEuMHB0O3BhZGRpbmc6MGNtIDBjbSAwY20gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFy Z2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjcyLjBwdCI+DQo8c3BhbiBsYW5nPSJFTi1V UyI+U28gdGhlIGNvbmZsdWVuY2Ugb2YgRE5TIGFuZCBIVFRQIGhlcmUgc2VlbXMgaW50ZXJlc3Rp bmcgdG8gYmV0dGVyIHVuZGVyc3RhbmQgYW5kIGRvY3VtZW50IGFzIFRSUi1zdHlsZSBwb2xpY2ll cyBldm9sdmUuDQo8L3NwYW4+U2luY2UgdGhlcmUgaXMgYW4gSFRUUCBzZXJ2ZXIgaW52b2x2ZWQg aW4gRG9ILCBwcmVzdW1hYmx5IGFsbCB0aGUgbm9ybWFsIEhUVFAgbG9nIGl0ZW1zIGFyZSBzZWVu ICZhbXA7IHByb2Nlc3NlZCBhbmQgY2FuIGJlIGxvZ2dlZCwgbGlrZSB1c2VyIGFnZW50LCBjb29r aWVzLCBhbmQgc28gb24uPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjcyLjBwdCI+DQo8c3BhbiBsYW5nPSJFTi1V UyI+RmlyZWZveCBkb2Vzbid0IHNlbmQgY29va2llcyBmb3IgRG9ILiA8L3NwYW4+V2UgZG8gc2Vu ZCBVc2VyLUFnZW50LCBhbmQgd2UgY291bGQgbG9vayBhdCByZW1vdmluZyB0aGF0LCBidXQgZ2l2 ZW4gVExTIENsaWVudEhlbGxvIGZpbmdlcnByaW50aW5nLCB0aGF0J3MgcHJvYmFibHkgbm90IGFk ZGluZyBhIGh1Z2UgYW1vdW50IG9mIGFkZGl0aW9uYWwgaW5mb3JtYXRpb24uPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6NzIu MHB0Ij4NCjxzcGFuIGxhbmc9IkVOLVVTIj4tRWtyPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjQ3LjU1cHQiPg0KPHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij5UaGlzIGltcGxpZXMgdGhlIGNvbWJpbmF0aW9u IEZpcmVmb3gvQ2xvdWRmbGFyZSBkb2VzIG5vdCBwb3NlIGEgc2lnbmlmaWNhbnQgcHJpdmFjeSBy aXNrLiBGYWlyIGVub3VnaC4gQnV0IHRoZSBnZW5lcmFsIGNhc2Ugb2Ygd2hhdGV2ZXItdGhlLWFw cCB1c2luZyBhIGhhcmR3aXJlZCBET0ggcmVzb2x2ZXIgcmVtYWlucywgbXVjaCB0aGUgc2FtZSBh cyB0aGUgYXJjaGV0eXBhbA0KIGNvZmZlZXNob3AgcmVzb2x2ZXIgY29tcGFyZWQgdG8gd2VsbC1i ZWhhdmVkLCBjb250cmFjdC1ib3VuZGVkIElTUHMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBs YW5nPSJFTi1VUyI+VGhpcyBzZWVtcyB0byBiZSBhc3N1bWluZyBhIG51bWJlciBvZiBmYWN0cyBh Ym91dCBob3cgSVNQcyBiZWhhdmUgdGhhdCBhcmUgbm90IGluIGV2aWRlbmNlLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MzYuMHB0Ij4tRWtyPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0Ij5JIHdhcyBub3QgbWFraW5nIGFueSBhc3N1bXB0aW9uIG9uIGNvbmNyZXRl IGJlaGF2aW9ycyAoYW5kIGZhciBiZSBpdCBmcm9tIG1lIHRvIHN0YXJ0IGFub3RoZXIgc2VtaS1y ZWxpZ2lvdXMgZGlzY3Vzc2lvbiBvbiB0aGUgYmVoYXZpb3IgYW5kL29yIG1vdGl2YXRpb25zIG9m IGRpZmZlcmVudCBhY3RvcnMpLCBqdXN0IHBvaW50aW5nIHRoYXQNCiB3ZSBtdXN0IGNvbnNpZGVy IGJlaGF2aW9ycyBpbiBhbGwgY2FzZXMsIGluY2x1ZGluZyBhcHBzIGFuZCBkZXZpY2VzIGluIGdl bmVyYWwsIHRoZSBzYW1lIHdheSB3ZSBjb25zaWRlciBhbGwga2luZHMgb2YgYWNjZXNzIHByb3Zp ZGVycy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+LS08bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+JnF1 b3Q7RXN0YSB2ZXogbm8gZmFsbGFyZW1vcywgRG9jdG9yIEluZmllcm5vJnF1b3Q7PG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij5EciBEaWVnbyBSLiBMb3BlejxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0Ij5UZWxlZm9uaWNhIEkmIzQzO0Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+PGEgaHJl Zj0iaHR0cHM6Ly93d3cubGlua2VkaW4uY29tL2luL2RyMmxvcGV6LyI+PHNwYW4gc3R5bGU9ImNv bG9yOiMwNTYzQzEiPmh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9pbi9kcjJsb3Blei88L3NwYW4+ PC9hPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+ZS1t YWlsOiZuYnNwOzwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQiPjxhIGhyZWY9Im1haWx0bzpkaWVnby5yLmxvcGV6QHRlbGVmb25pY2EuY29tIj48c3BhbiBs YW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwNTYzQzEiPjxzcGFuIGxhbmc9IkVOLVVTIj5kaWVn by5yLmxvcGV6QHRlbGVmb25pY2EuY29tPC9zcGFuPjwvc3Bhbj48L2E+PC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTAuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPlRl bDombmJzcDsmbmJzcDsmbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICYjNDM7MzQgOTEz IDEyOSAwNDE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPk1vYmlsZTogJm5ic3A7JiM0 MzszNCA2ODIgMDUxIDA5MTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+LS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGJyPg0KPGhyPg0KPGZvbnQgZmFjZT0iQXJpYWwiIGNvbG9yPSJH cmF5IiBzaXplPSIxIj48YnI+DQpFc3RlIG1lbnNhamUgeSBzdXMgYWRqdW50b3Mgc2UgZGlyaWdl biBleGNsdXNpdmFtZW50ZSBhIHN1IGRlc3RpbmF0YXJpbywgcHVlZGUgY29udGVuZXIgaW5mb3Jt YWNpw7NuIHByaXZpbGVnaWFkYSBvIGNvbmZpZGVuY2lhbCB5IGVzIHBhcmEgdXNvIGV4Y2x1c2l2 byBkZSBsYSBwZXJzb25hIG8gZW50aWRhZCBkZSBkZXN0aW5vLiBTaSBubyBlcyB1c3RlZC4gZWwg ZGVzdGluYXRhcmlvIGluZGljYWRvLCBxdWVkYSBub3RpZmljYWRvIGRlIHF1ZSBsYQ0KIGxlY3R1 cmEsIHV0aWxpemFjacOzbiwgZGl2dWxnYWNpw7NuIHkvbyBjb3BpYSBzaW4gYXV0b3JpemFjacOz biBwdWVkZSBlc3RhciBwcm9oaWJpZGEgZW4gdmlydHVkIGRlIGxhIGxlZ2lzbGFjacOzbiB2aWdl bnRlLiBTaSBoYSByZWNpYmlkbyBlc3RlIG1lbnNhamUgcG9yIGVycm9yLCBsZSByb2dhbW9zIHF1 ZSBub3MgbG8gY29tdW5pcXVlIGlubWVkaWF0YW1lbnRlIHBvciBlc3RhIG1pc21hIHbDrWEgeSBw cm9jZWRhIGEgc3UgZGVzdHJ1Y2Npw7NuLjxicj4NCjxicj4NClRoZSBpbmZvcm1hdGlvbiBjb250 YWluZWQgaW4gdGhpcyB0cmFuc21pc3Npb24gaXMgcHJpdmlsZWdlZCBhbmQgY29uZmlkZW50aWFs IGluZm9ybWF0aW9uIGludGVuZGVkIG9ubHkgZm9yIHRoZSB1c2Ugb2YgdGhlIGluZGl2aWR1YWwg b3IgZW50aXR5IG5hbWVkIGFib3ZlLiBJZiB0aGUgcmVhZGVyIG9mIHRoaXMgbWVzc2FnZSBpcyBu b3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgeW91IGFyZSBoZXJlYnkgbm90aWZpZWQgdGhhdCBh bnkgZGlzc2VtaW5hdGlvbiwNCiBkaXN0cmlidXRpb24gb3IgY29weWluZyBvZiB0aGlzIGNvbW11 bmljYXRpb24gaXMgc3RyaWN0bHkgcHJvaGliaXRlZC4gSWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhp cyB0cmFuc21pc3Npb24gaW4gZXJyb3IsIGRvIG5vdCByZWFkIGl0LiBQbGVhc2UgaW1tZWRpYXRl bHkgcmVwbHkgdG8gdGhlIHNlbmRlciB0aGF0IHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgY29tbXVu aWNhdGlvbiBpbiBlcnJvciBhbmQgdGhlbiBkZWxldGUgaXQuPGJyPg0KPGJyPg0KRXN0YSBtZW5z YWdlbSBlIHNldXMgYW5leG9zIHNlIGRpcmlnZW0gZXhjbHVzaXZhbWVudGUgYW8gc2V1IGRlc3Rp bmF0w6FyaW8sIHBvZGUgY29udGVyIGluZm9ybWHDp8OjbyBwcml2aWxlZ2lhZGEgb3UgY29uZmlk ZW5jaWFsIGUgw6kgcGFyYSB1c28gZXhjbHVzaXZvIGRhIHBlc3NvYSBvdSBlbnRpZGFkZSBkZSBk ZXN0aW5vLiBTZSBuw6NvIMOpIHZvc3NhIHNlbmhvcmlhIG8gZGVzdGluYXTDoXJpbyBpbmRpY2Fk bywgZmljYSBub3RpZmljYWRvIGRlIHF1ZSBhDQogbGVpdHVyYSwgdXRpbGl6YcOnw6NvLCBkaXZ1 bGdhw6fDo28gZS9vdSBjw7NwaWEgc2VtIGF1dG9yaXphw6fDo28gcG9kZSBlc3RhciBwcm9pYmlk YSBlbSB2aXJ0dWRlIGRhIGxlZ2lzbGHDp8OjbyB2aWdlbnRlLiBTZSByZWNlYmV1IGVzdGEgbWVu c2FnZW0gcG9yIGVycm8sIHJvZ2Ftb3MtbGhlIHF1ZSBub3MgbyBjb211bmlxdWUgaW1lZGlhdGFt ZW50ZSBwb3IgZXN0YSBtZXNtYSB2aWEgZSBwcm9jZWRhIGEgc3VhIGRlc3RydWnDp8Ojbzxicj4N CjwvZm9udD4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_23B6F36E36E84BE68E9C37E0F99FF409telefonicacom_-- From nobody Wed Jul 31 09:12:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 295CD1202FC for ; Wed, 31 Jul 2019 09:12:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H94gaV5AvNWU for ; Wed, 31 Jul 2019 09:12:32 -0700 (PDT) Received: from mail-wr1-x42e.google.com (mail-wr1-x42e.google.com [IPv6:2a00:1450:4864:20::42e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B4C9E1202B5 for ; Wed, 31 Jul 2019 09:12:31 -0700 (PDT) Received: by mail-wr1-x42e.google.com with SMTP id n9so70426035wru.0 for ; Wed, 31 Jul 2019 09:12:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=2xqH+sZ+c/6qGuB7HzwujgEBbo36540YcRqwY9JMKog=; b=kNI/lneOMsVNmJL1yRH5w8wkDWT1jnJEfCeJp/FrCF6a2PHgiB8hV5A++TI7IVdwrJ i7B99GCrfqQ0a1j/wuSo23M6Z5utJ9zBQVVb5Mu5zHHzEgrZGEQvHYBiZaYG5evmkt7p dRJVr6nN9OC44XPpY4F5uPEZvWE8sp+utr3+DFkIiMMdzy87sxlJQz11Qy+SGjzIcrVZ 6S+YMIiEprpOxBUzqfWH3EjgG0dWFq8PgbcIBmHUxDFnmDGR5XdikHSv6XcXN6sPp0rU JXTEkCzc/S63pW4b3yzzM4o26xG2Vkxy639G9pHh1F2jL95tqH03nIeDSy5BZx8Ktp6n HbaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=2xqH+sZ+c/6qGuB7HzwujgEBbo36540YcRqwY9JMKog=; b=t1EpBAtf3l9QbGx/NvQH1WShCo1TumOMs8t+WLT4FN4B5VZMRKtX8uGVeblzAJi71W TFMTQJCaFUT1o3NUJNVhmTZT55msfulE092mwWBxe1+5s8z3Kb8fr4P5eqX/ZLRdMzGU GD7+QIYlUx/lcxDGBw7Xa9ErNeKIUt3mzLmxYKawNIy/CDYMTMzGdWR2XKogMTAaVVqG gJ3HZWxBR9e9gbZjkqyNkOUenasX294Xpi748h/R46/x+MusNHG63WseO3IGx5z3fFgs n39fi4+vQdjKvlSiae8lr30ALdS2To/51tkNUiR5+giaGqRo0dy/vagONXqKUjdhBJ7s gHVw== X-Gm-Message-State: APjAAAWGve6s8GLnvW8hGGHvRDLeb4rxeMxZVb9+LRU9yKcmKlLRjh4M U/xTpAkQ5/JCiYw43EDXlX7U/80R8M8= X-Google-Smtp-Source: APXvYqxYyJ7R71yHUwiEUDXUpkvTRlkTRdyEg3xQ1xD0fVlDmoUY9mHoptDIBEjkig82d1iER3gLHw== X-Received: by 2002:adf:efd2:: with SMTP id i18mr132986442wrp.145.1564589549965; Wed, 31 Jul 2019 09:12:29 -0700 (PDT) Received: from ROADKILL.local ([132.185.158.35]) by smtp.gmail.com with ESMTPSA id v65sm77345856wme.31.2019.07.31.09.12.28 for (version=TLS1_3 cipher=AEAD-AES128-GCM-SHA256 bits=128/128); Wed, 31 Jul 2019 09:12:29 -0700 (PDT) To: add@ietf.org References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> From: Thomas Peterson Message-ID: <2e16aa6d-748b-f44a-3b1c-0b656e2195ab@gmail.com> Date: Wed, 31 Jul 2019 17:12:28 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:69.0) Gecko/20100101 Thunderbird/69.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 16:12:33 -0000 I agree, and have been discussing the idea off-list of having a document that also covers DNS trust anchors and their role, particularly when the network is providing DoT/DoH services, and the considerations where clients need a Do53 bootstrap. Maybe it would make sense to cover all of these points in a single informational document, as I don't believe such considerations belong in a BCP? Regards On 31/07/2019 16:58, Eric Orth wrote: > privacy mitigations and considerations for DoH/DoT/etc may be useful to > document in an Informational or BCP From nobody Wed Jul 31 09:51:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82B15120451 for ; Wed, 31 Jul 2019 09:51:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yYit22Cskrkm for ; Wed, 31 Jul 2019 09:51:53 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 236CA1202F8 for ; Wed, 31 Jul 2019 09:51:53 -0700 (PDT) Received: from wallace.rfc1035.com (hutch.rfc1035.com [195.54.233.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 9D4FA242109D; Wed, 31 Jul 2019 16:51:50 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <2e16aa6d-748b-f44a-3b1c-0b656e2195ab@gmail.com> Date: Wed, 31 Jul 2019 17:51:49 +0100 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <9E0BBDD5-73A0-415E-B891-CC86BD62F124@rfc1035.com> References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> <2e16aa6d-748b-f44a-3b1c-0b656e2195ab@gmail.com> To: Thomas Peterson X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 16:51:56 -0000 > On 31 Jul 2019, at 17:12, Thomas Peterson = wrote: >=20 > I agree, and have been discussing the idea off-list of having a = document that also covers DNS trust anchors and their role, particularly = when the network is providing DoT/DoH services, and the considerations = where clients need a Do53 bootstrap. Maybe it would make sense to cover = all of these points in a single informational document, as I don't = believe such considerations belong in a BCP? This is a badly needed document and I'll be happy to work on it. I think = it could even end up as a BCP. The big question is which WG would be the best place to develop this = I-D. It seems to straddle the doh and dprive WGs and wouldn't be = suitable for dnsop. From nobody Wed Jul 31 10:24:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F2E51205F1 for ; Wed, 31 Jul 2019 10:23:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HTJTJQpwZdv9 for ; Wed, 31 Jul 2019 10:23:54 -0700 (PDT) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-eopbgr780122.outbound.protection.outlook.com [40.107.78.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A60EB1205EE for ; Wed, 31 Jul 2019 10:23:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=RxSjojqjxDTwsxQ5KzFVfEk8xdgTTfxMiIWYbc2yJFyD+1eru/GDJ3RFG+8MS5g5GisymLGcdzoaa9sSg5UbOuv8ZpBEWzs5bevLnim8sXowZbHUtFYgbAVtgKnkhIZz6pUbaks1vnuMQx+8aUhlvkXFKFhr+2PhE1utfVtMPNUpvjLNFYYza7GXt5sorVwQ2X6HxHG0MJ+wfuefIasHHGvN1AN+ouqZQHFT1SPKk3k/2WcpCXM+6ZoJgDQ8tiaAY+lfgmK2+h/kz/dN2T39mcJGmy5CjIXG/eUEPj1C/ub0wuhqSBrZCsonttqmkog3hzPFex1ycgABw7Qz97UHIg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Pc5brmyVsLZ19EgVbL5io14qHJt3eQW9/IGZQpziTY0=; b=MZ8o3PCV65SoAkMQXFvSqmSG+BR892JGd9CfATcjVAorIQegIlVrYabS6kP9LkR9PzSKvcoiO6Zvrcer8kBNGm4zSuqIszxnhveYP5rlyOhC+RLq6DC6K8k8NJjfHu6s409FZbsJZFA0YkOw8TByyLk8WotykJq/qxbGlP7IjywyiNEZY2hRLk3jZKmsRgn3TD3kUjWxRRbYkXwmkq89xOJpLSLkgKNKDwu/NqajSdDLJxuVwyUY8gsNqoSTOUVUPh8ip7Y6Nwqni+GgNLhOctProIXhHizifneXwH+bmU3bIMX5b0DkhlrsCFS4oPN8ICsJwBBAT+VXfjgVZcT5vg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Pc5brmyVsLZ19EgVbL5io14qHJt3eQW9/IGZQpziTY0=; b=mBnozMbo27SI34OVgSSC3zPk9bfJSMCThu/KetjUrb+k0M4b1is0KWdakKouQIt4J3BXi8d/eX/ET4O4TGft5Nnm71bBsBdCoekKRYILqBgXV4xtc0HcQQLzzhfcNwaIS/U5A7sZ86R9bWieb10ryh/rsKiS8+JM1zPRBc1wgKg= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (20.179.20.141) by MN2PR21MB1375.namprd21.prod.outlook.com (20.179.23.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.2; Wed, 31 Jul 2019 17:23:44 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde%9]) with mapi id 15.20.2157.001; Wed, 31 Jul 2019 17:23:44 +0000 From: Tommy Jensen To: Mikael Abrahamsson , Eric Rescorla CC: ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRBOBtJeM4aHo/0yt9008UHcqWqbemEMAgAAO7gCAACA1AIABBgcAgAAx2YCAAccgAIAABO0AgALs5ICAAEfyHA== Date: Wed, 31 Jul 2019 17:23:44 +0000 Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2001:4898:80e8:b:e0c1:731b:6166:2f2d] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 18bdf5b7-398f-4840-4a81-08d715dbd721 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:MN2PR21MB1375; x-ms-traffictypediagnostic: MN2PR21MB1375: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 011579F31F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(376002)(39860400002)(366004)(136003)(346002)(396003)(199004)(189003)(14444005)(7736002)(105004)(446003)(6436002)(6306002)(6246003)(64756008)(86362001)(66556008)(66476007)(229853002)(55016002)(91956017)(6116002)(76116006)(54896002)(66946007)(236005)(52536014)(10090500001)(8990500004)(25786009)(66574012)(5660300002)(9686003)(81166006)(19627405001)(81156014)(14454004)(110136005)(4326008)(561944003)(99286004)(22452003)(66446008)(68736007)(33656002)(53936002)(478600001)(256004)(8676002)(74316002)(46003)(476003)(11346002)(10290500003)(966005)(102836004)(6506007)(71190400001)(71200400001)(53546011)(186003)(76176011)(606006)(8936002)(316002)(2906002)(486006)(7696005)(148743002); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1375; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: IeAsN7BYhhd+UegnH5aIEe7rQSQv5ZIRe/RSxZFBUIoJ+9kXPbS9Y1KdSuJBTKQYlrhAP+M/Yc+QBvfBCNKB9Kmzfv4r6xmViE4t2stnNHOACs62Au90levjKq2dhsuVqeoPyeqH7xjQoP27AZb8Jsn9VwIjsAmdusSTVHiKw2bqsuTb1PeIjm1b8JQl8Dfwt2QabaLeudY4i8qgQCi6Au7BbyLeu54fwk7h+4f7GqHvm9bqWB+K+sRALomSnS7FjpZpZAC+PtSTGwQXXaU7oITtB0jDSe0WmjqXMOnoA6oryRjUdzgNItZkZntK13efTcvqh21uQQxLBZbpod/X7bPUg6ztTRcuJcjWlqbRbKZVQ6w9YuO8pN/b2ouYjYaAt9XgxxsU48UsluiVH3OUqizeUIMwOg92QjTS2xk8UBI= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR21MB1213200F0431672525A7A33BFADF0MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 18bdf5b7-398f-4840-4a81-08d715dbd721 X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Jul 2019 17:23:44.5470 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: QL7eBDMup1PvOCUsbPhjGq9+vJXFYaDk+eVOCzS46YacyLnlFW6xxNkWtFSxiTx10k6zw9dJnndGczme3ugfZQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1375 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 17:23:59 -0000 --_000_MN2PR21MB1213200F0431672525A7A33BFADF0MN2PR21MB1213namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable > I feel we're back in the bad old days where a browser would just change what default browser I want to use, just because I happened to install that browser. Those kinds of policy choices are for me explicitly to make, not for the browser vendor to do for me. I don't want the browser vendor to choose search engine for me and I don't want the browser vendor to choose DNS resolver for me, without asking. Exactly. The default browser setting is a great parallel to the DNS configu= ration. It makes perfect sense for browsers to make recommendations to user= s about what DNS to trust and why, but not to decide under the covers witho= ut the full knowledge the platform may have about network policies, other a= pps, and so on. I imagine a world where browsers refer users to "change the= ir default DNS" or "change who you trust with your browsing" and configure = DNS servers through the platform and thereby compete with DHCP. Thanks, Tommy ________________________________ From: Add on behalf of Mikael Abrahamsson Sent: Wednesday, July 31, 2019 6:02 AM To: Eric Rescorla Cc: ADD Mailing list Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial= distribution at the MIC] On Mon, 29 Jul 2019, Eric Rescorla wrote: > As I said in Montreal, it's not like the user was consulted regarding > the use of the network provided resolver. As a general matter, users > aren't aware of DNS at all. Indeed. This is how it's always been. They expect this to be part of their Internet access functionality. The ones who do not make explicit choices by configuring a VPN, enable incognito mode, run a TOR browser because they explicitly want to change how things work. The proposal from several parties now seems to be to change this without asking the user. This is a big change. The user might not want to share their DNS lookups with whatever DoH resolver that the browser vendor has chosen. How do you know? Putting me end-user hat on, I trust my ISP more than I trust any of the common quad-whatever DNS resolver operators out there. I do not want my DNS lookups to all of a sudden end up somewhere else without my explicit consent. I expect unless I am asked and explicitly accept to not follow my DHCP configured resolver, for that DHCP configured resolver to be used. Not anything else. I feel we're back in the bad old days where a browser would just change what default browser I want to use, just because I happened to install that browser. Those kinds of policy choices are for me explicitly to make, not for the browser vendor to do for me. I don't want the browser vendor to choose search engine for me and I don't want the browser vendor to choose DNS resolver for me, without asking. -- Mikael Abrahamsson email: swmike@swm.pp.se -- Add mailing list Add@ietf.org https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.iet= f.org%2Fmailman%2Flistinfo%2Fadd&data=3D02%7C01%7CJensen.Thomas%40micro= soft.com%7Cff4068a09e0a40adc00f08d715b75a4b%7C72f988bf86f141af91ab2d7cd011d= b47%7C1%7C0%7C637001749554921119&sdata=3DTCuqvORtEX70sh7eVsLHSInlta8BG4= ssjGNwd97dcp8%3D&reserved=3D0 --_000_MN2PR21MB1213200F0431672525A7A33BFADF0MN2PR21MB1213namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
    > I feel we're back in the bad old days where a browser would just change 
    what default browser I want to use, just because I happened to install&nb= sp;
    that browser. Those kinds of policy choices are for me explicitly to make, 
    not for the browser vendor to do for me. I don't want the browser vendor=  
    to choose search engine for me and I don't want the browser vendor to&n= bsp;
    choose DNS resolver for me, without asking.

    Exactly. The default browser setting is a great parallel to the DNS configuration. = It makes perfect sense for browsers to make recommendations to users about = what DNS to trust and why, but not to decide under the covers without the f= ull knowledge the platform may have about network policies, other apps, and so on. I imagine a world where bro= wsers refer users to "change their default DNS" or "change w= ho you trust with your browsing" and configure DNS servers through the= platform and thereby compete with DHCP.

    Thanks,
    Tommy
    From: Add <add-bounces@i= etf.org> on behalf of Mikael Abrahamsson <swmike@swm.pp.se>
    Sent: Wednesday, July 31, 2019 6:02 AM
    To: Eric Rescorla <ekr@rtfm.com>
    Cc: ADD Mailing list <add@ietf.org>
    Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from = partial distribution at the MIC]
     
    On Mon, 29 Jul 2019, Eric Rescorla wrote:

    > As I said in Montreal, it's not like the user was consulted regarding =
    > the use of the network provided resolver. As a general matter, users <= br> > aren't aware of DNS at all.

    Indeed. This is how it's always been. They expect this to be part of their =
    Internet access functionality. The ones who do not make explicit choices by configuring a VPN, enable incognito mode, run a TOR browser because
    they explicitly want to change how things work.

    The proposal from several parties now seems to be to change this without asking the user. This is a big change. The user might not want to share their DNS lookups with whatever DoH resolver that the browser vendor has chosen. How do you know?

    Putting me end-user hat on, I trust my ISP more than I trust any of the common quad-whatever DNS resolver operators out there. I do not want my DNS lookups to all of a sudden end up somewhere else without my explicit consent.

    I expect unless I am asked and explicitly accept to not follow my DHCP
    configured resolver, for that DHCP configured resolver to be used. Not
    anything else.

    I feel we're back in the bad old days where a browser would just change what default browser I want to use, just because I happened to install
    that browser. Those kinds of policy choices are for me explicitly to make, =
    not for the browser vendor to do for me. I don't want the browser vendor to choose search engine for me and I don't want the browser vendor to
    choose DNS resolver for me, without asking.

    --
    Mikael Abrahamsson    email: swmike@swm.pp.se

    --
    Add mailing list
    Add@ietf.org
    https://nam06.saf= elinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman%2= Flistinfo%2Fadd&amp;data=3D02%7C01%7CJensen.Thomas%40microsoft.com%7Cff= 4068a09e0a40adc00f08d715b75a4b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7= C637001749554921119&amp;sdata=3DTCuqvORtEX70sh7eVsLHSInlta8BG4ssjGNwd97= dcp8%3D&amp;reserved=3D0
    --_000_MN2PR21MB1213200F0431672525A7A33BFADF0MN2PR21MB1213namp_-- From nobody Wed Jul 31 10:28:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB9DC1205EC for ; Wed, 31 Jul 2019 10:27:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OgtpFfx6M5gk for ; Wed, 31 Jul 2019 10:27:57 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 060551205DE for ; Wed, 31 Jul 2019 10:27:57 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id j6so18227016ioa.5 for ; Wed, 31 Jul 2019 10:27:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8k4CQWIZUVEmPiZVwQYyM1aRNMAy0jxX/NG9z+60Qp4=; b=QlYbTGta+eCD3HMgs83dVl5sbqraXiOjrYCBtN43LZFmnEJ1x9zLm5NucOdud7KZIL ztS2+pTMOFUD9LdkZbcO0w+7dcY2avWiBUjo4xgSv/xVVtT7VCuUktKAetvYu2VbD1Co 9ip5lNuiM/Yhm/aOrfwzSaoCXnYQSxpJ6JfwBe59eYp3C2uAf8/RCc/OzH2TfoNJcESd gKcu6Uff7fBAkOOnpzFI6QlOBe0NfdPzw279zidQkPvqoy7HzfdI35K5yylFKHd8fFSw GPn42ZiLB4mDN+f5Di2VLfJwtZ5Pciv26s2uUjo/wRVAVqtKyv+CIVO1xnJxD/wfdQtt Bb5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8k4CQWIZUVEmPiZVwQYyM1aRNMAy0jxX/NG9z+60Qp4=; b=aYGozQWH+za6eX1pQFqEl4yBqHQZueQVuJSQjDJRqT+GoCmVjyHS0r48CpK+C0sXRD ZomHg4iFEP40LTQzU251hrKeobgP5YOg30MMMlz22zUNaE0BeqRIm0pn2OKPF7csa1iJ ODJBPtyHko5cht1uoj4mKZL1+zHexo+oDpVMrI3kqsllOJQUrjUwuOkPxEeuEmz3lIdv dqo592xFwb9wJaUyBpnq8taXhjeirG5I78kzHFn67VPnVb+kgijjv6J4ZGGJk/QlAc3z wikN2WCyr2wdZ9VPz7axXwTh+54dzFO3jISJET2R+KMpj+7r3dlMr+0+x/ELh7+Mdfus UF0Q== X-Gm-Message-State: APjAAAXgSjKO8lpd8hleVp15IGYCIy4Zky9HfGLb1S5qqMVkuDrc0m6a 284UUnbshUrd5zZkbi7x5xabLVU+1uKkS9rfjHorO+af16M= X-Google-Smtp-Source: APXvYqzo5dWXO0nT9PpU/R3/pwcXEFLMXoo/aQnnugTa27GoTx6aQQelRF5/PMOLJ6/oDM69ev4NbPtHI06of5m8JA8= X-Received: by 2002:a02:13c3:: with SMTP id 186mr14428292jaz.30.1564594076192; Wed, 31 Jul 2019 10:27:56 -0700 (PDT) MIME-Version: 1.0 References: <8763F656-928B-49A8-B27F-431DCC02142F@rfc1035.com> In-Reply-To: From: Rob Sayre Date: Wed, 31 Jul 2019 10:27:44 -0700 Message-ID: To: Eric Rescorla Cc: Jim Reid , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000002123f9058efd724b" Archived-At: Subject: Re: [Add] quad-N usage data X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 17:27:59 -0000 --0000000000002123f9058efd724b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 31, 2019 at 8:57 AM Eric Rescorla wrote: > > > On Wed, Jul 31, 2019 at 7:11 AM Jim Reid wrote: > >> >> >> > On 31 Jul 2019, at 14:48, Eric Rescorla > >> wrote: >> > >> > given that plenty of people have their resolver configured to 8.8.8.8 >> or 1.1.1.1 >> >> While I'm sure that=E2=80=99s true, what data does Mozilla (or anyone el= se) have >> to quantify just how big =E2=80=9Cmany people=E2=80=9D actually is? > > > I seem to remember seeing something, but I don't have it to hand. > https://blog.apnic.net/2019/03/14/the-state-of-dnssec-validation/ "Google=E2=80=99s Public DNS service (8.8.8.8) is undoubtedly the most popu= lar DNS resolution service in the Internet =E2=80=94 some 15% of the world=E2=80=99= s users pass their queries through this service." thanks, Rob --0000000000002123f9058efd724b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


    =
    On Wed, Jul 31, 2019 at 8:57 AM Eric = Rescorla <ekr@rtfm.com> wrote:
    <= div dir=3D"ltr">

    On Wed, Jul 31, 2019 at 7:11 AM Jim Reid <jim@rfc1035.com> wrote:


    > On 31 Jul 2019, at 14:48, Eric Rescorla <ekr@rtfm.com> wrote:
    >
    > given that plenty of people have their resolver configured to 8.8.8.8 = or 1.1.1.1

    While I'm sure that=E2=80=99s true, what data does Mozilla (or anyone e= lse) have to quantify just how big =E2=80=9Cmany people=E2=80=9D actually i= s?

    =C2=A0I seem to remember seeing somethi= ng, but I don't have it to hand.

    "Google=E2=80=99s Public DNS servic= e (8.8.8.8) is undoubtedly the most popular DNS resolution service in the I= nternet =E2=80=94 some 15% of the world=E2=80=99s users pass their queries = through this service."

    thanks,
    Rob= =C2=A0
    --0000000000002123f9058efd724b-- From nobody Wed Jul 31 10:29:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B407A12063F for ; Wed, 31 Jul 2019 10:29:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sY56U8FHMRLS for ; Wed, 31 Jul 2019 10:29:16 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0CE9312060B for ; Wed, 31 Jul 2019 10:29:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1564594134; x=2428507734; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=dcKDHCtgGDOurlwqpH35QQPC/yB893U7a4jSpHaWRpQ=; b=vZPJxkRcFjVLaI1WgR94rwc4HAS0wGYDxiUbt+melphIy+Xnfk8lyHdGBjJ7jhY0 9J7kRdQUv6xuw0wZBWbeXW3hfc/1bOWsh7cvj5kDl1106E53yF0qVcUuhMYaS3Kl +cFZtK6JxlEfCR8XsaxpSpuFKW4gY11HlLu0Lpvxh1GkHf/T/TzAt9G4S0MEBkM1 eMqtabnwM/8bUJEFnV50EHZeXQpTJPycG1QXYP03WIgOJvPitAHAPGRxuVUbEKa4 /HUSp0Ng/jNvREnrtZuAAf8/ujLF06dBunnmnuYkq6Vd6PEACFlT2YJOjQoGe4t3 m47UDGxKTFEK4fKVVsdbMA==; X-AuditID: a2962c47-a9fff7000002e144-51-5d41cfd68cf0 Received: from COPDCEXC40.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 44.D7.57668.6DFC14D5; Wed, 31 Jul 2019 11:28:54 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC40.cable.comcast.com (147.191.125.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Wed, 31 Jul 2019 13:29:08 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Wed, 31 Jul 2019 13:29:08 -0400 From: "Livingood, Jason" To: "add@ietf.org" Thread-Topic: [Add] meeting hum: should the IETF take up this work? Thread-Index: AQHVR8V1WrgBv7BM8EegWWPMEALeFA== Date: Wed, 31 Jul 2019 17:29:08 +0000 Message-ID: <745AC544-A6E0-45E4-A571-4EF2A47F77CA@cable.comcast.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [96.114.156.8] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrJIsWRmVeSWpSXmKPExsWSUDRnsu61846xBiubJCz+n17H5sDosWTJ T6YAxqgGRpuSjKLUxBKX1LTUvOJUOy4FDGCTlJqWX5TqmliUUxmUmpOaiF0ZSGVKak5mWWqR PlZj9LGak9DFlLFixVXWgnvMFT13LzA1MF5g7mLk5JAQMJHY++cPWxcjF4eQwBEmiV/7djND OC1MEo8ev2GHcE4zShx8+4sFpIVNwEzi7sIrYO0iAooSjRvvMILYwgJOEkvvL2aHiDtLPN76 CSjOAWTrSXQdzQQJswioSiw6fRSslVfAReL1zG9MIDajgJjE91NrwGxmAXGJW0/mM0FcJyCx ZM95qEtFJV4+/scKYosK6Et8ObeJBSKuILF9/zYWkFXMApoS63fpQ4yxknh86iYzhK0oMaX7 ITvEWkGJkzOfQLWKSxw+soN1AqPYLCSbZyFMmoVk0iwkk2YhmbSAkXUVI6+hmZGeoamBnomJ nrnhJkZgglg0Tcd9B+OH87GHGAU4GJV4eI+ecowVYk0sK67MPcQowcGsJMK7WNw+Vog3JbGy KrUoP76oNCe1+BCjNAeLkjjv4ckasUIC6YklqdmpqQWpRTBZJg5OqQZG2XOM1W0qtt6rwvdf Scz1Vay6d3/fly3piVOLgr06ZVpFXzFlaffqdRjWf9j2PkPLX/dKj0xeF/dRxVvuDSfVtHR7 vmaYzo7ItTUP9xd+avyj7NvHZ0rvf9u+Ng5ettum/NYGs/PR1w2v7hAKDbmfeeNr6uc1945z 1BovbAnKXrb4l+sD7yYlluKMREMt5qLiRAABgB+nDAMAAA== Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 17:29:25 -0000 RnJvbTogRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPg0KPiBUaGlzIHNlZW1zIHRvIGJlIGFz c3VtaW5nIGEgbnVtYmVyIG9mIGZhY3RzIGFib3V0IGhvdyBJU1BzIGJlaGF2ZSB0aGF0IGFyZSBu b3QgaW4gZXZpZGVuY2UuDQoNCklTUHMsIGxpa2UgYnJvd3NlcnMgYW5kIHNlYXJjaCBwb3J0YWxz LCBkbyBub3QgYWxsIGhhdmUgdGhlIHNhbWUgYnVzaW5lc3MgbW9kZWxzLCBwcmFjdGljZXMsIGFu ZCBjdWx0dXJlcy4gSnVzdCBhcyB0aGUgRmlyZWZveCBicm93c2VyIGlzIHZlcnkgZGlmZmVyZW50 IGZyb20gR29vZ2xlIENocm9tZSwgdGhlbiBzbyB0b28gaXMgSVNQLTEgZnJvbSBJU1AtMi4gIA0K DQoNCg== From nobody Wed Jul 31 10:29:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BF71120651 for ; Wed, 31 Jul 2019 10:29:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bHhTkmeJv1AW for ; Wed, 31 Jul 2019 10:29:29 -0700 (PDT) Received: from mail-yb1-xb35.google.com (mail-yb1-xb35.google.com [IPv6:2607:f8b0:4864:20::b35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AD2DE12061D for ; Wed, 31 Jul 2019 10:29:25 -0700 (PDT) Received: by mail-yb1-xb35.google.com with SMTP id a14so24699863ybm.11 for ; Wed, 31 Jul 2019 10:29:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4TX+sZrEbOPb2uIRu1PvdsB/yPRXDAzzv8qw71xtOcY=; b=g3wCRJ/73LRtUfLIVkfo95DCWepjB0pJOBbFIik9KKkYY4KMXnRHrJ6ncab51aGzHC 2e2r3A8iDFgyS9KcAoLnz9WzqjzV450hW+H3+M3hXhoe/FqbYPhoo2RdTl7pQ9Ky+Bgs ri3aSRqPBT7P/bHqYfVnmW0mztcdsIMkc5bglkR2ADu0BuDb6Z/+KkecH6L9uT6LfkFs w+nwRGkDMd2j8rOfCn4csUI4VILH6xFMA2pCJ8FFjVFvU1lbMVMXc5dOrH4V3TKSv87o eOAMNKt3U9Tvv89pIDQ4PL/1JzEFcxn5ZjhjkT9z3GMpF1RXWSOiNqc5oqHI0yUE6qEx HFAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4TX+sZrEbOPb2uIRu1PvdsB/yPRXDAzzv8qw71xtOcY=; b=JuydCVrnTo8V2O8vkPANPkOKxNkBARP+qhSL2BetOiFAaMSdxbsOsZu30GztCuK4s2 IfA7xiPso03XJnerLlf5Do0+Hhuxc977VzdVH0aJ448j1e0wdl5CIZan1yS66ot5vONl 7nK7jZ13Ot63WQg5W6twReHUsgFyKprA2jwGbbK17O+VQI/jBlchLuaQzYBgzGqcWMVA VRvZGWFqYv4y/sLAb438fTfevOOZ4cr13ys+/gmlGYvXUv5Iz8nEvHuIKFC3sEHf72df EHfR6tqqFqXDegIH5q60K0Fc7znCBDgmddejfLCPL68Jjay2V1V4Y7RS7y2ccOzU7/4U rzuA== X-Gm-Message-State: APjAAAXCTBh077rkllxokOYFgK/1wnQaW31zv8+IE5GLtJ/tnxHVdi7g RD2SHT1gLHfaahq7QlAslmIWaBDZHCdbI4cUkUE+ZQ== X-Google-Smtp-Source: APXvYqwyASCyHiS6zU44GKrLhuO2Zzi0F5eLyP0Kd0F/UHYlVQRwBQ4lA083VlOPGVbndOfdtmagEBIz2If+F8BCqmc= X-Received: by 2002:a25:7714:: with SMTP id s20mr48967189ybc.25.1564594164601; Wed, 31 Jul 2019 10:29:24 -0700 (PDT) MIME-Version: 1.0 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> In-Reply-To: From: Alec Muffett Date: Wed, 31 Jul 2019 18:29:15 +0100 Message-ID: To: Mikael Abrahamsson Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000661721058efd7755" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 17:29:35 -0000 --000000000000661721058efd7755 Content-Type: text/plain; charset="UTF-8" Hi Mikael! On Wed, 31 Jul 2019, 14:02 Mikael Abrahamsson, wrote: > I feel we're back in the bad old days where a browser would just change > what default browser I want to use, just because I happened to install > that browser. Those kinds of policy choices are for me explicitly to make, > not for the browser vendor to do for me. > So, how do you feel about a coffee shop owner, ISP, or national government doing the same thing to you? -a --000000000000661721058efd7755 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Hi Mikael!

    On Wed, 31 Jul 2019, 14:02 Mikael Abrahamsso= n, <swmike@swm.pp.se> wrote:
    I feel we're back in the bad old days where a browser would just change=
    what default browser I want to use, just because I happened to install
    that browser. Those kinds of policy choices are for me explicitly to make, =
    not for the browser vendor to do for me.=C2=A0
    =

    So, how do you feel about a c= offee shop owner, ISP, or national government doing the same thing to you?<= /div>

    -a

    --000000000000661721058efd7755-- From nobody Wed Jul 31 10:41:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFB3512064A for ; Wed, 31 Jul 2019 10:41:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PXYs2des6iBQ for ; Wed, 31 Jul 2019 10:41:25 -0700 (PDT) Received: from NAM04-SN1-obe.outbound.protection.outlook.com (mail-eopbgr700131.outbound.protection.outlook.com [40.107.70.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31915120637 for ; Wed, 31 Jul 2019 10:41:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hYgHQ2opnypU9o/+vh3ownLS8aoOHtSGoHmNgdCQItyGWUzFPYWHggoCQf1BWi/+3o40fIKuCOR59zSaDGUAT5bPWv+2P3Mz9LaF/oTc/YouNKLP1XTGSaK+IHAfJMTS3ZXXqecsovIkc63HbpmKxkCiAhVMXmAv2S5n7LdCWC+8HMD2SuzCusuW6xIthDTRnubb/aXMzIANlOw2bbGj/tQi6nhtxXueVsbfBVy0RQpIYf+I4NdlQ2r6+Hwnu9J6AM/ocqLDuAUJwetp+sWgjQrkrqUveXo6pCUTQvZG/nkw8mfb0FceKY4iBOe9edq39QinReYVtuPLlxyAVIPuBQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=m0vBkZO0tzsXCdUHXnuuo4IK+g9M/RGHdrfonFn6A9A=; b=h6o53I9pB0Y6+6bD43EnmtfDorEXeP+wpfBt2IgQFRaqWyCaKWJQkwR/OZWbYQAMrFavrCzVSqi0K6wji8Bfpgemih13VcYfbm97tpUZSoiEbx1kz00lM0BXQEWz0GckQp2kahMittvYNlQdkVvCBs4VKKm+yYN6Bmw/qUpBu5vw1/AIUgoXyyxWLmJzAe07pogVCcbhDn79uA9VW19KuaJ7BtsHRf7QI9siCliezMloIYEsYEh1amRT9K4Bls4/C6P+8Hhh1maPB830eZkMvTlt5Tdcf0GcCPSZLVREzhRdYZJoXGVoRdK95l5p/5o25fFV9yTCLkl/tY1lha7r4w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=m0vBkZO0tzsXCdUHXnuuo4IK+g9M/RGHdrfonFn6A9A=; b=kiQOLy8lXDon+7rH5DowP3JNlpcY3Thzk49gDdJ63E1j8WqEFOsKHCUtYE08OBm3A5p1jv17usR3IVykfRiMR3l+NLClx5WLWNlTBtoapOxDT9n9C7mwoWPN+9YrxJMltAthrw+mLjamF69DV6O8+3ZvsjyazUaazg6PckHziZQ= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (20.179.20.141) by MN2PR21MB1215.namprd21.prod.outlook.com (20.179.20.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.2; Wed, 31 Jul 2019 17:41:23 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde%9]) with mapi id 15.20.2157.001; Wed, 31 Jul 2019 17:41:23 +0000 From: Tommy Jensen To: "Livingood, Jason" , "add@ietf.org" Thread-Topic: [Add] meeting hum: should the IETF take up this work? Thread-Index: AQHVR8V1WrgBv7BM8EegWWPMEALeFKbk++tU Date: Wed, 31 Jul 2019 17:41:23 +0000 Message-ID: References: <745AC544-A6E0-45E4-A571-4EF2A47F77CA@cable.comcast.com> In-Reply-To: <745AC544-A6E0-45E4-A571-4EF2A47F77CA@cable.comcast.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2001:4898:80e8:b:e0c1:731b:6166:2f2d] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 97ed34d9-4154-4903-ad9c-08d715de4e48 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:MN2PR21MB1215; x-ms-traffictypediagnostic: MN2PR21MB1215: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 011579F31F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(136003)(366004)(376002)(396003)(39860400002)(346002)(189003)(199004)(110136005)(102836004)(6116002)(81156014)(81166006)(8676002)(8936002)(14454004)(52536014)(25786009)(7696005)(33656002)(99286004)(316002)(478600001)(9686003)(53546011)(966005)(68736007)(54896002)(2906002)(22452003)(7736002)(53936002)(186003)(6506007)(236005)(10090500001)(55016002)(6436002)(76176011)(105004)(91956017)(2501003)(5660300002)(86362001)(6246003)(6306002)(76116006)(10290500003)(8990500004)(66946007)(64756008)(66476007)(66446008)(66556008)(66574012)(74316002)(256004)(46003)(476003)(446003)(11346002)(606006)(486006)(19627405001)(229853002)(71190400001)(71200400001); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1215; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: r4iBedOvMyUXPyWv61ZBSkcInheo1q9GS9C/H9bVJZrog/Dh7xGOUA+zW1nHECR34TmK2hvlto0EpI8dJTBrKLFlp4oK/N7hR/ZtC7cgfuPPZdBIwDOGI+q/KHJVjBKKzp5s3tMc+zZGmqHp7IGSo+5NmchabfQiqQKdofY+g8oRotZM3Q8sOHYSn3rgWTnXs3rzMEImYi1oR0dAd+oAjXX1f3/rfsn0zox2HG6DcmXNGFT3inr5IMTvD9v9wBzZVwP153M8pfPYxCsfleCcg5M37GtTSkrDkWn4KVM2HVducI+ynRIn0tnRJ9eaYCOGauuDZn41rcCTVDGHYgl8Ay5uvgebJ9tQa/Dcu8YAVAYABAyQU3a46MniOk+zXsgMZ1+tGC/bzm7m9hol+s/GK8L/sHs6nRl/sp6UwuwDaCw= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR21MB1213BD37BAC684B31414A47DFADF0MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 97ed34d9-4154-4903-ad9c-08d715de4e48 X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Jul 2019 17:41:23.4184 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: p54ZytJqAhSP+H54ZdtoZqPw7FwK810mq+giLVgcDPvv4ifxTsgyJyIHudjXnAI5WC63DNfJCbEUzsZ+/FO0EQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1215 Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 17:41:36 -0000 --_000_MN2PR21MB1213BD37BAC684B31414A47DFADF0MN2PR21MB1213namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Maybe a good way to empower UXs, app or platform, to inform the user about = their different DNS options would be to build user-centric information into= a feature discovery protocol for RRs. This would allow RRs committed to us= er value to advertise the features they want the user to know about. For example, RRs could provide answers to stub questions such as: * Maximum length of time (in seconds) personal data is retained * Maximum length of time (in seconds) anonymized data is retained * URL where RRs privacy or other legal policies can be discovered * Does or does not (boolean) filter or block results from authoritative= sources * Might be expected to be true for "clean filter" DNS services * ... This would allow stubs to build UXs that provide red/green checkmarks and r= ecommendations such as "Your current DNS server keeps your data longer than= this other server we recommend configuring instead". This would help separ= ate privacy friendly ISPs from the rogue airport/coffee shop Wi-Fi ISPs tha= t couldn't care less at run time. Thanks, Tommy ________________________________ From: Add on behalf of Livingood, Jason Sent: Wednesday, July 31, 2019 10:29 AM To: add@ietf.org Subject: Re: [Add] meeting hum: should the IETF take up this work? From: Eric Rescorla > This seems to be assuming a number of facts about how ISPs behave that ar= e not in evidence. ISPs, like browsers and search portals, do not all have the same business m= odels, practices, and cultures. Just as the Firefox browser is very differe= nt from Google Chrome, then so too is ISP-1 from ISP-2. -- Add mailing list Add@ietf.org https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.iet= f.org%2Fmailman%2Flistinfo%2Fadd&data=3D02%7C01%7CJensen.Thomas%40micro= soft.com%7C913ab902f70043663d5608d715dca716%7C72f988bf86f141af91ab2d7cd011d= b47%7C1%7C0%7C637001909757322923&sdata=3DQASynB6%2BqiWTpU%2FE9WipAaBLRx= nB3Lxmvo%2FTAPFCg2U%3D&reserved=3D0 --_000_MN2PR21MB1213BD37BAC684B31414A47DFADF0MN2PR21MB1213namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
    Maybe a good way to empower UXs, app or platform, to inform the user about = their different DNS options would be to build user-centric information into= a feature discovery protocol for RRs. This would allow RRs committed to us= er value to advertise the features they want the user to know about.

    For example, RRs could provide answers to stub questions such as:
    • Maximum length of time (in seconds) personal data is retained
    • M= aximum length of time (in seconds) anonymized data is retained
    • URL = where RRs privacy or other legal policies can be discovered
    • Does or= does not (boolean) filter or block results from authoritative sources
      • =
      • Might be expected to be true for "clean filter" DNS services<= /li>
    • ...
    This would allow stubs to build UXs that provide red/green checkmarks = and recommendations such as "Your current DNS server keeps your data l= onger than this other server we recommend configuring instead". This w= ould help separate privacy friendly ISPs from the rogue airport/coffee shop Wi-Fi ISPs that couldn't care less at run ti= me.

    Thanks,
    Tommy
    <= /div>
    From: Add <add-bounces@i= etf.org> on behalf of Livingood, Jason <Jason_Livingood@comcast.com&g= t;
    Sent: Wednesday, July 31, 2019 10:29 AM
    To: add@ietf.org <add@ietf.org>
    Subject: Re: [Add] meeting hum: should the IETF take up this work?
     
    From: Eric Rescorla <ekr@rtfm.com>
    > This seems to be assuming a number of facts about how ISPs behave that= are not in evidence.

    ISPs, like browsers and search portals, do not all have the same business m= odels, practices, and cultures. Just as the Firefox browser is very differe= nt from Google Chrome, then so too is ISP-1 from ISP-2. 


    --
    Add mailing list
    Add@ietf.org
    https://nam= 06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmai= lman%2Flistinfo%2Fadd&amp;data=3D02%7C01%7CJensen.Thomas%40microsoft.co= m%7C913ab902f70043663d5608d715dca716%7C72f988bf86f141af91ab2d7cd011db47%7C1= %7C0%7C637001909757322923&amp;sdata=3DQASynB6%2BqiWTpU%2FE9WipAaBLRxnB3= Lxmvo%2FTAPFCg2U%3D&amp;reserved=3D0
    --_000_MN2PR21MB1213BD37BAC684B31414A47DFADF0MN2PR21MB1213namp_-- From nobody Wed Jul 31 11:17:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6083D120687 for ; Wed, 31 Jul 2019 11:17:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xunKmbKMwLGK for ; Wed, 31 Jul 2019 11:17:02 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 926E7120685 for ; Wed, 31 Jul 2019 11:16:57 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 4CA836A34D; Wed, 31 Jul 2019 20:16:55 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1564597015; bh=8cQvPjg6BJaHVB4ILxqyXnF4PprwpdMhn6AFa8kqeLM=; h=From:Subject:Date:References:To:In-Reply-To:Cc:From; b=13F3Rx9dzjxprvn8gNLf+SWL2VSp104xwYevvvQab1j/tCuzStSimvyM+swuJfaBd ZGHP7YM0NJ/m4rNnm53ogGdoolOMBMxip2VvII/fuSISW2a3cuUt1kZgBR/9CjcDWG Nzfdg/Z0sE74Sm+g8CcWmXald/iJ+qL2MkcgFEhXOvrqZ480V7Gd0UqwYOl3r8orpv HO2yQLedA3x+KStH/a1p8XkUAUgNKPw1GoqSG7QRyTEtx8/qz0PcjWAqLjvvbJg2Xr dSk/HKLAarxGnQwu3SPH0ztZWMc3+3zW7FYlIl0Mqleweyrrj80EYuV0UrQ/zk/ye2 hrXqPgAiW4VMA== Received: from appsuite-gw4.open-xchange.com (appsuite-gw4.open-xchange.com [10.20.28.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 3F4F03C015B; Wed, 31 Jul 2019 20:16:55 +0200 (CEST) X-Header: Open-Xchange USM Mailer (USM Version: 7.10.2-2, EAS Version: 7.10.2-1, Build d17f7426766e7d3851e61d3f8794f10d65e74221) Content-Type: multipart/alternative; boundary=Apple-Mail-47B26FC7-10EC-4819-8AD4-16AF9E0E007E Content-Transfer-Encoding: 7bit From: "Cook, Neil" Mime-Version: 1.0 Message-ID: <1284734341.1260.1564597015193@appsuite-gw4.open-xchange.com> Date: Wed, 31 Jul 2019 19:16:54 +0100 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> To: Alec Muffett In-Reply-To: Cc: Mikael Abrahamsson , ADD Mailing list X-Mailer: Open-Xchange Mailer v7.10.2-Rev8 X-Originating-Client: USM-EAS Autocrypt: addr=neil.cook@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFY4uCMBCACanbgJRs8WrxZZmtPZEe1xEEaVXz2g4rs6H898mQ2bsSa3NmeyfHrY/C7cy9iVpOE Al5GQBmKnTx0mYe0Fm8KZYBh895lpGz1OkV8z4N+7fvYpkeiYSUrwmdxGyWm4/Ol4rWieBXUqSpQl1a O9dRC9YUDx6wE2kvUcT35y9PpsYOgZvmzNZ61NsQNemLeVnWCk2dWvF8BC63vRPzKNnnS1KSj7yY12X FiVFqyuuWC4U0w8xgmkw1QEGXi9lEjnq5nh2LP3+MhSS0SQUg4K/NQEFXxoe4Yi9WghC37Yfl58EGxy JSGNHruwJuHTTWjC0xPN6tL/iEg2u8wy7blFSqAlABEBAAG0J0Nvb2ssIE5laWwgPG5laWwuY29va0B vcGVuLXhjaGFuZ2UuY29tPokBQAQTAQIAKgQLCQgHBhUIAgkKCwUWAgMBAAKeAQIbAwWJEswDAAUDAA AAAAWCVji4IwAKCRCqPocTiyIWJ8ifB/4r81q323KtGT/g3UpKXd+WIo5g6P5LRvaHcY0gWaT9RbRlg JfvbjXN2oY9HFE0PQBPpFozBvEVe9dtt0MROW5wWRygntyI5ROvEsD9I91xOIqcrEBpkCEFFeyqbq8+ +Yw5k8+IFIEFduopookBbmO3/gbMxkXFJ/cIh+OUWCIxV/kphlgJCGavwJq00Zo42SzMF42u5C63yHn kfT6zSQU0Y9z26FW/tyq6O1eI9aUAcaiMxLCAyR8pD+Dl8jaFPxbS7hyAk3srrA9dXvuL3mw4w6uEiW FUkuZ6onolSXQhZCUQ6+7y51f2XfbEH/gwWl8uDMc6IlunyZPZljvzEx9buQENBFY4uCMBCACbgNhut /V5nDmAh1sD1fyg1NBK8/NBuv24HhrdlEYuupU0ByS5Y4qhi+8ptu7d5vYNgGTbptZuob8Y4QEZS1BR EI7shZozYjsJjSzmHtnM+A+G0dSsXCaSKoTppsYL67sM1Cs5goZjsHnbIXDJi8SuvXtnTYxgxgGPLpU Rtci4LGKYksGEGy7q+hGvMA3KNSSZAu1OOwwLE71/E12VgXWWW7NuaJs67qLBtXcc3XiyEn2tCHdyTx yIl8ucMieNhkZt0jAkXgH+wAV71OyrjHBOWdsm+giHH70aLeZyz+x5D+FEOgh3inwYnIXASdwEDXT+2 lb+IbqjLhkYx7MoKfajABEBAAGJATEEGAECABsFAlY4uCMCGwwECwkIBwYVCAIJCgsFCRLMAwAACgkQ qj6HE4siFid2cQf9G6sstAGA9CBNOWujVe/8YEFYNOSut5upwIRe50/GcBhEoh6p6sMIesaGEwsvwyh V212cpXyi7pLO//jN+swOjVGazz68CRyFLAx8Z6Uyyp5kbj/tnlC5mqoa6KZL36VZTNF3ow0fEm5qNq VD59BxCpOei8r9mMeM4b7rji0lBJC3f6d5hZos9xmCx9Z6ynvWM8nD/bk6XMUKTUEuXr0ESMTkSIXUe O2RYsDHHyrkolWfrJ3npSFaZ4YI7/vSfsTVKgbcVqGZ7Oz3cGeR4vT+9V2MySL9dJr5TFmubPxCVzyw iFyqDh51hDl/oTgzn0OJ2A98hvdCWJODbATdQzExVQ== Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 18:17:04 -0000 --Apple-Mail-47B26FC7-10EC-4819-8AD4-16AF9E0E007E Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 SG1tIGNvZmZlZSBzaG9wcyBhbmQgSVNQcyBwcm92aWRlIGEgcmVjdXJzaXZlIEROUyBzZXJ2aWNl IHNvIHRoYXQgeW91IGNhbiBhY2Nlc3MgdGhlIGludGVybmV0LiBPbmUgdGhhdCB5b3XigJlyZSBu b3Qgb2JsaWdlZCB0byB1c2UuIEkgdGhpbmsgSeKAmW0gb2sgd2l0aCB0aGF0Lg0KDQpBbHNvIGxl dOKAmXMgbm90IGNvbmZsYXRlIGNvZmZlZSBzaG9wcyBhbmQgSVNQcyB3aXRoIG9wcHJlc3NpdmUg Z292ZXJubWVudHMuDQoNCk5laWwNCg0KU2VudCBmcm9tIG15IGlQaG9uZQ0KDQo+IE9uIDMxIEp1 bCAyMDE5LCBhdCAxODoyOSwgQWxlYyBNdWZmZXR0IDxhbGVjLm11ZmZldHRAZ21haWwuY29tPiB3 cm90ZToNCj4gDQo+IEhpIE1pa2FlbCENCj4gDQo+PiBPbiBXZWQsIDMxIEp1bCAyMDE5LCAxNDow MiBNaWthZWwgQWJyYWhhbXNzb24sIDxzd21pa2VAc3dtLnBwLnNlPiB3cm90ZToNCj4+IEkgZmVl bCB3ZSdyZSBiYWNrIGluIHRoZSBiYWQgb2xkIGRheXMgd2hlcmUgYSBicm93c2VyIHdvdWxkIGp1 c3QgY2hhbmdlIA0KPj4gd2hhdCBkZWZhdWx0IGJyb3dzZXIgSSB3YW50IHRvIHVzZSwganVzdCBi ZWNhdXNlIEkgaGFwcGVuZWQgdG8gaW5zdGFsbCANCj4+IHRoYXQgYnJvd3Nlci4gVGhvc2Uga2lu ZHMgb2YgcG9saWN5IGNob2ljZXMgYXJlIGZvciBtZSBleHBsaWNpdGx5IHRvIG1ha2UsIA0KPj4g bm90IGZvciB0aGUgYnJvd3NlciB2ZW5kb3IgdG8gZG8gZm9yIG1lLiANCj4gDQo+IA0KPiBTbywg aG93IGRvIHlvdSBmZWVsIGFib3V0IGEgY29mZmVlIHNob3Agb3duZXIsIElTUCwgb3IgbmF0aW9u YWwgZ292ZXJubWVudCBkb2luZyB0aGUgc2FtZSB0aGluZyB0byB5b3U/DQo+IA0KPiAtYQ0KPiAN Cj4gLS0gDQo+IEFkZCBtYWlsaW5nIGxpc3QNCj4gQWRkQGlldGYub3JnDQo+IGh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkDQo= --Apple-Mail-47B26FC7-10EC-4819-8AD4-16AF9E0E007E Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPkhtbSBjb2ZmZWUg c2hvcHMgYW5kIElTUHMgcHJvdmlkZSBhIHJlY3Vyc2l2ZSBETlMgc2VydmljZSBzbyB0aGF0IHlv dSBjYW4gYWNjZXNzIHRoZSBpbnRlcm5ldC4gT25lIHRoYXQgeW914oCZcmUgbm90IG9ibGlnZWQg dG8gdXNlLiBJIHRoaW5rIEnigJltIG9rIHdpdGggdGhhdC48ZGl2Pjxicj48L2Rpdj48ZGl2PkFs c28gbGV04oCZcyBub3QgY29uZmxhdGUgY29mZmVlIHNob3BzIGFuZCBJU1BzIHdpdGggb3BwcmVz c2l2ZSBnb3Zlcm5tZW50cy48L2Rpdj48ZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+TmVpbDxicj48 YnI+PGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIiBkaXI9Imx0ciI+U2VudCBmcm9tIG15IGlQ aG9uZTwvZGl2PjxkaXYgZGlyPSJsdHIiPjxicj5PbiAzMSBKdWwgMjAxOSwgYXQgMTg6MjksIEFs ZWMgTXVmZmV0dCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFsZWMubXVmZmV0dEBnbWFpbC5jb20iPmFs ZWMubXVmZmV0dEBnbWFpbC5jb208L2E+Jmd0OyB3cm90ZTo8YnI+PGJyPjwvZGl2PjxibG9ja3F1 b3RlIHR5cGU9ImNpdGUiPjxkaXYgZGlyPSJsdHIiPjxkaXYgZGlyPSJhdXRvIj48ZGl2PkhpIE1p a2FlbCE8YnI+PGJyPjxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj48ZGl2IGRpcj0ibHRyIiBjbGFz cz0iZ21haWxfYXR0ciI+T24gV2VkLCAzMSBKdWwgMjAxOSwgMTQ6MDIgTWlrYWVsIEFicmFoYW1z c29uLCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnN3bWlrZUBzd20ucHAuc2UiIHRhcmdldD0iX2JsYW5r IiByZWw9Im5vcmVmZXJyZXIiPnN3bWlrZUBzd20ucHAuc2U8L2E+Jmd0OyB3cm90ZTo8L2Rpdj48 YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MCAwIDAgLjhleDti b3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij4NCkkgZmVlbCB3ZSdy ZSBiYWNrIGluIHRoZSBiYWQgb2xkIGRheXMgd2hlcmUgYSBicm93c2VyIHdvdWxkIGp1c3QgY2hh bmdlIDxicj4NCndoYXQgZGVmYXVsdCBicm93c2VyIEkgd2FudCB0byB1c2UsIGp1c3QgYmVjYXVz ZSBJIGhhcHBlbmVkIHRvIGluc3RhbGwgPGJyPg0KdGhhdCBicm93c2VyLiBUaG9zZSBraW5kcyBv ZiBwb2xpY3kgY2hvaWNlcyBhcmUgZm9yIG1lIGV4cGxpY2l0bHkgdG8gbWFrZSwgPGJyPg0Kbm90 IGZvciB0aGUgYnJvd3NlciB2ZW5kb3IgdG8gZG8gZm9yIG1lLiZuYnNwOzxicj48L2Jsb2NrcXVv dGU+PC9kaXY+PC9kaXY+PGRpdiBkaXI9ImF1dG8iPjxicj48L2Rpdj48ZGl2IGRpcj0iYXV0byI+ U28sIGhvdyBkbyB5b3UgZmVlbCBhYm91dCBhIGNvZmZlZSBzaG9wIG93bmVyLCBJU1AsIG9yIG5h dGlvbmFsIGdvdmVybm1lbnQgZG9pbmcgdGhlIHNhbWUgdGhpbmcgdG8geW91PzwvZGl2PjxkaXYg ZGlyPSJhdXRvIj48YnI+PC9kaXY+PGRpdiBkaXI9ImF1dG8iPi1hPC9kaXY+PGRpdiBkaXI9ImF1 dG8iPjxicj48L2Rpdj48L2Rpdj4NCjwvZGl2PjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBl PSJjaXRlIj48ZGl2IGRpcj0ibHRyIj48c3Bhbj4tLSA8L3NwYW4+PGJyPjxzcGFuPkFkZCBtYWls aW5nIGxpc3Q8L3NwYW4+PGJyPjxzcGFuPjxhIGhyZWY9Im1haWx0bzpBZGRAaWV0Zi5vcmciPkFk ZEBpZXRmLm9yZzwvYT48L3NwYW4+PGJyPjxzcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vYWRkIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2FkZDwvYT48L3NwYW4+PGJyPjwvZGl2PjwvYmxvY2txdW90ZT48L2Rpdj48L2Rpdj48 L2JvZHk+PC9odG1sPg== --Apple-Mail-47B26FC7-10EC-4819-8AD4-16AF9E0E007E-- From nobody Wed Jul 31 11:34:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15E321206E3 for ; Wed, 31 Jul 2019 11:34:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A0SBIK2KL2mD for ; Wed, 31 Jul 2019 11:34:13 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100084.outbound.protection.outlook.com [40.107.10.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFEBA1206D7 for ; Wed, 31 Jul 2019 11:34:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WOA8sn1kZyxUPuQLmSb0A7FTAHkHPMkyZyLncPhdVrzRkux1n+aGLeffN1O8w+uN2RbDYxjZ/3dp6KTIEvisSGXhYqy8pk/W5yTAyrqJuUF6crTtHqRpCdeJtHA+K0GKtMFu88QcFmx30WPgzhm/dvvAUdJJ4sXkvboPHdsvkQDyCJmyQ3gElYDyxaZa9IxBayIW7VD1ign31wnnETeEgEL4DxE/yYB0yRE9a57s2nHyrsUnZn5JanacWb9TcxKOTkKkLl7A0IGQNebfLRcKo0ZVOdogu1wNWnMcQdX0W8v/WxnBVTsmAP5mIibo6jTMNAIeAmEVWMSTTPsr+2FwZw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KLeAWjictGW4gyy47Px1Mn3Kn+6X+45U42wcknX4u9A=; b=mKPKA2ufq7wTn3Q9Vlt7hRlRSKzRrizADutiD0/OrMY/b3QB4mVgur2Lphdk+zBrEUolaPndwRlbQ26ukeSoWgrfxDciQNHWl2cLMJI6oPqJyQRaY7w9yVoYi2VmLla+6yXO4U9NFEgEuz3nSlq16PepKA//LmnIwrdt1mBs0vsJQY7Yvm0UMJRVeRmZ3hszX6w9zrYgphIshwahGhxjha2bPqwNFZLmVE7Vb7jyx8O4OdRLjDqSm/wyA8DRb/B77LapH6nWRKt7u6NmNUd10r0zZzovi4sdzS2ljgI9f2JslQjc4CDkktBULObcs9TwLogTVZI8UCaGft7GpRFt3A== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KLeAWjictGW4gyy47Px1Mn3Kn+6X+45U42wcknX4u9A=; b=cZEpWchTZ3t48v9mDrodmRK9WNGxNyN1aR7a8eLHshLjE8GAQ9AfHrJX8m24ahokNW+XyjMGrYUtLuVBKE3j6zO8dXPjxRZ2JuGgyo5jUh6EUospJ+wmBZ1h3pjg15BIIjcRkqgdPwG3V4RiJZk3hWWyrDbakOWscn5cixy4nE4= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0254.GBRP265.PROD.OUTLOOK.COM (10.166.103.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.14; Wed, 31 Jul 2019 18:34:10 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2115.005; Wed, 31 Jul 2019 18:34:10 +0000 From: Andrew Campling To: "Livingood, Jason" , "add@ietf.org" Thread-Topic: Different environments Thread-Index: AdVHzopWCk4RIEp5Tyqzriwl4+Axuw== Date: Wed, 31 Jul 2019 18:34:10 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:99f0:80ab:86fb:55ae] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e6b0f19d-9ebf-4e8c-1357-08d715e5adee x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0254; x-ms-traffictypediagnostic: LO2P265MB0254: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 011579F31F x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(376002)(39830400003)(34096005)(366004)(136003)(396003)(189003)(199004)(66446008)(64756008)(66556008)(66476007)(66946007)(76116006)(66574012)(52536014)(8936002)(6436002)(5660300002)(46003)(81156014)(81166006)(186003)(6506007)(110136005)(7696005)(102836004)(4744005)(3480700005)(44832011)(86362001)(486006)(476003)(99286004)(7736002)(221733001)(2501003)(33656002)(256004)(14444005)(6116002)(71200400001)(71190400001)(14454004)(68736007)(2906002)(7116003)(8676002)(74316002)(508600001)(305945005)(9686003)(53936002)(316002)(25786009)(55016002)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0254; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: sa3NM1huy3WYBfu4pwwPodX0CaWdSiaEVbgEhIXmaqq8suMTS3HnFsMTJFlezuOD7rQUf6UY1CZuyUMakPiPIEVGTqhDzlEL/nHP3XPCHV892wSfdzDfkOrYZPXB7crMZ5W+zoecgM8zpxYe5W+JsIMuJDaoXgqZT4mChUhe0+6f+qAWl095i096zA6RLnSEIu3fbtLvL+AcAL99q0DJjY0yBuClF/SeK9nbVhK5mHghWI3LjFptu3iIV7rsQ8swriO3iqb2vgbf0w73ulypD1NJPjbXMhHItNpePDdGP9RbZE1znVzcEOLl2aHW+KpNdvJIStJDuiY5PPZtVy0h83yGog+UGjffqoQnek0ywc9+lfFjfkSxM3ywkV6e3Xj1AKy3/FK0pz01PpGoUkaI7sA1t1u3ju2/SWP50KrHp0U= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: e6b0f19d-9ebf-4e8c-1357-08d715e5adee X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Jul 2019 18:34:10.5229 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0254 Archived-At: Subject: [Add] Different environments X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 18:34:15 -0000 PiBGcm9tOiBMaXZpbmdvb2QsIEphc29uIDxKYXNvbl9MaXZpbmdvb2RAY29tY2FzdC5jb20+DQoN Cj4+IEZyb206IEVyaWMgUmVzY29ybGEgPGVrckBydGZtLmNvbT4NCj4+IFRoaXMgc2VlbXMgdG8g YmUgYXNzdW1pbmcgYSBudW1iZXIgb2YgZmFjdHMgYWJvdXQgaG93IElTUHMgYmVoYXZlIHRoYXQg YXJlIG5vdCBpbiBldmlkZW5jZS4NCg0KPiBJU1BzLCBsaWtlIGJyb3dzZXJzIGFuZCBzZWFyY2gg cG9ydGFscywgZG8gbm90IGFsbCBoYXZlIHRoZSBzYW1lIGJ1c2luZXNzIG1vZGVscywgcHJhY3Rp Y2VzLCBhbmQgY3VsdHVyZXMuIEp1c3QgYXMgdGhlIEZpcmVmb3ggYnJvd3NlciBpcyB2ZXJ5IGRp ZmZlcmVudCBmcm9tIEdvb2dsZSBDaHJvbWUsIHRoZW4gc28gdG9vIGlzIElTUC0xIGZyb20gSVNQ LTIuICANCg0KQW5kIG9mIGNvdXJzZSBkaWZmZXJlbnQgSVNQcyB3b3JrIHVuZGVyIGRpZmZlcmVu dCBsZWdhbCBhbmQgcmVndWxhdG9yeSBzeXN0ZW1zIHdoaWNoIG1heSBpbXBhY3Qgb24gdGhlaXIg YmVoYXZpb3VyIHdoZW4gaXQgY29tZXMgdG8gaXNzdWVzIGxpa2UgRE5TLCBmb3IgZXhhbXBsZSB0 aG9zZSBpbiBFdXJvcGUgaGF2ZSB0byBhZGhlcmUgdG8gR0RQUi4gIEluIG1hbnkgY2FzZXMgc29m dHdhcmUgY29tcGFuaWVzLCBpbmNsdWRpbmcgYnJvd3NlciBjb21wYW5pZXMsIGhhdmUgZW5qb3ll ZCBhIHByZXR0eSBsaWdodCB0b3VjaCByZWd1bGF0b3J5IGVudmlyb25tZW50LCBhbHRob3VnaCB0 aGVyZSBhcmUgc2lnbnMgdGhhdCB0aGlzIGlzIGdyYWR1YWxseSBiZWluZyBjdXJ0YWlsZWQsIGF0 IGxlYXN0IGluIHNvbWUganVyaXNkaWN0aW9ucy4gIA0KDQpXaGV0aGVyIGNvbnNpZGVyaW5nIGJy b3dzZXJzLCBzZWFyY2ggcG9ydGFscyBvciBJU1BzLCB0cmVhdGluZyBhbGwgcGFydGljaXBhbnRz IGFzIGhvbW9nZW5vdXMgaXMgbGlrZWx5IHRvIGJlIGEgbWlzdGFrZSwgYXMgaXMgYXNzdW1pbmcg dGhhdCB0aGUgY2lyY3Vtc3RhbmNlcyBpbiB5b3VyIGhvbWUgbWFya2V0IGFwcGx5IGluIGFsbCBv dGhlcnMuDQoNCg== From nobody Wed Jul 31 11:46:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DD691200F8 for ; Wed, 31 Jul 2019 11:46:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eY0_OEKFfzX5 for ; Wed, 31 Jul 2019 11:46:28 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 52F92120018 for ; Wed, 31 Jul 2019 11:46:27 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 336AD5F421C4; Wed, 31 Jul 2019 20:46:26 +0200 (CEST) Received: from [192.168.2.190] (p54B8A0E0.dip0.t-ipconnect.de [84.184.160.224]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id E38CA5F4042E; Wed, 31 Jul 2019 20:46:24 +0200 (CEST) From: "Ralf Weber" To: "Alec Muffett" Cc: "Mikael Abrahamsson" , "ADD Mailing list" Date: Wed, 31 Jul 2019 20:46:24 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> In-Reply-To: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 18:46:31 -0000 Moin! On 31 Jul 2019, at 19:29, Alec Muffett wrote: > On Wed, 31 Jul 2019, 14:02 Mikael Abrahamsson, > wrote: > >> I feel we're back in the bad old days where a browser would just >> change >> what default browser I want to use, just because I happened to >> install >> that browser. Those kinds of policy choices are for me explicitly to >> make, >> not for the browser vendor to do for me. >> > > So, how do you feel about a coffee shop owner, ISP, or national > government > doing the same thing to you? Simply better as: - if the coffee shop owner does something I do not like I can not buy my coffee there, or if it is really worse I can sue them as long as they are in my jurisdiction. - I have a contract with my ISP and ISPs where I live (Europe/Germany) are heavily regulated so there ability to do evil is very limited. If they do I can sue them, but that is hardly necessary as my ISP (Deutsche Telekom) actually sued the government in order to not retain my login data. - My national government is something I can influence by voting or participating in the political process None of this applies to most browser and DoH server vendors. Eg. Mozilla is an US non profit and Cloudflare is an US for profit, I simply have no way to hold them accountable. That is one of the major drawbacks of the centralisation that will be caused by applications doing DNS (there are more ISPs then applications that will do that). So long -Ralf —— Ralf Weber From nobody Wed Jul 31 13:07:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BAC91120077 for ; Wed, 31 Jul 2019 13:07:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.756 X-Spam-Level: X-Spam-Status: No, score=-0.756 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, NUMERIC_HTTP_ADDR=1.242, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JKUvsfBGKnzL for ; Wed, 31 Jul 2019 13:07:30 -0700 (PDT) Received: from mail-oi1-x22c.google.com (mail-oi1-x22c.google.com [IPv6:2607:f8b0:4864:20::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AE5512004F for ; Wed, 31 Jul 2019 13:07:30 -0700 (PDT) Received: by mail-oi1-x22c.google.com with SMTP id w79so51768545oif.10 for ; Wed, 31 Jul 2019 13:07:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=UJP49z3o7RCkCWskrB7KiRxPZoBGXWwUKtS711Gq79c=; b=bqa0nDZvpC2/aFIXePaotXRL8vjh9I1w9Ling+B3+jpw/f4N8aYjOoJMQt+sFKz+Dt C0hoSA15WjvzjXHzQweS/6JzAAETrUnssLDVu8UfhJIyGYEW4pyJ2FgBSlRqZBtyJRhv rIO+E+0eBcZJARl16SLYUJ8WlSL8hx0RupR/Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=UJP49z3o7RCkCWskrB7KiRxPZoBGXWwUKtS711Gq79c=; b=RPHGoAj/Wzq++ANTLByT83RmtknZ2VDwtHcBtwMIl+oZNGUNHlocrPETkAKI5e9SfW 4DTiLd/b5gBESp1uBPmPvxvICM1IK3VJJdMOqVNHe+kuLYa8KhjMnKLDnReqntnqMu1s Nm76FGKddNUhsYA/1JTdaS7o5sJPagjPmaNIJPkQrpZBRnZsV5Sd+HM0mY+uJbYTZ0J+ OJxISZc0EbqrtC/Z9vv/9bMmxzfyyDJH1SnrKUi2cVzZRWmmrd1y52aZnZAw11tBoHh8 SEFqKucHpW22bAny9Rqz/6uHQVS3/qgEkS0YJ55jXopTUuiyNez1al2T42PwpW2pNkmo Pl+A== X-Gm-Message-State: APjAAAWcuVqehlPWBWp9wsnzv+S70FlSKAGX9/y5JrEznx/fV31Zvcv+ YhTPKq2b6XaZfGLb1CgHbI1hf8km7hbD8kbk5g5GRA== X-Google-Smtp-Source: APXvYqxN1tZ/pBek6dJVmi3ORGe9rgfgTF/zGxy8yKT5NEih2hf07G9Q7McZ/9puVutn0cZYxhshPIB9+iikkyoxDnA= X-Received: by 2002:a05:6808:3c5:: with SMTP id o5mr60102141oie.102.1564603649143; Wed, 31 Jul 2019 13:07:29 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> In-Reply-To: <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> From: =?UTF-8?B?w5NsYWZ1ciBHdcOwbXVuZHNzb24=?= Date: Wed, 31 Jul 2019 16:07:17 -0400 Message-ID: To: "Livingood, Jason" Cc: Adam Roach , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000b8f08c058effac62" Archived-At: Subject: Re: [Add] meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 20:07:35 -0000 --000000000000b8f08c058effac62 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Jason, On Tue, Jul 30, 2019 at 5:49 PM Livingood, Jason < Jason_Livingood@comcast.com> wrote: > On 7/25/19, 10:12 AM, "Add on behalf of Adam Roach" on behalf of adam@nostrum.com> wrote: > > You can see, for example, Cloudflare's associated privacy > policy at > https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-p= olicy/firefox/ > > [JL] This speaks to the DNS query/response. But with DoH, this is > contained inside of an HTTP envelope, so to speak, which has much more ri= ch > tracking - noted at https://www.cloudflare.com/privacypolicy/ under > website visitors (which I presume applies to all HTTP transactions). So t= he > confluence of DNS and HTTP here seems interesting to better understand an= d > document as TRR-style policies evolve. Since there is an HTTP server > involved in DoH, presumably all the normal HTTP log items are seen & > processed and can be logged, like user agent, cookies, and so on. > Cloudflare modified the HTTPS processing for DoH requests, we did this for privacy, efficiency and speed reasons. The overwriting goal was to be compliant with the our public policies and commitments. Anything that matches https://tools.ietf.org/html/rfc8484#section-4.1 definition of DoH request is NOT logged by the HTTPS service, we will only respond to DoH requests on a defined list of DoH service names/addresses. Our DoH module only counts connections, no logging of content ( mainly to verify we do not drop anything internally) The DNS resolver system is the only one that writes to the resolver logs, it is unaware of any user agent and other HTTP things, There is no setting or reading of cookies from our servers (you can confirm this by doing a request on you own), like curl --verbose -H 'accept: application/dns-json' ' https://cloudflare-dns.com/dns-query?name=3Dcomcast.com&type=3DAAAA' > [JL] In addition, I suspect a concern (for the very high scale centralise= d > DoH platforms) is not just the per-user privacy policy but also what > aggregated business intelligence a global scale platform would be able to > develop (e.g. of a population of 500M users, how many have queried for *. > netflix.com in the past N hours, by country, ASN, user agent, etc.), > relative to competitors or potential competitors. So I suspect these > concerns may arise, at least for platforms of very high scale / > penetration. > > This is not unique to DoH in any way or shape! This is common to all DNS queries and having access to query streams, so every DNS provider should answer if they share any DNS query data and with whom and for what purpose. Anyone that has access to query stream from one of the top ISP's in a few countries might have better view than large Public DNS Resolver. Restating Cloudflare 1.1.1.1 data policy: Cloudflare will not share any query data with anyone!! Per our agreement with Apnic; they have access to subset Resolver of logs for the last 24 hours only data that arrived on the 1.x.x.1 addresses, they do not a have access to data sent by Firefox users unless the user modified the URL to *"https://1.1.1.1/dns-query ".* Cloudflare will not use the query data for anything other than to improve the service. Cloudflare keeps traffic aggregations and may share those publicly from time to time. Cloudflare is fully compliant the policy that Firefox has published AND they have NO access to query data --=20 =C3=93lafur Gudmundsson | Engineering Director www.cloudflare.com blog.cloudflare.com --000000000000b8f08c058effac62 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Jason,=C2=A0

    On Tue, Jul 30, 2019 at 5:49 PM Livingood= , Jason <Jason_Livingood@comcast.com> wrote:
    On 7/25/19, 10:12 AM, "Add on behalf of A= dam Roach" <add-bounces@ietf.org on behalf of adam@nostrum.com> wrote:
    > You can see, for example, Cloudflare's associated privacy
    =C2=A0 =C2=A0 policy at https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy= /privacy-policy/firefox/

    [JL] This speaks to the DNS query/response. But with DoH, this is contained= inside of an HTTP envelope, so to speak, which has much more rich tracking= - noted at https://www.cloudflare.com/privacypolicy/ u= nder website visitors (which I presume applies to all HTTP transactions). S= o the confluence of DNS and HTTP here seems interesting to better understan= d and document as TRR-style policies evolve. Since there is an HTTP server = involved in DoH, presumably all the normal HTTP log items are seen & pr= ocessed and can be logged, like user agent, cookies, and so on.

    Cloudflare modified the HTTPS processing for DoH r= equests, we did this for privacy, efficiency and speed reasons.=C2=A0
    Th= e overwriting goal was to be compliant with the our public policies and com= mitments.=C2=A0
    Anything that matches=C2=A0https://tools.ietf.org/htm= l/rfc8484#section-4.1=C2=A0definition of DoH request is NOT logged by t= he HTTPS service, we will only respond to DoH requests on a defined list of= DoH service names/addresses.=C2=A0

    Our DoH module= only counts connections, no logging of content ( mainly to verify we do no= t drop anything internally)=C2=A0
    The DNS=C2=A0 resolver system i= s the only one that writes to the resolver logs, it is unaware of any user = agent and other HTTP things,=C2=A0

    There is no set= ting or reading of cookies from our servers (you can confirm this by doing = a request on you own), like=C2=A0

    curl --verbose -H 'accept: application/dns-json'= ; 'https://cloudflare-dns.com/dns-query?name= =3Dcomcast.com&type=3DAAAA'



    [JL] In addition, I suspect a concern (for the very high scale centralised = DoH platforms) is not just the per-user privacy policy but also what aggreg= ated business intelligence a global scale platform would be able to develop= (e.g. of a population of 500M users, how many have queried for *.netflix.com in the past N hours, by country, ASN, user agent, etc.), relative to comp= etitors or potential competitors. So I suspect these concerns may arise, at= least for platforms of very high scale / penetration.=C2=A0


    This is not unique to DoH in any = way or shape!
    This is common to all DNS queries and having access= to query streams, so every DNS provider should answer if they share any DN= S query data and with whom and for what purpose.=C2=A0
    Anyone= that has access to query stream from one of the top ISP's in a few cou= ntries might have better view than large Public DNS Resolver.
    Cloudflare will not use the query data for anything other than to impr= ove the service. Cloudflare keeps traffic aggregations and may share those = publicly from time to time.=C2=A0

    Cloudflare is fu= lly compliant the policy that Firefox has published AND they have NO access= to query data=C2=A0
    --
    =C3=93lafur Gudmundsson |= =C2=A0Engineering Director=C2=A0www.cloudflare.com blog.cloudflare.com
    --000000000000b8f08c058effac62-- From nobody Wed Jul 31 13:23:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95CFD12006D for ; Wed, 31 Jul 2019 13:23:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EGz7mAT27qLq for ; Wed, 31 Jul 2019 13:23:08 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5747E120018 for ; Wed, 31 Jul 2019 13:23:08 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45zPms3CRWzKy8; Wed, 31 Jul 2019 22:15:25 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1564604125; bh=xX2udyrL5OjeO0K14U2wi9ACdBaNukjufJVfV/zMxVM=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=gt6iDL+vykOAx3lQE4vgNdJDxAbmp+Zr+ZpEBAsiSY7r9+8n370Y+nGjxdgaoGCrm aq+JQTuSKPGfWDaHurUfTytJZbDO6F6rRrS7vaKbAFC8O6/y8en7DKABghl/zn2w2J Pwe58UQTtaXEt54oRVjXjReV+P91vqrRsZoHj51s= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id BZEcHCCt0pw4; Wed, 31 Jul 2019 22:15:24 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Wed, 31 Jul 2019 22:15:23 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 4661F3159D3; Wed, 31 Jul 2019 16:15:22 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 4661F3159D3 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 3CB764017C9B; Wed, 31 Jul 2019 16:15:22 -0400 (EDT) Date: Wed, 31 Jul 2019 16:15:22 -0400 (EDT) From: Paul Wouters To: Ralf Weber cc: Alec Muffett , ADD Mailing list , Mikael Abrahamsson In-Reply-To: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 20:23:11 -0000 On Wed, 31 Jul 2019, Ralf Weber wrote: >> So, how do you feel about a coffee shop owner, ISP, or national government >> doing the same thing to you? > Simply better as: > - if the coffee shop owner does something I do not like I can not buy my > coffee there, or if it is really worse I can sue them as long as they are in > my jurisdiction. > - I have a contract with my ISP and ISPs where I live (Europe/Germany) are > heavily regulated so there ability to do evil is very limited. If they do I > can sue them, but that is hardly necessary as my ISP (Deutsche Telekom) > actually sued the government in order to not retain my login data. The difference between a hotel/coffeeshop wifi and an ISP is very minimal in the EU. Legally, the hotel and coffeeshop are ISPs. You are furthermore reasoning from the idea that you can find out about the coffeeshop violation of your privacy, but real users cannot. > - My national government is something I can influence by voting or > participating in the political process Have you seen the madness in the world these days? > None of this applies to most browser and DoH server vendors. Eg. Mozilla is > an US non profit and Cloudflare is an US for profit, I simply have no way to > hold them accountable. I believe the GDPR covers foreign entities servicing Europeans, so I think these entities are also required to follow GDPR. Paul From nobody Wed Jul 31 14:29:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADB7F12006D for ; Wed, 31 Jul 2019 14:29:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cTBQAVq02ZlY for ; Wed, 31 Jul 2019 14:29:37 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id D0E9812001A for ; Wed, 31 Jul 2019 14:29:36 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 25BE45F42DB2; Wed, 31 Jul 2019 23:29:34 +0200 (CEST) Received: from [192.168.2.184] (p54B8A0E0.dip0.t-ipconnect.de [84.184.160.224]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 28D8D5F421C4; Wed, 31 Jul 2019 23:29:34 +0200 (CEST) From: "Ralf Weber" To: "Paul Wouters" Cc: "ADD Mailing list" , "Mikael Abrahamsson" , "Alec Muffett" Date: Wed, 31 Jul 2019 23:29:33 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> In-Reply-To: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 21:29:39 -0000 Moin! On 31 Jul 2019, at 22:15, Paul Wouters wrote: > The difference between a hotel/coffeeshop wifi and an ISP is very > minimal in the EU. Legally, the hotel and coffeeshop are ISPs. So even less reasons to point your DNS to a huge US corporation. > You are furthermore reasoning from the idea that you can find out > about > the coffeeshop violation of your privacy, but real users cannot. That is what consumer advocacy groups and the press are for. Once smart people have figured out these violations they will get known. >> - My national government is something I can influence by voting or >> participating in the political process > > Have you seen the madness in the world these days? Yes, but I am still with Churchill on this: Many forms of Government have been tried, and will be tried in this world of sin and woe. No one pretends that democracy is perfect or all-wise. Indeed, it has been said that democracy is the worst form of Government except all those others that have been. But we are getting off topic here. >> None of this applies to most browser and DoH server vendors. Eg. >> Mozilla is an US non profit and Cloudflare is an US for profit, I >> simply have no way to hold them accountable. > > I believe the GDPR covers foreign entities servicing Europeans, so I > think > these entities are also required to follow GDPR. That is true, but ISPs are bound to more then the GDPR, but enforcing anything if you don’t have a legal entity in the EU is difficult. Long story short there is no reason for me or any other european to switch it’s DNS from its ISP to a US cloud provider. So long -Ralf —-- Ralf Weber From nobody Wed Jul 31 14:52:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6C241200B7 for ; Wed, 31 Jul 2019 14:52:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FjygPtJFGN_r for ; Wed, 31 Jul 2019 14:51:58 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100086.outbound.protection.outlook.com [40.107.10.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA474120089 for ; Wed, 31 Jul 2019 14:51:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=GWY3qJ3rOW+DTG+X3R1qvQRZBHW0XqVxlvtf4gOyp5iTVkNjcTtjHpCdRRewdPWU7SQ5Y/8z+g3tPO+EFJSavorRN9/j6nx47mfKea4FUHpSDLcahTar8FsUmN8A0QWuh7vws4wJuFWgyckXQVXl5XPekkWaz+foh6wsPzxcWPIjA+AqTDwyN4OExaU4DBI+2OAGwO5PqjlMfuty1ZTh7wSODpQ0SAGjRdXdTzxULRxpPQcIQtjc1TapnnaHC7p5l/LDEHE51I0l9Il9My0idVih+RkrftNsBHUTFMMYBPKLpiTCuoC8r63kqRp5UOVUb5C+xktDh8slgW8DsCgCNQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Yy3At7+NbTB4U+eanYT1l61Mk1yN3jL/FyTMxK0KQZM=; b=hthQtUoVFBuQ6fJytRHhALJBnvA4aLmHtcJyRfMgmoXoO9zg6RxuOvtiw/ziY4MUYlzXCs/EApTdSG3/HcAJHRxMNs2mX4ctBtnrKkJa60JmdcDplI7fPLvWBbWAaqPXAWA9kdSJUP4z//xp1Pa/UEQtzh7lkLY/ufE/EN61ZzJepFQo6fr57l9FyT0StiJwUGmBI/3DWrPtC+sW3dqBkERAkZwMdf59+yjitbfCOS2DJKi9hvFDQ8cjc0Tt3hPu+t6WChoFsyTCIrvq1uJVDPMOXblMomg3KzGaC5LL4YBelXvV8z4MQTVK+mLxpqCw/X6QNf9iDBd67YbTesq3vA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Yy3At7+NbTB4U+eanYT1l61Mk1yN3jL/FyTMxK0KQZM=; b=W3yX060iKjmRlTm+3KvCWjGqcfqa6pA4ZECheK2eZSAOvn5CDV2n28Z8cpbLCbsAKTxGs6hyPImqW5UNHKS8y8sg4mHsn1zGO7WO7myz/BCOt6QhLqwOAdxa2BrexRa1DFWOLy2h+xIZ3I7CB/RS92hDY3DG1uE046ngAn3wS6g= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0142.GBRP265.PROD.OUTLOOK.COM (10.166.85.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.14; Wed, 31 Jul 2019 21:51:55 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::387c:9c12:531b:b7bd%3]) with mapi id 15.20.2115.005; Wed, 31 Jul 2019 21:51:55 +0000 From: Andrew Campling To: Eric Rescorla , ADD Mailing list Thread-Topic: [Add] My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVR6mWZoZPou0EEUS/VpZ0WAAFuKblQdBA Date: Wed, 31 Jul 2019 21:51:55 +0000 Message-ID: References: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:49bd:5fca:38a4:81b5] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e0340659-8b1c-4015-6867-08d716014df7 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0142; x-ms-traffictypediagnostic: LO2P265MB0142: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 011579F31F x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(396003)(366004)(346002)(39830400003)(34096005)(136003)(189003)(199004)(81156014)(44832011)(4744005)(486006)(25786009)(8676002)(186003)(54896002)(6306002)(5660300002)(9686003)(81166006)(6506007)(53546011)(446003)(11346002)(8936002)(68736007)(476003)(6116002)(790700001)(7736002)(74316002)(33656002)(86362001)(46003)(102836004)(508600001)(66946007)(110136005)(66556008)(66476007)(64756008)(71190400001)(76116006)(6436002)(71200400001)(52536014)(76176011)(14454004)(229853002)(6246003)(53936002)(66446008)(236005)(316002)(7696005)(2906002)(55016002)(256004)(99286004)(46492003)(148743002); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0142; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: YDBT6hUJYbJd6pIXVuqSC0Js413WDxxLjZbAa+ahXTofFWONceVoxYeh7DEtYSSwc0LzjSOm+oS/KqlQ7I0Q6KoU6NgYRsXQLegbnSh5msjjEXvfDgc1fW3pUan+TzW4ZuLVKO18XLAJEJVcqvNwlk0jA565uFJMFYMPAZbet1h2qlFj8AhHSmBrNicIdkpKpEWHc3d9QqoM4mIva1aY8PV9VRkUpGTonq+9Bthc5yaGfY3cjhHh0HoUDDXHvskcG/UAgQNUTekieIrX7Fq88DG36IPjypGcbJI93cSfO91QCk9bKW3yL3mm7Y0t8Y1QjIpB1h3DYNOIezaaZUqZSDjoLldeIBoX8iZyjPdBJvTA2kVs8C2aqSIcOB5t59Id8ZiZ+uE7h+wl2Y6XAqT9aQ3YZILJt7BjxemnTFZJYT8= Content-Type: multipart/alternative; boundary="_000_LO2P265MB13275541D364C577B32188F9C2DF0LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: e0340659-8b1c-4015-6867-08d716014df7 X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Jul 2019 21:51:55.4133 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0142 Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 21:52:01 -0000 --_000_LO2P265MB13275541D364C577B32188F9C2DF0LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQo+IE9uIFdlZCwgSnVsIDMxLCAyMDE5IGF0IDE1OjAyIEVyaWMgUmVzY29ybGEgPGVrckBydGZt LmNvbT4gd3JvdGU6DQoNCj4+IE9uIFdlZCwgSnVsIDMxLCAyMDE5IGF0IDc6MDEgQU0gUGF1bCBF YmVyc21hbiA8bGlzdC1hZGRAZHJhZ29uLm5ldDxtYWlsdG86bGlzdC1hZGRAZHJhZ29uLm5ldD4+ IHdyb3RlOg0KDQo+PiBNYW55IHVzZXJzIG9mIDguOC44LjggZG8gc28gYmVjYXVzZSB0aGV5IGdl dCBpdCB2aWEgREhDUC4NCg0KPiBBYnNvbHV0ZWx5IHRydWUsIGJ1dCBJJ20gbm90IHN1cmUgd2h5 IHRoYXQgbWF0dGVycy4gVGhlIGZhY3QgaXMgdGhhdCBtYW55IGFsc28gbWFudWFsbHkgY29uZmln dXJlIGl0LCBhbmQgbm8gbWF0dGVyIGhvdyBpdCBpcyBjb25maWd1cmVkLCBpdCdzIG5vdCB0aGUg SVNQIHByb3ZpZGluZyB0aGUgc2VydmljZS4NCg0KDQpJbiB0aGUgbWFya2V0cyB0aGF0IEnigJlt IG1vc3QgZmFtaWxpYXIgd2l0aCwgdGhlIHNwbGl0IG9mIHVzZXJzIG9wdGluZyB0byBvYnRhaW4g RE5TIGZyb20gYSBzb3VyY2Ugb3RoZXIgdGhhbiB0aGVpciBJU1AgaXMgYXJvdW5kIHRlbiBwZXJj ZW50LiAgSW4gdGhvc2UgbWFya2V0cyB0aGUgYWJvdmUgc3RhdGVtZW50IHRoYXQg4oCc4oCmIG1h bnkgYWxzbyBtYW51YWxseSBjb25maWd1cmUg4oCm4oCdIHdvdWxkIGJlIG1vcmUgYWNjdXJhdGVs eSByZXdyaXR0ZW4gYXMg4oCcYSBzbWFsbCBtaW5vcml0eSBtYW51YWxseSBjb25maWd1cmXigJ0u DQoNCkluIHJlYWxpdHkgYmVoYXZpb3VyIHZhcmllcyBzaWduaWZpY2FudGx5IGJldHdlZW4gbWFy a2V0cyBzbyB3ZSBzaG91bGRu4oCZdCBhc3N1bWUgdGhhdCwgZm9yIGV4YW1wbGUsIHRoZSBiZWhh dmlvdXJzIHRoYXQgYXBwbHkgaW4gdGhlIFVTLCBvciBpbmRlZWQgdGhlIHZlcnkgZGlmZmVyZW50 IGJlaGF2aW91cnMgaW4gVmlldG5hbSwgYXJlIGdlbmVyYWxseSB0cnVlIGVsc2V3aGVyZS4NCg== --_000_LO2P265MB13275541D364C577B32188F9C2DF0LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxp Lk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlv cml0eTozNDsNCgltYXJnaW4tdG9wOjBjbTsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1hcmdpbi1i b3R0b206MGNtOw0KCW1hcmdpbi1sZWZ0OjM2LjBwdDsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9 DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHls ZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmln aHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsN Cglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30N CnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQg NzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0 aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZh dWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwh LS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86 aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFb ZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGluaz0iYmx1ZSIgdmxpbms9 InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZndDsgT24gV2VkLCBKdWwgMzEsIDIwMTkgYXQgMTU6MDIgRTxzcGFuIGxhbmc9IkVOLVVT Ij5yaWMgUmVzY29ybGEgJmx0O2VrckBydGZtLmNvbSZndDsNCjwvc3Bhbj53cm90ZTo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZndDsmZ3Q7IE9uIFdlZCwg SnVsIDMxLCAyMDE5IGF0IDc6MDEgQU0gUGF1bCBFYmVyc21hbiAmbHQ7PGEgaHJlZj0ibWFpbHRv Omxpc3QtYWRkQGRyYWdvbi5uZXQiPmxpc3QtYWRkQGRyYWdvbi5uZXQ8L2E+Jmd0OyB3cm90ZTo8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBwdDtt YXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pjxicj4NCiZndDsmZ3Q7IE1hbnkgdXNlcnMgb2YgOC44LjguOCBkbyBzbyBiZWNhdXNlIHRoZXkg Z2V0IGl0IHZpYSBESENQLiA8bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZndDsgQWJzb2x1dGVseSB0cnVlLCBidXQgSSdtIG5vdCBz dXJlIHdoeSB0aGF0IG1hdHRlcnMuIFRoZSBmYWN0IGlzIHRoYXQgbWFueSBhbHNvIG1hbnVhbGx5 IGNvbmZpZ3VyZSBpdCwgYW5kIG5vIG1hdHRlciBob3cgaXQgaXMgY29uZmlndXJlZCwgaXQncyBu b3QgdGhlIElTUCBwcm92aWRpbmcgdGhlIHNlcnZpY2UuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5JbiB0aGUgbWFya2V0cyB0aGF0 IEnigJltIG1vc3QgZmFtaWxpYXIgd2l0aCwgdGhlIHNwbGl0IG9mIHVzZXJzIG9wdGluZyB0byBv YnRhaW4gRE5TIGZyb20gYSBzb3VyY2Ugb3RoZXIgdGhhbiB0aGVpciBJU1AgaXMgYXJvdW5kIHRl biBwZXJjZW50LiZuYnNwOyBJbiB0aG9zZSBtYXJrZXRzIHRoZSBhYm92ZSBzdGF0ZW1lbnQgdGhh dCDigJzigKYgbWFueSBhbHNvIG1hbnVhbGx5DQogY29uZmlndXJlIOKApuKAnSB3b3VsZCBiZSBt b3JlIGFjY3VyYXRlbHkgcmV3cml0dGVuIGFzIOKAnGEgc21hbGwgbWlub3JpdHkgbWFudWFsbHkg Y29uZmlndXJl4oCdLiZuYnNwOw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0Ij5JbiByZWFsaXR5IGJlaGF2aW91ciB2YXJpZXMgc2lnbmlmaWNhbnRseSBiZXR3ZWVu IG1hcmtldHMgc28gd2Ugc2hvdWxkbuKAmXQgYXNzdW1lIHRoYXQsIGZvciBleGFtcGxlLCB0aGUg YmVoYXZpb3VycyB0aGF0IGFwcGx5IGluIHRoZSBVUywgb3IgaW5kZWVkIHRoZSB2ZXJ5IGRpZmZl cmVudCBiZWhhdmlvdXJzIGluIFZpZXRuYW0sIGFyZSBnZW5lcmFsbHkgdHJ1ZQ0KIGVsc2V3aGVy ZS4gJm5ic3A7Jm5ic3A7Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_LO2P265MB13275541D364C577B32188F9C2DF0LO2P265MB1327GBRP_-- From nobody Wed Jul 31 15:02:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C7091200FB for ; Wed, 31 Jul 2019 15:02:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WdcwICxADxDd for ; Wed, 31 Jul 2019 15:02:06 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0C781200C7 for ; Wed, 31 Jul 2019 15:02:05 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id C9F6BBE51; Wed, 31 Jul 2019 23:02:03 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c7SvH6gnP6Ly; Wed, 31 Jul 2019 23:02:01 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 99538BE50; Wed, 31 Jul 2019 23:02:01 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564610521; bh=j0X+OZ1ozGWdUHybsMb85rT9OOGgK0KDjPkVFERbrt4=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=1io9/pfzS9xwV0Cb0j+uVhLiHwwmPivGESBWlNK1mLA2JQD0IQDUgVAFR1A0Os9Qr Xm6ECCdlKLdDk3n7UnQTdnerSQkjI+mFdU2uBwulCzn5qwumJ1ibqrl7S967pN47Vy g6CtN/ll4X/ogNbFunBTiPr1MHzKwtxN1NE5MmuE= To: Ralf Weber , Paul Wouters Cc: Alec Muffett , ADD Mailing list , Mikael Abrahamsson References: <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 31 Jul 2019 23:02:00 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="kcbcEFqkX8G0Kg1L3ABONRpZYVZu57Em4" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 22:02:08 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --kcbcEFqkX8G0Kg1L3ABONRpZYVZu57Em4 Content-Type: multipart/mixed; boundary="TXlxS6t3FqXS0Lfo1wwCDhr5UVGxEbVJA"; protected-headers="v1" From: Stephen Farrell To: Ralf Weber , Paul Wouters Cc: Alec Muffett , ADD Mailing list , Mikael Abrahamsson Message-ID: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> In-Reply-To: <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> --TXlxS6t3FqXS0Lfo1wwCDhr5UVGxEbVJA Content-Type: multipart/mixed; boundary="------------DA727340E8F5576809F184EE" Content-Language: en-GB This is a multi-part message in MIME format. --------------DA727340E8F5576809F184EE Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 31/07/2019 22:29, Ralf Weber wrote: > Long story short there is no reason for me=20 It's fine that you conclude that. > or any other european=20 That is incorrect. I do use CF's DoT and other DoT services and occasionally CF's DoH. Some of that is just playing about/testing, but my home ISP did have an incident last year where their DNS went awol for a weekend (seemingly related to the root key roll;-) so I set my home router to use CF's DoT. I've not bothered to reset it since as my view of the choice is between two for-profit foreign-owned companies and in fact I know more about CF than the latest in a long line of investors who happen to own the ISP today. I make no claim that that is common but it is an existence proof that your claim above is false. In much of the discussion on this list, I see what I perceive as people (on all "sides") frequently describing DNS setups in ways that seem tailored to suit their argument and not reflect reality with any fidelity. I don't find any conclusions based on such arguments at all convincing TBH, no matter how frequently those may be asserted. And I have a hard time seeing any WG working on this topic being able to make progress in the face of such dodgy arguments. Cheers, S. > to > switch it=E2=80=99s DNS from its ISP to a US cloud provider. --------------DA727340E8F5576809F184EE Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------DA727340E8F5576809F184EE-- --TXlxS6t3FqXS0Lfo1wwCDhr5UVGxEbVJA-- --kcbcEFqkX8G0Kg1L3ABONRpZYVZu57Em4 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1CD9gACgkQWrL68XsX K+p0phAAuGbXDqYaUJ3T2biTAk2GQ/XzHXk5asgFImUMEdiapfEm85p79rs202RU jBEcFWRCx4qfqJAabzwOC1cd8c6giY03iTEqTpzGREJmw9SEaq1s4FVUcLiTzPTT AlH93Z5Q+zuxrprgWxW0RCWlwnoPfDZVpJScq+q7NQqQhbxVRX9vB4T28OSYqOOj Pomk+72Zplo0qlub2W/y4ea1S4T22oHSn8SGbckKEL1JkiAtJyCGBLMjX5y4YYRB ydSQKUjXIzWotcWI2vRqgbJuphZeyDe2mAgQJmORaD3hes1ThQiQk6DA9vwjFNVw eoiSEJdiuM2eUTLgaHai0lcylAGb5eMuRC2HlLSpODwH72wHiXdymraw9iVu531l 0xVrfshm0xV2blqubATtlBPbVw954b214kEm3a9NH4vDnhKIxdAtPGMm35NiVTC8 EFotb78UOZtNNDhbu0RmGfB43AY/HzuvFgb/CZHHo/mmKUi6b7rwMXsdMEm9eaU9 tn5qgmzlbXZYxafoIMDcdVaXVsQfZGMDiEGprU5PI+PUcFHrsSZT+jPDPsnZf7tY fl/y3gfJ+DfHT+5me1mfin0lKfUcEDfhsJIQdTbymOr6Xx1hxhYtOr5OKTowHLyZ SSu5imk+LhKF4G1EtU/aATBjyXQtXON9NYl0dvxNxzQwR1m9MdI= =/Y7h -----END PGP SIGNATURE----- --kcbcEFqkX8G0Kg1L3ABONRpZYVZu57Em4--